--- title: "End-of-Life Technology: CNI Cyber Risk | Firevault" description: "Nearly half of all network assets are ageing or obsolete. When technology can no longer be patched, it becomes a permanent open door for attackers. Physical…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": "GB" } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/learn/knowledge/end-of-life-technology-cni-hidden-cyber-risk#webpage", "url": "https://fire-vault.com/learn/knowledge/end-of-life-technology-cni-hidden-cyber-risk", "name": "End-of-Life Technology: CNI Cyber Risk", "description": "Nearly half of all network assets are ageing or obsolete. When technology can no longer be patched, it becomes a permanent open door for attackers. Physical…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "/assets/eol-cni-technical-debt-BLFuiVpl.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/learn/knowledge/end-of-life-technology-cni-hidden-cyber-risk#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/learn/knowledge/end-of-life-technology-cni-hidden-cyber-risk#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "End-of-Life Technology: CNI Cyber Risk", "item": "https://fire-vault.com/learn/knowledge/end-of-life-technology-cni-hidden-cyber-risk" } ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "End-of-Life Technology: CNI Cyber Risk", "description": "Nearly half of all network assets are ageing or obsolete. When technology can no longer be patched, it becomes a permanent open door for attackers. Physical disconnection addresses what patching cannot.", "url": "https://fire-vault.com/learn/knowledge/end-of-life-technology-cni-hidden-cyber-risk", "image": "/assets/eol-cni-technical-debt-BLFuiVpl.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@id": "https://fire-vault.com/#organization" }, "datePublished": "2026-02-12T00:00:00.000Z", "dateModified": "2026-02-12T00:00:00.000Z", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/learn/knowledge/end-of-life-technology-cni-hidden-cyber-risk" }, "inLanguage": "en-GB", "articleSection": "Knowledge", "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview The Scale of Technical DebtWhy End-of-Life Technology Is a …The United Kingdom: Highest Rela…The Patching Problem: Speed, Sca…The Cost of DowntimeWhere Patching Ends, Physical Di…Matching the Solution to the Sca…Regulatory Direction and the Cas…ConclusionMore [Knowledge Vault](/learn/knowledge)/ Knowledge Knowledge · 12 February 2026 # End-of-Life Technology: CNI Cyber Risk Nearly half of all network assets are ageing or obsolete. When technology can no longer be patched, it becomes a permanent open door for attackers. Physical disconnection addresses what patching cannot. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 10 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Flearn%2Fknowledge%2Fend-of-life-technology-cni-hidden-cyber-risk)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Flearn%2Fknowledge%2Fend-of-life-technology-cni-hidden-cyber-risk&text=End-of-Life%20Technology%3A%20CNI%20Cyber%20Risk%0A%0ANearly%20half%20of%20all%20network%20assets%20are%20ageing%20or%20obsolete.%20When%20technology%20can%20no%20longer%20be%20patched%2C%20it%20becomes%20a%20permanent%20open%20door%20for%20attackers.%20Physical%20disconnection%20addresses%20what%20patching%20cannot.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Flearn%2Fknowledge%2Fend-of-life-technology-cni-hidden-cyber-risk)[](mailto:?subject=End-of-Life%20Technology%3A%20CNI%20Cyber%20Risk&body=Nearly%20half%20of%20all%20network%20assets%20are%20ageing%20or%20obsolete.%20When%20technology%20can%20no%20longer%20be%20patched%2C%20it%20becomes%20a%20permanent%20open%20door%20for%20attackers.%20Physical%20disconnection%20addresses%20what%20patching%20cannot.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Flearn%2Fknowledge%2Fend-of-life-technology-cni-hidden-cyber-risk) ![End-of-Life Technology: CNI Cyber Risk](/assets/eol-cni-technical-debt-BLFuiVpl.jpg) Knowledge Why it matters ## What this means for organisations holding critical data Nearly half of all network assets are ageing or obsolete. When technology can no longer be patched, it becomes a permanent open door for attackers. Physical disconnection addresses what patching cannot. **On this page**[The Scale of Technical Debt](#section-0)[Why End-of-Life Technology Is a …](#section-1)[The United Kingdom: Highest Rela…](#section-2)[The Patching Problem: Speed, Sca…](#section-3)[The Cost of Downtime](#section-4)[Where Patching Ends, Physical Di…](#section-5)[Matching the Solution to the Sca…](#section-6)[Regulatory Direction and the Cas…](#section-7)[Conclusion](#section-8) On this page 1. [The Scale of Technical Debt](#section-0) 2. [Why End-of-Life Technology Is a National Security Issue](#section-1) 3. [The United Kingdom: Highest Relative Risk](#section-2) 4. [The Patching Problem: Speed, Scale, and Impossibility](#section-3) 5. [The Cost of Downtime](#section-4) 6. [Where Patching Ends, Physical Disconnection Begins](#section-5) 7. [Matching the Solution to the Scale of Risk](#section-6) 8. [Regulatory Direction and the Case for Action](#section-7) 9. [Conclusion](#section-8) A new report by WPI Strategy, commissioned by Cisco, quantifies the