Seven-year-old technology is worthless, says Palo Alto. On a factory floor, seven years is not old.

On 1 September 2026 Nikesh Arora said something on CNBC that will stay lodged in board meetings: nothing deployed seven or ten years ago is prepared to fend off attacks at machine speed.

On the earnings call he put a number on the gap. Around one trillion dollars of security debt worldwide that needs modernising. Alongside it he sets the five trillion dollars due to flow into data centres and AI capability over the next five years. Anyone investing that much, runs his argument, must be assuming AI will create considerable value inside the enterprise.

I find the number plausible. I find the conclusion dangerous if you carry it unfiltered into a manufacturing company.

Where Arora is right

The core of his argument holds. Attackers use the same models as defenders. What used to take days, finding vulnerabilities, writing exploits, searching through systems, now runs in minutes. A security architecture built around human reaction time arrives too late.

What is remarkable is the reversal behind it. Less than a year ago the security industry was treated on the stock market as a loser of the AI wave, because capable models would supposedly make classic security software redundant. Now the opposite holds. AI is the reason everybody has to upgrade.

Anyone who looks at the entire world market, as Arora does, sees data centres, cloud infrastructure, corporate networks. There, infrastructure is renewed every three to five years. There, seven years really is old, and there his statement is probably correct.

In production, seven years is young.

Legacy is not a failure, it is the normal state

I have spent close to seven years on security in operational technology, first selling endpoint and OT security, since then responsible for solutions that also have to run in production. What I learned there contradicts the reflex from IT at a fundamental level.

A plant is costed over fifteen, twenty, sometimes thirty years. The controller inside it belongs to the machine, not to IT. It was supplied by the machine builder, approved by the machine builder, and any change to it, including an operating-system update, can cost that approval. Add to that round-the-clock operation with no maintenance window, warranty conditions that rule changes out, and safety sign-offs after which nothing on the system may be touched.

The result is a landscape in which controllers from the nineties run next to systems from last year. Visualisations on Windows 7. Labelling machines with a proprietary operating system from 2005 whose manufacturer no longer exists. Warehouse management as an in-house development from twenty years ago, reachable only through a terminal.

That is not negligence. Given enough time, every new system becomes a legacy system. Anyone who treats that as a failure has not understood production.

Controlled ageing instead of replacement

The alternative to “rip it all out” has a name in OT security: controlled ageing. The idea is simple and demanding to implement.

Every system passes through lifecycle phases. Active, as long as the manufacturer supports it. Phasing out, once a successor exists and an end date is fixed. Discontinued, when support and sales end. And eventually retired, when spare parts are no longer available either. Each phase calls for different sensible measures, and in none of them is the answer automatically replacement.

For that to work you first need knowledge. Which systems exist at all, which phase are they in, what software level are they on, and above all: how critical are they to the process. A controller running a secondary unit is a different matter from the one the whole line depends on.

Only with that knowledge can you decide system by system. Replace, where it is economical and criticality demands it. Migrate, where a successor exists. Or secure differently, where neither is possible, with a layered concept that leaves the machine itself untouched.

And because plants change over decades, you need a process that records every change. Not as bureaucracy, but as memory. If you do not know what was changed on a controller three years ago, you cannot judge whether it is still safe today.

None of this needs a trillion. It needs somebody who knows the plants and is given the time to record them.

The real obstacle is not technical

Here comes the part I know from sales and that appears in no security debate.

The success of OT security is invisible. The plant runs. It ran before, too. Somebody who has spent a year recording, assessing and securing legacy systems ends up with exactly what they started with: a running production line. To the management board that looks like money that changed nothing.

That is why OT security projects rarely fail on technology. They fail because nobody can explain what the budget was actually for. And they fail because availability is treated as the normal state rather than as an achievement.

Over the years I have watched IT managers and production heads walk into the management board with a good concept and come back with half a budget. Not because the concept was bad. Because it was presented in the language of technology rather than in the language of risk.

What works is the opposite of Arora’s number. Not the trillion everybody has to pay. The specific plant, the specific line, the specific day of downtime and what it costs. Anyone who can say that a stoppage on this line means two hundred thousand euros a day, and that securing the controller costs a fraction of that, gets budget. Anyone who talks about attacks at machine speed gets an appointment in three months.

What NIS2 makes of it

The German NIS2 implementation act has been in force since 6 December 2025, with no transition period, and many mid-sized manufacturers fall under it without knowing. It does not demand wholesale replacement. It demands risk management that reflects the state of the art and chooses measures proportionate to the risk.

That is precisely the logic of controlled ageing. Anyone who knows their plants, has documented their lifecycle phase and their criticality, and can justify per system why a given measure was chosen, meets the spirit of the regulation considerably better than somebody who buys new technology and leaves the old controller running undocumented.

What this means for sales

Anyone selling security to manufacturing companies faces a constellation that does not exist in classic IT. Four things I have learned.

First, the buyer does not sit where you would assume. The CIO holds the budget for the office world. Production is decided by the head of production, and they measure in hours of downtime, not in vulnerabilities. Talk only to IT and you are selling to somebody who has no authority over the line.

Second, “rip it all out” is the end of the conversation. The head of production knows their plant has another twelve years in it. They know what a replacement costs, and they know nobody will pay for it. Start there and you will be politely shown out. Ask instead how the plant gets safely through those twelve years, and you get the second meeting.

Third, you need a calculation, not a threat. Attacks at machine speed impress nobody who has spent twenty years keeping a line running. What impresses is a number: a day of downtime on this line costs this much, securing the three most critical systems costs a fraction of it. That is a sentence a head of production can pass on to their management board. And that is exactly the point, because they sell it internally, not the salesperson.

Fourth, you are not selling a product but a state. Controlled ageing is not a purchase, it is a process somebody in the building has to run permanently. Conceal that during the sale and you have a disappointed customer a year later. Say it openly and you sell more slowly and for longer.

Take the number seriously and the conclusion not at all. In production, the answer to faster attacks is not replacement but knowledge. And in sales it is not fear but arithmetic.

How do you justify budget for something whose success nobody can see?