In May 2017, the WannaCry ransomware attack affected approximately a third of NHS trusts in England. The attack exploited a vulnerability in Windows XP — a Microsoft operating system whose mainstream support had ended three years earlier. The government committed, in the aftermath, to eliminating reliance on unsupported software across the NHS estate.
Seven years later, NHS England’s own data shows that approximately 40% of NHS trusts still run clinical systems on software components that have reached end of life. The problem is structural, persistent, and inadequately funded.
Why Legacy Systems Are Dangerous
Software manufacturers issue security patches — updates that fix known vulnerabilities — as long as a product is in active support. When support ends, no more patches are issued. New vulnerabilities discovered after the end-of-support date will never be fixed by the manufacturer. Any system running unsupported software is permanently exposed to whatever vulnerabilities exist in that software, including vulnerabilities that are actively being exploited by ransomware groups.
NHS trusts typically run dozens of clinical applications, each with its own lifecycle. An electronic patient record system might run on a supported server operating system but include database components or third-party integration modules that are past end of life. A radiology system might depend on a proprietary image processing library for which the originating company no longer exists. Mapping these dependencies is technically complex; resolving them requires either patching (impossible for unsupported software), isolation (preventing the vulnerable system from communicating with the broader network), or replacement.
The Cost of Replacement
Replacing a legacy clinical system is not a technical exercise — it is a clinical change programme. Electronic patient record systems, in particular, require extensive configuration, data migration, workflow redesign, and staff training. A major EPR implementation for a large acute trust typically costs £30-60 million and takes two to four years. Done poorly, EPR implementations can cause significant clinical incidents; there have been documented cases of patient harm related to EPR migration errors.
NHS England’s published estimate for the cost of achieving full cyber resilience across the NHS estate — including legacy system replacement, network segmentation, and staff training — is approximately £3.9 billion over ten years. The annual cyber security budget of approximately £338 million funds ongoing operational security and incremental improvement, not the capital replacement programme needed to address legacy systems at scale.
The Isolation Fallback
Where replacement is not immediately feasible, NHS guidance recommends “isolating” legacy systems — separating them from the broader network so that a compromised legacy system cannot become a pathway into clinical systems. Network segmentation is a recognised security control; it does not fix the vulnerability in the legacy system but limits the blast radius if it is exploited.
NHS England’s cyber maturity assessments evaluate whether trusts have isolated their most critical legacy systems. The 2024 assessment found that 62% of trusts with significant legacy system exposure had implemented or were implementing appropriate isolation measures. The remaining 38% had legacy systems with insufficient isolation — meaning an attack on those systems could propagate across the trust’s network.
Why Two Decades of Commitments Have Failed
The WannaCry attack was not the first warning. NHS Digital had published reports on legacy system risk in 2013, 2015, and 2016. Post-WannaCry commitments were made at ministerial level in 2017, 2019, 2021, and 2023. Each commitment was accompanied by additional funding — incremental, and insufficient to address the structural backlog.
The core problem is that replacing clinical systems requires temporary disruption to clinical services — systems must be taken offline, staff must be retrained, workflows must change. In a health system operating under sustained pressure, clinical capacity to absorb that disruption is perpetually insufficient. Legacy system replacement is perpetually deferred in favour of maintaining throughput. The deferred investment compounds over time, increasing both the cost and the risk of the eventual replacement.
NHS England’s Chief Information Officer told Exposed News: “Cyber security and legacy system modernisation are top priorities. We are making significant progress and the proportion of systems running unsupported software has fallen substantially since 2017. There is more to do and we continue to invest, working with trusts to prioritise the highest-risk systems.”