A legacy application is older software that was built before modern identity controls were common, so it may not support native multifactor authentication, phishing-resistant login, or current SSO standards. These systems are often still business-critical, which makes them a frequent weak point in security programs.
In practice, attackers look for legacy apps because they may rely on passwords alone, basic forms authentication, or outdated protocols that are easier to steal or relay. Defenders reduce that risk by placing the app behind a proxy or access gateway, adding agentless MFA, restricting network access, or modernizing the application. The key challenge is coverage: if one important app cannot enforce the same controls as the rest of the environment, it can become the easiest path to account takeover.