Somewhere in your plant there is a Windows XP or Windows 7 machine that nobody wants to touch. It runs an HMI, a historian client, a PLC programming station, a lab instrument or a CNC controller, and it has been doing the same job since before the current plant manager arrived. Everyone knows it should be retired. Everyone also knows what happens to the line if it stops.

Microsoft stopped patching XP in April 2014 and Windows 7 in January 2020. The paid Extended Security Updates (ESU) for Windows 7 ran out in January 2023. None of that made these machines disappear. What has changed in the last twelve months is the size of the problem around them: Windows 10 is now out of mainstream support, more Windows editions hit their end dates this month, regulators are writing end-of-support language into binding rules, and ransomware crews are hitting industrial companies at record volume.

This guide is written for CISOs, OT security leads and plant engineering managers who have already heard “just upgrade” and know why it is not that simple. It covers what is new in 2026, how legacy Windows actually gets exploited in plants, and a practical set of controls you can deploy without touching the control logic or stopping production.

Key takeaways

• Legacy Windows is not a fringe issue. In a 2026 survey of 550 European OT decision-makers, six in ten said legacy Windows makes up at least half of their OT environment, and 51% had an incident involving it in the past 12 months (up from 43% a year earlier). This is a vendor-run survey, so read it as directional.

• The “legacy” population is growing. Windows 10 reached end of support on October 14, 2025, and on October 13, 2026 Windows 10 Enterprise LTSB 2016, Windows 10 IoT Enterprise LTSB 2016 and the final ESU year for Windows Server 2012/2012 R2 all hit their limits.

• You cannot patch your way out, but you can contain, restrict and monitor your way to an acceptable risk. The goal is a documented set of compensating controls, not a perfect operating system.

• The most effective single investments are usually boring ones: accurate inventory, tight segmentation, locked-down remote access, application allowlisting and tested recovery images.

• Auditors, insurers and regulators increasingly ask for evidence of these controls. “We know, and it is on the roadmap” is no longer enough.

Why these machines are still running (and why that is rational)

It is easy to blame neglect. In most plants it is a rational response to constraints. The same 2026 survey lists the top barriers to replacement: compatibility with legacy equipment (54%), cost (38%, down from 45% in 2025), downtime risk (35%) and lack of vendor support for newer systems (21%).

In practice that looks like this:

• Certified software stacks. The SCADA or HMI vendor certified one OS build. Changing it voids support, and in regulated sectors (pharma, food, medical devices) it can trigger revalidation.

• Drivers and hardware. A 20-year-old PCI card or serial interface for a drive controller has no driver for anything newer. Modern industrial PCs often no longer ship XP or even Windows 7 drivers.

• Machine lifecycles. A packaging line or turbine controller is bought for 25 years. The PC inside was a minor line item in 2005.

• No maintenance window. Some processes run continuously for months. Others have one shutdown a year, and the backlog is long.

So the honest framing is not “why haven’t you upgraded?” but “how do we make the risk of staying acceptable while the replacement plan matures?”

The latest developments (as of October 28, 2026)

1. Windows 10 joined the unsupported club

Windows 10 22H2 support ended on October 14, 2025. Microsoft then offered a paid ESU program for businesses at $61 per device in year one, doubling to $122 in year two and $244 in year three, with the commercial program running up to October 10, 2028. Coverage is cumulative: if you start in year two you pay for year one as well. Consumer ESU was extended to October 12, 2027. For a plant with a few hundred Windows 10 HMIs, that curve gets expensive quickly, and ESU is a bridge, not a destination.

2. October 13, 2026 was a busy day for end-of-support dates

Two weeks ago, Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise LTSB 2016 reached end of support, with paid ESU offered for up to three more years. The third and final ESU year for Windows Server 2012 and 2012 R2 also ended that day, and reporting indicates there is no fourth year to buy. Windows Server 2016 follows on January 12, 2027. If you run historians, OPC servers, domain controllers or batch servers on 2012 R2 or 2016, these dates matter more than the desktop ones. Check the exact ESU terms for your SKU with Microsoft or your OEM, because IoT licensing has had its own pricing track.

