Legacy software under pressure from AI: where new security risks emerge

Artificial intelligence now plays a major role in cybersecurity. It does not necessarily create new security holes in software, but it helps attackers find vulnerabilities faster, prepare exploits and research potential targets more efficiently, even if your application does not use AI at all.

You may not use AI, but attackers do

The Czech National Cyber and Information Security Agency has already highlighted the role of artificial intelligence in cybersecurity. It points in particular to new frontier AI models, which have significantly improved their ability to automatically identify and verify software vulnerabilities.

The UK’s National Cyber Security Centre has reached a similar conclusion. Its forecasts go even further, expecting AI to accelerate vulnerability research, exploit development, social engineering and the use of stolen data by 2027. The main risk is therefore not entirely new types of attacks, but more efficient execution of existing ones.

One third of breaches start with a software vulnerability

When it comes to protecting company data, responding to a vulnerability “sometime next month” is no longer enough. Verizon reports that in 2025, exploitation of software vulnerabilities was the initial access vector in 31% of the incidents it tracked.

The time between public disclosure of a vulnerability and its exploitation has also become shorter. Publicly known vulnerabilities can now be exploited within days, and AI is likely to reduce that window even further.

For business software security, the key factor is increasingly how quickly a company can eliminate newly discovered risks.

AI can find vulnerabilities before attackers do

Artificial intelligence does not only help hackers. Security teams use the same types of models to analyse code, identify vulnerabilities and, in some cases, suggest fixes. The race is increasingly about who finds the weakness first.

Google, for example, is developing a system called Big Sleep, created by teams from DeepMind and Project Zero. The AI agent has already discovered a previously unknown vulnerability in SQLite, and Google is using it to automate the search for further security issues in real-world software.

Anthropic is taking a similar approach. When testing Claude on the Firefox source code, the model identified dozens of security issues within two weeks. For one of the vulnerabilities, it was also able to create a working exploit in a controlled environment.

AI is shortening the time available to fix vulnerabilities

Legacy software has one disadvantage that is becoming increasingly important in the age of AI: fixes are often slow.

Updating a single library can break an integration. An operating system upgrade can disrupt production. Some parts of the system may have become so fragile that nobody wants to touch them.

Attackers, however, are moving in the opposite direction. AI allows them to identify and test weaknesses faster. Security therefore increasingly depends on how quickly the software owner can respond to a newly discovered risk.

How can you tell when legacy software has become a problem?

The age of custom software is not a problem by itself. Risk emerges when years of postponed updates, unknown dependencies or lost know-how begin to accumulate. A company may then discover that the software still works, but nobody knows how to change it safely.

• Unsupported technologies: The operating system, database or framework no longer receives security updates.
• Unknown dependencies: The company does not know which libraries and components the custom application actually uses.
• Irregular updates: Security patches are installed late or inconsistently.
• Lost know-how: The original IT supplier is gone and the documentation is missing or outdated.
• Risky deployments: There are no reliable tests, test environment or deployment process.
• Outdated authentication: The system does not support multi-factor authentication or modern access management.
• Unnecessary internet exposure: Administration interfaces, APIs or remote access remain publicly accessible even when they do not need to be.
• No clear view of the software stack: The company cannot quickly determine whether a newly discovered security risk affects its own system.

Fix, modernize or replace?

Legacy software does not always need to be replaced. If it can still be updated safely and continues to serve its purpose, it may be enough to remove the most serious weaknesses or modernize the system gradually.

Developing a new custom solution makes sense only when maintaining the existing one becomes too expensive or too risky.

One of the advantages of custom software is that you can decide based on the actual condition of the system. What matters is not how old the software is, but whether it can withstand today’s security threats. At a time when AI is accelerating vulnerability discovery, the speed at which a company can respond and fix security issues is becoming increasingly important.