Free tool · Modernization
Legacy Software Risk Assessment
Somewhere in your business there's a system nobody wants to touch — it works, mostly, and everyone's afraid of the day it doesn't. Ten yes/no questions score how exposed you actually are across security, maintainability, and continuity, and tell you what to fix first.
Yes is always the risky answer. Answer for the one system you'd least like to explain to your insurer — "no" is the default for every question.
1. The framework or language version it runs on no longer receives security updates.
Security · 3 points if yes
2. Only one person — or a vendor you've lost touch with — really understands it.
Continuity · 3 points if yes
3. There's no useful documentation.
Maintainability · 2 points if yes
4. There are no automated backups that have actually been test-restored.
Continuity · 3 points if yes
5. Dependencies haven't been updated in over a year.
Security · 2 points if yes
6. There are no automated tests.
Maintainability · 2 points if yes
7. It doesn't support multi-factor authentication.
Security · 2 points if yes
8. There's no centralized logging — problems are discovered by users complaining.
Maintainability · 2 points if yes
9. The original developer or vendor is unreachable or out of business.
Continuity · 2 points if yes
10. Customer or financial data lives inside it.
Security · 2 points if yes
Verdict
Low risk — keep running it
At this score the boring advice is the right advice: keep running it. Modernization can genuinely wait, and you shouldn't buy anything from us or anyone else to fix a problem you don't have. Re-take this assessment once a year and watch whether the score climbs.
Overall risk score
0 / 100
0 of 23 risk points, normalized to 100.
Band
Low risk
Bands: under 25 low, 25–49 moderate, 50–74 high, 75+ critical.
High-severity yeses
0
Weight-3 questions — unsupported platform, one-person knowledge, untested backups.
Where the risk concentrates
Security
0 / 100
Maintainability
0 / 100
Continuity
0 / 100
How the math works
Weighted questions you can recompute by hand.
Each yes adds its question's weight to your total. Three questions carry a weight of 3 — running on a platform with no security updates, depending on a single person who understands the system, and having no test-restored backups — because those are how businesses actually lose systems and data, not slowly but all at once. The other seven weigh 2. The maximum is 23 points, and the overall score is your yes-weights divided by 23, times 100, rounded.
The three category bars use the same math within each category: Security questions total 9 points, Continuity 8, and Maintainability 6, and each sub-score is your yes- weights in that category divided by its maximum, times 100. Bands: under 25 is low, 25–49 moderate, 50–74 high, 75 and up critical. The score measures risk — how exposed you are to the common failure modes — not code quality; a well-written system with no backups still scores badly, and it should. All of it is a directional estimate, not a quote or an audit.
What to do with the number
A score doesn't fix anything. Here's what does.
Score 50+?
The clock is running. Our modernization work replaces legacy systems incrementally — the old one keeps running while a new one absorbs it piece by piece, at a fixed price.
Software modernizationWhat failure actually looks like
The abstract risk becomes concrete fast. We wrote up the first 72 hours after a small business gets hacked — what breaks, what it costs, and what would have prevented it.
The first 72 hoursReplacing it with something custom?
Replacement projects fail in the preparation, not the code. Our implementation-prep guide covers the data cleanup, process mapping, and staffing decisions to make before anyone writes a line.
How to prepareFrequently asked questions
Asked before the calculator, usually.
What counts as legacy software?
Age isn't the test — support is. A system is legacy when the platform it runs on no longer gets security updates, when nobody on staff can change it safely, or when the vendor who built it is gone. A five-year-old app can be legacy by that definition while a fifteen-year-old one that's actively maintained is not.
Is a high score a reason to rewrite the system?
Almost never all at once — big-bang rewrites are the most common way modernization projects fail. First knock out the cheap items: tested backups, dependency updates, and MFA are weeks of work and remove real risk immediately. Then replace the system incrementally, one workflow at a time, while the old one keeps running.
How accurate is this score?
It's a directional estimate, not an audit — ten questions can't inspect a codebase. The score measures your exposure to the failure modes that actually take systems down, weighted by how often we see each one cause real damage. Treat it as a prioritized worry list, not a verdict on the code.
What does modernization actually cost?
Every project we do is fixed-price, quoted after we've mapped the workflow — never from a calculator score. The 48-Hour Workflow Map is a fixed $250 that credits toward the build, and focused custom builds typically land between $30k and $80k. But most moderate scores need a few weeks of cheap hardening, not a build at all.
Go deeper: the 48-Hour Workflow Map, custom software development in New Jersey, JNC Suite, a legacy replacement we built, and all free tools.
Want a real assessment instead of ten questions?
Tell us what the system does and what worries you about it. We'll say honestly whether it needs modernizing — and if it doesn't, we'll say that too.