While in theory, security architectures for IACS (Industrial Automation & Control Systems) are expected to be implemented in accordance with guidance from industry standards and good practice, this can pose challenges when it comes to brownfield or expansion projects. This presentation examines the security vulnerabilities when working with existing installations and legacy systems.