The business services systems controlled by BACS often use components that may not receive updates due to their age and thus contain vulnerabilities or no longer correspond to the current state of the art. This often results from substandard development and maintenance processes on the manufacturer side or from software that uses insecure protocols due to a lack of computing and storage capacity.

In addition, manufacturers often fail to provide patches, so that insecure BACS-relevant components are also used over a very long period of time. The risk is increased by the fact that access to such components must also be enabled in BACS.