The Invoice You Never See: Quantifying the Real Price of Running Legacy Software
Photo: aging server room dusty data center legacy infrastructure, via thumbs.dreamstime.com
Every CIO in America can name the moment a legacy system nearly became a headline. For Equifax, it was March 2017, when an unpatched Apache Struts vulnerability in a legacy framework opened the door to a breach affecting 147 million consumers. For COOP, the Swedish retail cooperative, it was a 2021 third-party software update that froze hundreds of stores' point-of-sale systems for days. Neither incident began with a dramatic failure. They began with an accumulation of small, defensible decisions to defer modernization one more quarter.
The phrase "if it ain't broke, don't fix it" has a certain Midwestern pragmatism to it. But in enterprise software, the systems that appear unbroken are often the ones bleeding the most value — precisely because the losses are distributed, incremental, and invisible on any single quarterly report.
The Four Ledgers of the Legacy Tech Tax
When we work with clients across manufacturing, financial services, and healthcare, the true cost of aging systems shows up in four distinct places. Most organizations only track the first.
1. Direct maintenance spend. Industry analysts have long cited that organizations devote 60 to 80 percent of IT budgets to keeping existing systems running rather than building new capability. For a mid-market company with a $40 million IT budget, that's $24 to $32 million spent largely on standing still. Extended support contracts, niche consultants who understand a COBOL codebase, and hardware that hasn't been manufactured in a decade all carry premium pricing.
2. Risk exposure. Unpatched vulnerabilities in end-of-life software are actively cataloged and exploited. Beyond breach risk, there's the compliance dimension: SOX controls, HIPAA safeguards, and PCI DSS requirements become progressively harder to demonstrate on systems that can't log, encrypt, or segment the way modern auditors expect. Regulators do not accept "the vendor no longer supports that module" as a mitigating factor.
3. Opportunity cost. This is the largest and least visible ledger. When your product team needs six weeks to ship a feature that a competitor ships in six days, you're not just slow — you're funding your rival's market share. Integration friction compounds this: every new SaaS tool, API partner, or data initiative inherits a tax from the fragile middleware connecting to the core system.
4. Talent attrition. The US engineering labor market rewards people who build with modern tooling. Developers assigned to maintain a 30-year-old monolith leave faster, cost more to replace, and are harder to recruit in the first place. Gartner and others have repeatedly flagged the shrinking pool of professionals willing to work on legacy platforms as a top operational risk for the decade ahead.
A Framework for Calculating Your Number
To make the legacy tax legible to a board, we recommend a simple annual calculation across four inputs:
- Run cost delta: (Current maintenance + support + infrastructure for the legacy system) minus (estimated cost of the equivalent modern workload). Be honest about migration costs amortized over five years.
- Risk-adjusted exposure: Estimated probability-weighted cost of a security or compliance incident. Use your cyber insurance underwriter's own modeling — they price this risk whether you do or not.
- Friction cost: Hours your teams spend on workarounds, manual reconciliation, and integration plumbing, multiplied by loaded labor rates.
- Attrition premium: Additional recruiting spend and lost productivity attributable to hard-to-staff roles on the legacy stack.
For most enterprises we've walked through this exercise with, the total lands between 15 and 30 percent of the legacy system's apparent annual cost — every year, compounding. That's the number that reframes a modernization project from "nice to have" to "risk management."
When Deferral Becomes a Decision You Can't Take Back
The pattern in cautionary tales is rarely ignorance. It's the slow-motion trap: deferring modernization raises the eventual cost, and the rising cost makes further deferral more attractive. By the time the original vendor is gone, the documentation is gone, and the engineer who understood the payroll batch job has retired to Scottsdale, the organization faces a rewrite priced in the tens of millions — or a crisis migration executed under duress.
Companies that modernized proactively — many of the regional US banks that moved core processing to cloud platforms in the late 2010s, for instance — absorbed a planned, budgeted disruption. Those that waited absorbed an unplanned one, on a timeline chosen by circumstance rather than strategy.
The Bottom Line
"It still works" is an operational observation, not a financial one. The systems that look cheapest on the run-rate report are frequently the most expensive assets in the portfolio once risk, friction, and forgone opportunity are priced in. The organizations pulling ahead aren't the ones with the newest technology — they're the ones with an honest accounting of what their old technology actually costs.
