A legacy web app is an older browser-based application that still depends on outdated standards, browser quirks, or compatibility modes to function correctly. These systems often include internal portals, line-of-business tools, and vendor applications built for older versions of Internet Explorer or other now-obsolete web behaviors.
In cyber security, legacy web apps matter because they are harder to patch, test, and secure than modern applications. They may require compatibility features such as IE mode, which creates a single point of failure if the browser, operating system, or policy layer breaks. Attackers also target legacy apps because old frameworks, weak authentication flows, and unpatched components can expose them to injection, session abuse, or insecure file handling. Defenders should inventory these apps, limit access, isolate them where possible, and test updates in a controlled ring before broad deployment.