Service

Legacy software: migration and security patching

Production systems that are no longer maintained: languages and frameworks out of support, dependencies with known vulnerabilities and code without a responsible team. This service upgrades or migrates them, with a scope defined before work starts.

Context

Why now

Since 2025, AI models find vulnerabilities in existing code at a scale and speed that did not exist before. The same tools are available to security teams and to attackers.

The most exposed software is the software that has not changed in years: it has no automated tests, its original team is gone and the upgrade has been postponed because it keeps the business running. That is the software this service covers.

Scope

What it includes

Two lines of work, engaged together or separately depending on the outcome of the assessment.

Security patching

Fixing the code that is in production, without changing platform.

  • Review of the code and its dependencies with static analysis and AI-based tools
  • Fixing the vulnerabilities found, in order of risk
  • Regression testing before every deployment
  • A report of what was fixed and what remains open

Migration

Moving to supported versions or platforms.

  • Upgrading the language, framework and dependencies to supported versions
  • Replacing unsupported components: databases, libraries, operating systems
  • Migration to another platform when upgrading is not viable, in phases and with a rollback plan
  • Documentation and handover to the team that will operate the system
First step

A two-week assessment

The service starts with a fixed-scope, fixed-price assessment. Deliverables:

  • Inventory of systems, languages, frameworks and dependencies, with their support status (End of Life)
  • Known and detected vulnerabilities, classified by risk and exposure
  • A recommendation per system: patch, upgrade, migrate or retire
  • A work plan with phases, estimated effort and order of execution

With the report, the company decides what to execute and with whom.

Terms

How I work

  • A non-disclosure agreement before accessing the code.
  • I work in your repository and your environments. Changes are delivered as reviewable commits, with tests.
  • You own the resulting code, tests and documentation.
  • The person who does the assessment is the person who does the work.

Let's talk about your systems

Tell me what you run in production and since when. I reply personally.

Contact