In fiscal year 2025, US federal agencies planned to spend about $83 billion, 79% of their IT budget, on operating and maintaining existing systems. The Government Accountability Office says roughly 80% is typical (GAO).
The same report lists the 11 legacy systems most in need of replacement. They are between about 23 and 60 years old. Eight run on languages like COBOL or assembly. Seven have security vulnerabilities that can only be fixed by modernizing them. Together they cost about $754 million a year just to keep running. And two of them had no modernization plan at all.
Even where plans existed, they were thin. Of the nine documented plans, only three included all three elements GAO considers essential: milestones, a description of the work, and a plan for retiring the old system. GAO has recommended for nearly a decade that the Office of Management and Budget direct agencies to identify legacy systems that need modernizing. That recommendation is still open.
It would be easy to read that as a story about old technology. The person who ran the federal government's modernization fund thinks it's a story about budgeting.
Software isn't a bridge
Larry Bafundo was executive director of the Technology Modernization Fund from 2024 to 2025. In May he put it plainly: "The federal government budgets for technology the way it budgets for bridges and roads, as discrete projects" (Niskanen Center).
A bridge gets a large up-front budget and is then expected to run for years with little reinvestment. Software treated that way gets a big build budget, then a thin maintenance line. Nobody invests in it again until it's so far behind that replacement is the only option. Then the replacement is funded as another one-off project, and the cycle starts again. Bafundo calls it the legacy IT trap: deferred maintenance eats the budget, which makes modernization harder, which defers it further.
Even the fix got funded like a project
The Technology Modernization Fund was created in 2017 to break that cycle. It started with $175 million. It has received more than $4 billion in requests but manages just over $1 billion in active investments, so demand has run about four times what it can fund (Niskanen, same).
Its own funding has followed the pattern it was meant to fix. It received $1 billion from the American Rescue Plan in 2021, then lapsed in December 2025 for the first time since its launch, freezing nearly $200 million of projects (FedScoop). Congress reauthorized it through September 30, 2026 with a $5 million appropriation (GovExec). The White House requested no new money for fiscal 2027 (MeriTalk). Today it runs only until December 11 under a stopgap spending bill (GovConWire).
The design is sensible. It's a revolving fund: agencies repay what they borrow, so the same money can fund the next project without a new appropriation (GovExec, same). The fiscal 2027 proposal would top it up by moving up to $100 million of other agencies' unspent funds into it, rather than by appropriating new money.
A big injection, then a lapse, then a stopgap. That is project funding, applied to the thing that was supposed to replace project funding.
Why "it'll pay for itself" isn't enough
Modernization is usually sold on savings. GAO's July audit of the fund shows why that's a fragile argument on its own (GAO).
As of June 2025, 24 funded projects expected about $1.06 billion in savings. Eleven had realized about $13.5 million. More than 98% of the expected savings are scheduled for fiscal 2027 or later. Of six completed projects that expected savings, two met or were on track to meet their targets and four did not. One estimate was revised from about $210 million to $35 million.
GAO still expects substantial savings ahead, and the timing is the real issue: savings arrive late and often smaller than forecast. If savings are the only justification a modernization project is allowed to have, many necessary projects will never get approved.
Bafundo's proposed fix is to fund a portfolio with two kinds of investment: those that generate savings and can repay the fund, and those justified by reducing risk or improving service, without a clean financial return. An unsupported platform with known vulnerabilities belongs in the second category, whether or not it saves money.
This isn't only a government problem
The federal data is unusually well documented, but the mechanism isn't specific to government. In our experience, many organizations fund a system's build as a capital project, run it for years on a maintenance budget, and only discuss replacement once it's urgent. The bill arrives all at once, and so does the risk.
The difference in a mid-market company is scale, not shape. The system might be one core platform rather than eleven, and the budget line might be "keep the lights on" rather than "operations and maintenance." The trap works the same way.
What to do about it
Fund products, not projects. Give important systems a standing budget for continuous improvement, sized to how critical they are. Steady reinvestment beats a crisis rewrite every decade.
Justify modernization on risk as well as savings. Unsupported platforms, security exposure and a single person who understands the system are reasons to invest, and they belong in the business case alongside savings.
Write the plan before it's urgent. GAO found two of the government's most critical legacy systems had no modernization plan. Every core system you run should have one, with milestones and a plan for retiring the old one.
Track run-versus-change spend. Know what share of your technology budget keeps things running and what share improves them. If the first number keeps growing, the trap is closing.
We modernize legacy systems incrementally, so the business keeps running while the old system is replaced. If your maintenance budget keeps growing and your modernization budget keeps shrinking, let's talk.