3. CISA put end-of-support equipment on a deadline clock

On February 5, 2026, CISA issued Binding Operational Directive 26-02, which requires US federal civilian agencies to inventory and replace end-of-support edge devices: a report due May 5, 2026, decommissioning of listed devices by February 2027 and replacement of the remainder by August 2027. CISA also encouraged adoption of the OpenEoX standard so vendors can publish end-of-support dates in a machine-readable form.

Be precise about scope: the directive covers federal agencies and edge devices, not your plant HMIs. But it is a signal. When the lead US cyber agency tells government to treat unsupported technology as an unacceptable risk, contract clauses, insurer questionnaires and sector regulators tend to follow.

4. Threat activity against industrial organizations keeps rising

2026 OT/ICS Cybersecurity Report (published February 17, 2026) counted about 3,300 industrial organizations hit by ransomware in 2025, by 119 groups, up from 80 the year before, with manufacturing accounting for more than two-thirds of victims. It also described adversaries moving beyond pre-positioning to mapping control loops, meaning they are learning how to influence physical processes. A third-party tally built on Dragos’s quarterly data puts industrial ransomware incidents in the first half of 2026 at roughly 2,160, about 58% above the same period a year earlier.

One nuance is worth a CISO’s attention. Dragos observed no ransomware operator manipulating a control system in Q2 2026. Plants stop because the servers, hypervisors and business systems they depend on go down. Legacy Windows therefore matters in two ways: as a foothold for attackers, and as a fragile dependency that cannot be quickly rebuilt when the surrounding IT estate is encrypted.

5. The 2026 legacy OT survey: incidents up, endpoint tools down

Networks’ 2026 survey of 550 senior decision-makers across France, Germany, Italy, Poland, Sweden and the UK found incident rates of 72% in Sweden, 68% in Poland and 64% in the UK, and 70% in both food and beverage and semiconductor manufacturing. The leading concerns were malware (56%), unauthorized access (38%), ransomware (37%) and lack of patching (33%). Two details stand out. Use of endpoint protection fell from 51% to 39%, likely because conventional IT agents can conflict with OT applications. And 55% now believe protecting legacy systems costs less than replacing them. The conclusion is not that replacement is wrong, but that protection is becoming the accepted bridge.

6. October 11–12: the French supermarket refrigeration attacks

Overnight on October 11 to 12, 2026, attackers remotely hit refrigeration controllers at hundreds of French supermarkets, forcing defrost cycles that spoiled food and, in some stores, started fires. Reports named Danfoss controllers first, with a second wave the following night affecting Dixell equipment from Copeland. French officials called it unprecedented, and the entry method had not been publicly confirmed at the time of writing. Greece’s national cybersecurity authority reported on October 14 that it had found more than 300 internet-exposed systems in its own country.

This is not, as far as public reporting shows, a Windows XP story. It is relevant anyway, because it shows how quickly an attacker moves when remotely reachable control equipment is found, and how a single OEM remote-management path can become a multi-site incident.

How legacy Windows actually gets exploited in a plant

Generic “XP is insecure” advice does not help a CISO prioritize. These are the realistic attack paths, roughly in order of how often they appear in OT incident work.

1. Pivot from IT. SANS research cited by ESET suggests close to 60% of OT attacks are believed to originate in corporate IT. Attackers land on an office laptop, steal credentials, and move toward anything reachable, including a legacy Windows box that accepts SMB or RDP from the business network.

2. Wormable network bugs that will never be fixed. EternalBlue (the SMBv1 flaw behind WannaCry in May 2017) and BlueKeep (RDP, CVE-2019-0708) showed how a flat network turns one unpatched Windows machine into hundreds. XP and Windows 7 will not receive fixes for the next one.

3. Vendor laptops and USB media. Engineering laptops and portable drives cross zones constantly. One infected laptop plugged into a flat OT switch bypasses every perimeter control.

4. Remote access. Vendor VPNs, always-on remote desktop tools and shared credentials are still the most common route from the internet to a control network.

5. Domain-joined legacy hosts. An unpatched machine joined to the corporate Active Directory is a stepping stone for credential theft and lateral movement.

6. Unsupported applications on top of the OS. Old browsers, Office, Java, PDF readers and runtime libraries have their own unpatched flaws, and many run on the same HMI.

Rule of thumb: treat every unsupported Windows machine as already compromised from the network’s point of view. Design controls so that if it were infected tomorrow, the damage stays inside one small zone.

A practical defense playbook for Windows 7 and XP in OT

The controls below are ordered by return on effort. Most can be done without modifying the legacy host or the control application.

