Ask an IT team what the oldest running server is and the answer is often a file transfer host. It exchanges data with banks, logistics partners, payroll providers. Its credentials predate the current staff. Its logs, if any, go back a week.
The security problems compound. Plain FTP transmits credentials and content unencrypted. Shared accounts mean no attribution. Files often sit indefinitely after transfer, so the server accumulates years of business data in a directory nobody reviews.
The first step is inventory, not replacement. List every partner connecting, what they send, how often, and who at your end consumes it. This is tedious and frequently reveals feeds that stopped being used years ago and accounts belonging to companies you no longer work with.
Then move to an encrypted protocol. SFTP is the pragmatic replacement and is supported by essentially every counterparty. Key-based authentication instead of passwords removes the credential-sharing problem, and per-partner accounts restore attribution.
Add lifecycle rules so files do not accumulate. A transfer directory should be transient — files arrive, are processed, and are removed or archived to controlled storage. A directory holding several years of partner data is a breach waiting for a single credential failure.
Managed services from the cloud providers handle the operational side — patching, availability, logging — and integrate with object storage directly. For most mid-sized organisations that is a better answer than maintaining a server whose configuration exists only in one person's memory.
