EvolveWare Blog

Hidden Risks of Modernizing Legacy Systems to COTS Products

EvolveWare

Is Your Government Agency Considering Moving Legacy Systems to Commercial-Off-the-Shelf or COTS Products? Read this first.

According to Gartner’s 2024 CIO and Technology Executive Survey, 75% of Government CIOs and executives are increasing funding for application modernization projects this year. There are a whole host of reasons behind this surge: the desire to harness new AI technologies, the desire to provide citizens with enhanced digital experiences, the challenge of recruiting talent with legacy knowledge, and the pressing need to address cyber security vulnerabilities. For instance, the White House recently issued a report recommending developers reduce dependency on programming languages like C and C++ due to memory safety vulnerabilities that increase the risk of cyberattacks. While Government IT leadership clearly recognizes the urgency around assessing and moving off legacy technologies, planning for and implementing these projects can be quite the undertaking. In recent years, many of these government agencies have turned to third party software vendors and commercial-off-the-shelf software, or COTS Products, as a way to speed up the modernization process and remove the need to internally maintain certain code components such as code that goes into creating a user interface. Some examples of these vendors include Gainwell Technologies who provide a modern state government Medicaid system, Curam Software, and Oracle’s suite of software solutions.

But deciding to move to these third-party products hasn’t always resulted in the faster and easier solution that agencies had hoped for. Many of them have faced project delays, budget overruns, and/or project failures in trying to move existing systems to these platforms.

So what gives? Is the strategy of moving to third party or COTS products not tenable? The short answer is no. State agencies can indeed benefit from moving to these third-party vendors IF they do the work upfront to understand their unique system needs and use that information to validate that a viable COTS product exists.

Case Study: Lessons Learned from Department of Veterans Affairs EHR Modernization Project

The Department of Veterans Affairs (VA) has been working on a modernized version of their electronic health records (EHR) system since 2018, after 3 previous attempts. The original system dubbed VistA, or the Veterans Health Information Systems and Technology Architecture, was developed by the agency 40 years ago and has grown to support approximately 100MM or more veteran medical encounters in a year. While the system is generally applauded by its users, it was becoming expensive to maintain due to the legacy programming language it was written in (Mumps) and made it hard for the agency to share data with relevant organizations such as the Department of Defense and community providers. So the agency signed a contract to move to a platform created by Cerner (now Oracle Cerner) for what was to be a 10 year modernization project. Almost 6 years into the project, there have been multiple delays and the original budget of $10B has already ballooned to $16B with the project roll-out halted until at least this summer.

One key reason called out for why the project has not gone according to plan is the difference in what the Oracle Cerner system is designed for versus what makes VA patients unique and therefore what the VA system requires. For example, the Oracle Cerner system is designed around billing which is not a priority for VA hospital providers. In addition, the VA requires management of referrals and care outside of their services. All these differences need to be reflected in the policies and logic that the system executes. That is where the number one lesson for planning and managing these projects comes from: an agency must start by understanding their source application both from a technical level as well as from a policy or “business rule” level.

Understand the policies running in your current system and develop requirements for your future system

Business rules extraction is the process of understanding and inventorying the organizational policies that are implemented through the execution of consolidated business logic. See examples and more about the difference between business logic and business rules here. These rules can then be analyzed and audited by an organization in order to:

Determine which rules or policies are still relevant for a future system
Retire any rules or policies that are no longer relevant
Identify which rules may need to be added for a future system.

This process is critical for many types of modernization efforts including those where a third-party product replacement is being considered for a current application or system. The process can either be used to determine which third party platform is the best fit to replace a legacy system (if one exists), or if a third-party tool has already been chosen, it can be used to determine which policies are not currently but need to be implemented in that tool.

A State’s Medicaid system case study

EvolveWare was recently involved in a project where a State was looking to move its Medicaid system to a modern third-party equivalent. In order to determine if that third-party product contained the appropriate functionality, the software vendor recruited us to use our Intellisys platform as an automation tool to speed up and de-risk the extraction of the business rules or policies from the source system and compare to the policies being implemented out of the box in the new product. Any functionality that was missing was deemed a policy that needed to be imported into the new, modern platform. For about 1.3MM lines of code, the rules extraction initiative was completed in 6 months, and the client was provided with all the information needed to evaluate if any critical policies still required implementation in their new platform.

