The Number
The US federal government spends over $100 billion per year on information technology. More than 80% of that — over $80 billion — goes to operating and maintaining existing systems. Not building new capabilities. Not modernizing. Keeping old systems running.
What This Looks Like
The Social Security Administration processes benefits on COBOL systems written in the 1970s. The IRS runs tax processing on mainframes from the 1960s. The VA manages veteran health records on systems that predate the internet. These aren't edge cases — they're the norm.
whitehouse.gov Runs WordPress
The symbolic dimension: the White House — the most prominent digital address in American government — runs WordPress. Our scanner confirmed it. The nation's digital front door sits on a framework with 18,005 known vulnerabilities.
The Modernization Gap
Congress has passed multiple modernization mandates — FITARA, MGT Act, TMF. Billions have been allocated. But the structural incentives favor maintenance over modernization: maintaining a working system is lower risk than replacing it. Nobody gets fired for keeping the lights on.
The result: America's digital infrastructure ages another year, every year. The maintenance cost rises. The security risk compounds. And the gap between what government services could be and what they are widens.
The CISA Dimension
CISA's Known Exploited Vulnerabilities catalog creates a direct connection between framework choice and compliance obligation. Federal agencies running WordPress or Drupal inherit the CVE patching burden of those platforms — a burden that grows with each new vulnerability disclosure.
