It’s simple: If you are using a legacy ecosystem, your compliance is at risk. The fact that your security hasn’t yet been compromised is no evidence of your safety; it really is a case of it being quiet, too quiet. When it comes to security breaches, it’s not a question of if, but when. Whether your household or institutional architecture, the full value of security is only appreciated after disaster has already struck.
Experian for example is doomed to forever be associated with the security breach in 2015 when 15 million of their customers’ private information was exposed. And who could forget the Adult Friend Finder breach in 2016 where up to 400 million logins on the "sex and swingers" hook-up site were leaked - sensitive data indeed.