Legacy Modernization Cost: Rehost, Refactor, or Rebuild

Most modernization budgets get defended twice: once to the CFO, who sees a seven-figure line item, and once to the board, who want to know why the system cannot just stay where it is. The honest answer is that it can, until it cannot. Hardware ages out, vendors sunset runtimes, auditors flag the lack of SSO, and a single retiring engineer takes the only working mental model of the batch jobs with them.

Before the budget conversation, you need defensible numbers for the three canonical paths: rehost, refactor, and rebuild. The ranges below are drawn from 2026 vendor surveys and our own delivery data, with the failure modes that eat budgets in each lane. The point is not to pick the cheapest option. The point is to pick the one whose risk profile matches the system's actual role.

Why the Status Quo Has a Price Tag

Doing nothing is a budget line, not a neutral baseline. GAO's July 2025 review of federal systems is the easiest number to cite in a board deck: eleven critical systems, 23 to 60 years old, roughly $754 million a year to keep running. Private enterprises face the same curve in miniature. A McKinsey Digital survey of fifty CIOs at billion-dollar companies found that 10 to 20 percent of new-product budget gets rerouted into tech-debt repair, and 60 percent said that debt had grown over the prior three years.

The maintenance curve itself bends the wrong way. Ensono's 2025 modernization survey reports that 49 percent of respondents overran their planned legacy maintenance budget the previous year. Vendor exit fees compound the problem on their own schedule: Microsoft's Windows 10 Extended Security Updates program starts at $61 per device in Year 1 and doubles each year to $244 by Year 3 after support ended on October 14, 2025. That is the pattern across end-of-life stacks. The runway is priced to make you leave.

The Three Paths, Priced for 2026

Rehost, refactor, and rebuild are the three columns on every modernization slide, but the vocabulary in the room usually comes from the 6 Rs framework. That framework was originally published by Gartner in 2010-2011 and later popularized by AWS, which added Replatform and Repurchase to the mix. For buyers, the useful simplification is still the big three, because they bracket the risk and the cost by roughly an order of magnitude each.

Rehost is a lift-and-shift: same binaries, new infrastructure. Refactor keeps the external behavior and the business logic but rewrites the internals, usually in flight, usually using a strangler-fig pattern that routes traffic from the old system to new services piece by piece. Rebuild is a greenfield replacement with modern frameworks, a new data model, and in most cases a new vendor contract with the business for what the system actually does now, rather than what it did in 2008.

The headline ranges hide a wide spread per application. A simple internal tool at the low end of rehost can land under $50,000. A regulated financial platform at the high end of rebuild runs past $5 million before anyone discusses change management. The cost drivers are consistent across every lane: integration count, data volume, compliance scope, and the age of the oldest contributor still able to explain why a given stored procedure exists.

Rehost Is the Cheapest Line Item and the Most Expensive Habit

Rehost works when the infrastructure is the problem and the software is not. End-of-life hardware, a data center lease ending in six months, a hypervisor the vendor stopped supporting. The 2026 per-server labor band most references converge on is $3,000 to $8,000 per workload, decomposed across discovery, agent install, network configuration, dependency validation, and cutover rehearsal. Full application-level rehost projects typically land between $25,000 and $250,000 depending on scope, with timelines of two to six months.

The failure mode is the one every FinOps team learns the hard way. Lift-and-shift reduces capital expenditure but does not automatically lower operating costs, and overprovisioning can raise cloud spend by 15 percent without optimization. The architectural debt rides along in the suitcase. Gartner has estimated that 80 percent of technical debt is architectural, which means a rehost moves the debt rather than paying it down. Pick rehost when the deadline is the forcing function and you have a credible plan to refactor afterward. Treat it as a down payment, not a destination.

Refactor Buys Time Without Betting the Business

Refactor is the quietest of the three and usually the most defensible. The business logic survives, so the finance team does not have to re-approve the system's reason to exist. Costs run $200,000 to roughly $2 million per application and timelines stretch six to eighteen months, depending on how deep the rewrite goes and how many integrations have to be stabilized along the way.

The pattern that keeps refactors solvent is strangler-fig: stand up a routing layer in front of the monolith, carve out one bounded context at a time, and let the old code shrink. Done well, every increment ships to production, every increment is reversible, and the team can pause the program at any sprint boundary without stranding capital. Done poorly, the routing layer becomes its own monolith and the strangled system refuses to die. The common tells are a nine-month "foundational" phase with no customer-visible delivery, and a dependency graph where every new service still reads from the old database.

Refactor is also the lane where AI-assisted code generation changes the math. The savings are real on boilerplate and test scaffolding. The risk is accepting generated code into a production system no one fully reviews, which is a separate workflow that audit before deployment addresses in more detail. If part of the team is a staff-augmentation pod running alongside employees, costs follow the dedicated-team pricing model rather than fixed scope.

Rebuild Is the Highest-Risk Option and Sometimes the Only Honest One

Rebuild is right when the data model blocks the next three years of product, the original stack is no longer hireable, or the compliance regime has shifted under the system (think PCI, HIPAA, or state privacy laws that did not exist when the code was written). Costs run $500,000 to $2 million for a single enterprise application and past $10 million for complex portfolios, with timelines of eighteen to thirty-six months.

The failure mode is well-documented and comes with hard numbers. McKinsey and University of Oxford research on more than 5,400 IT projects found that large projects with budgets above $15 million ran 45 percent over budget, 7 percent over schedule, and delivered 56 percent less value than predicted. Rebuilds concentrate every risk a software program can have into one bet: scope, architecture, team, vendor, and change management, all simultaneously.

What saves a rebuild is scope discipline on day zero. A tight, written specification before anyone writes code, with explicit non-goals, is worth more than any choice of framework. The RFP checklist covers what belongs in that document. For SaaS products that need to serve multiple customers from one codebase, the architectural call about multi-tenant data isolation belongs in that spec, not in a sprint-three design doc.

What the ROI Looks Like When It Lands

Modernization only earns its budget if someone measures the result. Kyndryl's 2025 State of Mainframe Modernization survey, admittedly a narrow slice of the market, reports ROI ranging from 288 percent for modernizing applications on the mainframe to 362 percent for moving workloads off it. The pattern across smaller surveys is similar: refactor and rebuild outperform rehost on three-to-five-year TCO, often by a factor of two, because the operating cost curve is flatter and the feature-delivery curve is steeper.

Those numbers assume the program ships. Half of modernization budgets never produce the measured savings because the project runs long, scope grows, or the organization reorganizes around a different priority. Build the ROI model with a 30 to 50 percent contingency on cost and schedule, and present the no-modernization baseline alongside it. The alternative to spending the money is spending the money anyway, just on maintenance.

Picking the Lane Before the Budget Meeting

The decision is cleaner than the vendor landscape suggests. If the pain is operational, the hardware is aging, and the software still earns its keep, rehost and plan a refactor behind it. If the business logic is sound but the codebase has gone brittle, refactor incrementally with strangler-fig and ship every two weeks. If the data model, stack, or compliance posture is incompatible with the next three years of product, rebuild with written scope and a contingency the board has already approved.

The failure mode that cuts across all three is treating the modernization as a technical event rather than a program. The code is the easier half. The harder half is the parallel-run window, the data migration, the user retraining, and the operational handoff. Price all four. Then pick the lane whose risk profile the organization can carry for the next two years, because that is how long it will take whichever option you choose.