Technology Strategy & Roadmaps

Legacy System Replacement: The Go/No-Go Questions

Replace, wrap or tolerate an aging system? A go/no-go scorecard weighs business criticality, failure risk, replacement cost and migration risk.

Computer Set Up with Window View in Office

Every company has a system that everyone is afraid of. It runs something important, it is old, and the people who understood it best are gone. Replacing it is expensive and risky. Leaving it is also expensive and risky, just more quietly.

Executives are often asked to decide with very little structure. The loudest voice wins, or the decision slides to the next budget cycle.

Four questions give the decision a shape: how critical is it, how likely is it to fail, what does replacement cost, and how risky is the move. Score them honestly and the right choice, replace, wrap or tolerate, is usually clearer than expected.

TLDR

  • The choice is not replace or ignore; wrapping and tolerating are real options.

  • Score four factors: business criticality, failure risk, replacement cost and migration risk.

  • End-of-support software is a distinct, rising risk and deserves its own flag.

  • Tolerating a system is a valid decision only when it is written down with a review date.

  • A decision with a date beats a debate with none.

Three real options

Replace means building or buying a new system and migrating to it. Wrap means leaving the core in place and putting a modern layer around it, so other systems and users do not touch the old one directly. Tolerate means keeping it as is, with extra monitoring and a written plan for what happens if it fails.

Each is right in some situations. The mistake is treating the decision as binary.

The go/no-go scorecard

Score each factor from 1 to 5 with the business owner and the technology lead together. The scores below are illustrative.

Factor (illustrative) Question Score (1 low, 5 high) Reading
Business criticality How much revenue or service stops if it fails? 5 High, favors action
Failure risk How likely is failure, given age, support and staff knowledge? 4 High, favors action
Replacement cost How much will a full replacement cost? 4 High, favors wrapping first
Migration risk How likely is the move itself to cause harm? 4 High, favors phasing

High criticality and high failure risk push toward action. High replacement and migration cost push toward wrapping or phasing the work. Low scores across the board are a legitimate reason to tolerate.

Watch end-of-support

A system whose vendor has stopped supporting it carries a different kind of risk, because security fixes stop arriving. Government agencies treat this seriously. CISA's directive on end-of-support edge devices binds federal agencies only, but its reasoning applies to any organization: unsupported devices are attractive targets because they stay exposed.

If a system is past end of support, flag it on the scorecard separately. It is a reason to move faster, whatever the other scores say.

Decide and date it

Whatever you choose, write it down with an owner and a review date. If the answer is tolerate, say what monitoring is in place and what event would change the decision.

For a framework that helps with the wider portfolio, see the application rationalization assessment.

Frequently asked questions

When is wrapping a legacy system better than replacing it?

When the core logic is sound and replacement cost or migration risk is high. A modern layer reduces exposure and lets you migrate in stages.

Is it ever right to tolerate an old system?

Yes, when criticality and failure risk are low or the replacement cost is out of proportion. Write the decision down with monitoring and a review date.

What makes end-of-support software different?

The vendor no longer supplies security fixes, so known weaknesses stay open. That raises the risk regardless of the system's other scores.

Who should make the call?

The business owner of the process, with the technology lead and finance. The decision is about risk and money, not only technology.

A Defensible Next Step

Pick the one legacy system your team talks about most and score it on the four factors this week. The score will either confirm the worry or show it is smaller than it feels. Book a Decision-Clarity Call if you would like a second opinion on the decision.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on Technology Strategy & Roadmaps

All CISO Insights
Technology Strategy & Roadmaps

When the CTO Says We Need to Rebuild

A rebuild proposal is a large bet. Test it against repair, phased replacement and doing nothing, and ask for evidence that the current system cannot scale.

Technology Strategy & Roadmaps

Shadow IT: Finding What Procurement Never Approved

Teams adopt tools without asking. Discover them, classify the risk, then decide to legitimize, replace or block. A five-step workflow for executives.

Technology Strategy & Roadmaps

When the Roadmap Assumes a Vendor That Might Not Exist

Many roadmaps lean on vendors whose survival is uncertain. Map each critical dependency, watch its health signals and write the fallback before you need it.