While it may seem time-consuming to go through this process when trying to save time by moving to COTS products, taking this step upfront will actually reduce time and wasted budgets on the backend. And most importantly, having the inventory and analysis of the policies contained in your current system will give you the peace of mind of knowing that no critical functionality is missing, particularly when citizens’ lives and well-being are affected by these systems.

To learn more about how Intellisys can help you evaluate if moving to commercial-off-the-shelf software is the right move, contact us.

Our Newsletter

Stay up to date with the latest from EvolveWare

Resources

Plan and Implement Application Modernization Initiatives to Achieve Success

Learn More from Our Customers

Schedule a consultation for more insights and practical modernization advice.

6 Modernization Use Cases for Business Rules in System Analysis and Design

Agile Business Rules Extraction (BRE) is a modern approach to identifying and documenting the policies and algorithms hidden within legacy software. Business rules are a fundamental component of system analysis and design. Using the Intellisys platform, organizations can uncover and leverage these rules or policies to ensure the success of digital transformation projects, such as re-imagining and rebuilding systems or migrating to modern platforms like Oracle ERP or low-code environments.

Key Takeaways:

The role of business rules in system analysis and design: Organizations that attempt system migrations without first extracting their legacy rules risk losing critical policies “in translation.” Having documented rules gives developers and AI models a reliable blueprint for rebuilding with confidence.

BRE helps clean up bloated software portfolios: The extraction process surfaces obsolete rules, duplicate logic, and dead code across systems — allowing organizations to rationalize their application landscape and cut unnecessary complexity.

Human-readable rules are a compliance superpower: In regulated industries, being able to point auditors to plain-English translations of cryptic COBOL or legacy code is invaluable. It removes the dependency on a handful of technical experts to explain system behavior.

Extracted rules inform smarter platform decisions: Rather than guessing which systems belong on a COTS product, a low-code platform, or a custom build, organizations can use rule complexity as an objective measure — as the U.S. Air Force did when evaluating 55 systems for Oracle ERP compatibility.
Agile BRE eliminates the dreaded “code freeze.” Traditional extraction required halting all policy updates during the process. Modern platforms like Intellisys allow continuous updates, ensuring extracted rules stay in sync with the live environment and are immediately usable in modernized systems.

In the world of IT, legacy systems are often described as “black boxes.” They perform critical functions—processing insurance claims, managing military logistics, or handling state-wide tax records—but the exact logic governing these functions is often buried under decades of code updates and lost documentation.

Business Rules Extraction (BRE) is the process of uncovering the policies and algorithms embedded within these systems. Once these rules are extracted, they cease to be “trapped” logic and instead become versatile assets that can drive an organization’s future. Based on the capabilities of the Intellisys platform, here is a deep dive into key use cases for business rules in system analysis and design, once they are successfully extracted from a legacy environment.

1. Driving Digital Business Transformation

The primary use for extracted business rules is to serve as the blueprint for digital business transformation. Many organizations find that their transformation initiatives—such as moving to the cloud or rebuilding a system from the ground up—stumble because they do not fully understand the logic running in their current environment.

By extracting these rules, organizations can:

Re-imagine and rebuild systems with confidence: Instead of guessing how a legacy system handles a specific edge case, developers have a documented list of rules to replicate or update in the new system based on evolving business needs.
Ensure functional parity: Extracted rules allow a new application to maintain the same business logic as the legacy version, ensuring that no critical policy is “lost in translation” during the migration.

2. Streamlining Portfolio Rationalization

Large organizations often suffer from “bloated” software portfolios where multiple systems perform overlapping functions. Extracted rules are the key to application rationalization.

Through the BRE process, organizations can identify:

Obsolete rules: Logic that is no longer used by the business but still exists in the code.
Duplicate rules: Situations where the same policy is being calculated or enforced in multiple ways across different systems.
Dead code: By using tools like Intellisys to deactivate “dead weight” and environment-specific code blocks, organizations can slim down their logic to only what is necessary for the business.

3. Satisfying Audit and Compliance Requirements

In highly regulated industries, it isn’t enough for a system to work; you must be able to prove how it works. Extracted business rules are invaluable for audit and compliance.

