The Department of Home Affairs initiates a sweeping review of obsolete government technology in response to AI-driven security breach, highlighting funding and vendor collaboration challenges in modernisation efforts.
The Department of Home Affairs has begun forcing a long-delayed reckoning with ageing government systems after an OpenAI agent reached non-public files on a Medicare statistics portal that dated back decades. In response, the department has ordered federal agencies to identify legacy technology, assess the security risks it creates and produce a management plan with a reduction target and a prioritisation strategy. According to the Australian Signals Directorate’s cyber guidance, legacy technology covers hardware, software, services, protocols or systems that are end-of-life or otherwise out of vendor support, which means the issue is broader than a simple list of obsolete machines.
Counting those systems will be the straightforward part. Fixing them will be far harder. Agencies are being asked to work out which systems can be disconnected, which can be replaced and which must remain in service for years because they encode complex business rules, hold difficult-to-migrate data or underpin public services that cannot tolerate interruption. The Australian Cyber Security Centre’s practitioner guidance says legacy IT should be replaced before it becomes a security liability, but it also recognises that organisations will often need low-cost mitigations while they prepare a longer transition.
That makes risk triage essential. Systems with the highest exposure, greatest operational impact and most realistic replacement paths should be tackled first, while the rest are hardened. The Australian Cyber Security Centre advises executives and practitioners to treat isolation, segmentation, enhanced authentication, tighter logging and monitoring, and protective controls between older systems and the wider internet as practical ways to reduce exposure. The point is not to pretend that every ageing platform can be made modern overnight, but to reduce the likelihood that one weak link becomes a broad compromise.
The harder policy question is who pays. The article argues that retiring legacy platforms will require money, scarce expertise and more leverage over vendors than a directive alone can provide. That concern is echoed in the Audit Office of South Australia’s review of legacy ICT systems, which found that modernisation is often slowed by funding and resource constraints and recommended a structured, risk-based approach. The federal government can partly address the problem by negotiating collectively with suppliers, extending support for still-useful systems, and using future procurement to demand longer security support periods, clearer end-of-support dates and limits on extended-support pricing. The European Union’s Cyber Resilience Act is cited as a useful precedent for placing such obligations on vendors. The message is plain: the stocktake will show where the danger sits, but reducing it will depend on funding, technical capability and vendors willing to share the burden.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
