This is a great topic. Some of the best gigs I've had were for organizations with dated technology. The fun comes when you need to apply all your fundamental skills to ensure you are covering all the basics with the tools you've been given. You're like a mechanic who gets a chance to hone some skills on a '32 Ford.
When you are in cybersecurity, you're always just an adviser, even if you're on the corporate side of things. Remember that. Organizational leaders may or may not take your recommendations seriously. You have to be sharp enough to know how to frame your recommendations, provide actionable metrics, and live with the results.
I have written innumerable recommendations where I have been either studiously ignored, or told no to my face. That's fine. You write up your recommendation for remediation, provide business leaders with the options to accept the risk as-is, mitigate the risk (and show how much that will cost), or seek to transfer the risk. Once they make their decision, you ask them to sign off. You've done your job. They must do theirs.
