October 27, 2026
By David Kirby, Vice President of Technology and Agentic AI Lead, DXC Technology
Every large organization has systems it can't afford to lose.
Such systems settle payments, check in passengers, pay benefits and underwrite policies, often operating on decades-old platforms that have remained reliable. That reliability has taught decision-makers to tread carefully: if a system never fails, leave well alone and patch cautiously. However, this practice is becoming a serious liability.
In a mid-2026 survey of 316 senior executives and risk managers, Gartner found that AI-enabled discovery of cyber vulnerabilities is the top emerging risk for organizations worldwide. Essentially, because machines can analyze legacy code more swiftly than any human team, “the systems nobody wants to touch” have become prime targets.
Replacing these systems wholesale is unrealistic. A more effective approach is to secure them in their current environments, integrate them with the wider business oversight and embrace legacy modernization services based on business risk priorities.
Three pressures are converging on the same systems:
1. Speed. Gartner warns that AI-driven discovery could outpace defenses unless remediation accelerates, recommending faster patching and automated fixes. And for platforms requiring weeks to test a single patch, that's a lot to live up to.
2. Rising cost of failure. In the Uptime Institute's 2026 outage analysis, 57% of respondents said their most recent major outage cost more than $100,000, with one in five citing costs north of $1 million. Uptime attributes much of this rise to more services relying on a single facility (core legacy platforms being a prime example).
3. Scrutiny. Regulators now expect proof that critical services can withstand disruption (as detailed in the EU's DORA/NIS2 rules, Australia's CPS 230 standard and others). Governments encounter similar challenges. The U.S. Government Accountability Office identified the 11 federal legacy systems most in need of modernization and found that agencies running eight of them lacked fully documented plans. In the UK, the Public Accounts Committee reported that by early 2025, 319 legacy systems had been identified across government, with a quarter rated as high risk.
Age alone rarely explains why these systems are exposed. The primary cause is fragmentation. Global enterprises often run mainframe, data center and cloud environments managed by separate teams, tools and suppliers, each with limited visibility. As a result, alerts on one platform might not be linked to related activity on another.
The UK provides a clear example. Its assurance scheme for critical government systems excluded legacy platforms because many recommended controls could not be applied. The most important assets sat outside the framework built to protect them.
The problem is compounded as specialists retire and mergers add new estates to existing ones. If fragmentation is the main challenge, unified visibility must be the first best practice for modernizing legacy systems.
A practical approach to modernize legacy systems without disrupting operation protects existing systems while creating room for phased legacy system modernization.
DXC's Hogan core banking platform processes more than $2.5 trillion in transactions every day across 300 million accounts. Its companion, CoreIgnite, lets banks connect with fintechs and launch digital products while the mainframe's security and performance stay intact.
The same thinking underpins DXC OASIS (launched April 2026). This single orchestration layer sits above the organization’s tools, so security and operations teams see mainframe, data center and cloud activity together. Powered by Claude, it's already in production with more than 50 customers.
Nordic insurer, If Skadeförsäkring, shows what this looks like in practice. After acquiring Danish insurer Topdanmark, the region's largest property and casualty insurer chose DXC to operate its mission-critical estate across Finland, Sweden, Denmark and the Baltics. DXC OASIS now helps unify thousands of compute resources across mainframe, data center and Microsoft Azure environments, strengthening governance, security and visibility as the two organizations join forces.
When systems are ready to evolve, AI shortens the journey. Through its alliance with Anthropic, DXC is using Claude to analyze and refactor legacy codebases at scale, reducing the time aging code is left exposed.
As attackers use AI to probe weaknesses, so defenders must use AI to find and fix them before serious disruption occurs.
DXC validated its find-and-fix response internally before presenting a solution to clients. By deploying Agentic SOC throughout its global security operations, DXC automated 99% of alerts, cut investigation time by 67.5% and saved 225,000 analyst hours.
Without accountability, speed counts for little in regulated industries. Consequently, DXC anchors its AI initiatives in DXC Xponential, a blueprint that builds governance, compliance and observability into every deployment. This ensures automated actions leave an audit trail accessible to boardrooms and regulators. In addition, tens of thousands of Claude-certified DXC engineers will be working within client environments, combining agentic speed with human insight.
For security leaders, that means quicker containment, fewer escalations and readily available evidence for auditors.
The gap between finding flaws and fixing them will keep growing unless leaders take deliberate action:
The systems nobody wants to touch are typically the ones customers and citizens rely on most. Securing these systems now protects revenue, reputation and trust, enabling organizations to modernize on their own terms, rather than in response to an attack.
David Kirby is Vice President of Technology and Agentic AI Lead at DXC Technology.
