True or false: Companies should replace their legacy security technologies immediately.

• A. True
• B. False
• C. Sometimes
• D. Never

Answer: (B)

Security program modernization is best handled through a risk-based, phased approach rather than immediate replacement of every legacy security technology. Replacing everything right away is rarely practical because legacy systems often support critical business processes, and sudden upgrades can cause downtime, compatibility issues, and budgeting problems. The smart move is to assess each legacy component for risk, end-of-life status, and exposure to known vulnerabilities, then prioritize and plan upgrades accordingly. While some items may require rapid action if they are no longer supported or pose an unacceptable risk, most modernization happens over a staged timeline with a clear roadmap. In the meantime, strengthen defenses around legacy systems using compensating controls—such as network segmentation, stricter access controls, enhanced monitoring, patch management where possible, and controlled data flows—to reduce risk during the transition. This approach aligns security improvements with business needs and resource constraints rather than forcing immediate replacement.