In addition to specific ICS components, office IT components and software are increasingly being used in ICS solutions. Due to the very long lifecycles in OT, these components are usually operated much longer than is common for office IT—even beyond the support cycles provided by product suppliers in some cases.

In these instances, updates that address vulnerabilities are no longer provided after the supplier's support has expired. Meanwhile, these vulnerabilities and the tools available to exploit them are often publicly documented. This makes it possible for even inexperienced attackers to successfully compromise the OT systems affected. The same applies if updates are not installed or installed only after a very long delay.

Furthermore, long periods of use can cause problems in procuring spare parts (if they are no longer produced, for example). This may also apply to knowledge regarding the care and maintenance of legacy systems, which new employees will not have.

ICS components also frequently contain detailed information on the processes they control or monitor. This information may be partially reconstructed from other transmitted values such as measurement or control data, as well. The same holds true for control programs or parameters. Attackers can access confidential information in this way.