Articles
Every C-level team and board of directors knows the number on the IT budget line. Far fewer can tell you what that number actually bought.
Year after year, the request comes in: more for maintenance, more for support contracts, more for “keeping things running.” The board approves it, because the alternative sounds worse. But there’s rarely a corresponding line that says what was gained. No return column. Just a cost that keeps climbing, attached to a system that isn’t getting any newer.
That’s usually where this gets filed away as an IT problem. It isn’t. It’s a capital allocation problem that’s been mislabeled for years, because nobody translated it into terms a CFO actually manages by.
Here’s the reframe worth sitting with: a legacy system is not a sunk cost sitting quietly on the balance sheet. It’s an active, compounding one. Every year it stays in place is a decision, and that decision has a price tag, whether or not anyone’s written it down. This piece is about writing it down.
Category 1: Maintenance overhead
Start with the cost everyone can already see. Licensing fees. Support contracts. The patching and firefighting that keeps an aging system upright. That’s the visible line item, and it’s the one most budget conversations stop at.
The invisible cost sits right next to it: the hours a company’s most senior technical people spend keeping old systems alive instead of building anything new. That’s not a rounding error. It’s opportunity cost with a salary attached, and it rarely shows up as its own category anywhere.
A useful gut-check metric: what percentage of the total IT budget is going to upkeep versus progress? If the split has been drifting toward upkeep for a few years running, that’s not stability. That’s a slow leak.
And it compounds. Legacy systems don’t get cheaper to maintain as they age; they get more expensive, because the people who understood them originally retire, move on, or simply forget the details. Every year that knowledge walks out the door, the next year’s maintenance gets a little harder and a little pricier.
Category 2: AI lockout
This is the category most CFOs haven’t priced yet.
Legacy systems tend to come with poor data quality, no real API layer, and information scattered across sources that were never designed to talk to each other. That’s not just old technology. It’s a foundation that’s structurally incompatible with the AI initiatives the rest of the business is asking to fund.
Here’s where the cost hides: when an AI pilot stalls or underdelivers because the data underneath it wasn’t ready, it gets written up as “the AI project didn’t work.” It rarely gets traced back to where the failure actually started. The system gets a pass. The initiative takes the blame.
Meanwhile, competitors who modernized aren’t necessarily using smarter AI. They’re using the same tools on a foundation that lets them actually work. That gap compounds quietly, and it’s one of the more expensive lines on this list precisely because it’s the least visible.
Category 3: Competitive exposure
Shift from internal cost to market cost. What does it cost when a competitor can quote faster, launch faster, or sell faster than you can?
Speed-to-decision is a proxy metric most CFOs already understand intuitively, even outside of technology. It shows up in win rates, in customer retention, in how long a deal cycle takes relative to the competitor who closed it first.
Across insurance, healthcare, financial services, and manufacturing alike, the pattern looks the same: a modernized competitor compresses a cycle time that used to be a durable advantage, and does it consistently enough that it stops looking like an exception and starts looking like the new baseline. What used to be a moat becomes table stakes for everyone except the company still running on the old system.
Category 4: Security and compliance exposure
Legacy systems accumulate risk quietly. Vulnerabilities go unpatched longer than anyone intends. Vendors stop supporting old versions. Integrations that were built for a different era get held together in ways they were never designed for, in a threat landscape that’s moved on without them.
There’s a regulatory dimension too. Compliance requirements around data governance, audit trails, and industry-specific mandates increasingly assume a level of system visibility and control that legacy environments often can’t deliver. “We’ve always done it this way” doesn’t hold up in an audit the way it used to.
CFOs already understand this cost framing in other contexts: the cost of a breach or compliance failure, weighed against the cost of modernizing before either happens. Insurance underwriters and auditors are already pricing this risk into premiums and findings, even in organizations where the internal budget hasn’t caught up to that reality yet.
And like the other categories, it compounds. Every year on the legacy system widens the gap between what compliance now expects and what the system is actually capable of delivering.
What is the status quo actually costing you annually?
Here’s a framework for turning all four categories into a single number your board can act on. Treat it as a lens.
Maintenance overhead. Current spend, expressed as a percentage of total IT budget going to upkeep rather than progress.
AI-readiness cost. The value of stalled or underperforming AI initiatives that trace back to data or systems gaps rather than the AI itself.
Competitive cost. An estimate of what cycle-time gaps versus modernized competitors are costing in win rate, retention, or margin, even if the estimate is directional rather than precise.
Security and compliance exposure. The estimated cost of a plausible breach or compliance failure, weighted by likelihood, set against the cost of remediating now.
Add those four together and the status quo stops being a feeling and starts being a number. That number is the real cost of another year of inaction, and it’s very likely larger than the number currently sitting on the maintenance line alone.
The real risk was never modernizing
That’s the piece that tends to get inverted. Modernization gets treated as the risky move, the one that needs a business case and a champion and a careful pilot. Staying put gets treated as the safe default, the option that doesn’t require justification.
It’s the reverse. The real risk has been the years spent treating this as a discretionary decision, while it was becoming the most consequential one on the balance sheet.
If this number is one you can’t yet put a figure to, the AI Opportunity Roadmap is a good place to start; it’s a no-cost diagnostic built to identify where legacy constraints are costing you the most, and where fixing them first would matter most.