"Don't touch that": Why legacy technical debt is one of the biggest risks in your server room

The most dangerous sentence in a server room is often: "Don't touch that."

It is usually said half-jokingly, half-grimacing. It refers to that old machine that still works, that runs something critical, and that has survived so many patches and workarounds that no one really dares touch it anymore.

At AWSMTECH (Switzerland) LTD, we hear this sentence constantly from small and medium-sized businesses in Geneva. And it almost always points to the same underlying problem: legacy technical debt.

Legacy debt is not simply old technology. It is old technology that has become a silent dependency. The kind of debt that quietly accumulates risk, until the day it suddenly turns into an outage, a security incident or an emergency upgrade at the worst possible moment.

A legacy debt audit is the fastest way to bring this hidden exposure to light.

01What legacy debt actually looks like

Legacy debt is not just "old hardware." It is old hardware that has become normal.

It is the server running a critical business application, the network equipment whose origin no one remembers anymore, or the temporary fix that became a permanent dependency. Over time, this debt quietly builds up in many infrastructures based in Geneva.

As Infinite Lambda explains, legacy debt "happens even to the best systems," silently accumulating costs and constraints until it becomes too expensive, or too risky, to ignore.

This is why a legacy debt audit is anything but theoretical. At AWSMTECH (Switzerland) LTD, we consider it a visibility exercise: identifying the oldest and most critical risks that should still be actively managed, but often no longer are.

The security problem generally arises when "old" turns into "impossible to update."

The UK NCSC's recommendations are very clear: when technology becomes obsolete, it should ideally no longer be used, and the only truly effective mitigation is to stop using it. If a system can no longer be updated, its weaknesses do not disappear over time. They simply wait for the wrong day.

Legacy debt also becomes visible when basic server hygiene starts to slip.

The NIST SP 800-123 standard describes secure server operation as an ongoing discipline including regular updates, log monitoring, backups and the removal of unnecessary services. When these fundamentals become irregular, legacy debt stops being just a security problem and also becomes a reliability and incident-management problem.

Finally, legacy debt often hides at the edge of the network. Internet-facing equipment that has reached end of support represents a disproportionate risk in the most exposed part of your environment.

02The 3 oldest risks to identify as a priority

In the majority of legacy debt audits we carry out for organisations based in Geneva, 3 categories consistently stand out as the riskiest. They combine age and impact: they sit at the entry point of the infrastructure, can no longer be patched, or have gradually drifted away from a healthy configuration.

Risk #1: Network equipment at end of support

If you want to quickly identify the most critical risks, start with the network edge.

Firewalls, VPNs, routers and other internet-facing equipment are the entry point into your environment. Once they reach End-of-Support (EOS), security updates stop and protecting them becomes increasingly difficult.

What to check during your audit:

• List all network equipment: firewalls, VPNs, routers, and check their support status.
• Identify which equipment is exposed to the Internet and which services are publicly accessible.
• Spot equipment that can no longer receive current firmware or security updates.

For Geneva SMEs, unsupported network equipment often represents the technical risk with the greatest potential impact.

Risk #2: Obsolete systems that can no longer be patched

Obsolete systems represent the purest form of legacy debt.

They still work, but no longer receive security patches. This means every newly discovered vulnerability becomes permanent. No workaround truly makes unsupported software secure. It is only a temporary risk reduction until replacement.

What to check during your audit:

• Identify all unsupported systems: server operating systems, appliances, hypervisors and critical applications.
• Spot systems requiring security exceptions: legacy protocols, weak authentication or specific firewall rules.
• Identify "business-critical but unsupported" systems.

At AWSMTECH (Switzerland) LTD, this is often the category where the hardest, but also most necessary, decisions begin.

Risk #3: Servers that "still work" but whose fundamentals have been neglected

This is the most deceptive risk, because everything appears to be working normally.

The server is officially supported. The hardware works. No one complains. Yet over time, the fundamentals drift: updates become irregular, unnecessary services stay active, and backups have not been properly tested.

NIST SP 800-123 reminds us that server security relies on essential but low-visibility practices: updates, log monitoring, service control and backup validation. These are the fundamentals that prevent small problems from turning into long outages.

What to check during your audit:

• Actual state of updates: current patch level and frequency of delays.
• Service sprawl: active services that are no longer needed.
• Admin accounts and services: shared credentials and excessive permissions.
• Confidence in backups: date and outcome of the last restoration test.
• Change management: who can change what and how these actions are tracked.

For SMEs in French-speaking Switzerland, this category often represents a hidden operational fragility rather than an obvious security flaw.

03Stop carrying a silent risk

Legacy debt never announces itself loudly. It stays quietly in the background, until the day it turns into an outage, a security exposure or an unplanned emergency migration.

A legacy debt audit lets you regain control. It turns "we should deal with that someday" into a clear, prioritised list of concrete actions.

Start with the highest-impact risks:

• Network equipment at end of support.
• Obsolete, unpatchable systems.
• Servers whose fundamentals have drifted over time.

Then assign owners, set deadlines and move each item from "too risky to touch" to "handled."

At AWSMTECH (Switzerland) LTD, we support small and medium-sized organisations across Geneva and French-speaking Switzerland with pragmatic, risk-oriented audits that lead to concrete action.

Contact us for help with your next legacy debt audit.