Why AI is raising the stakes for legacy government IT

Aging technology has long underpinned essential government services because replacing critical systems is expensive, complex and risky. AI is changing that calculation by helping threat actors identify and exploit vulnerabilities faster, increasing the risks associated with older technology.

Under a new Australian Government direction, non-corporate Commonwealth entities must identify their legacy technology, develop risk-management plans and set reduction targets by 31 March 2027. While the direction applies to Commonwealth entities, the underlying challenge extends across the public sector: government organisations at every level must understand the risks associated with aging technology, particularly as AI changes the speed and sophistication of cyber threats.

The answer is not simply to replace every old system, but to understand where the greatest exposure lies, how vulnerabilities and access permissions create risks across the environment, and where investment in modernisation or stronger protection will have the greatest impact. This starts with establishing a reliable view of the systems, information, identities and dependencies already in place.

Discovery needs to lead to action

Government IT environments have evolved over decades, resulting in applications running different software versions, serving different purposes and supporting different user groups. Some remain essential to public services, while others are underused, disconnected or obsolete.

In large, complex government environments, technology leaders may not have a comprehensive view of every application, integration and dependency. A thorough stocktake can establish that baseline.

Government organisations need to identify which systems remain in use, including those operated by external providers; the software versions they run; whether vendor support and security updates are still available; what information they hold; and how applications connect.

They also need to understand who can access those systems and how. User accounts, service identities and permissions can accumulate over time, leaving unnecessary access that attackers may exploit to move between systems or reach sensitive information.

Without this baseline, it is difficult to make informed decisions about the next steps.

Not every aging system presents the same risk

The direction requires affected entities to set targets for reducing legacy technology and to explain how they will prioritise that reduction. The distinction matters: a risk-based program asks which systems create the greatest exposure, not simply which systems are the oldest.

An isolated, appropriately protected, older application containing minimal sensitive data may present a very different level of risk from one supporting public-facing services, holding sensitive information or connecting to multiple applications and identities.

Government organisations need to assess each system’s exposure based on the sensitivity of the information it holds, the availability of security updates, the strength of access controls, its connections to other systems, and the potential consequences of a compromise.

This provides a stronger basis for identifying where immediate action is required and where existing controls may be sufficient while longer-term changes take place.

AI increases the urgency

Prioritisation has become more pressing as AI accelerates how quickly weaknesses can be discovered and connected. AI-enabled tools can help analysts and attackers identify some vulnerabilities faster, correlate findings across large environments and reduce the effort required for reconnaissance. A relatively minor weakness can become more serious when combined with exposed credentials, excessive permissions or another vulnerability elsewhere in the environment.

Understanding these connections is particularly important in large government environments, where a weakness in one application can create exposure elsewhere. Alongside longer-term modernisation, organisations should prioritise timely patching, remove unnecessary access, strengthen monitoring and isolate vulnerable systems where appropriate.

Modernisation does not always mean replacement

The direction also requires affected entities to identify opportunities to rationalise IT infrastructure and implement mitigations for legacy systems that must remain. This makes modernisation a portfolio decision, not a replacement program.

Some older systems require modernisation or migration. Others may need software upgrades, stronger segmentation, improved patching or tighter access controls. Duplicated, unused or low-value applications may be retired.

Where aging technology systems must remain, government organisations need to understand the residual risk, implement appropriate controls and regularly reassess whether those protections remain effective.

A robust stocktake turns a complex technology environment into a clear sequence of decisions: where to invest, what to rationalise or retire, and which risks can be contained while longer-term solutions are developed.

Protect the information as technology changes

Updating the IT environment is only part of the challenge. Government organisations must also maintain control over the information their systems process.

As applications are upgraded, integrated, migrated or retired, government organisations need to understand where information originated, how it moves between systems and which records are authoritative. Effective information governance, including appropriate retention and disposal policies, helps protect critical records while reducing unnecessary stores of sensitive information.

Identity-based access controls are equally important. Employees, service accounts, applications and AI agents should have access only to the systems and information needed to perform their authorised functions.

These disciplines help reduce risk throughout what, for many government organisations, will be a multi-year modernisation process.

The March deadline gives Commonwealth entities an opportunity to turn their stocktakes into practical plans for managing the risks associated with existing technology infrastructure. For government organisations more broadly, the same principles apply: understand where the greatest exposure lies, strengthen protections where necessary and prioritise modernisation where it will have the greatest impact.

As AI accelerates parts of the cyber threat landscape, the cost of leaving those decisions unresolved is increasing. Government technology leaders need to turn visibility into action, strengthen protections now, and build a practical roadmap for longer-term modernisation.

Image credit: iStock.com/Marco VDM