Travel & Hospitality

Booking the Future on Systems from the Past

Airlines, hotels, and travel platforms processing billions in transactions through reservation systems designed in the mainframe era.

Key data points

Global Distribution Systems age

Amadeus, Sabre, Travelport — core reservation infrastructure from the 1960s-80s.

40+ years

Airline IT spending on legacy maintenance

Three quarters of IT budget maintaining existing systems. One quarter for innovation.

~75%

Hotel PMS systems over 10 years old

Property management systems managing guest data, billing, and operations on aging platforms.

~60%

Travel sector data breaches (2025)

Guest records, payment data, passport information — on legacy infrastructure.

~380

Revenue lost to system outages

Global airline industry. Legacy system failures causing cancellations and booking errors.

$1.2B annually

Risk factors

What keeps Travel & Hospitality CISOs awake

●

Global Distribution Systems built on TPF and mainframe architecture from the 1960s processing 80% of airline bookings

●

Hotel property management systems storing guest PII, payment cards, and passport data on unpatched platforms

●

Loyalty program databases on legacy systems with billions of dollars in liability and minimal modern security

●

OTA integrations through legacy APIs with no rate limiting, minimal authentication, and plaintext data transmission

●

Check-in kiosks and in-room systems running unsupported OS versions with network access to backend systems

Stack comparison

Typical vs Recommended

Typical Travel & Hospitality stack

Java 8 31

Oracle Database 40

.NET Framework (4.x) 39

jQuery 41

IIS 35

Recommended modern stack

Next.js 79

Python 3 85

PostgreSQL 81

Docker 77

Node.js 78

Score your own stack →

Regulatory landscape

Compliance Exposure

PCI DSS 4.0

Payment card data everywhere: booking, check-in, POS, minibar, spa. Legacy systems expand PCI scope exponentially.

GDPR

Guest data across legacy PMS, CRM, loyalty, and booking systems. Data subject requests require querying all of them.

Passport Data Regulations

International ID data subject to varying national regulations. Legacy systems often lack data residency controls.

ADA / Accessibility

Booking platforms on legacy web frameworks frequently fail accessibility requirements. Legal exposure growing.

Latest Travel & Hospitality insights

Innovation & Growth

The Edge Advantage: Why Modern Frameworks Win on Speed, Cost, and Reach

May 2026 · 6 min

Read insight →