In the 2026 Verizon Data Breach Investigations Report, exploitation of software vulnerabilities became the most common way attackers gain initial access entry point for attackers, overtaking credential abuse for the first time in the report's 19-year history. It opened 31 percent of breaches. Credential abuse opened 13 percent. In healthcare, vulnerability exploitation was the primary entry point in one in five breaches. Legacy application security risk matters most in that finding, because an unsupported application keeps every vulnerability it ever had.

Verizon added pretexting as a separately tracked entry method this year, which moved some incidents out of the credential abuse count. Credential abuse still appears somewhere in the attack chain in 39 percent of breaches. Vulnerability exploitation leads as the first step, and unpatched systems are where that step is easiest to take.

Legacy application security risk is that finding applied to a health system's own portfolio. Every unsupported or forgotten application is one of those entry points. These systems hold protected health information, stay connected to the network, and no longer receive security updates. The technical gap is the visible half of the problem. Once leadership knows the gap exists and keeps the system running, the exposure becomes legal and financial.

Application rationalization closes that exposure at the source. Retiring systems no one uses removes the attack surface they represent, and archiving their data into a governed archive keeps the records available without keeping the risk online.

This post covers what drives legacy application security risk, why knowing about one creates legal liability, why an unmanaged portfolio compounds the exposure, and why rationalize applications to reduce that risk. One point belongs up front. Retiring an unsupported application removes the attack surface and the recurring cost of keeping it alive in a single decision. The security case and the financial case are one case.

What Is Legacy Application Security Risk?

Legacy application security risk is the exposure a health system carries when an application stops receiving security patches while it still holds data and touches the network. Retiring the application ends that exposure, and the data moves into a governed archive.

1. Unpatched systems stay exploitable: An application that no longer receives security updates keeps its known vulnerabilities, and attackers scan for exactly those.
2. The data stays sensitive: A system running past its useful life still holds the electronic protected health information (ePHI) it always did. A breach through a system that holds unsecured ePHI carries notification obligations under the Health Insurance Portability and Accountability Act (HIPAA).
3. Integrations extend the reach: Legacy systems connect to current ones, so a compromise of the old system can move laterally into the live environment.
4. Behind the firewall is still reachable: Internal systems fall outside routine monitoring, and attackers use them as a route to more valuable systems. In the Change Healthcare attack, public testimony indicates attackers logged in to a legacy remote access portal that lacked multifactor authentication.

Each of these is a legacy system cybersecurity risk that stays on the books until someone retires the application.

Knowing About a Legacy Application Security Risk Creates Legal Exposure

Awareness changes the category of the risk. An unpatched system is a technical problem. An unpatched system the organization knows about and keeps running is a legal one.

Clearsense CTO Jonathan Cook makes this argument in Healthcare Innovation. Once a health system knows a system has security gaps and leaves it in place, it exposes itself to regulatory action, insurance disputes, and litigation. That is the hidden part of legacy application security risk. The conversation leaves the security team and reaches general counsel.

1. Regulators ask who accepted the risk: When a documented HIPAA security program covers a system the organization knows is unsupported or unpatchable, leaving it in operation without remediation or a formal exception can read as a failure to implement reasonable and appropriate safeguards. Cook points to the March 2026 settlement between the U.S. Department of Health and Human Services Office for Civil Rights (OCR) and MMG Fusion after a breach affecting roughly 15 million people, where OCR cited the lack of an accurate and thorough risk analysis.
2. Underwriting puts the system on the record: Cyber insurers underwrite against the controls an organization represents. Cook writes that insurers can scrutinize a claim much more aggressively when a breach traces to a system that falls short of those representations, and that disputes over known, unresolved risk can affect payouts, premiums, and future coverage terms. An unsupported system carried for years becomes a disclosure item, and a disclosure item belongs in front of the board.
3. Litigation needs a clear story: On February 13, 2026, the Delaware Supreme Court revived insurers' breach-of-contract claims against Blackbaud following a ransomware attack. A security program, a known risky system, and an incident through that same system give a plaintiff the story.