cybersecurity risk posed by End-of-Life technology across Critical National Infrastructure. The findings are stark: the United Kingdom carries the highest relative risk score of any country assessed. For organisations responsible for essential services, the implications demand immediate attention. ## The Scale of Technical Debt End-of-Life technology is hardware or software that can no longer receive security patches from its vendor. It is not merely old. It is indefensible. Once a vendor withdraws support, every newly discovered vulnerability becomes a permanent, unfixable exposure. There is no remediation pathway. There is no workaround. The system is, by definition, compromised from the moment a threat actor identifies its weakness. Industry estimates suggest that globally, almost half of all business network assets are ageing or obsolete. In the United Kingdom, 228 legacy IT systems were identified across government departments in 2024, with more than one in four rated as high risk for operational and security failures. > **£4.7 billion**, the planned UK government IT budget in 2019, of which nearly half was consumed simply keeping legacy systems running., _[National Audit Office](https://www.nao.org.uk/reports/managing-legacy-it/)_ The financial burden is equally severe. The US federal government spent $100 billion on IT and cyber investments in 2023, with an estimated $80 billion directed towards operating and maintaining existing systems, including legacy infrastructure. The National Audit Office found that government departments lacked fully funded remediation plans for over half of their legacy IT assets. This is not a maintenance problem. It is a compounding security liability. Like any form of debt, the longer it is ignored, the more aggressively it grows, consuming budgets that should be directed towards innovation, resilience, and growth. ## Why End-of-Life Technology Is a National Security Issue The distinction between legacy technology and End-of-Life technology is critical. Legacy systems may still function as intended and receive vendor support. End-of-Life systems cannot be patched when new vulnerabilities are discovered. They represent permanent, known gaps in the security perimeter, gaps that adversaries actively catalogue and exploit. The consequences are not theoretical: - In 2023, hackers exploited a widely used productivity tool that had reached End-of-Life status to compromise at least two US federal agencies. - A 2022 industry survey found that **60 per cent of French hospitals** still relied on Windows 7 systems, despite security support having ended in 2020. - In February 2024, the Chinese state-sponsored group **[Volt Typhoon](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a)** was confirmed to have compromised multiple US [critical infrastructure](/control-for-critical-infrastructure) sectors, including communications, energy, transportation, and water systems. The joint cybersecurity advisory issued in response began with 'Apply patches for internet-facing systems' and concluded with 'Plan end of life for technology beyond manufacturer's supported lifecycle.' The message could not be clearer: unpatchable technology in connected systems is an open invitation to adversaries. > "The threat to critical national infrastructure is real, enduring, and growing. The gap between the threat and our collective defences is widening.", _[NCSC Annual Review 2024](https://www.ncsc.gov.uk/annual-review/2024)_ ## The United Kingdom: Highest Relative Risk The WPI Strategy research modelled End-of-Life risk across five CNI sectors in five countries. The United Kingdom emerged with the most concerning profile of any nation assessed. | Country | Overall Risk Score | |---|---| | **United Kingdom** | **92.0** | | United States | 88.0 | | Germany | 87.8 | | France | 83.0 | | Japan | 65.0 | The United Kingdom's healthcare, energy, and water sectors carry particularly elevated scores. This reflects both the high concentration of UK infrastructure, where disruption to a single operator can cascade across entire regions, and the country's significant exposure to End-of-Life technology across these critical sectors. Between September 2023 and August 2024, the NCSC responded to **1,957 reported cyber incidents**, with a threefold increase in the most severe category compared to the previous year. The trajectory is clear: attacks are becoming more frequent, more sophisticated, and more damaging. ## The Patching Problem: Speed, Scale, and Impossibility > **5 days**, the average time-to-exploit a newly discovered vulnerability in 2023, down from 63 days in 2018., _[Google Threat Analysis Group](https://blog.google/technology/safety-security/tag-bulletin-q1-2024/)_ Even where patches exist, the window for exploitation has collapsed. For End-of-Life technology, the window is not narrow. It is permanently open. There is no patch to apply. There is no vendor to call. The vulnerability exists for as long as the system remains connected. Sixty per cent of EU cyber breaches in 2022 and 2023 exploited known vulnerabilities for which patches were available but had not been applied. This underscores a dual failure: organisations struggle both to patch what can be patched and to replace what cannot. The operational reality compounds the challenge. In water systems, where older operational technology has been overlaid with digital connectivity, operators have been found to avoid installing updates that could disrupt legacy systems and interrupt essential services. The result is infrastructure that is simultaneously connected to modern threat landscapes and defended by obsolete technology. As one CISO at a UK water utility noted in an industry forum: _'We know the systems are vulnerable. But replacing them means shutting down services that people depend on every day. So we manage the risk as best we can.'