Legacy code is often written in cryptic languages (like COBOL or early Java) that auditors cannot read. BRE tools bridge this gap by providing a plain English translation of these tools. This allows both technical and management personnel to verify that the software is adhering to current legislative and business policies. If a regulator asks why a certain decision was made by the system, the organization can point to a specific, human-readable rule extracted directly from the source code. AI-Augmented platforms such as Intellisys use the latest technologies to automate the generation of these summaries, saving organizations more time and effort.

4. Facilitating Modern Platform Selection

One of the most strategic uses of extracted rules is informing the selection of a new technology stack. Not every legacy application belongs on the same modern platform. BRE helps organizations identify which applications are best suited for:

Commercial Off-the-Shelf (COTS) Products: For example, the U.S. Air Force wanted to do a comprehensive analysis of USAF legacy systems to determine whether the Oracle E-Business Suite Enterprise Resource Planning (ERP) system would be a good fit. To do so, they extracted and rationalized rules from 55 different systems to determine which ones should be implemented in the Oracle ERP suite and how best to do so.
Low-Code/No-Code Platforms: By understanding the complexity of the extracted rules, IT leaders can decide if an application can be moved to a low-code environment or if it requires a more robust custom build.

5. Architecting for Microservices

Modern software architecture is built on microservices—small, independent units of logic. Extracted business rules provide the “DNA” for these services. Once rules are extracted and consolidated, they can be transformed into modern code and used to define and generate specific microservices. This allows a massive, monolithic legacy application to be broken down into agile, manageable components that are easier to update and scale.

6. Bridging the Gap Between IT and Business

In many legacy environments, there is a “knowledge silo” where only a few senior developers understand the code. When business rules are extracted and exported into project management tools like Jira, they become visible to the entire organization.

This visibility allows for:

Better Informed Decisions: The State of New York extracted business rules from 31 million lines of legacy code written for their Integrated Eligibility System (IES). They then exported these rules into Jira to help them plan a rebuild of the entire IES system.
Clearer Communication: Because rules are presented at a granular level and annotated for readability, business stakeholders can provide feedback on the logic without needing to understand the underlying programming language.

The Importance of the "Agile" Approach

A significant challenge in traditional rules extraction is the “code freeze.” Historically, organizations had to stop making policy updates while the extraction took place. However, Agile BRE (as seen on the Intellisys platform) allows for continuous updates.

If a legislative policy changes while the extraction is in progress, the platform can automatically transfer those code updates without affecting unrelated rules. This ensures that the finalized, extracted rules are always in sync with the live business environment, making them immediately ready for use in a modernized system.

The Future of Business Rules in System Analysis and Design: User Stories and Tech Specs

Extracted business rules are more than just documentation; they are the functional core of each organization. Whether they are being used to rationalize a portfolio, validate a COTS platform, or generate microservices, these rules provide the clarity needed to move from a legacy-bound past to a digitally transformed future.

While extracting and understanding business rules will continue to remain important for all the reasons outlined above, the latest technologies are enabling organizations to use these higher level policies in a multitude of ways while reducing time and effort spent on transformation. Platforms such as Intellisys now allow automated generation of user stories or technical specifications. The user stories can be exported and used as part of a system re-write. The technical specifications can be automatically converted into code using spec-driven development tools or custom AI pipelines.

With platforms like Intellisys bridging the gap between legacy logic and modern development, organizations no longer have to treat their past as a barrier — instead, they can use it as the blueprint for a faster, smarter, and more confident path forward.

Contact us to see how Intellisys can help leverage your business rules in system analysis and design use cases for legacy applications.

Application Assessment Application Modernization Documentation & Analysis

Successful AI Adoption Requires Technical Debt Management Tools

Article Summary: AI-assisted development is generating architectural technical debt faster than it resolves it— creating systemic instability for unprepared organizations. Adopting the right technical debt management tool to meet an organization’s requirements is imperative. EvolveWare has been recognized as a Representative Vendor in the 2026 Gartner® Market Guide for Technical Debt Management Tools. The company’s Intellisys platform helps organizations get ahead of this risk by providing deep visibility into existing systems across legacy and modern codebases.

