IT Strategy

Costly software outages are endemic across industries, due largely to a disconnect between IT leaders and developers, according to a Tricentis report. The quality engineering tool vendor commissioned Censuswide to survey over 2,700 CIOs, CTOs and IT engineering professionals.

Two-thirds of companies expect a major disruption over the next year, with nearly one-quarter of respondents characterizing their organization’s level of risk as “extreme,” the report found.

“Severe outages are the ones that tend to get noticed,” Lee McClendon, chief digital and technology officer at Tricentis, told CIO Dive. “People in IT know that when a significant executive knows about a problem and is breathing down their neck, it’s a big deal.”

As businesses turn to the latest technology to accelerate innovation and drive growth, leaders are telegraphing mixed messages to software development teams, prioritizing speed over quality.

Nearly two-thirds of respondents acknowledged their organization regularly deploys untested code, either accidentally or to meet expedited release schedules. More than three times as many developers felt pressure to accelerate delivery rather than enhance software quality, Tricentis found.

The downstream effect of misaligned incentives can be costly.

Outages caused by faulty code strain IT resources, cutting into productivity and profits, McClendon said. Costs tied to software outages surpassed $1 million annually for 2 in 5 organizations surveyed, and nearly half of financial services reported losses exceeding $5 million.

“An outage that affects how you make money is always the easiest one to see,” said McClendon, pointing to consumer-facing website and app failures.

Enterprises scrutinized software engineering practices and bolstered incident response and recovery plans last year in the aftermath of the global outage caused by a faulty CrowdStrike Windows systems security update. Direct losses among the Fortune 500 were estimated at $5 billion and Windows system crashes left airline passengers stranded as carriers canceled thousands of flights.

Outdated systems can hamstring remediation efforts. More than one-third of respondents to the Tricentis survey said services technical debt hinders software development. Nearly the same proportion pointed to poor communication between developers and testers as a major hurdle.

“There’s a disconnect between leadership and the people responsible for quality,” McClendon said. “In the quest to be faster, we have to constantly remind our teams that we also want quality.”

The emergence of generative AI assistants trained to test code and perform other time-consuming tasks can help elevate quality and cut through tech debt. AI coding tools can also turn the heat up on developers to deliver software faster, according to a March HackerRank report.

Technology executives are looking to agentic automation to speed delivery processes. More than 4 in 5 CIOs, CTOs and software delivery professionals expect the technology to yield productivity gains by taking over repetitive coding tasks, according to Tricentis. Nine in 10 respondents said they trust AI to make critical software release decisions.

The impetus is on leaders to set a tone that prizes quality and efficiency, said McClendon. “If you focus on speed and you're not considering quality as well, we know that bad things are going to happen,” he added.

Aging technology systems represent a proverbial thorn in any CIO's side. Outdated and posing security risks, cumbersome and difficult to integrate, they persist in the enterprise because replacing them would be too costly or disruptive to business operations. 

To steer organizations toward more modern implementations, tech leaders can identify priority areas, rely on partners across the C-suite to accelerate efforts and convey the potential business gains that can make lengthy IT overhaul worthwhile.

CIOs should start by identifying where exactly legacy technology lives and what it's connected to, said Kris Lovejoy, global practice lead, security and resiliency, at Kyndryl. 

"You might have a very modern application infrastructure and an underlying database, you might even be on the cloud, but what you always find is it's connected into a lot of other systems, many of which may be legacy," Lovejoy said during a CIO Dive-Cybersecurity Dive virtual event. "It might be that everything is fine with production, but then you've got a legacy firewall that's connected to your high availability sites."

Businesses need to take stock of the cybersecurity risks posed by existing legacy systems when on the path to core system overhauls, according to Christina Powers, cybersecurity partner at West Monroe. 

"It's also important to have that understanding of what potential vulnerabilities may exist on those systems, so that you can have that risk assessment done to understand what you're working with, from an inventory perspective and a risk perspective," Powers said.

Ultimately, the ability to bolster security can fuel modernization efforts, as executives contend with a turbulent cyber risk climate.