_ This is the impossible calculus that End-of-Life technology forces upon operators of essential services. ## The Cost of Downtime When End-of-Life systems are exploited, the consequences extend far beyond the immediate breach. > **$400 billion**, the annual cost of system downtime to the world's largest companies, with 56 per cent attributable to cybersecurity incidents., _[Splunk, 2024](https://www.splunk.com/en_us/form/the-hidden-costs-of-downtime.html)_ Perhaps most troubling, 54 per cent of executives admitted to intentionally leaving root causes of downtime unaddressed, likely to avoid the cost of remediating legacy systems. This is not ignorance. It is a calculated gamble that the cost of remediation exceeds the perceived risk of exploitation. Until, inevitably, it does not. Recovery timelines are lengthening. Research by Fastly found that organisations took an average of **7.34 months** to recover from attacks in 2024, 25 per cent longer than anticipated. Organisations that invested less in cybersecurity faced recovery periods approaching 11 months. Nearly a full year of compromised operations. The human cost is equally significant: - The **2024 Synnovis attack** on NHS healthcare services affected over 11,000 patients and cost £32.7 million. Blood tests were delayed. Surgeries were cancelled. Lives were directly impacted. - The **2020 Hackney Council [ransomware attack](/threats/ransomware)** disabled housing, health, and benefits services for almost a year, with costs exceeding £12 million. The council was still struggling to fully recover more than two years later. - **Transport for London's 2024 breach** compromised 5,000 customer bank details and cost over £30 million in response and remediation. These are not abstract statistics. They are schools that could not access pupil records. Patients who could not receive treatment. Families who could not access housing support. The cost of End-of-Life technology is measured in human outcomes, not just financial ones. ## Where Patching Ends, Physical Disconnection Begins The WPI Strategy report's recommendations focus on asset registers, lifecycle management, procurement reform, and regulatory reporting. These are necessary measures. But they share a fundamental assumption: that all critical data and systems must remain connected, and that security depends on the speed and completeness of patching. For organisations that accept this assumption, the risk calculus is straightforward but unforgiving: - Every system that cannot be patched is a permanent vulnerability. - Every delay in remediation extends the window of exposure. - Every connection to the network is a potential pathway for compromise. Physical disconnection offers an alternative architecture for the data that matters most. When critical assets are physically disconnected from the network, they are removed from the threat surface entirely. End-of-Life technology in connected systems cannot compromise data that is not connected. Unpatched vulnerabilities cannot be exploited across a physical gap. > You cannot breach what is not connected. You cannot ransom what you cannot reach. You cannot exploit a vulnerability in a system that has no network interface. The entire category of risk that the WPI Strategy report quantifies, the exposure created by unpatchable technology, simply does not apply to assets held offline. This is not a software control. It is not a configuration change. It is a fundamental architectural decision that eliminates the attack vector at its root. ## Matching the Solution to the Scale of Risk The scale of End-of-Life exposure varies enormously across organisations. A board director safeguarding personal liability documents faces a different challenge to a water utility protecting decades of operational data. The solution architecture must reflect this. For individuals and senior leaders, **Vault** provides a [digital safe deposit box](/vault) for crown jewel documents, contracts, [intellectual property](/oss-for-intellectual-property), succession plans, and personal records that would cause irreparable harm if compromised. Each Vault is physically disconnected, hardware-encrypted, and identity-locked through KYC and multi-factor authentication. It is the simplest expression of a powerful principle: critical data that is not connected cannot be breached. For organisations managing larger volumes of sensitive data, operational records, research archives, regulatory documentation, **Storage** delivers scalable [offline secure storage](/offline-secure-storage) measured in terabytes. Storage enables CNI operators to move