Why an Unmanaged Application Portfolio Is a Security Risk

Legacy application security risk multiplies when no one actively oversees the software portfolio, allowing unmonitored systems to accumulate.

1. An uninventoried system stays unprotected: Applications bought outside central governance never reach the security team's list, so they go unpatched and unmonitored by default.
2. Growth has owners and retirement does not: New systems get funded and deployed while old ones keep running, and every merger adds an inherited portfolio to the count.
3. Zombie applications are the easiest targets: A zombie application is a system with no active user base that keeps running. It draws the least attention, the least patching, and the least monitoring, which is exactly what an attacker wants. Retiring these systems removes them from the attack surface entirely.
4. Unmanaged systems carry unbudgeted risk: Security monitoring, patching, and incident response for a forgotten application need an owner and a budget line. Without both, the work does not happen.
5. The remediation gap keeps widening: Verizon found organizations fully remediated only 26 percent of vulnerabilities on the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities list in 2025, down from 38 percent the year before. Median time to fully patch rose from 32 days to 43. A system no one owns sits at the end of that queue.
6. The same records live in more places than anyone planned: Protected health information spread over dozens of legacy systems means dozens of locations to inventory, monitor, patch, and report on after an incident. Consolidating those records into one governed archive reduces the number of places the data exists. That is risk reduction in itself, before any single application retires.

Why Rationalize Applications: How Retirement Reduces Cybersecurity Exposure

Why rationalize applications? Because rationalization cuts legacy application security risk by shrinking the number of systems an attacker can target, which makes it a security strategy and a cost strategy in the same program.

1. Retirement removes the attack surface permanently: The application retires. The exposure ends. No attacker can exploit a decommissioned application, so every system retired is one fewer entry point and one less source of legacy application security risk.
2. A full inventory is the first security control: Rationalization starts by cataloging every application, which gives the security team the visibility it never had.
3. Scoring puts risk at the front of the queue: Ranking applications on risk alongside cost places the unpatched, unsupported systems first, and prioritization order decides how fast the exposure falls.
4. Archiving preserves the data and removes the source risk: Moving records into a HITRUST r2 certified environment that also holds a SOC 2 Type 2 report keeps them accessible and compliant while the vulnerable source system goes away. The system retires. The records remain.
5. Consolidation shrinks the integration map: Fewer active systems mean fewer network connections and fewer paths for attackers to move across the network.
6. Retirement closes compliance findings: An unsupported system that cannot meet current security standards is a regulatory liability, and retiring it removes that finding.
7. One decision returns cost and risk: Retiring an unsupported application removes its attack surface and its licensing, hosting, support, and staff cost in the same decision. The financial result is a recurring net operating expense reduction after archive and service costs. Some of those costs may qualify for capitalization, subject to the health system's accounting policies. The security request and the budget request become one request, which is why it gets funded. One large health system ran the program at enterprise scale. A Gartner case study (G00836537) documents data archived from more than 800 systems and nearly $100 million in recurring operating-expense savings. Every one of those systems carried its own attack surface.

What to Expect From a Partner Reducing Legacy Application Risk

Health systems should fund application retirement as a standing enterprise program that lowers legacy application security risk, scored on risk and cost together, with the chief information security officer (CISO) and the chief financial officer (CFO) presenting one business case to the board. Decommissioning is a standing function, and the partner a health system selects has to run it as one. The right partner retires the legacy systems that create exposure and preserves their data in a governed archive, so a health system shrinks its attack surface without losing access to historical records.

1. Portfolio-scale throughput: The partner runs concurrent workstreams on one repeatable process, which shrinks the attack surface at the pace the exposure demands.
2. Full lifecycle ownership: Inventory, assessment, archiving, and decommissioning, including termination of the underlying contract, sit with one accountable partner through a managed service.
3. Verifiable credentials: Ask any partner for its current HITRUST r2 certification letter and SOC 2 Type 2 report before archiving begins.