In June 2026, the cyber security agencies of the UK, US, Canada, Australia and New Zealand, known as the Five Eyes, issued a rare joint warning: AI is about to make cyber attacks faster and cheaper, and "the timeline is not years, it is months." Old, unsupported systems were near the top of their list. If your business still runs on an old Microsoft Access database or a Visual Basic 6 program, this guide explains what that means for your Access database security, in plain English.
- For UK SMEs
- Plain English
- Checklist included
- Sources included
The short version: an old system isn't a problem because it's old. It's a problem when nobody patches it, nobody supports it, and it's reachable from the internet. AI makes all three easier to exploit, so now is a good time to check where yours stands.
the warning/
What did the Five Eyes AI warning say?
On 22 June 2026, the heads of the UK's National Cyber Security Centre (NCSC), the US agencies CISA and NSA, and their Australian, Canadian and New Zealand counterparts signed a joint statement called The AI shift in cyber risk: why leaders must act now.
Their point is simple. AI tools can now find weaknesses in software and turn them into working attacks much faster than before, which shrinks the time between a flaw being found and criminals using it. The statement calls cyber risk "a core business risk and leadership responsibility", not just an IT issue.
It lists five practical actions. The agencies say they "are not new, but are now urgent":
Reduce your attack surface
Limit unnecessary access and internet connections, and question whether systems need to be exposed at all.
Patch faster
Install security updates quickly, because AI is shortening the time attackers need.
Address legacy systems
"Unsupported systems are easy targets. They are not just technical debt, they are strategic liabilities."
Strengthen identity and access
Limit who can reach critical systems, use strong authentication and review permissions regularly.
Prepare for incidents
Test your response plans, train your team and assume a breach will happen one day.
The statement was written for leaders of organisations of every size. You don't need a security team to act on it, but you do need to know what your business actually runs on.
why it matters/
Access database security: why old systems are exposed
Microsoft Access and Visual Basic 6 (VB6) were the go-to tools for small business software in the 1990s and 2000s, and many of those systems still run UK firms today. Access itself isn't the villain: the version in Microsoft 365 is still supported and updated. The risk comes from old versions, missing support and the way these systems were set up.
no patches/
No more security updates
Access 2016 and Access 2019 reached end of support on 14 October 2025, as did Windows 10, and older versions stopped years earlier. They still open, but any flaw found now will never be fixed.
no support/
Nobody left to fix it
Microsoft says there's no supported way to create or maintain VB6 applications. Often the developer has ceased trading too, so there's no source code and nobody to call.
quietly exposed/
Open to the internet
A database on a shared drive was safe enough inside one office. Add remote desktop for home working, a forwarded port or an old VPN box, and the network it lives on may be reachable from anywhere.
The weaknesses built into older systems
- Everyone shares one login, or there's no login at all
- Older .mdb file passwords can be removed with freely available tools
- Anyone who can open the file can usually copy all of it
- There's no record of who viewed or changed what
- Backups are a copy of one file, if anyone remembers
- It only runs on an old PC that can't be updated
None of this is anyone's fault. These systems were built for a world where the office network was a closed room. AI-assisted attackers are very good at finding the door that was left open. It's the same lesson as PHP2Shell and plugin debt on websites: software that can't be updated becomes the easiest way in.
the bigger picture/
Why UK SMEs should act now
The Five Eyes warning isn't the only reason to look at old systems this year.
The rules are tightening
The Cyber Security and Resilience Bill brings managed service providers, data centres and critical suppliers into UK cyber regulation. It completed its House of Lords stages on 2 November 2026 and now returns to the Commons. It isn't law yet, and most small firms won't be regulated directly, but the IT suppliers you rely on will be, and they'll expect more from their customers.
Your clients and insurer will ask
Cyber Essentials, the government-backed scheme many contracts and insurers ask for, requires software to be licensed, supported and kept up to date, with unsupported software removed. An old database can stand between you and a pass.
Staff are the front line
A Moneysupermarket survey of 250 UK small businesses, reported in May 2026, found that only 10% give staff AI security training. AI-written phishing emails are harder to spot, and one stolen password is all an old system needs.
Your data lives there
Customer records, contracts and years of history usually sit in that one old file. Losing it, or having it stolen, is a data protection problem as well as a business one.
the safe route/
What a safe legacy system migration looks like
Replacing an old system sounds risky, and done badly it is. Done well, it removes the risk without losing anything. This is how we approach legacy system conversion at Cirrus Design Studio:
Find out what it really does
We take a copy of the system and its data and map every table, screen, report and business rule, even without the source code.
