Legacy Application Assessment Services: A Buyer's Guide

Legacy application assessment services are fixed-scope consulting engagements in which an outside firm evaluates your aging applications — code health, architecture, dependencies, security exposure, run cost, and business fit — and delivers a scored portfolio plus a modernization recommendation you can budget against. Published market ranges put a typical engagement at one to six weeks and, for a medium-complexity application, somewhere in the tens of thousands of dollars — though scope, estate size, and how much of the discovery is agent-automated move both numbers substantially. This guide is for CIOs, CTOs, and VPs of Engineering who are evaluating providers rather than methodology: what these services actually include, how they are priced and where the conflicts of interest hide, which deliverables a paid assessment owes you, and the questions that separate an evidence-based assessment from a sales document with a scoring rubric attached.

What Legacy Application Assessment Services Include

A credible assessment service evaluates three things: the application itself, the environment it runs in, and the business value it carries. Everything a provider proposes should map to one of those, and a proposal that covers only the code is scoping an audit, not an assessment.

In practice, the engagement decomposes into six workstreams:

Workstream	What the provider examines	Typical evidence produced
Inventory and ownership	Every application, service, database, integration, and scheduled job in scope; versions, hosting, owners	System catalog with owners and lifecycle status
Code and architecture health	Complexity, coupling, duplication, test coverage, change frequency; architecture vs. as-built reality	Complexity scores, dependency and data-flow maps
Security and compliance exposure	End-of-life components, known CVEs, secrets in code, audit-trail and regulatory gaps	Risk register with severity and owners
Data	Where systems of record actually live, how data moves (APIs, file drops, shared databases), schema fragility	Data-flow map, integration inventory
Run cost and delivery drag	Maintenance spend, incident load, and the delivery tax each system imposes	Cost-of-legacy attribution per system
Business criticality and fit	What revenue and operations depend on each system; whether it still matches how the business works	Value/criticality scores from stakeholder interviews

The security workstream deserves particular scrutiny, because legacy estates concentrate risk in components nobody patches anymore. OWASP's legacy application management guidance is a useful baseline for what a provider should be checking: unsupported dependencies, missing security contacts, absent logging, and the compensating controls that keep an unpatchable system defensible.

Good providers then push the findings through a decision framework rather than leaving you a pile of observations — most commonly Gartner's TIME model (Tolerate, Invest, Migrate, Eliminate) for the portfolio disposition and the AWS 7 Rs for the per-application migration strategy. The assessment is Phase 1 of the larger program laid out in our AI-powered legacy modernization roadmap; this article covers how to buy that phase well.

When to Buy the Assessment Instead of Running It Yourself

An assessment is work you can do internally — the full methodology, dimension by dimension, is in our practical guide to AI legacy system assessment. Buying it as a service makes sense in five situations:

1. Before you budget a modernization program. Boards fund numbers, not intentions. An external, evidence-based assessment produces the per-system cost and risk attribution a budget request needs — and carries more weight with a CFO than an internal estimate from the team that wants the budget.
2. Your senior engineers are the bottleneck. Assessment is weeks of reading and interviewing. If the people capable of doing it are the same people keeping production alive, the assessment either doesn't happen or starves delivery.
3. Nobody left understands the system. When the original builders are gone and documentation froze years ago, you need reverse-engineering capacity — agent-assisted reading of the codebase plus structured recovery of tribal knowledge, the workflow described in legacy system documentation with AI.
4. Due diligence with a deadline. M&A, private-equity reporting, cyber-insurance renewals, and audit findings all impose external clocks that internal teams rarely beat.
5. You need independence. When the modernize-or-replace question is politically loaded — a system with an internal champion, a vendor relationship under review — an outside scorer de-personalizes the verdict.

The counter-case is real too: if you have senior capacity available and no external deadline, running the assessment internally with agent tooling builds exactly the institutional knowledge a modernization program needs, and current tooling has collapsed the effort gap between internal and external execution.

Engagement Models and How They're Priced

Assessment services come to market in three shapes, and the pricing model tells you whose interests the assessment serves.

Free or heavily discounted assessments. Common, and not worthless — but understand what they are: presales. The provider funds the assessment to originate a modernization deal, so the output is optimized to justify the next engagement. Free assessments tend to be interview- and scan-based, shallow on code-level evidence, and structurally incapable of recommending "tolerate" or "retire" — dispositions that end the sales conversation. Use them as a second opinion, never as the budget document.

