Legacy System Replacement: The Go/No-Go Questions
Replace, wrap or tolerate an aging system? A go/no-go scorecard weighs business criticality, failure risk, replacement cost and migration risk.

Every company has a system that everyone is afraid of. It runs something important, it is old, and the people who understood it best are gone. Replacing it is expensive and risky. Leaving it is also expensive and risky, just more quietly.
Executives are often asked to decide with very little structure. The loudest voice wins, or the decision slides to the next budget cycle.
Four questions give the decision a shape: how critical is it, how likely is it to fail, what does replacement cost, and how risky is the move. Score them honestly and the right choice, replace, wrap or tolerate, is usually clearer than expected.
TLDR
The choice is not replace or ignore; wrapping and tolerating are real options.
Score four factors: business criticality, failure risk, replacement cost and migration risk.
End-of-support software is a distinct, rising risk and deserves its own flag.
Tolerating a system is a valid decision only when it is written down with a review date.
A decision with a date beats a debate with none.
Three real options
Replace means building or buying a new system and migrating to it. Wrap means leaving the core in place and putting a modern layer around it, so other systems and users do not touch the old one directly. Tolerate means keeping it as is, with extra monitoring and a written plan for what happens if it fails.
Each is right in some situations. The mistake is treating the decision as binary.
The go/no-go scorecard
Score each factor from 1 to 5 with the business owner and the technology lead together. The scores below are illustrative.
| Factor (illustrative) | Question | Score (1 low, 5 high) | Reading |
|---|---|---|---|
| Business criticality | How much revenue or service stops if it fails? | 5 | High, favors action |
| Failure risk | How likely is failure, given age, support and staff knowledge? | 4 | High, favors action |
| Replacement cost | How much will a full replacement cost? | 4 | High, favors wrapping first |
| Migration risk | How likely is the move itself to cause harm? | 4 | High, favors phasing |
High criticality and high failure risk push toward action. High replacement and migration cost push toward wrapping or phasing the work. Low scores across the board are a legitimate reason to tolerate.
Watch end-of-support
A system whose vendor has stopped supporting it carries a different kind of risk, because security fixes stop arriving. Government agencies treat this seriously. CISA's directive on end-of-support edge devices binds federal agencies only, but its reasoning applies to any organization: unsupported devices are attractive targets because they stay exposed.
If a system is past end of support, flag it on the scorecard separately. It is a reason to move faster, whatever the other scores say.
Decide and date it
Whatever you choose, write it down with an owner and a review date. If the answer is tolerate, say what monitoring is in place and what event would change the decision.
For a framework that helps with the wider portfolio, see the application rationalization assessment.
Frequently asked questions
When is wrapping a legacy system better than replacing it?
When the core logic is sound and replacement cost or migration risk is high. A modern layer reduces exposure and lets you migrate in stages.
Is it ever right to tolerate an old system?
Yes, when criticality and failure risk are low or the replacement cost is out of proportion. Write the decision down with monitoring and a review date.
What makes end-of-support software different?
The vendor no longer supplies security fixes, so known weaknesses stay open. That raises the risk regardless of the system's other scores.
Who should make the call?
The business owner of the process, with the technology lead and finance. The decision is about risk and money, not only technology.
A Defensible Next Step
Pick the one legacy system your team talks about most and score it on the four factors this week. The score will either confirm the worry or show it is smaller than it feels. Book a Decision-Clarity Call if you would like a second opinion on the decision.
Get Board-Ready on AI and Cyber Risk
A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.


