What do legacy IT and on-premises mean, and why is legacy IT a particular challenge for security?

Legacy IT means old systems that may no longer meet today's state of the art or were not designed to run in modern environments; on-premises (on-prem) means "in our own data centre", as opposed to a service hosted by an external provider such as a cloud or outsourcing partner.

• Legacy IT is hard to secure because it often cannot be patched, changed or integrated with modern security mechanisms. The security usually has to be built around it, for example by isolating it, rather than into it.
• On-premises literally means "on one's own premises". Its counterpart is any service hosted by someone else: a cloud service at a cloud provider, or a server in an outsourcing partner's data centre. The distinction matters for who controls, operates and is responsible for the system.