Security by antiquity: Why older tech is sometimes safer from hackers
There’s a strange irony sitting at the heart of modern cybersecurity. While companies pour billions into the newest firewalls, AI-driven threat detection and zero-trust architectures, some of the most resilient systems on the planet are running software that predates smartphones. Old mainframes still process a huge share of global banking transactions. Certain military systems have relied on decades-old hardware well past when most consumer tech would have been landfill. And more than a few IT administrators quietly admit that their oldest, least-updated machine has never once been compromised, while their newest cloud deployment gets probed daily.
This isn’t nostalgia talking. It’s a real, if limited, security phenomenon that researchers sometimes call security by antiquity or security through obsolescence. The idea is straightforward: attackers build their tools around the systems everyone actually uses. When a piece of technology becomes rare enough, or different enough from the current mainstream, it stops being a worthwhile target. Not because it’s inherently stronger, but because nobody bothers building an attack for it anymore.
Think about how most cyberattacks actually work. Ransomware crews, botnet operators and most cybercriminals aren’t crafting bespoke exploits for every target. They’re running automated scanners across the internet looking for known vulnerabilities in widely deployed software, then deploying pre-built exploit kits at scale. That model depends entirely on scale and familiarity. A hacking toolkit built to exploit a common vulnerability in a current version of Windows Server or a popular router firmware is useless against a machine running an operating system from fifteen years ago with a completely different codebase and command structure. The attacker’s tools simply don’t know what they’re looking at.
There’s a real-world case that illustrates this well. Security researchers have repeatedly flagged that hackers specifically hunt for end-of-life networking hardware, like older D-Link routers, precisely because those devices stopped receiving patches and became permanently vulnerable to known flaws. That sounds like the opposite of security by antiquity, and in a sense it is. The distinction matters. Old technology isn’t safer because it’s old. It’s sometimes safer because it’s obscure, disconnected from the internet, or different enough structurally that common attack tooling doesn’t apply. Old technology that’s still exposed to the internet with known, unpatched vulnerabilities is often the easiest target of all.
That distinction shows up clearly in industrial control systems and critical infrastructure. Power plants, water treatment facilities and manufacturing floors frequently run equipment and control software that’s decades old, sometimes because replacing it is enormously expensive, sometimes because the systems were never designed with networked connectivity in mind at all. The Cybersecurity and Infrastructure Security Agency, the US government’s lead agency on this issue, has repeatedly warned operators of industrial control systems that isolation and physical separation from the internet remain some of the most effective defenses available, precisely because so much of this equipment can’t be patched the way modern IT systems can.
Air-gapping, the practice of physically isolating a system from any network connection, is the purest expression of this philosophy. If a computer has no path in or out, remote hacking becomes physically impossible. It’s why some of the most sensitive government and military systems still rely on hardware that has no wireless capability, no modern networking stack, and in some documented cases, storage media that predates the internet as most people know it. But air-gapping isn’t a silver bullet either. Stuxnet, the malware that sabotaged Iranian nuclear centrifuges over a decade ago, famously crossed an air gap by hitching a ride on an infected USB drive. It’s a reminder that isolation only works as long as nothing physical crosses the boundary, and human behavior tends to be the weak point in even the most airtight design.
There’s also a quieter, more mundane version of this effect happening inside ordinary businesses. Legacy mainframes running COBOL, a programming language that first appeared in 1959, still handle a significant share of global financial transactions. These systems are often criticized as clunky and expensive to maintain, but they also sit largely outside the attention of the modern hacking economy, which has organized itself almost entirely around exploiting web applications, cloud misconfigurations and popular enterprise software. Nobody is selling exploit kits for a 40-year-old proprietary banking system on underground forums, because the market for that skill set essentially doesn’t exist anymore.
None of this amounts to an argument for abandoning modern security practices in favor of digital archaeology. The same obscurity that protects old systems from automated, opportunistic attacks offers little defense against a determined, well-resourced adversary, particularly a nation-state actor with the time and motive to study a specific legacy target. Old systems also tend to lack modern encryption standards, logging capabilities and authentication protocols, which makes them harder to monitor and easier to quietly compromise once an attacker does figure out how they work. Security researchers generally agree that obscurity should be treated as a layer of defense, never the whole strategy. A system that’s simply old and disconnected from any support or patching lifecycle is often a ticking liability rather than a safe harbor.
While hackers can’t target it in quite the same way they might target a modern Android or iOS device, the phone’s operating system, Symbian, does have some old, known vulnerabilities. The flipside is that “nobody’s targeting them anymore”, adds Hyppönen. Similarly, the Nokia could be more at risk from techniques that snoop on phone calls. But how many people will bother? It’s a security trade-off.
What this whole pattern really reveals is how much of modern cybersecurity is a numbers game shaped by economics rather than pure technical strength. Attackers go where the return on investment is highest, and that means targeting the software running on the most machines, with the most well-documented vulnerabilities, and the largest potential payout. Anything that falls outside that pattern, whether through genuine obscurity, physical isolation, or sheer structural difference from the mainstream, tends to slip under the radar simply because it isn’t worth anyone’s time to attack.
For organizations weighing whether to modernize aging systems, the lesson isn’t that old equals safe. It’s that the security value of an old system depends entirely on whether it’s isolated, unsupported and quietly ignored, or exposed, unpatched and still connected to the wider internet. The former can genuinely buy time. The latter is exactly the kind of soft target that keeps showing up in breach reports year after year.