According to the 2026 Gartner® Market Guide for Technical Debt Management Tools (accessible to Gartner subscribers only), “By 2028, AI will create more technical debt on architecture levels than it solves.”¹ As organizations such as Microsoft and Anthropic roll out tools to address fixing code level technical debt, the remaining technical debt will be in architecture, system design, and dependencies. According to the Market Guide, that debt “creates systemic instability and long-term fragility.”¹ This report is not the only one that mentions the potential pitfalls of AI-assisted development. In a report on the state of AI generated code, Sonar found that 61% of developers agree that AI often produces code that seems correct but isn’t reliable. They also found that 90% of issues associated with AI generated code are considered code smells or harder to pinpoint maintainability challenges. This means that a lot of potential time savings from using AI code generators are getting eaten up by oversight and verification that is required later. Or worse, if that verification is not performed, potential system failures may occur.

That’s why one of the report’s key recommendations is to “Prioritize the adoption of a technical debt management tool that addresses your most pressing need: architectural technical debt reduction, code quality improvement, application portfolio prioritization, or preparation for large scale system modernization.”¹ EvolveWare is proud to be recognized as a Representative Vendor in this report. The company’s Intellisys Platform uses AI and automation to speed up and de-risk key processes involved in maintaining and modernizing applications, including providing robust documentation, diagrams, and reports of the current state of applications. Organizations can start simply by understanding their current systems and then use that information for future portfolio prioritization or modernization initiatives. For those who choose to rationalize or modernize their systems, the platform extracts unparalleled context from source systems and allows users to use that information to refactor first to power successful system migrations.

This is even more important for those with legacy systems or systems written in older technologies. With legacy systems there is the existing technical debt and then there is the new technical debt that is introduced when trying to adopt these newer AI technologies. If an organization is not careful, the compound of all of this can create major security gaps, budget overruns or complete shutdowns. Since the Intellisys platform supports reverse-engineering of applications written in 20+ languages including both legacy and modern ones, large organizations are able to assess entire portfolios written across multiple years as opposed to only being able to concentrate on a few. A State’s Department of Transportation used the tool to create an enterprise repository for consumable inventory applications written in COBOL, C#.NET with T-SQL, PL/SQL, and VB .NET prior to moving off the mainframe.

Organizations are also able to continue to assess the state of their code as changes are made. Intellisys supports agile documentation capabilities where newer versions of the source code can be processed and reports are generated identifying where changes to the code have been made and the impact. While working on a modernization initiative for their large IES system, the State of New York used this feature to identify where changes in the production code were made and how they impacted modernization work that had been performed prior to those changes. This ensured that the modernized version of the application would be in sync with any updates made to the production version of the code, as the project involved 31 million lines of legacy code and took 3 years to complete.

The relationship between AI adoption and technical debt is neither simple nor one-directional. AI offers productivity gains, but those gains come with architectural and maintainability costs that are only beginning to be fully understood. As the evidence from Gartner, Sonar, and others makes clear, the organizations best positioned to benefit from AI-assisted development are those that approach it with discipline — maintaining visibility into their systems, enforcing architectural standards, and actively managing the debt that accumulates over time.

For organizations carrying legacy systems into this new era, the stakes are particularly high. The compounding effect of pre-existing technical debt and the new debt introduced by AI adoption is not a theoretical risk — it is an operational one. The good news is that the tools and frameworks needed to manage this challenge are maturing alongside the AI technologies creating it. As AI continues to reshape how software is built and maintained, organizations that invest in understanding what they have today using a robust technical debt management tool will be far better equipped to make sound decisions about where they are going tomorrow.

To learn more about EvolveWare’s Intellisys Platform technical debt management tool capabilities, contact us.

1 Gartner, Market Guide for Technical Debt Management Tools, Tigran Egiazarov, Howard Dodd,Aaron Harrison, 13 April 2026

Gartner is a trademark of Gartner, Inc. and/or its affiliates

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Application Assessment Documentation & Analysis

Legacy Application Mapping: The Compass to Successful Modernization

Article Summary: Thorough legacy application mapping and documentation is an essential prerequisite for any modernization effort. Undocumented legacy systems carry serious risks including hidden security vulnerabilities, mounting technical debt, and the danger of losing critical business logic during migration. Modern AI-powered tools have dramatically accelerated this process — reducing documentation time by over 95% and enabling continuous updates without code freezes. Real-world examples, including a Department of Defense system and a global insurance company, demonstrate that investing in documentation first leads to faster, higher-quality modernization outcomes. Keep reading to learn more.

