Written by: Bradley Butler, Cyber Security Advisory and GRC Principal, Mantel
Key takeaways for business leaders:
- The first step is always visibility. As with any security program, you can’t protect what you don’t know you have, and you can’t prioritise what you don’t understand.
- Identification isn’t the hard part. Most organisations have been cataloguing legacy technology for years. The gap lies in understanding the context and risk of that technology and how it intersects with threats posed by frontier AI.
- Risk sits in the context, not the inventory. That means understanding what a legacy technology system does, how sensitive or critical it is, what controls are in place, and what happens if it’s retired.
- Modern tooling enables, but doesn’t replace, human judgement. Attack surface management (ASM) platforms like Wiz can surface exploitable vulnerabilities and exposure. The deeper work of understanding business purpose, dependencies, and operational necessity requires cross-functional collaboration.
- This discipline shouldn’t be limited to government. Private sector organisations managing critical or sensitive systems face the same kinds of legacy technology risks and should adopt the same rigour, regardless of regulatory mandate.
What is PSPF Direction 002-2026?
PSPF Direction 002-2026, Strengthening Commonwealth Cyber Posture Against AI-Enabled Risks, is a formal directive issued by the Secretary of the Department of Home Affairs under the Protective Security Policy Framework on 29 September 2026. It requires all non-corporate Commonwealth entities to conduct a Legacy Technology Stocktake by 31 March 2027 and develop a Legacy Technology Risk Management Plan, built into their cyber security strategy, that includes reduction targets, prioritisation strategies, documented mitigations for systems that must remain in operation, and procedures to rationalise the technology estate. Entities operating Systems of Government Significance face an earlier deadline of 31 December 2026 to apply additional risk reduction measures and report on the stocktake of those systems.
Legacy technology risk has been a known problem for decades
The Direction positions frontier AI capabilities as the cause of urgency around legacy technology. The Direction warns that “Frontier AI capabilities have targeted the Commonwealth’s technology estate,” implying this is a new threat vector.
The threats targeting legacy technology have always existed. Unsupported, unpatched systems with vulnerable code have been targets for attackers for decades. What has changed is the capability of those threats. Frontier AI has significantly increased the speed, scale, and sophistication with which vulnerabilities can be identified and exploited. The underlying risk was already unacceptable. AI has amplified it.
The Direction shouldn’t need to hide behind the AI label to justify action on legacy technology. The risk was unacceptable before frontier AI arrived.
The real value is in the context
”Organisations often have comprehensive asset registers and know which systems are end-of-life. What they lack is insight into the context and risk of their legacy technology and, critically, how these systems intersect with the threats posed by frontier AI.
Bradley ButlerCyber Security Advisory and GRC Principal, Mantel
The first step is always to inventory and classify your assets. Most organisations have been conducting assessments of their technology estate for years. The infrastructure audits, the asset registers, the “systems of concern” spreadsheets: they already exist. Many government agencies can tell you which systems are end-of-life, unsupported, and ageing.
What I’ve seen across clients recently is a gap in understanding. Organisations often lack insight into the context and risk of their legacy technology and how these systems intersect with the threats posed by frontier AI.
The critical elements of the Direction sit in requirement 2, the Legacy Technology Risk Management Plan requirements. Subsections (a) to (d) are where the real work happens: defining reduction targets commensurate with risk tolerance and appetite, developing prioritisation strategies, documenting mitigations for systems that must continue operating, and identifying areas to rationalise the technology estate.
The Legacy Technology Risk Management Plan requires something far harder: organisations must develop context around each legacy technology system.
- What does it do?
- What risk does it pose?
- How sensitive or critical is it to operations?
- What controls are currently in place?
- What would be the impact of retiring it?
Through our partnership with Wiz, Mantel can help organisations use ASM capabilities to identify and analyse legacy technology, surfacing exploitable vulnerabilities and exposure across the estate. But tooling is only the enabler. Understanding the system’s business purpose, its dependencies, and its operational necessity requires human rigour and cross-functional collaboration.
Organisations that treat the stocktake as the deliverable will file a list and move on. Organisations that invest in understanding the context of their legacy technology will make defensible decisions about which to retire, which to mitigate, and which to accept as necessary operational risk.
”The Direction doesn’t mandate perfection; it mandates clarity. Some legacy technology will remain. That’s acceptable, provided the risk is understood, the mitigations are documented, and the decision is defensible. What’s unacceptable is pretending the risk doesn’t exist.
Bradley ButlerCyber Security Advisory and GRC Principal, Mantel
Understanding exposure: Recent PHP vulnerabilities
Recent security alerts, such as the critical vulnerabilities disclosed in PHP (a general-purpose scripting language), highlight why organisations need visibility across every layer of their technology stack. PHP underpins a broad range of web applications and legacy systems, so widely deployed or unpatched instances are an attractive target for automated exploitation.
The Australian Cyber Security Centre (ACSC) advisory assumes, as a first step, that organisations already have a complete inventory of their systems. It also makes clear that an inventory is only effective when paired with an understanding of component dependencies. Knowing whether PHP, or any other core runtime, exists within active, legacy or third-party web environments allows security teams to assess risk accurately and prioritise remediation before vulnerabilities are weaponised.
The governance question extends beyond government
The Direction applies only to non-corporate Commonwealth entities. There’s an implicit assumption that corporate Commonwealth entities and private sector organisations have the luxury of ignoring this problem.
They don’t.
Private sector organisations, from critical infrastructure operators and large enterprises to small service providers, are contending with the same kinds of legacy technology risks. They face the same tension between operational continuity and security posture, and the same shortage of skilled remediation resources. Building the business case for technology investment and refresh cycles is just as hard.
If legacy technology risk warrants a formal Direction for government agencies, it warrants the same discipline across the private sector. A Direction can’t be issued to private entities, but the practice it mandates (systematic identification, risk-based prioritisation, and documented plans) should be standard across all organisations managing critical or sensitive systems.
Suggested next steps
- Reassess your risk appetite. The amplified threat from frontier AI means risk tolerances set even 12 months ago may no longer be fit for purpose. Ensure your risk appetite reflects the current threat landscape.
- Categorise legacy technology by sensitivity and criticality. Not all legacy technology carries equal risk. Focus effort where it matters most: systems handling sensitive data or underpinning critical operations.
- Decide to reduce or mitigate. For each legacy technology system, determine whether it can be retired or whether documented mitigations are required.
How Mantel can help
Through our partnership with Wiz, Mantel can help you identify and analyse Legacy Technology across your environment and build the contextual understanding required to make defensible decisions. We also offer Agentic AI threat analysis – using our specific knowledge of Agentic AI capabilities to analyse the potential threats to your Legacy Technology. This helps organisations understand how AI-enabled attackers might target their specific vulnerabilities and what the consequences would be.
Across the Legacy Technology lifecycle, we can support your organisation to:
- Assess posture: understand your current state and risk exposure.
- Remediate vulnerabilities: address identified risks through targeted remediation.
- Manage security operations: provide ongoing monitoring and response.
Contact us to discuss your organisation’s needs.
