Skip to content
Security & Trust

COBOL, Java 8, Python 2: The Three Horsemen of Legacy

Three technology generations that still run critical infrastructure. One has no new developers. One stopped receiving updates. One was officially sunset in 2020.

· 7 min read
Share on X LinkedIn
COBOL, Java 8, Python 2: The Three Horsemen of Legacy

COBOL: Still Running, Nobody Learning

~95 billion
Daily COBOL transactions globally
Banks, insurance companies, government agencies. More daily transactions than Google searches.
~300,000
Active COBOL developers worldwide
Source: Reuters/Micro Focus COBOL survey (2022). Widely cited figure.
~800 billion lines
COBOL code still in production
Source: Reuters/Micro Focus estimate. Widely cited but difficult to independently verify.

COBOL isn't a technology problem. It's an actuarial problem. The people who understand it are aging out of the workforce. When they leave, the knowledge leaves with them. There's no Stack Overflow for COBOL business logic from 1987.

The US government spent $337 million on COBOL maintenance in a single year. That's not modernization — that's life support.

Java 8: The Enterprise Comfort Zone

Java 8 was released in 2014. Public updates ended in 2019. It remains the most-used Java version in enterprise production — over 35% of all Java applications.

~35%
Enterprise apps still on Java 8
Source: New Relic State of Java report. Java 8 public updates ended March 2019 (Source: oracle.com).
$15 - $25 per employee
Annual Oracle Java SE subscription cost
Source: Oracle Java SE licensing page (oracle.com). Employee-based pricing introduced January 2023.

The cost isn't just the subscription. It's the accumulation of workarounds for post-Java-8 ecosystem changes, the inability to use modern libraries, the security vulnerabilities in dependencies that dropped Java 8 support, and the developer frustration of working in a time capsule.

Moving from Java 8 to Java 21 isn't a version bump. It's often a rewrite. Modular system changes, removed APIs, updated dependency trees — the longer you wait, the harder the migration.

Python 2: Officially Dead, Quietly Alive

Python 2 reached end-of-life on January 1, 2020. No security patches. No bug fixes. Officially dead.

~15%
PyPI packages still requiring Python 2
Modeled estimate from PyPI download statistics. Python 2 EOL: January 1, 2020 (Source: python.org).
~20%
Organizations still running Python 2 in production
Modeled estimate. Source: ActiveState survey on Python 2 usage in enterprise (2023).

The danger isn't the runtime itself — it's the shadow IT. Python 2 scripts run in corners of organizations that security audits never reach. Data pipelines processing customer records. Automation scripts with hardcoded credentials. ETL jobs that feed production databases. All running on a runtime that hasn't received a security patch in six years.

The Common Thread

COBOL, Java 8, Python 2 — three different eras, same problem. Technology that works well enough to avoid replacement, but accumulates risk silently. The cost of maintaining them rises every year. The pool of people who understand them shrinks every year. The security exposure grows every year.

This follows a similar pattern to what we documented for WordPress. The difference is scale: WordPress affects 43% of the web. These three affect the systems that run the global economy.

Share this insight