The cost of not modernising
Aug 28th, 2024 by Jesper Kråkhede
My previous post was about VPN vulnerabilities. Here is the business side: what it costs not to modernise.
Old remote access looks cheap. It is already paid for, it works and the team knows it. Replacing it is a project with a cost, a risk and a lot of work.
But look at what keeping it costs. Emergency patching several times a year, often outside working hours. Investigations every time a new vulnerability is published, to find out if you were hit before you patched. Hardware and support contracts that keep going up. Capacity problems when everyone works from home at once. And the risk: in many of the big incidents of the last years, the old remote access was the way in.
Modern alternatives are not free either. But they move the cost from emergency work to planned work, they reduce the number of systems exposed to the internet and they often come as part of platforms you already pay for.
So for management: Compare the full cost of the old solution, including the emergencies and the risk, with the cost of the new. Not just the licence. Most organisations that do the full calculation find that modernising is cheaper over three years.
And don´t wait for the incident to make the decision for you. It will be a lot more expensive then.
Standing still isn´t free. It just sends the bill later.