Two sentences cost more in legacy software than any others: "we should rewrite this" and "we should leave it alone." Both usually get said in a meeting where nobody has priced the alternatives.
Here is the short answer to whether a legacy app is worth modernizing: five factors decide it, and the age of the code is not one of them. Business criticality, change frequency, named risk, surviving knowledge, and integrations decide whether an application should be left running, remediated, modernized, or rewritten. Most legacy applications belong in the middle two. We make this call regularly on ColdFusion and Ruby on Rails applications, and the pattern behind the good decisions is consistent enough to write down.
Four outcomes, not two
A legacy application has four possible outcomes, not the two most meetings debate.
Leave it running. The application is stable, rarely changes, and runs on a supported runtime. Spending here is vanity. Document it, monitor it, move on.
Remediate. Remediation fixes a specific, named risk without changing what the application does. Typical targets are an end-of-life runtime, unpatched dependencies, credentials in source, and backups nobody has ever restored. It is the highest-return work in legacy software, because the cost is bounded and the damage it prevents is not.
Modernize. The application matters and must keep changing, but the platform fights every change. Modernizing moves it to a supported runtime, current infrastructure, and a sane deployment path while keeping its behavior. Most of what gets pitched as a rewrite should be this.
Rewrite. The behavior itself is wrong for the business, or the code has degraded past the point where preserving it preserves anything. Rewrites are sometimes right. They are right far less often than they are proposed.
Should you modernize or rewrite? Five questions decide
Five questions sort a legacy application into the right outcome. Answer them before anyone proposes a solution, write the answers down, and let the answers pick.
1. Who notices if it goes down, and how fast? If the answer is "nobody for a week," look at leaving it running or retiring it, however old the code is. If the answer is "the CFO, within the hour," the application has earned real investment. Business criticality sets the budget, whatever the code quality.
2. How often does it need to change? Change frequency is the clearest line between remediate and modernize. A stable application on an old platform needs securing, then nothing more. An application with a real feature backlog on an old platform pays an old-platform tax on every change, so it is a modernization candidate.
3. What is the risk, by name? "It's old" is not a risk. "It runs on ColdFusion 11, which passed the end of Adobe's extended support on April 30, 2021, faces the public internet, and touches payment data" is a risk, and it prices the remediation for you. The exposure is real: in December 2023, CISA reported that attackers exploited a ColdFusion vulnerability to compromise two public-facing servers at a federal civilian agency in June 2023. If you cannot name your exposure, you have an inventory problem before you have a modernization problem.
4. Does anyone still understand it? Knowledge decays faster than code. When the last person who understood the batch jobs has left, every option costs more. A rewrite costs the most, because it needs a full understanding of the current behavior that nobody has. AI-assisted code analysis has changed this math: recovering what an undocumented system does is now far cheaper than reading it by hand. In our work, the tools find the behavior quickly, and an engineer still confirms each finding against the running system before anyone relies on it.
5. What is it connected to? Integrations are the hidden multiplier. An application with three quiet consumers is a contained project. An application that forty spreadsheets, two vendors, and an SFTP job depend on will punish any plan that treats it as standalone. Map the connections before you choose the outcome.
Why do teams pick the wrong option?
Teams pick the wrong option when they skip the sorting and jump to the answer that flatters someone. Rewrites flatter engineers. Leaving it alone flatters budget owners. Remediation and modernization flatter nobody, which is why they are underused and why they are usually right.
When the honest answer to question 4 or 5 is "we don't know," that is not a blocker. It is the first work package.
If the application runs on ColdFusion and has earned investment, how we plan a ColdFusion migration shows how we sort one app into keep, rewrite, and retire. If the worry is the platform itself, what still runs on ColdFusion in 2026 explains why the runtime you neglect is a bigger risk than the language. For help with the sorting, an AI readiness assessment is often the fastest way to find out what you have, and our ColdFusion and legacy modernization services describe how we do the work.