Expert interview: Understanding and assessing legacy systems

Sebastian Grundhöfer works at 7P, where he focuses intensively on modernising critical IT systems. His main task is to identify ways in which software landscapes that have evolved over time can be made future-proof without creating uncontrolled risks during ongoing operations. In the first part of our interview, he discusses the real risks of legacy systems, why so many companies become mired in this issue, and how the ‘Legacy Fast Check’ can finally provide clarity.

Question: Sebastian, you have been working on modernising critical IT systems for years. What has changed fundamentally in the last two to three years, and why is this topic so relevant right now?

Sebastian Grundhöfer: Although legacy systems have always existed, the pressure has increased significantly in recent years. In the past, it was often possible to postpone addressing the issue as long as the systems were running smoothly. Today, that is much more difficult. Business departments are demanding a much faster pace for implementing new functions. At the same time, security requirements are tightening and the regulatory framework is demanding concrete proof. Furthermore, companies are losing the employees who built these systems and who truly understand them. The old technology itself does not pose a risk. The actual risk is that it is unclear which processes are running in the system. Artificial intelligence can now help with this. For the first time, we have tools that can be used to unravel extensive codebases and hidden dependencies much more quickly. While AI cannot replace experts, it does speed up the process of creating transparency enormously.

Question: If you had to describe ‘legacy’ in one sentence, what would it be?

Sebastian Grundhöfer: The system is still running, but its ability to adapt has been compromised. In short, legacy is not just old code; it’s a business-critical system. Every change becomes more expensive and riskier because detailed knowledge of the system has been lost over time.

Question: Many companies recognise the need for modernisation, but are reluctant to take action. What are the most common concerns that you hear about?

Sebastian Grundhöfer: The biggest concern is almost always: ‘We’re touching something that is running stably today, but operations may grind to a halt afterwards.’ Underlying this is the justified fear of unforeseen system failures and uncontrollable project costs. As knowledge has gradually dissipated over the years, it has become almost impossible to conduct a thorough manual assessment of hidden dependencies and their potential impact on business processes in advance.

Question: How can this uncertainty be countered?

Sebastian Grundhöfer: By not starting with a preconceived modernisation thesis. Instead, we start with a structured inventory. This is precisely why we developed the ‘Legacy Fast Check’. Modernisation requires a different approach. The attitude of ‘rewriting everything’ almost always leads to chaos. First, transparency must be created. We examine the system from an external perspective, considering factors such as architecture, dependencies, risks, test coverage, knowledge silos and security issues. Only then can the next steps be planned reliably.

Question: What does a typical legacy project look like in practice, and what has been your most challenging case to date?

Sebastian Grundhöfer: The most complicated cases are not necessarily those involving the oldest programming languages. Problems arise when specialist knowledge is completely lacking in the company. If a system is inadequately documented and full of special cases that have developed over time, enormous uncertainty arises because the original reasons for certain decisions are no longer known. In terms of project management, this results in a sensible sequence: first understand, then decide, and only then modernise in a targeted manner. Existing system knowledge must be secured before taking small, controlled steps.

Question: When it comes to legacy modernisation, 7P places a particularly strong focus on artificial intelligence. Why? What can AI achieve in this area that traditional methods cannot?

Sebastian Grundhöfer: AI is extremely effective at understanding, whereas traditional modernisation approaches waste a lot of time at this stage. Old systems contain a lot of implicit knowledge. Traditionally, developers work their way through the code manually, but this is not scalable. AI can help to quickly identify hidden patterns and make technical debt transparent. This can significantly speed up the analysis phase. However, we always emphasise that AI is a tool for our experts, not a replacement for specialists.

Question: What kind of AI technology is actually used, and what is ready for production today?

Sebastian Grundhöfer: Above all, AI-supported code explanation and automated review preparation are production-ready today. Modern embedding and retrieval approaches are also promising. These approaches make extensive codebases and the associated technical documentation searchable and queryable in context. In contrast, fully autonomous modernisation is a vision for the future. The idea of an AI agent that can independently understand a critical system, rebuild it, and put it directly into production is neither realistic nor desirable for regulated industries. AI will continue to accelerate progress, but always under clear human control.

In the second part, we will discuss how legacy retrofitting works in practice and what companies need to do to progress from understanding to implementation.