Step 1: Build a real inventory

You cannot protect what you cannot see. For every legacy host record: OS and service pack, role, process or line it supports, vendor and support status, network connections (who talks to it, on which ports), installed software, removable media use, remote access paths and who owns the risk. Passive network discovery is preferable on fragile devices, because active scanning has been known to crash old controllers and embedded stacks. Tag each asset with a criticality rating tied to safety, production and regulatory impact.

Step 2: Isolate with zones and conduits

Follow the IEC 62443 model: group assets into zones by function and risk, and control every path between them through defined conduits.

• Place legacy hosts in their own zone, behind an industrial firewall or next-generation OT firewall, not just a VLAN on a shared switch.

• Write allow-lists by IP, port and protocol. Default deny both ways.

• Block direct internet access completely, including for update services and telemetry.

• Where data only needs to leave the zone (historian feeds, reporting), use one-way gateways or data diodes so nothing can come back in.

• Remove legacy hosts from the corporate domain. Use local accounts with unique, vaulted passwords instead.

Step 3: Shrink the attack surface on the host itself

You may not be able to patch, but you can usually disable.

• Disable SMBv1 where the application allows it, and block SMB (TCP 445) and NetBIOS at the zone boundary where it does not.

• Turn off RDP, Telnet, FTP, remote registry and any service the application does not need. Test changes against the vendor’s documented configuration.

• Lock USB ports physically or by policy, and route all media through a scanning kiosk.

• Remove or isolate browsers, mail clients and Office from HMIs. Operators should not browse from a control screen.

• Apply the last available cumulative updates, and harden local security policy, auditing and account lockout.

Step 4: Use application allowlisting instead of traditional antivirus

Signature-based antivirus on XP and Windows 7 is increasingly unsupported, heavy on old hardware, and can interfere with real-time control applications. Application allowlisting (default-deny for executables) is a better fit for fixed-function machines because the software set rarely changes. Choose tools that officially support the legacy OS, run offline, and have low overhead. The 2026 survey’s drop in endpoint protection adoption suggests many plants tried IT-style agents, hit conflicts, and backed off. A tested, OT-aware allowlisting tool avoids that trap.

Step 5: Lock down remote and third-party access

• Replace always-on vendor VPNs with time-limited, approved sessions through a jump host or secure remote access gateway.

• Require multi-factor authentication, session recording and per-vendor accounts.

• Never allow direct inbound connections to a legacy host. Brokered sessions only.

• Review OEM remote-management features, including cloud-connected ones. The French refrigeration incident is a reminder that vendor-managed controllers deserve the same scrutiny as your own servers.

Step 6: Add virtual patching and passive monitoring

When you cannot patch the host, you can sometimes block the exploit on the wire. Industrial intrusion prevention systems can apply virtual patches that drop known exploit traffic for unpatched Windows flaws before it reaches the machine, and deep-packet inspection of industrial protocols can flag unexpected writes, new talkers and out-of-hours changes. Pair this with passive OT network monitoring so you have a baseline of normal behavior. Deploy inline devices with hardware bypass so a failure cannot stop production.

Some third-party “micropatch” services also cover certain end-of-life Windows versions. They can be a useful supplement, but confirm with your ICS vendor first, since unapproved changes to a certified host can affect support.

Step 7: Make recovery boring

If you can restore a legacy HMI in 30 minutes, ransomware becomes an inconvenience. If you cannot, it is a shutdown.

• Keep verified, offline, offsite full-disk images of every legacy host, plus configuration and project files.

• Test restores on spare hardware quarterly, and record the time it takes.

• Hold spare hardware. Legacy-compatible industrial PCs are getting harder to source, so buy spares before you need them.

• Where licensing allows, convert physical machines to virtual machines on a hardened hypervisor. This helps with snapshots and hardware independence, but the guest OS is still unsupported, so the other controls still apply.

Step 8: Control change and keep a risk register

Record each legacy host in a risk register with the compensating controls, the owner, the review date and the replacement trigger. Define who can approve exceptions. This document is what an auditor, insurer or board member will ask for.

Step 9: Fund a replacement path anyway

Compensating controls reduce risk; they do not remove it. Use each planned outage to retire one machine, ask OEMs for supported upgrade paths, and specify supported operating systems in every new purchase order. Windows 10 IoT Enterprise LTSC 2021 and Windows 11 IoT Enterprise LTSC 2024 have long support windows, which makes them realistic targets for new builds.

