{"id":1160,"date":"2026-03-27T10:00:00","date_gmt":"2026-03-27T10:00:00","guid":{"rendered":"https:\/\/wade.one\/blog\/?p=1160"},"modified":"2026-03-27T10:00:00","modified_gmt":"2026-03-27T10:00:00","slug":"what-makes-a-legacy-system-dangerous","status":"publish","type":"post","link":"https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/","title":{"rendered":"What Makes a Legacy System Dangerous"},"content":{"rendered":"<p>A legacy system is not dangerous just because it is old.<\/p>\n<p>I have seen plenty of older systems that were boring, understandable, and stable enough to keep earning their keep. I have also seen newer systems that were far more dangerous because they were badly designed, badly owned, and impossible to change safely.<\/p>\n<p>That is the part people miss. Age is not the real issue. Risk is.<\/p>\n<h2>The first danger sign: nobody really understands it<\/h2>\n<p>The most dangerous legacy systems are the ones where understanding has collapsed.<\/p>\n<p>Nobody fully knows how the moving parts fit together. The business rules live in old code, half-remembered conversations, and production behavior that nobody wants to touch. A few strange jobs run on a schedule. Some integrations fail in ways that only one person knows how to fix. A deployment step exists because &#8220;it has always been done that way.&#8221;<\/p>\n<p>That is when a system becomes dangerous.<\/p>\n<p>Not because it is ugly, but because it is opaque.<\/p>\n<h2>The second danger sign: change becomes scary<\/h2>\n<p>If every change feels risky, expensive, and slow, you have a dangerous system.<\/p>\n<p>That usually means some combination of:<\/p>\n<ul>\n<li>poor or missing test coverage<\/li>\n<li>weak observability<\/li>\n<li>tightly coupled components<\/li>\n<li>manual release processes<\/li>\n<li>unclear rollback paths<\/li>\n<li>fragile integrations with outside systems<\/li>\n<\/ul>\n<p>At that point the real problem is not just technical debt. It is operational fear.<\/p>\n<p>Teams stop improving the system because they do not trust what will happen if they touch it. So the system gets worse, not because people are lazy, but because the cost of change keeps climbing.<\/p>\n<h2>The third danger sign: it cannot be maintained properly<\/h2>\n<p>This is where legacy turns from annoying into risky.<\/p>\n<p>If the dependencies are out of support, the runtime is hard to patch, the deployment model is brittle, or the infrastructure relies on hand-built knowledge, then the system is not just old. It is exposed.<\/p>\n<p>That exposure might be:<\/p>\n<ul>\n<li>security risk<\/li>\n<li>compliance risk<\/li>\n<li>availability risk<\/li>\n<li>staffing risk<\/li>\n<li>vendor lock-in risk<\/li>\n<\/ul>\n<p>A lot of organisations ignore this phase because the system still &#8220;works.&#8221; But a system can keep working right up until the day it becomes a serious business problem.<\/p>\n<h2>The fourth danger sign: all the knowledge sits with too few people<\/h2>\n<p>If one or two people are carrying the system in their heads, that is a risk whether they are employees, contractors, or external vendors.<\/p>\n<p>This is the classic legacy trap. The business depends on the system, but the real documentation is a person. If they leave, get pulled onto something else, or simply stop wanting to be the emergency contact, the organisation discovers how little control it actually has.<\/p>\n<p>That is why bus factor matters more than people like to admit.<\/p>\n<h2>What I look for instead<\/h2>\n<p>When I assess a legacy system, I am not mainly asking whether the code looks modern.<\/p>\n<p>I care more about:<\/p>\n<ul>\n<li>can we change it safely<\/li>\n<li>can we see what it is doing<\/li>\n<li>can we deploy it repeatably<\/li>\n<li>can we recover from failure<\/li>\n<li>can more than one person understand it<\/li>\n<li>can we keep it patched and supported<\/li>\n<\/ul>\n<p>If the answer to most of those is no, then the danger is real even if the application still appears to be doing its job.<\/p>\n<h2>My view<\/h2>\n<p>The dangerous legacy systems are not the ones that are merely old.<\/p>\n<p>They are the ones that have become opaque, brittle, under-observed, under-owned, and too important to fail.<\/p>\n<p>That is when the conversation needs to move beyond &#8220;technical debt&#8221; and into business risk.<\/p>\n<p>Because once a system is hard to understand, hard to change, and hard to recover, it is no longer just inconvenient.<\/p>\n<p>It is dangerous.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A legacy system is not dangerous just because it is old. It becomes dangerous when nobody can change it safely, nobody can see what it is doing, and the business depends on it anyway.<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[13,25],"tags":[43,45,46,48],"class_list":["post-1160","post","type-post","status-publish","format-standard","hentry","category-programming","category-software-engineer","tag-consulting","tag-legacy-systems","tag-software-architecture","tag-technical-debt"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What Makes a Legacy System Dangerous - wade.one<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Makes a Legacy System Dangerous - wade.one\" \/>\n<meta property=\"og:description\" content=\"A legacy system is not dangerous just because it is old. It becomes dangerous when nobody can change it safely, nobody can see what it is doing, and the business depends on it anyway.