Somewhere in your corporation is an e-commerce platform that’s twenty years old. It still takes orders, so nobody wants to touch it. It’s “paid for,” so it looks free on the balance sheet. Both of those beliefs are wrong, and the gap between them is one of the most expensive misunderstandings in enterprise IT. A two-decade-old commerce system isn’t a paid-off asset — it’s a liability accruing compound interest, and the interest rate is going up. Here’s the actual cost comparison against migrating to a fresh, no-legacy platform, with the honest caveats on both sides.

What the legacy platform actually costs (the part not on the invoice)

The maintenance line item is the small part. The real cost is structural, and the data is brutal.

It eats the budget. Enterprises spend an estimated 60–80% of their entire IT budget just maintaining legacy systems, leaving as little as 20% for anything new — AI, mobile, new products. Your twenty-year-old store isn’t just costing you its maintenance; it’s costing you the four-fifths of your capacity it consumes that could have gone to the things that grow the business.

The cost compounds — it doesn’t hold steady. Legacy maintenance costs are reportedly rising 18–25% in 2026 and compounding 10–20% a year, driven by three things that all get worse with time: the developers who understand old stacks are retiring and getting scarcer, unsupported architectures need bespoke security patches nobody else will write, and compliance audits increasingly penalise technical debt. This is the critical point: the cost curve of legacy points up, forever. Doing nothing is not holding steady — it’s signing up for an expense that grows every year.

The specialist tax. The people who can safely touch a twenty-year-old codebase are rare and expensive — specialist contractors now command $180–250 an hour, up from $120 in 2022 — and often there’s exactly one person who truly understands your system. That “bus factor of one” is a business risk with a person’s name on it. When they leave or retire, the knowledge leaves with them, and the cost to reconstruct it is enormous.

The security cost, which for e-commerce is the scary one

A twenty-year-old e-commerce platform is the highest-value, weakest-defended target a corporation can run, because it sits on exactly the intersection attackers love: payments and personal data, on an architecture too old to defend properly. Old frameworks stop receiving security updates; the patches that do exist are bespoke and slow; and the checkout is already the most attacked page on the internet. Now price the failure. IBM’s 2026 study puts the average data breach at $4.99 million globally — and $11.5 million in the US, with AI-driven attacks running about $1 million higher and breaches that take over 200 days to contain (which legacy systems, poorly instrumented, routinely do) costing over $5 million versus $3.87 million for fast ones.

Read that against a legacy commerce platform holding customer payment and identity data, and the maintenance cost stops being the headline. One breach can cost more than a decade of the maintenance you were trying to avoid — and a twenty-year-old unsupported stack is precisely where breaches come from. The legacy platform isn’t just expensive to run; it’s an uninsured bet against a multi-million-dollar downside.

What migrating to a fresh, no-legacy platform changes

Now the other side. Moving that store onto a modern, self-hosted, source-available platform like VBWD doesn’t just refresh the look — it changes the shape of the cost.

You delete the compounding, not just reduce it. The reason legacy is so expensive is combinatorial: a stack of systems from different eras, each with its own patches and specialists and fragile seams. A fresh platform is one modern codebase with one upgrade path — the seams between four legacy systems disappear because they’re no longer four systems. Support stops being “keep a museum of incompatible parts from collapsing” and becomes “run one modern application your team actually understands.” That’s what turns a compounding cost into a flat one.

Security becomes a posture, not a prayer. A modern stack gets current security updates; being source-available means your security team can read and audit exactly what runs rather than trusting a black box you’ve lost the source to; the admin backoffice is isolated from the storefront; and there’s a real data boundary. Self-hosted means the customer and payment data lives under your control and jurisdiction. You move from “defending an architecture too old to defend” to “running a modern, auditable, current one.”

You get the 80% back. The capacity that was locked up maintaining legacy is freed for the things that grow revenue — AI features (a shopping assistant, an agent-callable catalogue), native mobile, new products — because the platform ships those as core rather than as another fragile bolt-on. The opportunity cost of legacy isn’t just money; it’s every quarter you couldn’t ship what customers now expect.

The honest cost comparison — including migration’s real price

Migration is not free, and anyone who says otherwise is selling you a disaster. It’s a project: migrating catalogue and order data, re-implementing your genuinely custom features as plugins, integration with your ERP and payment providers, testing, and a careful cutover. It costs real money and takes months, and it carries real risk — a botched commerce migration can lose orders. That capex is the honest weight on the migration side of the scale.

But here’s the comparison that matters. The legacy cost is a compounding operating expense that rises 10–20% every year, forever, plus an uninsured multi-million-dollar breach exposure, plus the opportunity cost of the innovation you can’t fund. The migration cost is a one-time capital expense that stops the bleed. Over a two-to-three-year horizon, for most mature corporations running genuinely old commerce, the migration pays for itself against maintenance alone — before you even price in the breach risk it removes and the revenue the freed capacity enables. You’re comparing a large one-time number against an ever-growing recurring one, and compounding always wins that argument given enough time.

When NOT to migrate, honestly: if the legacy platform is stable, cheap, low-risk, and the business line is winding down anyway, keep it — migration is capex you don’t need. And if your “legacy” is only a few years old and well-maintained, this isn’t you. The migration case is strongest exactly where the pain is: an old, expensive, fragile, security-exposed commerce platform that the business still depends on.

The read

A twenty-year-old e-commerce platform feels free because it’s “paid for” and it still works. It is neither free nor safe. It consumes the majority of an IT budget, compounds in cost 10–20% a year, depends on a shrinking pool of expensive specialists, and sits on an architecture too old to defend around payments and personal data — where a single breach can cost more than a decade of the maintenance you were avoiding. Migrating to a fresh, no-legacy, self-hosted, secure platform is a one-time capex that converts that compounding liability into a controlled, flat cost, hands your security team an auditable modern stack, and frees the capacity to build what customers now expect. The legacy platform isn’t the safe choice. It’s the expensive one that only looks safe because the bill arrives slowly.

Scope your migration

If you run legacy e-commerce and want to see what moving to a modern, self-hosted, source-available platform looks like — the migration plan, the timeline, the cost picture against what you spend today — request an enterprise installation and migration scope at vbwd.cc/contact. Tell us what you’re running and we’ll map the move.

Analysis as of 30 July 2026, drawing on IBM’s 2026 Cost of a Data Breach study (via Help Net Security) and legacy-maintenance cost reporting from vFunction and nCube. Figures are third-party estimates and industry averages that vary widely by organisation; the “pays for itself in 2–3 years” and cost claims are directional, not a guarantee for any specific case. Not financial advice. Sources: IBM / Help Net Security, vFunction, nCube.