In the world of enterprise IT, legacy systems are often treated like ancient, mysterious artifacts. They are foundational to the business, yet few people truly understand how they work from the inside out. As the original developers who built these systems retire from the workforce, organizations are left with millions of lines of code—often in languages like COBOL, Fortran, or PowerBuilder—that have been patched and extended for decades. This “black box” scenario creates a significant barrier when it comes time for legacy modernization.

Many organizations realize that legacy application mapping or creating application documentation is not just a secondary administrative task; it is a critical requirement for future planning and a fundamental prerequisite for any successful transformation, even more so when using newer AI technologies. Without a comprehensive understanding of the current state, any attempt to modernize is akin to sailing into a storm without a compass.

The Hidden Risks of Undocumented Code

The lack of in-depth understanding regarding source code is one of the primary challenges that compromises an organization’s ability to generate scalable future applications. Legacy systems that have been modified over many years often contain hidden security vulnerabilities, making them prime targets for hackers. Furthermore, these systems typically carry immense technical debt, which create unnecessary costs for organizations. In a recent Deloitte survey on Global Technology Leadership, they estimate that technical debt accounts for 21% to 40% of an organization’s IT spending.

When thorough legacy application mapping is missing or outdated, the risks of modernization skyrocket. There is a very real fear of unknowingly leaving out a vital business rule or a critical line of code during the migration process. This is particularly true for large-scale government or enterprise projects where hundreds of systems may be interconnected and where regulations are a large concern. For example, the Department of Defense once struggled with a critical recruitment system that had become impossible to maintain because so little knowledge existed regarding its internal workings, as it had been developed by multiple third-party vendors over several years and no current documentation existed. The system had essentially failed by the time modernization became imperative.

Legacy Application Mapping as a Strategic Foundation

Modernization is rarely a one-size-fits-all process. Depending on the organization’s goals, the path might involve a Business Transformation or a Technology Transformation.

Business Transformation: This involves changing business models and processes. In this scenario, Agile Business Rules Extraction (BRE) is essential. Detailed documentation allows subject matter experts to identify and extract embedded business logic and policies so they are not lost when moving to a new platform like a COTS or Low-code/no-code environment. It will also allow organizations to identify which rules to keep, update and/or retire for their future system(s).
Technology Transformation: This focuses on replacing outdated systems to reduce costs and staff attrition risks. Here, the modernization path typically chosen is Code Optimization & Migration. Current documentation helps with determining how to best optimize the code prior to migrating it, allowing developers to identify and deactivate dead or unwanted code before migrating to a modern language like Java or C#. In addition, code transformation to modern technologies is only as successful as the detail or context provided to it. This context relies on the mapping or documentation generated.

In both cases, obtaining a foundational understanding of the application is the first step.

The Power of Automated Documentation

Traditionally, documenting a legacy system was a manual, grueling process that required months of interviews and code reviews. However, modern platforms like Intellisys have revolutionized this by using AI and machine learning to automate the process.

Automated documentation provides several game-changing benefits:

Speed and Efficiency: Automation can lead to a 95%+ reduction in the time required to generate application documentation.
Accuracy and Completeness: Human error is a significant risk in manual documentation. Automated bookkeeping ensures that no critical dependencies or data flows are missed.
Continuous Updates (No Code Freezes): One of the biggest hurdles in modernization is the “code freeze,” where developers must stop making changes to the live system while it’s being documented. Advanced automation allows the documentation and knowledge repository to be continuously updated even as changes are made to the legacy application.

Accessibility for Non-Experts: Documentation “translates” legacy code into a format that more people can understand. As noted by technical leads at BMI, automated tools like Intellisys make COBOL code available to a large group of people who are technical but not fluid in mainframe programming, allowing them to see program relationships and attribute changes clearly.