Starting with core systems

The average enterprise IT stack is rife with applications and systems, particularly in older organizations or companies that have endured mergers and acquisitions.

As CIOs begin to think about migration, lining up key business processes with the legacy tools that fuel them is an ideal starting point, Powers said.

"The first piece is really starting with understanding what are the critical processes that the organization needs to be able to maintain to continue operations, for revenue generation and providing services," Powers said. "Then figuring out what are the legacy systems and applications supporting each of those."

Documenting, testing and communicating with stakeholders changes forthcoming can be critical to ensuring success throughout a migration process, Powers said. But modernization is an ongoing affair.

CIOs must continue to evaluate IT tools to identify "where it's possible to reduce reliance on legacy systems, where it's possible to retire, to migrate so that you can continue to reduce the risk," Powers said.

Although simply strengthening the cybersecurity posture is a powerful motivator, tech and security leaders can also keep business goals in mind when approaching modernization.

"Often in the information security business, we don't consider the business needs," said Fritz Jean-Louis, principal cybersecurity advisor at Info-Tech Research Group. CIOs and CISOs can collaborate closely to sustain a secure IT environment. 

This process includes identifying areas where overlapping systems are needed.

"If it's core, you should have redundancy," said Jean-Louis.

The modernization process can also help identify the potential business gains of shifting systems to new processes, Lovejoy said.

"It becomes a very interesting dynamic where the security and resiliency people are actually the ones that are writing the business case for modernization nowadays, because of the security and resiliency risk associated with the maintenance of this technology," Lovejoy said. 

Outdated technology is causing banks to lose customers, according to a survey from consulting firm Baringa. The company surveyed 4,000 U.S. and U.K. residents with bank accounts and 400 U.S. and U.K. bank leaders about the digital customer experience.

Legacy technology architecture slowed modernization and hurt customers’ digital experiences, according to 68% of IT leaders and banking executives. Meanwhile, 62% of customers switched or have considered switching banks to find a better digital experience and product from their bank. 

Two-thirds of bank leaders estimated that some of their oldest programming code was written prior to 2000. Nearly one-third of banks' oldest technology infrastructure — including systems such as payments and transaction processing or call center support — dated back to the 1960s or earlier.

Lagging modernization in core IT systems can hinder banks’ ability to differentiate their products and services, threatening their ability to retain customers and respond to digital demands. 

Four in five consumers between the ages of 18 and 54 are comfortable with having an exclusively digital relationship with their bank, according to the Baringa survey. Despite the rise in new technologies facilitating more personalized customer experiences, such as generative AI and AI agents, many bank leaders hesitate to invest due to concerns about how emerging technologies are constantly evolving, David McGibbon, a partner at Baringa, shared in the survey announcement. 

However, old technologies pose risks bank IT leaders must address that not only solve technical problems but improve how customers interact with their banks online, he said. Banks must find ways to improve their online digital experiences to retain customers in the modern era, including strategic investments in new technologies to minimize risks posed by older IT systems. 

"Doing so won’t just solve a technical problem, but the smoother working of the business and the greater customer experience this allows will build customer satisfaction and loyalty, increasing the bank’s performance in all areas," he said.

The banking industry has spent more than $2.8 trillion since 2011 to make products digital, Steve Smith, managing director of the Banking and Capital Markets industry group at Accenture, shared with CIO Dive.

That broad effort to modernize has created a "sea of sameness," he said.

"Customers effectively feel that Bank A is no different than Bank B, is no different than Bank C," Smith said. Banking executives are struggling to create new experiences that help their business stand out in a crowded market, according to Smith. 

Banks are struggling to pull insightful data from core IT systems in real time to create more personalized customer experiences. Yet as bank executives invest in new technologies to enable greater personalization, they're often held back by regulatory, risk and compliance concerns, he added.

"What ends up happening is you get a fairly watered-down impact, because you're hamstrung in terms of where you're actually able to test, learn, grow and scale," Smith said.