Fixed-scope paid assessments. The provider prices the assessment itself, delivers the artifacts, and you owe them nothing further. This is the model that permits honest answers, including "most of this estate should be tolerated, and one system should be retired." Published market figures put a medium-complexity single-application assessment in the $10,000–$50,000 range, with portfolio engagements scaling with estate size. Some providers credit the assessment fee against a subsequent modernization program — a reasonable structure that preserves independence while rewarding continuity.

Assessment as Phase 1 of a committed program. If you have already selected a modernization partner, the assessment runs as the program's first phase. Efficient — no context handoff — but you have spent your leverage: the disposition matrix that should have let you compare providers per application, the procurement mechanics covered in our buyer's guide to cloud application modernization services, is now produced by the incumbent.

On duration: manually executed assessments typically run one to four weeks for a single environment, stretching toward a quarter for large portfolios. Agent-led discovery compresses this to roughly two to three weeks for a single business-critical system and four to six weeks for an enterprise portfolio. A proposal quoting six months of assessment before any decision is either doing discovery by hand or billing by the month.

The Deliverables a Paid Assessment Owes You

Whatever the engagement model, the exit artifacts are the same six: a complete system inventory, a dependency and data-flow map validated against the running environment, a risk register with owners, a scored portfolio with TIME dispositions and 7-R strategies, a quantified cost of legacy per system, and a first-wave recommendation with a captured metrics baseline. (Each artifact is specified in detail in our assessment methodology guide.)

As a buyer, apply three acceptance tests before signing off:

• The portability test. Could you hand the deliverables to a different vendor and have them execute? If the assessment only makes sense as a preamble to the assessor's own proposal, you bought a sales document.
• The evidence test. Every score traces to something checkable — a measured complexity number, a mapped dependency, an attributed cost — not to "based on our experience." Ask to see the trace for two or three systems chosen at random.
• The decision test. Leadership can act on it: fund a first wave, retire a named system, tolerate a scored remainder. An assessment that ends in observations without dispositions did not finish.

The cost-of-legacy artifact is the one most often missing and most worth insisting on. Maintenance spend, incident load, and delivery drag attributed per system is the denominator of every ROI calculation the program will ever make — the discipline we detail in reducing legacy application maintenance cost.

How AI-Native Assessment Services Differ

The largest divergence between providers today is not methodology — TIME and the 7 Rs are common property — but how the evidence gets gathered. AI-native providers put coding agents on the mechanical share of discovery: crawling repositories, building dependency graphs, scoring complexity, flagging dead code, extracting business rules into reviewable summaries, and mapping EOL components against known CVEs. Humans then supply what agents cannot: business criticality, runtime behavior under production load, contractual constraints, and validation of everything extracted.

The buyer-visible consequences are concrete:

• Depth per dollar. Agents read the entire codebase, not the sample a time-boxed consultant reaches. The difference shows up as evidence density in the deliverables.
• Speed. The discovery weeks compress; the human judgment weeks — interviews, scoring, sequencing — set the floor. McKinsey's LegacyX work reports 40 to 50 percent acceleration on modernization programs when generative and agentic AI carry the analysis and conversion load — and assessment is the most analysis-heavy phase there is.
• Verifiability. An agent-produced dependency map can be checked against the running system; extracted business rules can be reviewed by the people who operate the process. You are reviewing compiled evidence, not trusting summarized impressions.

Ask a provider claiming AI-native assessment two questions: which agent platforms run the discovery, and what share of assessment effort remains senior human review. A defensible answer to the second is around a third — a provider claiming full automation is skipping the judgment the assessment exists to produce.

How to Evaluate an Assessment Provider

Beyond the general provider-selection criteria that apply to any modernization engagement, five are assessment-specific:

1. Evidence-based discovery, not interview-only. Ask what percentage of findings will trace to code-level analysis versus stakeholder conversation. Interview-only assessments reproduce your organization's existing beliefs with a consultant's letterhead.
2. A read-only access model with a security posture. The provider will hold your source code and infrastructure configuration. Expect a documented handling model: read-only repository access, no production credentials, stated data residency, and deletion on exit. A provider without a crisp answer here has not done this often.
3. Willingness to recommend against modernization. Ask directly: "In your last five assessments, how many systems did you recommend tolerating or retiring?" An assessor whose every engagement concludes "modernize everything, starting with a large program" is running a funnel.
4. Named seniors doing the judgment work. Agent tooling handles the reading; the scoring, sequencing, and readout must come from named senior engineers and architects — the people in the proposal, not a team revealed after signature.
5. Deliverables specified in the SOW. The six artifacts above, listed as contractual exit criteria with the acceptance tests attached. Vague deliverables ("findings and recommendations") produce slide decks.