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/\" \/>\n<meta property=\"og:site_name\" content=\"wade.one\" \/>\n<meta property=\"article:published_time\" content=\"2026-03-27T10:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/Wade-Logo-cropped.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1518\" \/>\n\t<meta property=\"og:image:height\" content=\"1506\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@wadewomersley\" \/>\n<meta name=\"twitter:site\" content=\"@wadewomersley\" \/>\n<meta name=\"twitter:label1\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/03\\\/27\\\/what-makes-a-legacy-system-dangerous\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/03\\\/27\\\/what-makes-a-legacy-system-dangerous\\\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"What Makes a Legacy System Dangerous\",\"datePublished\":\"2026-03-27T10:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/03\\\/27\\\/what-makes-a-legacy-system-dangerous\\\/\"},\"wordCount\":611,\"publisher\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#\\\/schema\\\/person\\\/8b4739f8f8bb2cff5d792d4b8779fcc3\"},\"keywords\":[\"consulting\",\"legacy-systems\",\"software-architecture\",\"technical-debt\"],\"articleSection\":[\"Programming\",\"Software Engineer\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/03\\\/27\\\/what-makes-a-legacy-system-dangerous\\\/\",\"url\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/03\\\/27\\\/what-makes-a-legacy-system-dangerous\\\/\",\"name\":\"What Makes a Legacy System Dangerous - wade.one\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#website\"},\"datePublished\":\"2026-03-27T10:00:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/03\\\/27\\\/what-makes-a-legacy-system-dangerous\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/03\\\/27\\\/what-makes-a-legacy-system-dangerous\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/2026\\\/03\\\/27\\\/what-makes-a-legacy-system-dangerous\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/wade.one\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What Makes a Legacy System Dangerous\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/wade.one\\\/blog\\\/\",\"name\":\"wade.one\",\"description\":\"wade womersley - york based software engineer\",\"publisher\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#\\\/schema\\\/person\\\/8b4739f8f8bb2cff5d792d4b8779fcc3\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/wade.one\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/#\\\/schema\\\/person\\\/8b4739f8f8bb2cff5d792d4b8779fcc3\",\"name\":\"Wade Womersley\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/02\\\/200px.png\",\"url\":\"https:\\\/\\\/wade.one\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/02\\\/200px.png\",\"contentUrl\":\"https:\\\/\\\/wade.one\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/02\\\/200px.png\",\"width\":202,\"height\":200,\"caption\":\"Wade Womersley\"},\"logo\":{\"@id\":\"https:\\\/\\\/wade.one\\\/blog\\\/wp-content\\\/uploads\\\/2015\\\/02\\\/200px.png\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What Makes a Legacy System Dangerous - wade.one","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/","og_locale":"en_GB","og_type":"article","og_title":"What Makes a Legacy System Dangerous - wade.one","og_description":"A legacy system is not dangerous just because it is old. It becomes dangerous when nobody can change it safely, nobody can see what it is doing, and the business depends on it anyway.","og_url":"https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/","og_site_name":"wade.one","article_published_time":"2026-03-27T10:00:00+00:00","og_image":[{"width":1518,"height":1506,"url":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/Wade-Logo-cropped.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_creator":"@wadewomersley","twitter_site":"@wadewomersley","twitter_misc":{"Estimated reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/#article","isPartOf":{"@id":"https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/"},"author":{"name":"","@id":""},"headline":"What Makes a Legacy System Dangerous","datePublished":"2026-03-27T10:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/"},"wordCount":611,"publisher":{"@id":"https:\/\/wade.one\/blog\/#\/schema\/person\/8b4739f8f8bb2cff5d792d4b8779fcc3"},"keywords":["consulting","legacy-systems","software-architecture","technical-debt"],"articleSection":["Programming","Software Engineer"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/","url":"https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/","name":"What Makes a Legacy System Dangerous - wade.one","isPartOf":{"@id":"https:\/\/wade.one\/blog\/#website"},"datePublished":"2026-03-27T10:00:00+00:00","breadcrumb":{"@id":"https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/wade.one\/blog\/2026\/03\/27\/what-makes-a-legacy-system-dangerous\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/wade.one\/blog\/"},{"@type":"ListItem","position":2,"name":"What Makes a Legacy System