Back

Agencies told to list their old IT after the Medicare AI breach. New research says age isn't the problem

Solution Minds Consulting

Key Facts:

• Following a security breach in which an OpenAI agent accessed a Medicare data portal, Home Affairs has ordered federal agencies to catalogue their ageing IT systems by 31 March 2027, though the directive applies only to non-corporate Commonwealth entities and excludes private sector organisations.
• Research by Solution Minds Consulting (SMC) found that in nearly three quarters of enterprise system engagements, ownership of systems, processes or data was unclear, and manual workarounds were in place in 91% of cases, suggesting a stocktake focused on age alone may miss the most critical risks.
• System age — the primary focus of the government's stocktake — was documented in only 41% of SMC's engagements, whilst integration problems, data-quality issues, and governance gaps were present in every single engagement reviewed.
• SMC warns that whilst a stocktake is a necessary first step, it should trigger a deeper systems health check covering ownership, dependencies, what is actually broken, and what the organisation can realistically do about it, with five response pathways and nine board-level questions outlined in its research.
• Ageing systems are increasingly a workforce risk as well as a security concern, with business owners reporting difficulty retaining younger staff unwilling to rely on manual, workaround-dependent processes, and experts cautioning that the longer modernisation is deferred, the greater the gap becomes.

The order covers only federal agencies. Many businesses run on similar systems, and no one is asking them to check.

The OpenAI agent that got into a Medicare data portal did so through legacy systems linked to Services Australia, Finance Minister Katy Gallagher has said. Home Affairs has since ordered federal agencies to list their ageing IT systems by 31 March 2027.

New research from independent AI and enterprise software advisory firm Solution Minds Consulting (SMC) suggests that list could miss what matters. In real decisions about older systems, in business and Government, age was rarely the only deciding factor. In nearly three in four cases, it wasn't clear who owned the system. In nine out of ten, staff had implemented manual workarounds to circumvent systems.

The research, Beyond the Legacy Stocktake, comes a day after OpenAI's chief strategy officer, Jason Kwon, fronted a parliamentary committee in Sydney over the incident. It reviewed a selection of SMC's recent enterprise-system engagements with businesses and government agencies across Australia and New Zealand, and found:

• Unclear ownership of systems, processes or data was documented in 73% of engagements, and manual work or workarounds in 91%.
• Integration problems, reporting or data-quality problems, and governance or readiness gaps were documented in every engagement.
• System age, which agencies must now record, was documented in only 41%, and a support or lifecycle issue in 55%.
• 86% chose replacement, but only one engagement replaced everything at once. Half sequenced the change deliberately and about a third delivered it in phases. The rest optimised, remediated or retained their existing systems.
• In 55%, replacement had already been considered and deferred.

"After 30 years in enterprise software, I can tell you a list of old systems has never fixed anything on its own. The value is in deciding what to keep, fix or replace, and making sure someone owns that decision," said Jamon Johnston, CEO and Founder of SMC and a former Director at Deloitte Consulting.

"A stocktake tells you what you have. It doesn't tell you what to do next," said Mile Dimkovski, SMC's Executive Director.

"When we went back through our engagements, the age of the system was rarely what the decision turned on. It was data nobody trusted, interfaces nobody wanted to touch, workarounds everyone relied on, and whether the organisation was ready to change."

The Home Affairs order applies only to non-corporate Commonwealth entities. Banks, insurers, retailers, universities and councils also rely on long-lived core systems, but no one is asking them to check.

"This isn't just a Canberra problem," Mr Johnston said. "Many of the organisations in our research were businesses, and they had the same issues: no clear owner, data nobody trusted, and staff working around the system by hand."

"The Direction applies to government, but boards everywhere are asking for the same list," Mr Dimkovski said. "Run the stocktake. Then, for each system that matters, write down who owns it, what depends on it, what's actually broken, and which response the organisation can realistically carry out."

The Direction's own definition of legacy widens the gap. Under the Protective Security Policy Framework, a system only counts as legacy if it is end-of-life or out of support. A system that is still supported, but failing the organisation around it, falls outside the definition altogether.

SMC supports the stocktake as a necessary first step: an organisation cannot govern systems it cannot see. The risk is treating the list as the answer.

Mr Dimkovski said a stocktake should be the first step of a deeper systems health check. "You can find out what you have in two or three days. What you can't find out that quickly is how good it is, whether it still fits, and what you should do with it."

He said older systems were also becoming a workforce risk. "Business owners tell us they have people who've been there 20 years, but they can't keep younger staff for more than six or twelve months. Nobody wants to run their job through spreadsheets and manual emails. And two years is a long time in technology: the longer you wait, the further behind you fall."

The research sets out five pathways for any system on the list (retain and govern, optimise, isolate or remediate, stage modernisation, or replace) and nine questions boards should answer before approving a major system decision.

PSPF Direction 002-2026, issued by Home Affairs on 29 September, requires non-corporate Commonwealth entities to complete a legacy technology stocktake and risk management plan, including a target to reduce legacy systems, by 31 March 2027.

The Medicare incident came to light only because the company behind it reported it, almost three months later. The Direction itself names wider threats, including "cyber activities, foreign interference, espionage and sabotage".

"The Medicare incident was an accident that announced itself," Mr Dimkovski said. "The risks boards should worry about are the ones that don't. Every organisation should know which of its older systems it would struggle to watch, and who would notice if something went wrong."

SMC's research does not assess cyber security, and does not infer vulnerability from system age, hosting, manual work or integration.

Beyond the Legacy Stocktake: What SMC's recent engagements show about retaining, fixing and replacing core systems is available free at sm-c.com.au/beyond-the-legacy-stocktake/https://www.sm-c.com.au/beyond-the-legacy-stocktake/.

About us:

Solution Minds Consulting is an independent Australian and New Zealand business and technology advisory firm. For 20 years, SMC has worked on the client side to help organisations decide what to retain, optimise, remediate, stage or replace. It does not sell software or represent vendors. Founded in 2006 by Jamon Johnston, a former Director at Deloitte Consulting. sm-c.com.au

Contact details:

Ruth Hackel - Senior Marketing and Communications Manager

[email protected]