The assumption here is that you have to upgrade to the newest OS (on your old hardware). I'd challenge that assumption. If your software is ancient and unsuppor

The assumption here is that you have to upgrade to the newest OS (on your old hardware). I'd challenge that assumption. If your software is ancient and unsupported and you're willing to accept that security risk, using an unsupported operating system isn't going to increase your attack surface that much more than running out of date software was. OS level attacks are less common than serialization bugs in your client software leading to RCE leading to ransomware et al. And if you're not updating your OS for security reasons, is it for feature updates? If your OS and machines are there any to run specific software, this shouldn't be a problem. If it's working fine, leave it be. Mitigate your attack surface through a number of schemes like physically isolating vulnerable workstations and disabling all unnecessary services. I'm not advocating running unpatched OSes, but given how in my experience doing penetration testing most exploitable vulnerabilities are in some 3rd party client software (excluding OS misconfigurations), if your software is unmaintained, running the last working OS release doesn't seem like that much worse of a leap. In Apple's case, if you're maintaining your software, making the 32->64 bit transition should be pretty painless in this day and age, unless you're using the Carbon API created as a way to port legacy Mac programs to the new NeXT based Mac OS X. It never received a 64 bit version since Mac went 64 bit in 2007 and has been officially deprecated since 2012. Software platforms can't stay frozen in time and can't hang back forever. Microsoft struggles tremendously to maintain its tired backwards compatibility while juggling security and feature updates; see Google's project zero report on the CTF subsystem and how a fundamental design flaw in the Text Services Framework allows easy bypass of user sessions and sandboxes. Fixing the bug will invariably break correctly implemented old software. Well, that's enough rambling for now...