Real-World Examples

The criticality of documentation is best seen through the success of organizations that prioritized it. The Department of Defense, for instance, was able to transform the old, undocumented recruitment system mentioned above into a modern, multi-tiered Java architecture in record time by using automated optimization and migration solutions. By first establishing a 100% automated extraction of metadata, they were able to document, modernize, and deploy a system of 220,000 lines of code in just 6.5 months.

Similarly, a Global Insurance Company was facing critical risks across legacy systems powering insurance policy renewals, premium calculations, and claims processing. Documenting these systems to both plan the modernization effort as well as provide essential context for code migration was key. Due to the robust nature of the mapping provided, 2 million lines of legacy code in IBM iSeries COBOL, Oracle Forms & Reports, and .NET were migrated to modern Java and .NET at a 95% automation rate.

Agile Documentation Enables Continuous Modernization

In the rush to adopt new technologies like the cloud, AI, or microservices, it is tempting to skip the “boring” work of legacy application documentation. However, the evidence from the sources is clear: documentation is the key to modernization success. It reduces maintenance costs, identifies vulnerabilities, preserves critical business rules, and provides the “evidence” needed to make smart decisions about the future of an application portfolio.

It is vital to view documentation not as a one-time project, but as a living asset. The most successful modernization journeys involve creating an application knowledge base that evolves with the transformation. Once an application is moved to a modern language, maintaining that documentation ensures the organization never falls back into the “black box” trap.

Modernization is a journey. But you can’t know where you are without the legacy application mapping that documentation provides. Whether you are aiming for a total business transformation or a targeted technology update, your first step should always be to understand your applications to plan for the future.

To learn more about legacy application mapping within the Intellisys platform, download our infographic or contact us.

EvolveWare Blog

Hidden Risks of Modernizing Legacy Systems to COTS Products

EvolveWare

Our Newsletter

Stay up to date with the latest from EvolveWare

Resources

Plan and Implement Application Modernization Initiatives to Achieve Success

Learn More from Our Customers

Schedule a consultation for more insights and practical modernization advice.

You May Also Like...

6 Modernization Use Cases for Business Rules in System Analysis and Design

1. Driving Digital Business Transformation

2. Streamlining Portfolio Rationalization

3. Satisfying Audit and Compliance Requirements

4. Facilitating Modern Platform Selection

5. Architecting for Microservices

6. Bridging the Gap Between IT and Business

The Importance of the "Agile" Approach

The Future of Business Rules in System Analysis and Design: User Stories and Tech Specs

Successful AI Adoption Requires Technical Debt Management Tools

Legacy Application Mapping: The Compass to Successful Modernization

The Hidden Risks of Undocumented Code

Legacy Application Mapping as a Strategic Foundation

The Power of Automated Documentation

Real-World Examples

Agile Documentation Enables Continuous Modernization

Submit A Comment

Learn More About the Intellisys Platform

Overview of the Intellisys Platform

Documentation & Analysis

Agile Business Rules Extraction

Code Optimization & Migration

EvolveWare Blog

Hidden Risks of Modernizing Legacy Systems to COTS Products

EvolveWare

Our Newsletter

Stay up to date with the latest from EvolveWare

Resources

Plan and Implement Application Modernization Initiatives to Achieve Success

Learn More from Our Customers

Schedule a consultation for more insights and practical modernization advice.

You May Also Like...

6 Modernization Use Cases for Business Rules in System Analysis and Design

1. Driving Digital Business Transformation

2. Streamlining Portfolio Rationalization

3. Satisfying Audit and Compliance Requirements

4. Facilitating Modern Platform Selection

5. Architecting for Microservices

6. Bridging the Gap Between IT and Business

The Importance of the "Agile" Approach

The Future of Business Rules in System Analysis and Design: User Stories and Tech Specs

Successful AI Adoption Requires Technical Debt Management Tools

Legacy Application Mapping: The Compass to Successful Modernization

The Hidden Risks of Undocumented Code

Legacy Application Mapping as a Strategic Foundation

The Power of Automated Documentation

Real-World Examples

Agile Documentation Enables Continuous Modernization

Submit A Comment

Learn More About the Intellisys Platform

Overview of the Intellisys Platform

Documentation & Analysis

Agile Business Rules Extraction

Code Optimization & Migration

Intellisys: Supported Technologies

Overview of the Intellisys Platform

Agile Business Rules Extraction