For bank executives to win in the era of personalization, executives will need the right technical capabilities to remember and reward customers across the full relationship instead of through individual products, Smith said. That means turning to new tools like generative AI and large language models.

Larger banks are ramping up investment in generative AI capabilities. New technology use cases launched by the 50 biggest financial firms globally doubled from the last half of 2024, according to Evident Insights data. Nine out of the 50 firms documented using AI agents in pilot projects.  

To strengthen customer retention, executives should differentiate services, define technology needed to meet customer expectations and embrace a multiyear technology shift, according to the Baringa survey.

Generative AI is helping enterprises breathe new life into legacy infrastructure, as vendors deploy coding assistants and automation tools that target mainframe estates.

Capgemini rolled out a code conversion toolkit designed to refactor COBOL applications and update aging databases, the IT consulting and services firm said. Rocket Software, which marked 35 years of enterprise IT support this year, unveiled a suite of modernization services, including mainframe anomaly detection automation and a plain-language coding assistant.

Large language model technologies have boosted application refactoring capabilities to the point where many companies are opting to re-engineer mainframe applications rather than migrating them to the cloud, according to ISG market research.

“Service providers are using GenAI to open up new possibilities for clients,” John Schick, ISG consulting lead on mainframe computing, said in the report. “The functions that mainframes have always performed are still essential to many enterprises, and GenAI provides new ways to maximize their value.”

The mainframe ecosystem got an AI boost when IBM delivered the latest workhorse in its Z Systems lineage, the z17 mainframe. The newest member of IBM’s mainframe family comes equipped with Telum II high-capacity AI processors and will reach general availability in June. IBM’s previous Z Systems unit, the z16, had a historically successful run in terms of consistent revenue generation, IBM SVP and CFO James Kavanaugh said during a January earnings call.

Coding tools built on LLM capabilities have already unlocked value across the financial sector and are poised to deliver more, Michael Abbott, Accenture senior managing director and global banking lead, told CIO Dive in January. Goldman Sachs, Bank of America and Citigroup tied tangible efficiency gains to coding tools powered by generative AI models.

Generative AI-assisted coding is spreading across industries, according to a recent Publicis Sapient report. Executives are confident in the technology’s modernization capacity, the digital consulting firm found in a recent survey of 600 IT and business leaders. Four in 5 respondents are eyeing coding assistants to help manage legacy estates, refactor aging applications and automate software testing processes.

“One of the attributes of AI that we like is explainability — the fact that mainframe operations can now be explained in simple English to non-mainframers,” Rocket Software CEO Milan Shetti, told CIO Dive.

The software provider is also bullish on generative AI’s potential as a training tool for future mainframe talent. Rocket is ramping up efforts to address enterprise mainframe skills gaps and prepare engineers for z17 deployments, the company said.

“One of the most pressing challenges facing enterprise IT teams today is the ability to address the IT skills gap while modernizing core systems and scaling operations,” said IDC Group VP Stephen Elliot in the Rocket announcement. “AI is a powerful tool that allows IT to effectively align itself to the business by delivering greater insights and efficiency.”

Capgemini’s efforts center around easing the shift from mainframe to hybrid cloud infrastructure, the company said Wednesday. “Many organizations have already explored various mainframe migration approaches like rehosting, but none of these lead to a mainframe exit option,” Franck Greverie, Capgemini chief portfolio and technology officer, said in the announcement.

As generative AI models matures, the technology can create multiple modernization pathways, Lisa Dyer, SVP at IT services firm Ensono, said in an interview with CIO Dive.

“Clients running mission critical apps on mainframe are not necessarily known historically to be very experimental,” Dyer said. “Generative AI opens up ways to try out various options safely.”

As fast as companies have raced to modernize, legacy technology still lives within most enterprise systems. 

Whether older systems persist due to budget constraints, or they’re so vital that replacing them is a daunting task, legacy software and devices present potential security risks. 

Legacy technology may not be supported with security updates anymore, or devices were acquired so long ago that they were built before ransomware was a looming threat.

