Modern cybersecurity is evolving at an unprecedented pace, yet many organisations remain tethered to legacy IT systems – a risky proposition in today’s threat environment. 

While these older systems were once the backbone of innovation, they have become significant liabilities, vulnerable to increasingly sophisticated cyber-attacks. Essentially, legacy stacks are ill-equipped to handle modern threats, exposing organisations to breaches, ransomware, and data theft.

One of the most pressing concerns is the lack of ongoing support for legacy systems. As developers focus on newer technologies, critical patches and updates for older platforms become scarce, leaving known vulnerabilities unaddressed. 

Cyber-criminals exploit these weaknesses, often using legacy systems as entry points to compromise cloud-based data and infrastructure. High-profile incidents like the WannaCry ransomware attack of 2017, which targeted outdated versions of Windows, demonstrate the catastrophic risks tied to outdated IT stacks.

The challenges go beyond security vulnerabilities. Legacy systems often struggle to integrate with modern cybersecurity tools, leaving gaps in an organisation’s defense. 

Yet, despite the mounting risks, many businesses continue to rely on these systems due to cost concerns, compatibility with bespoke applications, or simple inertia. Upgrading requires significant investment—not just in new hardware and software, but also in training, integration, and operational downtime.

However, clinging to legacy technology is no longer sustainable. These systems are becoming digital time bombs, their vulnerabilities growing in tandem with the capabilities of cybercriminals. To protect against today’s threats, organisations must recognise the risks of legacy systems and take proactive steps to modernise. The stakes are clear: without decisive action, the vulnerabilities of the digital past could undermine the security of the digital future.

It’s on this uncertain horizon where Edinburgh-based Droplet offers a solution. At the heart of its philosophy lies the concept of ‘NeverTrust,” a stark contrast to the traditional credential-based access systems. 

In this interview with DIGIT, Barry Daniels, COO of Droplet, explains how the company is reshaping how organisational approach to security while tackling legacy stack challenges.

Rethinking Security for Legacy and Modern Systems

“Passwords, multifactor authentication, biometrics—these all still rely on identity-based credentials, and that’s inherently flawed,” says Daniels, as he challenges the prevailing approaches to cybersecurity. 

At the heart of Droplet’s philosophy is a departure from credential-based systems, which he sees as inherently vulnerable. Highlighting the RSA hack, Daniels explains how attackers “exploited the very algorithm meant to protect us,” proving that even the most robust credential systems can crumble under sophisticated attacks.

So how does Droplet differ?

When installed, Droplet creates a portable container that isolates applications from the underlying device’s operating system, ensuring secure migration of legacy applications to modern systems. 

Compatible with Windows, MacOS, ChromeOS, Linux, and any cloud platform, Droplet solves the challenges posed by unsupported software while helping organisations meet cyber accreditation standards like Cyber Essentials Plus and NIS2. 

It features an isolation layer that securely migrates older apps like Internet Explorer and Java-based software to newer operating systems, including Windows 11. Additionally, Droplet encrypts all traffic between clients and servers, preventing potential cyber-threats such as man-in-the-middle attacks, zero-day vulnerabilities, and ransomware. The NeverTrust network overlay blocks all inbound traffic and ports by default, ensuring that only authorised traffic is allowed within the Droplet boundary. 

“Droplet is a container technology, it’s our own ones and zeros, not rebadged Docker or Kubernetes,” says Daniels. 

“Droplet has been built with security focus in mind to deliver applications in the most secure way. We never trust anything and therefore we’re more focused on how you segregate, how you micro segment, how do you protect and control environments to an nth degree where you can take away the risk of the human layer, on the seven point OSI model.”

Droplet’s Never Trust approach rejects traditional zero trust’s reliance on identity verification and instead focuses on isolating applications and systems entirely. 

He says: “The difference with Droplet and what I want to see more of is that adoption, where you can run any workload that’s X86 or X64 bit in a Droplet container, but we’ve closed all the doors, we’ve not opened up those doors, we’ve not gone there. You go integrate with us.”

