All case studies

Where keeping it cost them

GAO

Found 11 legacy systems, aged 23 to 60, still running

Eleven systems across ten agencies are most in need of modernization; seven run with known vulnerabilities and three of the ten flagged in 2019 had been modernized by 2025.

Removed: nothing. The systems are still running, and retirement is in the plan without decommissioning being in it.

Outcome: three of the 10 critical systems GAO flagged in 2019 had been modernized by February 2025, while agencies spend about 80 percent of a federal IT budget above $100 billion a year on operations and maintenance of what already exists.

Governments are the largest test of this at scale, and their own auditors say the pruning rarely happens. GAO found 11 federal legacy systems “most in need of modernization” spread across 10 agencies, aged 23 to 60 years. Eight use outdated programming languages, four run unsupported hardware or software, and seven are “operating with known cybersecurity vulnerabilities” — the Environmental Protection Agency’s system above all, holding obsolete hardware and vulnerabilities that “cannot be remediated without modernization.”

Source: GAO, Information Technology: Agencies Need to Plan for Modernizing Critical Decades-Old Legacy Systems (GAO-25-107795) (17 July 2025)