Keep every record
Migrating your full history is part of the job, not an optional extra. For many businesses, that history is the whole point.
Host it in the UK
The new system runs on UK servers with backups and updates included. Our article on where your business data actually lives explains why that matters.
Build in security from day one
Every person gets their own login, access is limited to what each role needs, and a full audit trail records who changed what and when.
Switch over when you're ready
We run the old and new systems side by side, so your team only switches once they're confident.
The result is a cloud-based business system that you own, built around how your team works, with no per-seat licence fees. Our case studies show how three UK businesses replaced paper forms, spreadsheets and disconnected tools this way, and why bespoke explains when it makes sense.
checklist/
A quick checklist for your old system
Answer these honestly. If you're unsure about more than one or two, it's worth a closer look.
- Do you know what it's built in, and which version? Access 97, 2003, 2010 and VB6 all count as legacy.
- Is it still getting security updates, and is the PC it runs on?
- Can it be reached from outside the office, through remote desktop, a VPN or a forwarded port?
- Does everyone have their own login, with access only to what they need?
- Could you tell who changed a record last week?
- When was it last backed up, and has anyone tried restoring that backup?
- Who could fix it tomorrow if it stopped working?
- Is your website secure too? Run our free Website Health Check to check its HTTPS, certificate, speed and search basics in a minute or two, with no email needed.
For the system itself, book a free systems review. We'll look at what you run, tell you plainly how exposed it is and what your options are, with no obligation. Our website maintenance checklist and our guide to creating a strong password cover the everyday basics.
quick answers/
Legacy systems and AI security: quick answers
Is Microsoft Access still supported?
Access in Microsoft 365 is still supported. Access 2016 and Access 2019 lost support on 14 October 2025, and older versions earlier, so they no longer get security updates. Check which version your business is running.
Is Visual Basic 6 still supported?
Windows 11 still runs VB6 programs, but Microsoft stopped supporting the VB6 development tools in 2008 and says there's no supported way to maintain VB6 applications. In practice, nobody can safely fix or update them.
Does the Cyber Security and Resilience Bill apply to my small business?
Probably not directly. It's aimed at essential services, managed service providers, data centres and critical suppliers, and it isn't law yet. But suppliers that are covered are likely to expect better security from their customers.
Will we lose our data if we move off Access?
No. Cirrus Design Studio migrates every historic record into the new system and runs both side by side until you're happy. See legacy system conversion for how it works.
Can you replace a system without the source code?
Usually, yes. The data is in the database, and much of the logic can be read out of the program itself. Where it can't, Cirrus Design Studio watches the system running and documents what it does.
What should a small business do first?
Find out what your key systems are built on and whether they're still supported, then check whether they can be reached from the internet. Call Cirrus Design Studio on 01202 028 608 or book a free systems review if you'd like help.
talk to us/
Still running on an old Access or VB6 system?
Tell us what it does, roughly how old it is and what it's built in, if you know. Cirrus Design Studio is based in Bournemouth, UK-hosted and ICO registered, and we'll come back within one working day.
sources/
Sources
- NCSC, CISA, NSA, ASD, Canadian Centre for Cyber Security and NCSC New Zealand: The AI shift in cyber risk: why leaders must act now (22 June 2026)
- Microsoft: End of support for Access 2016 and Access 2019
- Microsoft: Visual Basic 6 support policy
- UK Parliament: Lords completes examination of Cyber Security and Resilience Bill
- NCSC: Cyber Essentials overview
- Startups.co.uk: SMEs lack AI cyber security training (5 May 2026)
This article is for general information only and isn't legal advice. If you have specific regulatory obligations, take advice from a qualified professional. Facts were checked on 5 November 2026.
Related articles
-
Where Does Your Business Data Actually Live?
A 17-day US freeze on UK access to AI models shows how fast the rules change. What digital sovereignty and the CLOUD Act mean for your business data. Read article -
PHP2Shell: What the PHP Security Flaws Mean for Your Website
Two critical PHP flaws, known as PHP2Shell, are being exploited. See who's affected, which PHP versions are safe and how we protected our clients. Read article -
Latest AI news: October 2026 highlights for business
The latest AI news from October 2026: background AI agents, rogue agents in live systems, Google AI search links, EU AI Act dates and what to do now. Read article