Unpatchable Doesn't Have to Mean Unprotected: How to Secure Legacy OT

In October 2026, cyberattacks targeting refrigeration management systems in French supermarkets caused temperatures to rise and refrigerated food to spoil. Just weeks later, similar incidents affected supermarkets in at least seven other European countries.

These attacks exposed security weaknesses in internet-connected refrigeration controllers, including legacy systems that no longer received security updates and supported devices running outdated firmware.

Across manufacturing facilities, utilities, transportation networks, and other critical infrastructure, organizations rely heavily on aging operational technology (OT). These legacy systems continue performing their intended functions reliably, even as their cybersecurity limitations become increasingly difficult to ignore.

Replacing aging equipment can be costly or impractical, and patching may require downtime that operations cannot easily accommodate. In some cases, security updates are no longer available at all. At the same time, legacy systems still need to exchange data with other equipment and remain accessible to the operators, maintenance teams, and vendors responsible for keeping them running.

So, how do you protect critical operations when they depend on vulnerable legacy systems?

Even when legacy systems cannot be patched, organizations can reduce risk by securing the connections surrounding these systems, restricting unnecessary access, and protecting the operational processes that rely on them.

Why Legacy OT Systems Can't Always Be Patched

Unlike conventional IT equipment, industrial controllers, human-machine interfaces (HMIs), and other OT assets are often expected to remain in service for decades. Their useful operational lives can extend well beyond the period during which manufacturers provide security updates.

And even when patches are available, applying them isn't always straightforward. Updates may require equipment to be taken offline, tested for compatibility, or validated against processes that cannot tolerate unexpected changes. In manufacturing, that could mean interrupting production. In water utilities or other critical infrastructure, the consequences of downtime may be considerably more serious.

These constraints create a difficult trade-off. Organizations must address known vulnerabilities while maintaining the availability and reliability of systems that support essential operations.

The European refrigeration incidents offer a striking example of legacy equipment remaining in service long after reaching end of life. Danfoss confirmed that some affected controllers had been discontinued as far back as 2016 and no longer received software or security updates.

This is a recognized challenge in OT security. NIST's Guide to Operational Technology Security discusses compensating controls as a means of reducing risk when patches are unavailable, require additional validation, or would necessitate unacceptable operational shutdowns.

Crucially, even when a vulnerability cannot be fixed, the risks it poses to critical operations can still be reduced.

How to Protect Legacy OT Systems When Patching Isn't an Option

The risks associated with a vulnerable OT system depend on more than its security weaknesses. Who can access it? What other systems can it communicate with? And if an attacker compromises it, how much of the operation could be affected?

When patching isn't possible, organizations can implement compensating controls—such as access restrictions, network segmentation, and monitoring—to reduce the risks associated with vulnerabilities that cannot be directly remediated.

Choosing the right controls begins with understanding an asset's operational role. A controller that manages a critical production process will likely require different protections from a monitoring device with limited connectivity. These differences should guide which controls are prioritized and how they're implemented.

Ultimately, protecting a legacy asset means protecting the operational function it performs, not just the device itself.

Limit the Reach of a Potential Compromise

In an industrial environment, even a controller responsible for a single piece of equipment may communicate with multiple systems that support a larger operation. While these connections are necessary for normal functioning, they can also create pathways for attackers to move laterally and reach additional assets. The goal is to preserve essential communications while limiting the pathways through which a compromise could spread.

Network segmentation can help reduce this risk by restricting communication between different parts of an industrial environment. More granular approaches, such as OT microsegmentation, allow organizations to control which individual systems are permitted to communicate, helping contain a compromise and limit its potential impact on other systems.

In increasingly interconnected OT environments, minimizing the effects of a compromise can be just as important as preventing the initial intrusion.

Reduce Exposure Without Sacrificing Connectivity

Direct exposure of operational management interfaces to the public internet presents another significant risk for vulnerable legacy equipment.

In its October 2026 advisory following the first wave of supermarket attacks, France's CERT-FR recommended removing affected refrigeration controllers from direct internet exposure and restoring necessary connectivity through protected networks. It also warned that restoring an end-of-life device to factory settings would not resolve vulnerabilities for which no security patch existed.

Industrial organizations depend on remote connectivity for many legitimate reasons. Vendors need to troubleshoot equipment, maintenance teams need to adjust configurations, and operators may need to monitor geographically distributed assets.

The key is to preserve these capabilities without giving users or attackers unnecessarily broad access.

Secure remote access provides a controlled path to operational systems without requiring their management interfaces to be publicly accessible. Strong identity verification helps ensure that users are who they claim to be, while least-privilege policies restrict them to the specific systems and resources they are authorized to access.

Organizations can further reduce risk by limiting access to approved time periods and maintaining visibility into privileged sessions throughout their duration. Session monitoring and recording provide a record of activity, helping security teams investigate suspicious behavior and understand what occurred during a remote connection.

For legacy equipment, agentless approaches are particularly valuable because they allow organizations to strengthen access security without installing software on devices that may not support it.

None of these controls can make an unpatched device invulnerable, but they can make it harder for attackers to gain access and exploit its vulnerabilities.

Make Security Improvements Without Disrupting Operations

For organizations operating legacy OT, implementing additional security controls introduces a practical challenge: the protections themselves must not interfere with the systems they're intended to safeguard.

Network restrictions that block essential communications, access policies that prevent urgent maintenance, or security controls that interfere with safety-critical processes can create serious operational risks of their own.

Organizations should begin by identifying their most critical assets, documenting necessary connections, and prioritizing the vulnerabilities that present the greatest operational risk. From there, security improvements can be introduced incrementally rather than through disruptive, organization-wide changes.

In OT environments, validation should account for more than routine operating conditions. Some critical communications occur only during maintenance, startup, shutdown, or abnormal events, and blocking them could have serious consequences.

Where possible, changes should be coordinated with operations teams, tested in advance, and supported by clear rollback procedures.

Reducing Risk When Vulnerabilities Remain

The supermarket refrigeration attacks in October and November 2026 exposed a particularly dangerous combination: aging operational equipment, unpatched vulnerabilities, and management interfaces accessible from the public internet.

For industrial organizations, the lesson extends far beyond refrigeration. When critical operations depend on vulnerable legacy systems, protecting the connections surrounding those systems can help reduce the likelihood of compromise and limit its consequences.

Patching and replacing vulnerable equipment should remain priorities wherever feasible. But when those options aren't available, organizations still have meaningful ways to reduce risk without disrupting the operations they need to protect.

Unpatchable doesn't have to mean unprotected.