Software Maintenance: The Real Cost Starts After Launch

Software is treated as a purchase and behaves like a vehicle. It needs servicing, the parts it depends on wear out, and neglect is invisible right up until it is expensive. Budget roughly fifteen to twenty percent of the original build cost per year for maintenance, and be sceptical of anyone who tells you it is optional.

What actually degrades

Nothing in the code changes on its own, but everything around it does. Language runtimes reach end of life and stop receiving security patches. Libraries publish vulnerability advisories. Browsers change behaviour, payment providers deprecate API versions, TLS certificates expire, and mobile platforms raise their minimum requirements every year. Software that is not maintained is not stable, it is accumulating risk quietly.

"The cheapest security incident is the dependency update you applied last month."

What a maintenance agreement should include

At minimum: security patching of the runtime and dependencies, monitoring with alerting that reaches a human, backups that are verified by an actual restore rather than assumed, a defined response time for outages, and a small monthly allowance for the minor changes every business needs. Anything less is a phone number, not a maintenance agreement.

Be clear about what falls outside it. New features are a project, not maintenance, and a contract that blurs that boundary produces an argument every quarter.

The tell of a serious support provider

Ask when they last restored your backup to a clean environment. Backups that have never been restored are a belief, not a safeguard, and the answer to that one question separates providers who monitor from providers who invoice.

Inheriting somebody else legacy system

Taking over software written by another team is normal and entirely workable, but it starts with an audit: what it runs on, what it depends on, what is out of support, where the data lives and whether it can be restored. That produces a prioritised list, usually with a handful of urgent security items and a longer tail of cleanup. Fix the urgent items first and modernise steadily rather than proposing a rewrite, which is almost always the more expensive path.