
During a recent clean out ahead of a remodeling project, our IT team opened a long ignored storage closet.
Inside was a 56k dial up USB modem, carefully tucked away years ago.
At first, it was a curiosity. A relic from another era. But the more I thought about it, the more that modem felt like something else entirely: a reminder of how unmanaged technology debt quietly turns into fiduciary risk for anyone with governance responsibility.
Because there was a time when that modem was state of the art.
It wasn’t a compromise.
It wasn’t risky.
It was the best technology available, doing exactly what it was designed to do.
Then the world changed.
How Yesterday’s Good Decisions Become Today’s Governance Problem
Technology rarely becomes dangerous because it stops working.
It becomes dangerous because the assumptions it was built on no longer hold.
Threat actors evolve. Connectivity expands. Regulatory expectations increase. Customers, partners, and insurers expect resilience. Systems that once represented prudence and efficiency quietly become unacknowledged exposure.
This is how cybersecurity debt forms, not through negligence, but through inattention over time.
And this is where technology debt crosses out of IT and into enterprise leadership, executive oversight, and governance.
When Tech Debt Becomes Fiduciary Risk
Many of the most significant breaches of the last decade weren’t caused by exotic attacks or cutting edge malware. They were enabled by legacy systems, inherited complexity, and governance blind spots.
• Equifax wasn’t breached because it lacked technology. It was breached because a legacy application went unpatched in an environment with poor asset visibility and unclear accountability.
• Target wasn’t breached because it ignored cybersecurity. It was breached because trust assumptions and insufficient segmentation allowed a third party compromise to become an enterprise wide incident.
• WannaCry’s impact on the NHS wasn’t about hacking sophistication. It was about unsupported systems operating well past their safe lifespan—systems leadership knew existed but hadn’t fully reckoned with.
These weren’t IT failures alone. They were risk management failures, with direct financial, reputational, and regulatory consequences.
“It Still Works” Is Not a Governance Standard
From a leadership and governance perspective, some of the most concerning phrases sound deceptively reasonable:
• “It’s been stable for years.”
• “We’ve never had an incident.”
• “Only a few people really understand it.”
• “Replacing it would be disruptive.”
These statements often describe systems that are:
• Outside modern monitoring and logging
• Difficult or impossible to patch
• Incompatible with zero trust principles
• Dependent on tribal knowledge rather than documented controls
Attackers don’t view these systems as dependable. They view them as predictable.
And regulators, insurers, and plaintiffs’ attorneys increasingly view them as foreseeable risk.
Cybersecurity Is a Leadership Duty of Care Issue
Cybersecurity is no longer just an operational concern or a line item in the IT budget. It is squarely part of:
• Enterprise risk management
• Regulatory and compliance obligations
• Financial oversight
• Brand, customer, and shareholder value protection
Boards, executives, and senior leaders are not expected to design networks or select tools. But they are expected to ask:
• Do we understand where our legacy systems are?
• Do we know which ones carry material risk?
• Are compensating controls in place where replacement isn’t feasible?
• Do we have clear ownership and end of life timelines?
In other words: Is cyber risk being governed, or merely inherited?
The Cost of Inherited Risk
The Colonial Pipeline incident made this visible at a national level. While the ransomware attack targeted IT systems, the lack of confidence in the broader security posture forced the shutdown of critical operations. A single compromised account cascaded into economic disruption across the East Coast.
That is the real cost of cybersecurity debt: not just breach response, but loss of trust, operational paralysis, and leadership scrutiny after the fact.
At that point, the conversation is no longer about technology.
It’s about oversight, accountability, and governance.
Why That Modem Matters
The 56k modem we found isn’t dangerous sitting in a closet. But it’s a powerful symbol.
Somewhere in almost every organization, there are modern equivalents still running in production, quietly doing their job, long after the risk landscape around them has fundamentally changed.
They remind us that:
• Yesterday’s innovation can become today’s vulnerability
• Cybersecurity debt grows silently
• Unmanaged legacy technology doesn’t just slow the business, it creates fiduciary exposure
Cybersecurity leadership isn’t only about adopting new tools or reacting to incidents.
Sometimes, it starts by opening a closet, taking inventory of what we’ve carried forward, and asking a governance level question that every senior leader now shares responsibility for answering:
Do we know where our cyber risk lives—and are we actively managing it?
For executives and senior leaders with governance responsibility:
If your role includes oversight of risk, resilience, or long term organizational health, this is not a theoretical issue. These are the conversations we regularly support with leadership teams at Centriworks.
If you’d like help assessing cybersecurity debt, legacy risk, or governance around cyber exposure, I invite you to contact me or the Centriworks team directly for a confidential discussion.



GoGreenET.com Reboot
Back in 2008, I founded GoGreenET to help East Tennessee businesses approach sustainability in practical, business‑driven ways. At the time, there was no local, business‑focused resource that connected environmental responsibility with what leaders actually cared about, costs, efficiency, and long‑term viability.
GoGreenET grew into a community platform supported by business leaders, media partners, and academic institutions, all centered on one idea: progress over perfection. The goal was never to be ideal, it was to help businesses take the first step, then the next.
Like many hyperlocal initiatives, GoGreenET eventually went quiet. Not because the mission stopped mattering, but because the conversation kept moving, and there was no longer a place designed to hold it.
Today, I believe the timing is right to reboot GoGreenET.
Sustainability is no longer a side topic. It’s tied directly to workforce attraction, operational resilience, cost control, and how communities stay competitive. Businesses are asking better questions, and they’re looking for practical answers grounded in real experience, not buzzwords.
This reboot isn’t about chasing trends or checking boxes. It’s about spotlighting local leaders, sharing what actually works, and helping businesses move forward in ways that are measurable and meaningful.
If you’re interested in where sustainability, business, and community intersect in East Tennessee, I invite you to follow along, and join the conversation.