Choosing the right treatment for each machine

Not every legacy host deserves the same response. A simple decision table keeps the conversation with plant management grounded.

A 30-60-90 day plan

First 30 days: see and stop the worst exposure.

• Build the legacy asset list using passive discovery and plant walk-downs.

• Block internet access and inbound SMB/RDP from corporate networks to legacy zones.

• Disable or restrict unnecessary services, and lock USB where possible.

• Take verified images of the top ten critical machines.

Days 31 to 60: contain.

• Introduce zone firewalls and allow-lists in front of the critical legacy zones.

• Move vendor access to a brokered, MFA-protected path.

• Pilot application allowlisting on one non-critical legacy host.

• Start passive monitoring and baseline normal traffic.

Days 61 to 90: prove and plan.

• Complete the risk register with owners and compensating controls.

• Run a restore drill and measure recovery time.

• Add virtual patching on the highest-risk segments.

• Agree a replacement roadmap tied to outage windows and budget.

Mapping to standards and regulations

• IEC 62443. The framework’s zone and conduit model and its patch management guidance for industrial automation systems (IEC 62443-2-3) accept that patching may not be possible, provided the risk is assessed and compensating measures are documented.

• NIST SP 800-82 Rev. 3. Provides guidance on patching in industrial control systems and on using compensating controls when patching is not feasible.

• NIS2 (EU). Article 21 requires risk-management measures that include vulnerability handling and basic cyber hygiene for essential and important entities.

• NERC CIP (North American bulk electric system). Includes patch management requirements, with mitigation plans permitted where a patch is unavailable.

• Cyber insurance. Questionnaires increasingly ask directly about end-of-life operating systems, segmentation and remote access controls.

The common thread is documentation: regulators and insurers rarely demand zero legacy systems, but they do expect a justified, evidenced plan.

Common mistakes to avoid

• Treating a VLAN as a security boundary. Without enforced rules, it is just a label.

• Installing a standard IT endpoint agent on a fragile host without vendor approval, then rolling it back after a stoppage.

• Active scanning production devices without testing.

• Assuming “air-gapped” means safe. Removable media, laptops and forgotten modems have defeated many air gaps.

• Leaving the one known workaround password unchanged because the vendor’s manual says so.

• Buying protection without a recovery plan. Prevention fails sometimes; restore capability decides the outcome.

Frequently asked questions

Is it safe to run Windows 7 or XP in an industrial plant in 2026? 

Not on its own. Both are unsupported and will not receive security fixes. They can be run at an acceptable level of risk only when isolated, restricted, monitored and backed up, with a documented replacement plan.

Can I still get security updates for Windows 7? 

Microsoft’s paid Windows 7 ESU ended in January 2023, and XP support ended in 2014. Some third-party micropatch services cover specific vulnerabilities, but they are supplementary and should be cleared with your ICS vendor.

Is Windows 10 now a legacy system too? 

Yes, for standard editions. Support ended on October 14, 2025. Organizations can buy ESU for up to three years, at rising cost, and long-term servicing editions have their own dates.

Does antivirus work on Windows XP and 7? 

Some vendors still support these systems, but protection is limited and performance impact can be a concern. Application allowlisting combined with network-level controls is generally a better fit for fixed-function OT machines.

What is virtual patching? 

Blocking exploit traffic at a network device so a vulnerable host never sees it, instead of fixing the flaw on the host. It is one of the few ways to protect machines that cannot be updated.

Should we replace everything immediately? 

Usually not. A staged approach works better: contain first, then retire machines as outage windows, budgets and OEM upgrade paths allow.

How Shieldworkz can help

Shieldworkz is an end-to-end industrial OT cybersecurity company covering SCADA, OT and IoT environments, with services, platform and solutions delivered as one bundle. For legacy Windows estates, that typically means a passive asset and risk assessment, a zone and conduit design aligned with IEC 62443, secure remote access, monitoring and detection, and incident response and recovery planning, all designed to avoid changes to your running control systems.

If you want a second opinion on where your unsupported machines sit and which controls would reduce risk fastest, talk to our team about a legacy Windows risk assessment. Book a meeting with our OT Security experts now!