A technical debt compendium¶

Or, why most infrastructure is one unpatched Windows 7 box away from catastrophe

The laws and the public agencies here are European; many of the figures come from firms, most of them American, whose reports measure the problem their products are sold to fix: breaches for IBM, cloud exposure for Tenable and Wiz, leaked secrets for GitGuardian, vulnerable dependencies for Sonatype and Black Duck, machine identities for CyberArk.

The scale of the problem¶

Technical Debt’s £45 Billion Toll for the UK Public Service, Cognizant, November 2025. The £45 billion is the government review’s estimate of productivity savings the public sector misses each year, the benefit of full digitisation rather than the running cost of legacy. In 2021 the government said it spent about £2.3 billion a year, close to half its technology budget, keeping outdated systems running.

Cost of a Data Breach Report, IBM. The 2026 edition puts the global average cost of a breach at 4.99 million dollars, up 12 per cent and a record high. The 2025 edition had recorded a fall to 4.44 million dollars, the first in five years.

Technical Debt and Its Impact on IT Budgets, Software Improvement Group, February 2025. The Amsterdam firm, which sells tools for managing technical debt, cites McKinsey’s finding that 10 to 20 per cent of budgets meant for new products go to servicing it instead, and puts, without a source, about 40 per cent of an IT budget into its fallout and 20 to 40 per cent of the average technology stack down as debt.

Government and critical infrastructure¶

State of Digital Government Review, UK Government, January 2025. 28 per cent of systems in central government departments were legacy in 2024, up from 26 per cent in 2023, with rates of around 10 to 50 per cent across NHS trusts and 10 to 70 per cent across police forces. NHS England recorded 123 major system failures in 2024.

Legacy IT Debt Slowing AI Adoption in UK Public Sector, Resultsense, February 2026, reporting a survey of 250 IT leaders in government, finance and manufacturing by the migration vendor Cloudhouse. 84 per cent of the government organisations carry Windows technical debt; across all respondents, three in five say legacy systems are blocking AI adoption and 45 per cent divert innovation budgets to keeping old infrastructure running.

ENISA Threat Landscape 2026, ENISA, September 2026. The EU cybersecurity agency analysed 8,257 incidents from 2025, mainly from open sources. DDoS remained the primary incident type at 51.3 per cent, followed by unauthorised access at 39.5 per cent, and phishing made up 77.8 per cent of the social engineering it recorded.

ENISA Threat Landscape 2025, ENISA, October 2025. The EU cybersecurity agency analysed 4,875 incidents between July 2024 and June 2025. DDoS attacks dominated at 77 per cent of reported incidents, driven largely by hacktivist activity, while ransomware accounted for 81.1 per cent of cybercrime incidents targeting EU organisations and remained the most directly impactful threat. State-aligned groups demonstrated supply chain compromise and abuse of signed drivers against telecommunications, logistics, and manufacturing across the Union.

Die Lage der IT-Sicherheit in Deutschland 2025, BSI, November 2025. Germany’s federal cybersecurity authority records an average of 119 new vulnerabilities reported daily during the period, roughly 24 per cent more than the year before.

NIS2 Directive, European Commission. It covers energy, transport, healthcare, finance, water, digital infrastructure, public administration and space. Member states had until October 2024 to transpose it; by July 2026, 23 had, and the Commission referred the other four, Ireland, Spain, France and the Netherlands, to the Court of Justice. In January 2026 the Commission proposed amendments to simplify its application.

NIS Investments 2025, ENISA, December 2025. A survey of 1,080 professionals in organisations in the EU’s most critical sectors, most of them large enterprises. Security spending held at 9 per cent of IT budgets, a median of 1.5 million euros, but went increasingly on technology and outsourcing rather than in-house teams. 76 per cent of organisations reported difficulty hiring cybersecurity staff and 71 per cent keeping them, against an EU shortage estimated at 299,000 in 2024.

Identity and access management debt¶

Machine Identities Outnumber Humans by More Than 80 to 1, CyberArk, April 2025. Drawing on respondents across France, Germany, Italy, the Netherlands, Spain, the UK, and beyond, the 2025 Identity Security Landscape finds machine identities outnumbering human ones by more than 80 to 1, driven by cloud and AI adoption, with nearly half holding sensitive or privileged access. 88 per cent of respondents define a privileged user as a human.

The State of Secrets Sprawl 2026, GitGuardian, March 2026. 28.65 million new hardcoded secrets were added to public GitHub commits during 2025, a 34 per cent year-on-year increase and the largest single-year jump on record. Roughly 64 per cent of credentials confirmed valid in 2022 were still valid when retested in January 2026, and commits made with Claude Code leaked secrets at 3.2 per cent against a 1.5 per cent baseline.