Bridging the Gap for Legacy Systems and Simplifying Compliance

For industries reliant on legacy infrastructure, security often feels like a losing battle. Daniels points out the challenges: “These systems outlive the software that’s supposed to support them. Replacing them isn’t always an option. It’s a culture of legacy, and it’s not going away.” 

Container-based technology allows organisations to safeguard these outdated systems without overhauling their entire setup, offering a solution that’s both cost-effective and scalable.

The challenge isn’t limited to legacy systems. BYOD (Bring Your Own Device) policies have introduced new vulnerabilities, particularly in hybrid work environments. 

Daniels’ take? 

When you just look at problems like BYOD, legacy stack and hybrid working security problems, it’s not going to go away – “it’s very nice and easy to say, well, just modernise, just constantly be able to refactor, repackage, make sure it’s modern, make sure it’s patched, make sure it’s up to date.

“You can’t always patch it. You can’t always update it, it’s not practical. It’s not commercially viable, let alone anything else.”

Simplifying Compliance and Future-Proofing Infrastructure

In an era of increasing regulatory pressure, Daniels sees compliance as both a necessity and an opportunity.

“Regulation is essential. What I have a problem with is the enforcement of regulation. It seems that too many organisations seem to get away with sweeping and just ignoring the security challenge that it brings. 

“I’ve heard horror stories over the years of people unplugging or taking things off the network on Audit day because they don’t want to discover what it does. 

“I think we’ve come up with a very individual tool, a very unique way of future-proofing technology to last for the life cycle of devices to never trust anything in THE way that you lock it down.

Daniels laments that a lot of SaaS route – warning that it’s essentially a means of kicking the regulatory can down the road

On this, he says: “You can say that you need to be at a certain regulatory standard but for me, it comes back to where’s the governance model around that? 

“Is that a safe way to look at it? Lots of the more security-centric organisations still keep things like meeting regulation and compliance in-house as opposed to relying on SaaS services, as this can often reduce compliance to a dangerous tick-box exercise, in my opinion.”

Dovetailing from compliance and regulation to future-proofing brings us full-circle to another pillar of Droplet’s approach. By decoupling software from hardware, their containerisation model extends the life of critical applications. “We’ve seen organisations reduce their infrastructure footprint significantly by using Droplet  – 300 servers down to 60 in one case. That’s not just about cost savings; it’s about sustainability and efficiency,” Daniels explains.

Recommended reading

• UK Cybersecurity Budgets Set to Surge Over 30% in 2025
• Half of Cybersecurity Professionals Expect to Burnout Within the Next Year
• Cyber Leaders Reveal Compliance and Boardroom Struggles

Daniels underscores the environmental benefits, too: “Every server we eliminate is one less piece of hardware consuming power, generating heat, and eventually ending up as e-waste. Security and sustainability can go hand in hand.”

Legacy IT systems present a persistent problem – with the rate of technology refresh and reliance on tech stacks that many organisations have divorced themselves from in their day-to-day as they simply don’t know what they do – or more frighteningly, what will happen if they turn them off. 

While they remain critical for many organisations, these systems often lack the resilience to withstand modern cyber-threats, leaving gaps in security and compliance. The reliance on outdated infrastructure can expose organisations to risks like ransomware, data breaches, and operational disruptions. 

Moreover, the scarcity of updates and support for legacy systems amplifies these vulnerabilities, complicating efforts to integrate them with modern cybersecurity frameworks.

Container-based technologies are emerging as a practical solution to bridge this divide, offering a way to secure legacy applications without requiring a complete overhaul. 

By isolating applications from underlying systems, these approaches can enhance security, simplify compliance with frameworks like Cyber Essentials Plus, NIS2 and DORA, and extend the utility of legacy infrastructure. 

Moving forward, organisations must balance modernisation with maintaining continuity, adopting solutions that address security gaps while ensuring compatibility with evolving regulatory demands.