Strategic roles of IT modernization and cloud migration in reducing cybersecurity risks of organizations: The case of U.S. federal government

•We empirically examine a “security-by-antiquity” argument in information security.•We find that a federal agency with a larger stock of legacy systems suffers from more frequent security breaches.•A 1%-point increase in spending in IT modernization is associated with a 5.6% decrease in security incidents.•Migration to the cloud is associated with fewer security incidents as well.