Legacy application assessment
A deep technical audit of the codebase — mapping technical debt, security exposure, integration dependencies and modernization risk before any code changes begin.
Assessment · Risk mapping
Legacy Modernization · Saudi Arabia
Legacy system modernization for Saudi enterprises
Crux moves COBOL, Oracle Forms and monolithic cores onto cloud-native platforms in phases — keeping the legacy system running until each replacement has proven itself in production.
At a glance
Typical programme
16–36 weeks
First production release
Week 8
Migration approach
Parallel running
Delivery base
Riyadh, KSA
Data residency
AWS Saudi / Azure KSA
Engagements are scoped and committed one phase at a time, not as a single fixed-price rewrite.
60%
Lower run-cost
Average reduction in system operational cost reported by enterprise clients after modernization.
Week 8
First delivery
Working modernized components reach production before the programme is half complete.
Zero
Downtime migrations
Parallel running keeps the legacy system authoritative until cutover is validated.
PDPL
Compliant by design
Data handling, residency and audit logging specified during assessment, not retrofitted.
The fundamentals
What is legacy system modernization?
Legacy system modernization is the process of transforming outdated enterprise software — mainframe COBOL applications, Oracle Forms front ends, VB6 clients and monolithic cores — into modern, maintainable, cloud-ready platforms without losing the business logic those systems have accumulated over decades.
It is not the same as a rewrite. A rewrite discards thirty years of encoded business rules and re-derives them from incomplete documentation, which is why big-bang replacements so often overrun. Modernization instead extracts, validates and re-implements that logic in stages, keeping the legacy system live as the safety net until each replacement component has proven functional parity under production conditions.
For enterprises in Saudi Arabia the pressure is compounding. Vendor support for older platforms is ending, the specialists who understand them are retiring, regulators expect real-time reporting and ISO 20022 messaging, and AI initiatives stall because the data sits behind overnight batch transfers instead of APIs.
Signs your systems need modernization
- Changes that should take days take months, and every release carries regression risk
- Only one or two people understand the codebase, and both are near retirement
- Integration happens through overnight batch files rather than real-time APIs
- The platform cannot support biometrics, instant payments, mobile-first channels or AI features
- Vendor support has moved to extended, premium-priced or end-of-life status
- PDPL and audit requirements are met by manual process rather than system design
- Infrastructure and licensing costs rise every year while capability stays flat
Where modernization sits in your roadmap
Modernization is the enabling step. Once a system is modular, tested and API-first, the work that follows becomes routine rather than heroic: portfolio-level application modernization, moving to cloud-native infrastructure, and connecting enterprise AI capabilities to data that is finally reachable.
Capabilities
Six ways we modernize enterprise systems
Most programmes combine three or four of these. The assessment determines which, and in what order.
Architecture redesign and refactoring
Redesign from monolithic legacy patterns to modular, testable, cloud-native architecture, preserving business logic while removing architectural debt.
Refactoring · MicroservicesCloud-ready transformation
Rearchitecture for AWS Saudi or Azure KSA deployment, with containerization, auto-scaling and cloud-native service integration that respects data residency rules.
Cloud migration · ContainerizationTechnology stack upgrades
Replacing obsolete languages, frameworks and databases with supported stacks — Python, Node.js, React, PostgreSQL — backed by automated test coverage.
Stack upgrade · API modernizationSecurity hardening
Rebuilt to OWASP standards with PDPL-compliant data handling, encryption at rest and in transit, and vulnerability scanning inside the delivery pipeline.
Security audit · PDPLPerformance optimization
Finding the real bottlenecks — query plans, caching layers, async processing, CDN delivery — with improvements measured against a recorded baseline.
Performance · Load testing-
2–3 weeks
Discovery and assessment
Codebase analysis, dependency mapping, security assessment, data model review and a modernization roadmap with sequencing rationale.
-
2–3 weeks
Architecture design
Target architecture, migration strategy, stack selection, test framework and the parallel-running plan that governs cutover.
-
6–8 weeks
Phase one modernization
The highest-value or highest-risk components first, delivered as working production code with full test coverage.
-
4–6 weeks
Parallel running
Modernized and legacy systems run side by side while functional parity, performance and data integrity are validated.
-
Ongoing
Phase two onward
Remaining components in priority order, each with production deployment, monitoring and handover to your team.
Delivery approach
Phased, not big-bang
We do not advocate big-bang rewrites. Work lands in phases while the legacy system keeps running in parallel, so the business is never betting on a single cutover date.
Each phase ships production-ready components, which means cost savings and performance gains start arriving well before the full programme completes.
