A national shipping and logistics operator runs a mix of decades-old operational systems alongside modern IT. It's the kind of estate where the two have never been assessed against each other from a risk perspective, simply because nobody had reason to until now.
Legacy systems that keep vessels and cargo moving were rarely built with modern security controls in mind, and they cannot simply be replaced: downtime is not an option in an environment where a stalled system has consequences well beyond IT. The client needed to know where the real exposure sat, in terms a board could act on, not a technical vulnerability list nobody could prioritise.
We mapped the legacy estate against the systems and data flows it actually touches, separating what carries real risk from what is simply old but harmless. That distinction did most of the work: in an environment like this, treating every legacy system as equally dangerous is as unhelpful as treating none of them as dangerous at all.
The output was a risk register in business language with a named owner for each item, a remediation roadmap sequenced by exposure rather than by ease, a resilience validation exercise to test whether the plan would actually hold under pressure, and a board-ready assurance summary translating the technical picture into decisions leadership could make.
As with any engagement of this kind, the real measure of success is what happens after the report. Remediation against the roadmap is ongoing, and a further resilience exercise is scheduled once the highest-priority items are closed. What changed immediately was that the exposure stopped being invisible to the people who had to decide what to fund.
The same blind spot exists anywhere legacy and modern systems sit side by side without ever having been assessed together. Shipping and logistics is simply where we have seen it most clearly.