Cloud misconfiguration: the epidemic nobody seems to want to discuss¶

The misconfiguration crisis¶

Tenable Cloud Security Risk Report 2025, Tenable, June 2025. Analysis of real-world cloud environments identifies the toxic cloud trilogy, workloads that are simultaneously publicly exposed, critically vulnerable, and highly privileged, as present in 29 per cent of organisations, down from 38 per cent. 54 per cent of organisations using AWS ECS have at least one task definition with an embedded secret, and 9 per cent of publicly accessible cloud storage contains sensitive data directly exposed to the internet.

Wiz Cloud Data Security Snapshot 2025, Wiz, May 2025. Analysis of hundreds of thousands of real-world cloud accounts found that 54 per cent of cloud environments have exposed virtual machines and serverless instances containing sensitive information including PII or payment data, and 72 per cent have publicly exposed PaaS databases lacking access controls. 12 per cent have containers that are both publicly exposed and exploitable via known vulnerabilities. These are not edge cases.

Major breach case studies¶

The 2024 Football Australia Data Breach: A Case of Misconfiguration and Inadequate Change Control, Cloud Security Alliance, June 2025. The 2024 Football Australia breach resulted from developers misconfiguring AWS S3 buckets. Publicly available search tools such as Shodan, BinaryEdge, and Grayhat Warfare make it relatively straightforward to find unprotected data repositories, which means the question is not whether someone will look but when.

Software supply chain: dependency hell and cascading failures¶

The supply chain crisis¶

2026 State of the Software Supply Chain, Sonatype, January 2026. Open source malware grew 75 per cent year-on-year to 1.233 million malicious packages tracked since 2019, with 454,648 new malicious packages discovered in the past year alone. Annual open source downloads reached 9.8 trillion across the four largest registries, a 67 per cent increase. Despite patches available for years, Log4Shell was still downloaded 42 million times in 2025. 65 per cent of open source CVEs lack an NVD-assigned CVSS score.

Black Duck 2026 Open Source Security and Risk Analysis, Black Duck, February 2026. Analysis of 947 codebases across 17 industries found mean vulnerabilities per codebase jumped 107 per cent in a single year. Open source appears in 98 per cent of audited codebases; two-thirds contain licence conflicts. Black Duck’s earlier research found that 76 per cent of organisations check AI-generated code for security risks and 24 per cent evaluate it for security, licensing and quality together.

European regulatory response¶

Cyber Resilience Act, European Commission, in force December 2024. The CRA is the EU’s first horizontal law imposing mandatory cybersecurity requirements on any product with digital elements placed on the European market, regardless of where its maker is based. It demands secure-by-design engineering, vulnerability handling, post-market monitoring, and a Software Bill of Materials. Reporting obligations for actively exploited vulnerabilities (an early warning within 24 hours) have applied since 11 September 2026; the main obligations apply from 11 December 2027. It is, in effect, a legal attempt to make supply chain debt someone’s accountable responsibility.

European Vulnerability Database, ENISA, launched 2025. Provided for by NIS2, the EUVD is Europe’s counterpart to the US National Vulnerability Database, enriching CVE records with CVSS scores and CWE classifications and offering dedicated views for critical, actively exploited, and EU-coordinated vulnerabilities. It launched in May 2025, while the funding of MITRE’s CVE programme was in question.

OWASP Top 10:2025, A03 Software Supply Chain Failures, OWASP, 2025. Top-ranked in the Top 10 community survey, with exactly 50 per cent of respondents ranking it number one. Since appearing in 2013 as “Using Components with Known Vulnerabilities,” the risk has grown to encompass all supply chain failures, and now carries the highest average incidence rate at 5.19 per cent when tested.

Financial sector resilience and the weight of the core¶

Digital Operational Resilience Act (DORA), EIOPA, in application since January 2025. DORA requires banks, insurers, investment firms, and their critical ICT third parties to withstand, respond to, and recover from ICT disruption. The friction is structural: operational resilience monitoring, reporting, and testing must be wired into legacy ICT systems that were never designed to expose it, and many third-party contracts had to be renegotiated to add audit rights, exit support, and incident commitments the original terms never contemplated.

The systems are fragile. The infrastructure is ageing. A lot of configurations are wrong.

Technical debt is not a temporary problem that organisations will eventually fix. It is a structural feature of how systems are built, maintained, and evolved. Quick decisions create long-term consequences. Legacy systems persist because replacing them is harder than keeping them alive. Cloud adoption creates new categories of misconfiguration faster than security teams can address old ones. Software dependencies multiply vulnerabilities whilst appearing to simplify development. Europe has now written much of this into law, which makes the debt visible and overdue, but does not, by itself, pay it down.