Get a modernization assessment
Technology mapping
From legacy stack to modern platform
Indicative per-component timelines. Sequencing depends on integration coupling, not on the list order.
| Legacy technology | Replaced with | Benefit | Timeline |
|---|---|---|---|
| COBOL / FORTRAN | Python or Java microservices | Faster, safer change cycles | 6–8 weeks |
| Oracle Forms / VB6 | React or Angular front end | Modern, accessible interface | 4–6 weeks |
| On-premise MSSQL | PostgreSQL or managed cloud database | Elastic scalability | 3–4 weeks |
| File-based integration | REST APIs and event streams | Real-time data movement | 4–5 weeks |
| Manual deployments | CI/CD pipelines (GitHub Actions) | Repeatable releases | 2–3 weeks |
| No monitoring | Datadog or CloudWatch with alerting | Proactive uptime | 2 weeks |
Common legacy-to-modern mappings from Crux modernization programmes.
Case studies
Decommissioning programmes we have delivered
Client names withheld under NDA. Programme structure and outcomes as delivered.
Core banking decommissioning
Monolithic core retirement · Finacle migrationA 1980s monolithic core was constraining digital growth, regulatory cadence and run-cost. It was retired through an eight-gated programme — discovery, target design, build and configure, data migration, test and parallel run, cutover, hypercare, decommissioning — with the Finacle migration as the core data-move workstream alongside archival, interface retirement and contract exit.
8
Gated phases
0
Service breaks
Finacle
Target core
Mobile banking app decommissioning
Legacy app retirement · Native replacementAn aging hybrid framework no longer met app store policies and could not support biometrics, push or instant payments, while two parallel stacks duplicated vendor and support cost. Every customer moved onto a native, API-first app through a phased coexist-then-sunset rollout — notify, download, re-auth, verify, sunset — before the legacy backend was shut down and store listings exited.
6
Phase rollout
100%
Customers moved
Native
New stack
Tuxedo to message broker migration
Oracle Tuxedo integrations · IBM App ConnectPoint-to-point Tuxedo connectors and an aging ESB were brittle, hard to secure and slow to onboard new consumers. Integrations were re-platformed onto IBM App Connect behind a single gateway with standard contracts and security profiles — OAuth/OIDC with mTLS, rate limits, schema validation, end-to-end tracing — retiring legacy paths consumer by consumer using a strangler pattern.
6
Strangler stages
1
Gateway standard
PCI-DSS
In scope
Questions
Legacy modernization, answered
The questions procurement and technology teams in Saudi Arabia ask most often.
How long does legacy system modernization take in Saudi Arabia?
Legacy system modernization projects typically take 16 to 36 weeks depending on system complexity, data volume and integration requirements. Crux uses a phased approach, delivering working modernized components from week 8 onwards to minimize business disruption.
What are the risks of legacy system modernization?
The primary risks are business continuity during migration, data integrity during transformation, and staff adoption of new systems. Crux mitigates these through parallel-running strategies, comprehensive data validation, automated regression testing, and change management built into every engagement.
How does legacy modernization support Vision 2030?
Vision 2030 requires enterprises to operate on modern digital platforms capable of integrating AI, enabling data-driven decisions and supporting rapid service innovation. Legacy systems prevent this. Crux programmes target the specific capabilities that Vision 2030 alignment depends on.
Can modernization be done without replacing the existing system?
Yes. Crux uses strangler-fig replacement, anti-corruption layers that wrap legacy systems with modern APIs, and selective refactoring — allowing you to modernize incrementally without a disruptive big-bang replacement.
What does legacy system modernization cost?
Cost depends on codebase size, integration count and data migration complexity. Because delivery is phased, budget is committed per phase rather than up front, and enterprise clients typically reduce system operational costs by around 60% after modernization.
Do modernized systems stay compliant with Saudi data regulations?
Yes. Work is built to PDPL requirements and NDMO cloud standards, with data residency on AWS Saudi or Azure KSA regions, encryption at rest and in transit, and audit logging designed in from the assessment phase rather than retrofitted afterwards.
Related services
All services →
What usually comes next
Related
Enterprise application modernization
The parent programme: portfolio-level assessment, sequencing and delivery across multiple systems.
Explore → Next stepCloud & DevOps transformation
Run modernized applications on cloud-native infrastructure with CI/CD, observability and cost control.
Explore → AI readyAI strategy & intelligent systems
Connect AI capabilities to a platform whose data is finally reachable through documented APIs.
Explore →
Start here
Stop paying interest on technical debt
A two to three week assessment gives you a dependency map, a risk register and a sequenced roadmap — enough to decide whether to proceed, and in what order, before committing to delivery.