Red flags, in rough order of severity: a modernization price quoted before any assessment; a free assessment positioned as sufficient basis for a seven-figure program; no mention of how your code will be secured during the engagement; a six-month assessment timeline; and TIME quadrants presented with no visible evidence trail from score to source.

Questions to Ask Before You Sign

Put these in the RFP or the first call — the answers separate providers faster than any capability deck:

1. What exactly do you need access to, and is any of it write access or production credentials?
2. Which parts of discovery are automated, with which tools, and what remains human judgment?
3. What are the named deliverables, and can we see redacted examples from a past engagement?
4. Will the deliverables let a different vendor execute the roadmap? Say it in the SOW.
5. How is the assessment priced, and is the fee credited if we proceed to a program with you?
6. Who — by name and role — performs the scoring and presents the readout?
7. How do you attribute run cost and delivery drag per system, and what data do you need from us?
8. What baseline metrics will you capture so the program's results can be proven later?

A provider who welcomes these questions is telling you how the engagement will go. So is a provider who doesn't.

FAQ

What is a legacy application assessment service?

A consulting engagement in which an external firm evaluates your legacy applications across code health, architecture, security, data, run cost, and business fit, then delivers a scored portfolio with a recommended disposition — modernize, replace, tolerate, or retire — for each system. It is the evidence-gathering phase that should precede any modernization budget.

How much does a legacy application assessment cost?

Published ranges put a medium-complexity single-application assessment at roughly $10,000–$50,000, with portfolio-scale engagements priced by estate size and scope. Free assessments exist but are presales instruments — useful as a second opinion, not as a budget document. Some providers credit the assessment fee against a follow-on program.

How long does a legacy application assessment take?

One to four weeks for a single application with conventional methods; agent-led discovery makes two to three weeks realistic for a business-critical system and four to six weeks for an enterprise portfolio. Timelines quoted in months signal manual discovery or scope you should question.

What is included in a legacy application assessment?

A system inventory, dependency and data-flow mapping, code and architecture analysis, a security and compliance risk register, per-system cost attribution, and stakeholder-scored business criticality — synthesized into a disposition matrix (typically Gartner TIME plus the AWS 7 Rs) and a first-wave recommendation with a captured baseline.

Are free legacy assessment services worth it?

As a calibration input, yes; as a decision basis, no. Free assessments are funded by the provider's sales motion, tend to be shallow on code-level evidence, and are structurally biased toward recommending a modernization program. Treat them the way you treat a vendor's ROI calculator: informative about the vendor, not about your estate.

Should the same company that assesses also do the modernization?

It can — continuity saves a context handoff, and crediting the assessment fee into the program is a fair structure. But insist on portable deliverables specified in the SOW, so proceeding with the assessor is a choice you make on the evidence, not a dependency they engineered. Independence matters most when the modernize-or-replace question is contested internally.

What happens after the assessment?

The disposition matrix feeds a portfolio-level modernization strategy — sequencing, funding, governance — and the first wave goes into execution: stabilize the chosen system, migrate incrementally, validate against the captured baseline. How to build that strategy is covered in our guide to enterprise application modernization strategy.

Buy Evidence, Not a Pitch

The point of paying for an assessment is to make the next seven-figure decision on evidence someone can check. Hold providers to that standard: code-level discovery, portable deliverables, per-system cost attribution, and the professional honesty to recommend tolerating or retiring systems when the data says so. Get that, and the assessment costs weeks while the mistakes it prevents cost quarters.

If you want to see what an agent-accelerated, evidence-first assessment looks like against your own estate, start with the AI Readiness Assessment — an executive-level diagnostic that maps your legacy estate, identifies which assessment and modernization work is agent-suitable, and returns a prioritized 90-day plan. And when the assessment phase is done, our legacy application modernization services execute the waves it recommends: senior engineering teams paired with parallel agent workstreams, a first production milestone within 2 weeks, and a track record of 400+ delivered projects as an official Cognition enablement partner.