Dangerous"}]},{"@type":"WebSite","@id":"https:\/\/wade.one\/blog\/#website","url":"https:\/\/wade.one\/blog\/","name":"wade.one","description":"wade womersley - york based software engineer","publisher":{"@id":"https:\/\/wade.one\/blog\/#\/schema\/person\/8b4739f8f8bb2cff5d792d4b8779fcc3"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/wade.one\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":["Person","Organization"],"@id":"https:\/\/wade.one\/blog\/#\/schema\/person\/8b4739f8f8bb2cff5d792d4b8779fcc3","name":"Wade Womersley","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/200px.png","url":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/200px.png","contentUrl":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/200px.png","width":202,"height":200,"caption":"Wade Womersley"},"logo":{"@id":"https:\/\/wade.one\/blog\/wp-content\/uploads\/2015\/02\/200px.png"}}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":1159,"url":"https:\/\/wade.one\/blog\/2026\/03\/26\/why-most-software-projects-do-not-need-a-rewrite\/","url_meta":{"origin":1160,"position":0},"title":"Why Most Software Projects Do Not Need a Rewrite","author":"","date":"March 26, 2026","format":false,"excerpt":"Most rewrite discussions are really a sign that the team is frustrated, not that a full rebuild is the smartest technical decision. In most cases, incremental change is the better call.","rel":"","context":"In &quot;Programming&quot;","block_context":{"text":"Programming","link":"https:\/\/wade.one\/blog\/category\/programming\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1179,"url":"https:\/\/wade.one\/blog\/2026\/04\/11\/the-best-engineering-decisions-usually-remove-work\/","url_meta":{"origin":1160,"position":1},"title":"The Best Engineering Decisions Usually Remove Work","author":"","date":"April 11, 2026","format":false,"excerpt":"The best engineering decisions usually do not add more process or more code. They remove work, shorten paths, and make the remaining system easier to understand.","rel":"","context":"In &quot;Programming&quot;","block_context":{"text":"Programming","link":"https:\/\/wade.one\/blog\/category\/programming\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1178,"url":"https:\/\/wade.one\/blog\/2026\/04\/10\/what-actually-slows-software-delivery-down\/","url_meta":{"origin":1160,"position":2},"title":"What Actually Slows Software Delivery Down","author":"","date":"April 10, 2026","format":false,"excerpt":"Software delivery usually slows down because of decisions, handoffs, fear, and bad environments, not because developers are typing too slowly.","rel":"","context":"In &quot;Software Engineer&quot;","block_context":{"text":"Software Engineer","link":"https:\/\/wade.one\/blog\/category\/software-engineer\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1188,"url":"https:\/\/wade.one\/blog\/2026\/04\/20\/why-i-prefer-explicit-over-magical-defaults\/","url_meta":{"origin":1160,"position":3},"title":"Why I Prefer Explicit Over Magical Defaults","author":"","date":"April 20, 2026","format":false,"excerpt":"Defaults are useful until they become hidden policy. I usually prefer explicit configuration because it is easier to understand, easier to change, and much less surprising later.","rel":"","context":"In &quot;Programming&quot;","block_context":{"text":"Programming","link":"https:\/\/wade.one\/blog\/category\/programming\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1155,"url":"https:\/\/wade.one\/blog\/2026\/03\/26\/ai-is-not-a-bubble-denial-is-the-real-problem\/","url_meta":{"origin":1160,"position":4},"title":"AI Is Not a Bubble. Denial Is the Real Problem","author":"","date":"March 26, 2026","format":false,"excerpt":"AI tooling is not going away. What a lot of people are calling a bubble looks more like denial in the face of tools that are already becoming normal developer infrastructure.","rel":"","context":"In &quot;AI&quot;","block_context":{"text":"AI","link":"https:\/\/wade.one\/blog\/category\/ai\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1176,"url":"https:\/\/wade.one\/blog\/2026\/04\/08\/why-build-pipelines-become-part-of-the-product\/","url_meta":{"origin":1160,"position":5},"title":"Why Build Pipelines Become Part of the Product","author":"","date":"April 8, 2026","format":false,"excerpt":"Build pipelines stop being \"just internal tooling\" the moment they start deciding how fast you can ship, how often you break things, and how painful releases feel.","rel":"","context":"In &quot;Software Engineer&quot;","block_context":{"text":"Software Engineer","link":"https:\/\/wade.one\/blog\/category\/software-engineer\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/posts\/1160","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/comments?post=1160"}],"version-history":[{"count":1,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/posts\/1160\/revisions"}],"predecessor-version":[{"id":1166,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/posts\/1160\/revisions\/1166"}],"wp:attachment":[{"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/media?parent=1160"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/categories?post=1160"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wade.one\/blog\/wp-json\/wp\/v2\/tags?post=1160"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}