Our escrow accounting runs on one machine nobody touches. Is that safe?

Most title offices have one. The computer that runs escrow accounting, or the reconciliation, or a piece of software the state or your underwriter requires. It works, everyone is slightly afraid of it, and the rule has become that nobody touches it.

That rule protects it from accidental change and exposes it to everything else.

• It is not being patched. Not touching it usually means updates were turned off years ago after one broke something. A machine handling escrow funds, running an operating system with known vulnerabilities, on the same network as everyone's email, is the highest value target in the building sitting in the weakest state.
• Its backup is probably unverified. Often it is excluded from the normal backup because it was set up before the current arrangement, or because someone worried about interfering with it. This is the one machine where losing the data is a regulatory problem as well as a business one.
• Nobody knows how to rebuild it. The install media, the license key, the vendor contact, the configuration. If it fails on a Tuesday, how long until it is back? In a lot of offices the honest answer is nobody knows, which means it could be days.
• Access is usually shared. A single login several people use, so you cannot tell who did what on the machine that touches escrow accounting, which is exactly where you need that record most.

What we do about it without breaking anything, because the fear of breaking it is legitimate:

Take a full image of it first, so there is a way back. Then isolate it on the network so it can reach only what it genuinely needs and cannot be reached by everything else, which addresses the largest risk immediately without changing the machine at all. Get it into verified backup, with a restore test performed. Document the rebuild: version, license, vendor, configuration, steps. Give people individual logins. Then, carefully and with the vendor involved, work out whether it can be updated or replaced, which is a separate conversation with no deadline attached.

The first two steps take a day and remove most of the risk. The rest can go at whatever pace you are comfortable with.