No matter why legacy tech sits in a system, companies need to protect those stacks and devices before they become a gateway for systemwide attacks.

The value of security isn’t measured in how many defense solutions a company buys, said Brian Scriber, VP of security and privacy technologies at CableLabs. “You measure it by what’s your weakest point of entry.” 

Legacy technology, modern risk

It’s not surprising that many older devices aren’t capable of modern day protections: some threats didn’t exist when they were created. Older devices were often “built in an area where you didn’t have awareness of things like logging minimum or cryptographic support,” said Scriber.

Companies may have also bought software — whether they know it or not — that uses older technology. “Even though you have that vendor’s most recent solution, you may not have everything in that supply chain,” he said. 

It’s also possible that some companies and organizations may not have the talent to figure out how to protect legacy technology, said Betsy Soehren Jones, partner at West Monroe. 

The talent crunch has been a common problem for utility sector companies, which often use analog technology. Entities that are focused on keeping the lights on may not have resources dedicated to identifying how these critical systems are exposed to potential cybersecurity risks. 

“I don’t know if it’s necessarily a symptom of ‘we don’t know,’ it’s [about] ‘do you have the workforce on staff or can you find a vendor you trust to mitigate or remediate what’s in your environment?’” Soehren Jones said. 

Visibility into legacy tech

When it comes to software, leaders should understand everything that exists in their stack, including the pieces that make up their vendors’ software.

This approach requires having software bills of materials for everything, said Scriber. That way, organizations can have better visibility into their tech stack vulnerabilities. If an attacker exploits security gaps in vendor software, a CISO can quickly identify it, and stop it.

Inventory also needs to be a priority, he added. 

“The quickest and best way to get real results is to understand what you have in your network, how old are the devices, how old is the firmware in the device, when was it updated, what software is included in here, and what things might be lurking under the covers,” Scriber said.  

Companies should also have strong intrusion detection systems, so that if something does start poking at legacy tech, or legacy software starts acting out of pattern, CISOs can identify and stop threats. 

For very old devices, like those that are part of critical infrastructure, basic cybersecurity hygiene can make a difference, said Soehren Jones. “It sounds so simple…but when was the last time somebody changed the password on it? It might have actually been five to 10 years,” she said. 

Some older devices may not be able to take patches "because, if you patch it, is it going to break the whole system?” she said. In those cases, devices should not be internet-facing without firewall protection.  

There has been additional investment in software within sectors that have long been ignored, she said, which means that there may be solutions now that didn’t exist a few years ago. For example, it might have once made sense to have three separate systems tied together, but one solution could now replace them all.

While focus has been put on modernizing older software and devices, exactly what makes a device “legacy” may not be its age, said Scriber. Some newer devices may have been brought to market with a speed-over-safety priority, or they used software older than 10 years old. 

“It’s kind of like buying a new car … you drive it off the lot and suddenly you now have a used car,” he said. “As soon as you deploy them, they become legacy devices.” 

Aging IT environments are driving companies to prioritize modernization as executives grapple with higher than expected maintenance costs and interoperability challenges, according to a report Ensono. The company surveyed 500 IT decision-makers in the U.S. and U.K. at organizations generating more than $500 million in revenue annually. 

Cybersecurity risks, slow release cycles and the high costs of legacy tech maintenance are primary drivers fueling organizations to invest in IT modernization, the Ensono survey found. Nearly half of the respondents said legacy maintenance costs exceeded expectations in the last year. Respondents also cited talent gaps as a stumbling block to revamping IT infrastructure. 

“CIOs and IT leaders clearly recognize where they need to go with modernization, but lapses in workforce availability, expertise, and fluctuating budgets create headwinds that restrict sustained momentum,” Ensono’s Chief Strategy Officer Brian Klingbeil said in a release announcing the study. 

The pace of change prompted by the rise of generative and agentic AI is driving enterprises to prioritize modernizing their IT systems, analysts said. 

“One of the things that slows down agility and creates friction is just the time and effort it takes to maintain legacy infrastructure, legacy workloads, that weren’t designed for this rapid pace of change,” said Niel Nickolaisen, an adjunct research advisor for consulting firm IDC’s IT executive program. 