entire categories of critical data beyond the reach of network-borne threats, including those that exploit the End-of-Life vulnerabilities this report quantifies. For enterprises requiring systematic control across multiple sites, departments, or compliance frameworks, the **Platform** provides the architecture to implement physical disconnection at scale. Nine integrated modules, from fv-Firebreak for data segmentation to fv-Isolate for physical port control, enable organisations to manage the path of data to protect their most critical assets. The Platform supports on-premise, co-located, and hybrid deployments across Firevault Bunker locations. This is not a replacement for the lifecycle management and remediation the report advocates. It is recognition that for [crown jewel data](/oss-for-business), the records, intellectual property, and operational information that an organisation cannot afford to lose, the gap between what should be patched and what can be patched will always exist. That gap requires a fundamentally different approach. ## Regulatory Direction and the Case for Action The regulatory environment is moving towards greater accountability. The United Kingdom's forthcoming [Cyber Security and Resilience Bill](https://www.gov.uk/government/publications/cyber-security-and-resilience-bill-policy-statement/cyber-security-and-resilience-bill-policy-statement) will expand mandatory security requirements for CNI operators and bring managed service providers into scope. The EU's [NIS2 Directive](https://digital-strategy.ec.europa.eu/en/policies/nis2-directive) has already strengthened obligations across member states. Japan's [Active Cyber Defence Act](https://www.japantimes.co.jp/news/2025/05/16/japan/politics/active-cyber-defence-bill-passes/), passed in May 2025, requires operators to submit IT asset inventories and report incidents to a newly strengthened National Cybersecurity Office. These frameworks increasingly expect CNI operators to demonstrate that appropriate protective measures are in place. For organisations carrying significant End-of-Life exposure, demonstrating compliance will require showing either a credible remediation plan or alternative controls that address the risk. Physical disconnection through offline secure storage provides that alternative, ensuring that the most critical data remains protected regardless of the patching status of connected infrastructure. Whether through Vault for personal protection, Storage for departmental resilience, or Platform for enterprise-wide architecture, the capability exists today. ## Conclusion The WPI Strategy report provides the clearest quantification yet of the cybersecurity risk that End-of-Life technology poses to Critical National Infrastructure. The United Kingdom's position as the highest-risk country assessed should concentrate attention at board level and across government. The report's recommendations for better asset management, reformed procurement, and regulatory transparency are essential. But they address the symptoms of a deeper architectural challenge: critical data stored on systems that are, by definition, permanently vulnerable. > The question is not whether End-of-Life technology presents a risk. The WPI Strategy research has answered that definitively. The question is what to do about the data that is too important to leave exposed while the slow work of remediation continues. By physically disconnecting critical assets from the network, organisations eliminate the exposure that End-of-Life technology creates. You cannot breach what is not connected. And you cannot exploit a vulnerability in a system that has no network interface. For CNI operators, the path forward is clear: patch what you can, replace what you must, and disconnect what you cannot afford to lose. About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. [Get started](/get-started)[Talk to the team](/demo) **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Keep reading ## You may also find these useful [Knowledge ### NCSC CNI Guide: Severe Cyber Threats An authoritative guide aligned with NCSC recommendations for Critical National Infrastructure. How physical disconnection supports the four-objective framework for cyber resilience. ](/learn/knowledge/ncsc-cni-severe-cyber-threat-guide)[Knowledge ### UK CNI Threat Landscape 2026 State actors, ransomware groups, and supply chain vulnerabilities converge on UK critical infrastructure. Understanding the threat informs the defence. ](/learn/knowledge/uk-cni-threat-landscape-2026)[Knowledge ### Ransomware Protection: Offline Strategy Ransomware attacks have evolved from opportunistic to surgical. The only data attackers cannot encrypt is data they cannot reach. ](/learn/knowledge/ransomware-protection-offline-strategy) ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ![David Bailey](/assets/david-bailey-Dgqj8eaE.jpg) ![Kenny Phipps](/assets/kenny-phipps-CVyooRsR.jpg) Online Now Concierge ## Which offline secure storage solution is right for you? Answer a few quick questions and we will recommend the right solution, whether that is a personal vault or a scalable offline storage system built for your needs. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up