A technology stand-off is in place as organisations battle the expectation to use fast-moving innovations like AI to create real value and gain a competitive edge, with the constraints of being trapped on legacy operating systems. Application modernisation projects are still too slow, costly and dependent on manual services. At a time when innovation should be the priority, outdated traditional packaging and patching models leave IT teams reliant on external specialists and without meaningful control over their application estates.
The implications, however, extend far beyond delayed projects and internal conflict. Continued reliance on legacy systems is exacerbating security, support and compliance risks.
Packaging fallacy
The fact that a significant percentage of Windows machines on various out of support operating systems cannot or will not be migrated to Windows 11 may have made headlines, but this is not just the tip of the iceberg; it fundamentally overlooks the endemic problem affecting both public and private sector transformation projects. Too many critical business operations across healthcare, finance and public sectors remain quiet captives to unsupported systems such as Windows 7, Vista and even Windows XP. Every day these migration projects stall, organisations face compounding security risks, extortionate extended support fees and severe compliance exposures.
Reliance on legacy operating systems is not a choice. It is not a sign of lacklustre IT plans or wilful ignorance of the security risks. Despite the widespread desire to update, move and achieve digital goals, organisations are hamstrung by a packaging automation fallacy that claims migration projects will take 12 – 24 months or longer to achieve and cost most of the digital transformation budget. The reliance on Global Systems Integrators (GSIs) to achieve migration also sidelines internal IT teams, taking away any meaningful control over their own application estates.
Furthermore, even the recent updates to the packaging automation story, with fewer hours per app, faster migrations and, in theory, smaller GSI invoices, have not addressed the fundamental security issue. Converting an application is only half the battle; ensuring it runs securely on modern operating system builds requires ongoing maintenance. Just consider the continuously escalating risk landscape: Microsoft’s monthly Patch Tuesday floor is now measured in the low hundreds of Common Vulnerabilities and Exposures (CVE). Indeed, with over 600 cited in the July release, the scale of the problem continues to increase. Windows 10 and App-V both reached end-of-support in the 2025–26 window, leaving swathes of legacy Win32 apps running on an un-patched platform.
Endemic risk
In addition to the risk of breach, regulated organisations across financial services, healthcare and government must now evidence software provenance, including updates. If it takes 24 months to repackage 500 lines of business applications by hand, how are organisations going to respond to every new dependency-chain CVE?
The traditional modernisation model is fundamentally flawed. There is no excuse for a reliance on armies of manual packaging contractors billing by the hour. From the weeks spent auditing application estates, hunting down missing installation media and documenting legacy tools to the manual bottleneck that ‘requires’ specialist packaging engineers to rebuild and repackage applications sequentially, one by one, the traditional model is a license to print money. When packaging a single complex application manually often takes anywhere from one to five days, projects will inevitably drag on, during which time fees rise almost as quickly as the security risks.
It doesn’t matter how many applications that require migrating to a new operating system, virtual desktop infrastructure (VDI), or modern cloud workspace, the service led approach cannot be justified any more.
True automation
GSIs frequently sell ‘automated packaging’, but in practice, this often means nothing more than running basic scripts inside a manual, human-heavy workflow. If a system still requires an engineer to manually install, reverse-engineer and rebuild every legacy app sequentially, that is not automation. It is just a faster version of the same service-led model. True automation shifts power back to the internal IT team by replacing manual labour with intelligent, parallel engine execution.
Automation can capture live, functional applications directly from active environments even when original installation media or documentation has been lost for years. In tandem, automated remediation utilises AI-driven analysis to understand issues within the package and apply fixes. It recognises dependencies and delivers an up to date application package. By undertaking the processes in parallel and at pace, the one to five day per application model is transformed to migrating around 400 legacy applications in around one hour.
Furthermore, this is a completely open and flexible approach. Package once, deliver anywhere ensures there is no more built-in obsolescence: applications are packaged into universal storage formats that deploy seamlessly across both laptop and virtual cloud platforms.
Continuous process
Underpinning this model is an essential decoupling of the desktop stack. Unlocking the tight coupling that links applications, user profiles and security configurations to the underlying operating system removes the endemic problems associated with operating system updates. Adopting a Composite Desktop Model and decoupling the desktop into three independent layers creates an infrastructure that is stateless, resilient and inherently cheaper to operate.
Once applications are separated from the base operating systems, an upgrade is no longer a cause for concern but a routine, non-disruptive event. And this is vital to achieving a continuously up to date security posture. The challenge is not simply responding to the patch Tuesday CVEs. It is the frequency of application updates from vendors. It is Windows rolling servicing model. And, of course, expectation from regulators of proof, not plans or promises.
The only architecture that meets that combined pressure is one where the packaging pipeline is a continuously running system, not a project. Every aspect of the process – capture, remediation, signing and delivery – is continuous. The result is not just an application estate that is transformed and validated within days, but one that is constantly ready to receive the next update.
Conclusion
There is growing recognition that while advancements in AI are acting as a massive catalyst, speeding up innovation across the board, the intense cycle of innovation is putting immense strain on organisations. Internal structures and technology platforms are not keeping pace, adding risk and hijacking innovation budget. Application repacking is now vital – not just to support business goals but to address the escalating security risk.
In an era of proven automation, there is no need for manual application repackaging. With the power of automated application repackaging available there is no need for organisations to be constrained by aging, insecure operating systems long past their expiration date. It is time for a rigorous challenge to this obsolete approach.
By Steve Horne, CEO, AppCURE.
- Cybersecurity
- Digital Strategy
- Infrastructure & Cloud
- Risk & Resilience