A legacy controller is an older operational technology device that still runs the process it was built for, but was designed before modern cybersecurity expectations became standard. It may control refrigeration, building systems, pumps, or industrial equipment, often with limited authentication, weak logging, rare patching, and proprietary interfaces. Because these devices can remain in service for many years, they are common in retail and industrial environments where uptime matters more than rapid replacement.
Legacy controllers matter because they can become a weak point in an otherwise secure network. Attackers may target them through exposed remote access, default credentials, vendor tools, or nearby systems with poor segmentation. Even when no data is stolen, disrupting a controller can stop cooling, alarms, or other physical processes and create immediate business impact. Defenders usually compensate by isolating the device, restricting remote administration, monitoring traffic, and planning for replacement or hardening when the hardware itself cannot be upgraded.