CIOs must evaluate areas where it’s possible to retire or lessen reliance on legacy systems, according to panelists speaking during a CIO Dive and Cybersecurity Dive virtual event in August. Particularly as IT teams understand that legacy environments “just won’t scale” with the rapid changes businesses are undergoing today, said Gartner VP Analyst Jeff Vogel. 

Not only are older IT systems costly to support and maintain, they might also increasingly lack the talent needed to operate them. If skills required to maintain legacy systems are scarce, it makes the project a high-priority modernization candidate, Nickolaisen said. 

Modernization efforts will require IT teams to assess whether it’s worth the cost for an organization to keep a legacy system over replacing it,  Nickolaisen said. The Ensono survey revealed that enterprises starting modernization efforts can be slowed by focusing on the interoperability of legacy IT systems with newer platforms.

Nearly 3 in 5 respondents work at organizations functioning in a hybrid IT environment, with legacy IT systems still playing a critical role in day-to-day operations, according to Ensono. 

“You’ve got to look at it on a case-by-case basis and decide what is the pain in keeping it, what’s the pain in integrating it with everything else and how does that compare to the cost of replacing it,” Nickolaisen said. 

IT teams will be operating in hybrid environments for the foreseeable future, Nickolaisen expects, despite the greater focus on IT modernization prompted by AI developments.

Mainframe workforce demographics are shifting as veteran engineers retire and younger technologists join the ranks, according to BMC. The IT service management provider surveyed 1,000 mainframe technologists for its 20th annual report.

Just over half of respondents identified as millennials, up from 36% seven years ago. Generation Z mainframers comprised 15% of this year’s respondents, a jump from just 1% in 2018.

“Twenty years ago, the conversation around the mainframe was often about its longevity,” John McKenny, SVP and GM of Intelligent Z optimization and transformation at BMC, said in an announcement accompanying the report. "That narrative has completely transformed … A new generation of professionals is embracing the platform, driving innovation and leveraging AI technologies.”

While cloud threatened to supplant mainframe as a core enterprise platform, the compute workhorse has proven remarkably resilient. Broad concerns about data privacy and security related to the use of cloud-based generative AI technologies have helped bolster mainframe’s reputation in recent years.

“If you have a mainframe, it’s almost certainly running critical business applications, regardless of the industry,” McKenny told CIO Dive in July. “These organizations wouldn’t have a mainframe if it wasn't running a core application.”

Sentiment around the mainframe’s projected lifespan has shifted along with the demographic composition of the workforce maintaining the units. 

Nearly every respondent to the BMC survey — 97% — viewed mainframe as a long-term environment suited for new workloads, which was the highest percentage in the survey’s two-decade span. Almost three quarters of respondents said their organization was expanding its mainframe capacity; more than one-third attributed the growth to novel applications or a mix of legacy and new apps.

Generative AI workloads, including agentic tools, are some of the platform’s most recent arrivals. More than 4 in 5 organizations have implemented or plan to deploy large language models in mainframe environments, according to a Kyndryl survey of 500 business and IT professionals published earlier this month.

LLM coding capabilities are also helping sustain mainframes as engineers leverage generative AI assistants to modernize legacy applications.

Capgemini targeted aging COBOL code and databases, and Rocket Software leveraged natural language processing to overcome mainframe modernization hurdles with AI assistants rolled out in May. BMC also has an automated mainframe intelligence tool, called BMC AMI Assistant, that deployed last year and IBM’s watsonx assistant increased its capabilities to include a library of over 100 programming languages in October. 

As the mainframe workforce gets younger, generative AI models trained on legacy code are helping bridge the inherent skills gaps created when veteran engineers retire, leaving newer hires to grapple with aging applications, McKenny said.

The latest generation of mainframe, IBM's z17, meets developers on AI-native soil, with processors designed for high-capacity workloads and a retooled operating system that can run applications in Python as well as COBOL, C and Java.