The UK National Audit Office says the government was operating at least 228 “legacy” computer systems as of March 2024, increasing the risk of a disruptive hack
Depends what you mean by ‘legacy’, though - Windows 2000 was, well, 25 years ago. [embedded post] Mark O'Neill / @radiobeartime.com : The words “at least” are doing a hell of a lot of work there. [embedded post] X: Sir Humphrey / @pinstripedline : Latest NAO report on HMG cyber security is concerning. 30% central govt cyber security roles gapped, up to 50% shortages in some depts. Low pay, CS recruitment process and wider market seen as reason why. Report well worth reading. https://www.nao.org.uk/... [image] @naoorguk : The cyber threat to the UK government and public services is severe and fast growing. We have set out what action government must take to build its cyber resilience. Watch the report director's summary of our findings 👇 Read our report: https://www.nao.org.uk/... [video] @naoorguk : 58 critical government IT systems were independently assessed in 2024, and significant gaps in cyber resilience were found. At least 228 legacy systems are in use and government doesn't know how vulnerable these are. What can be done? Read our report: https://www.nao.org.uk/... [video]
Context & Ripple Effects
The NAO’s assessment adds operational detail to a broader run of UK cyber-resilience warnings: the NCSC had described a widening gap in the UK’s ability to counter cyber threats, while a parliamentary report had already flagged the risk of a catastrophic ransomware attack against government.
The problem also reaches beyond central-government security operations. Warnings about outdated NHS IT creating safety risks show how ageing public-sector technology can turn a technical weakness into a service-delivery issue.
First-order effects
- Departments relying on the identified systems face elevated disruption risk without a complete view of their exposure, following the NAO’s finding of significant resilience gaps in its review of critical systems.
- Cyber remediation capacity is constrained immediately by substantial unfilled security roles, leaving affected departments with less in-house capacity to assess, secure, or replace ageing technology.
Second-order effects
- Government technology leaders will have to triage scarce cyber staff and modernization work toward the most critical systems, potentially delaying lower-priority digital projects.
- Suppliers supporting public-sector infrastructure may face greater demand for system inventories, security controls, and migration support, while departments become more dependent on external expertise to fill capability gaps.
Third-order effects
- If legacy estates and hiring gaps persist together, cyber resilience will become a limiting condition on public-sector digital transformation rather than a discrete IT-maintenance problem.
- The pattern points toward stronger pressure for government-wide visibility and accountability over critical systems, because departmental ownership alone has not produced a clear picture of vulnerability.
The trend: The UK public sector’s cyber posture is increasingly shaped by the interaction of ageing core systems and a constrained security workforce, making modernization a resilience requirement.