Your ColdFusion application is not the problem. Finding anyone to maintain it is.
We have worked with CFML since 2003. That means we can keep a ColdFusion system running safely for as long as it makes commercial sense, and migrate it properly when it stops.
There is nothing wrong with a ColdFusion system that works.
ColdFusion has spent twenty years being declared dead while continuing to run insurance platforms, government portals and internal systems that process real money every day. If your application is stable, secure and doing its job, replacing it because the language is unfashionable is an expensive way to solve a problem you do not have.
The genuine risks are narrower and more concrete: engine versions that no longer receive security patches, hosting that is becoming hard to source, and a maintainer population that is retiring faster than it is replaced.
Those are addressable individually. An engine upgrade and a security review is a fraction of the cost of a rewrite and usually buys several more years of comfortable operation.
When migration does become the right call, because the business needs capabilities the platform cannot reach, or because support has genuinely run out — it should be a considered decision with a staged plan, not a panic after an incident. We can hold either position with you, and we will say which one we think is right.
Three routes, and one of them is usually cheapest.
We are equally happy delivering any of these, which is what makes the recommendation worth listening to.
Maintain and secure
The application meets the business need and the roadmap does not require change. A support retainer, patching, security hardening and documentation, so the system is not one resignation away from being unmaintainable.
Lowest cost Fastest Buys yearsUpgrade in place
The application is fine but the engine is out of support or the hosting is failing. Version upgrade to a supported Adobe release or to Lucee, dependency remediation and regression testing against real transactions.
Weeks Behaviour preserved Removes the security riskMigrate in stages
The business needs capabilities the platform will not reach, or support has ended. Comprehension first, then module-by-module replacement with both systems live in parallel until each slice is proven.
Largest Incremental Reversible per sliceSix risks worth confirming, whatever you decide long term.
These apply whether you keep the application for another decade or start migrating next quarter, and most can be resolved in weeks rather than months.
Is the engine still receiving security patches?
Unsupported ColdFusion versions have known, published, actively exploited vulnerabilities. This is the single most urgent item on the list.
Is the administrator interface exposed?
The CF Administrator reachable from the public internet is one of the most common causes of a ColdFusion compromise, and one of the easiest to close.
Are file uploads properly constrained?
Unrestricted upload handling has been the entry point in a large share of documented CFML breaches. Type, size and execution path all need checking.
Do the queries use parameters?
Older CFML frequently concatenates SQL. A pass with cfqueryparam across the query surface removes an entire class of vulnerability.
Is there a working, tested restore?
Backups that have never been restored are not backups. This matters more, not less, on a platform with a shrinking pool of people who could rebuild it.
Is any of it written down?
If one person holds the knowledge, documentation is the cheapest risk reduction available, and it is the prerequisite for every other option here.
Eight ways teams engage us on ColdFusion.
Most start with the audit, because it is cheap and it makes every subsequent decision easier to defend. Each of these has a page of its own.
The question that decides the target.
Almost every ColdFusion migration conversation begins with the wrong question, which platform is better. None of the four candidates is meaningfully better than the others for the kind of application CFML typically runs, and arguing about it is the most reliable way to waste a quarter.
The question that decides it is who will operate the system in five years and what they already know. A technically ideal target your organisation cannot hire for is how you arrive back in this same position, one platform later.
We deliver in all four, which is the only reason this recommendation is worth anything. A firm that only staffs one of them will find a reason why yours is the situation that suits it.
Each target has a page of its own with the construct mapping, the traps and the staging plan, so you can check our reasoning instead of take it on trust.
The audit comes first, whatever you decide after it.
-
Week 1
Audit the engine and the exposure
Version, patch status, exposed surfaces, dependencies and hosting reviewed. Anything urgent is flagged the day we find it, not in a report a fortnight later.
-
Weeks 2–3
Close what is urgent
The immediate exposures remediated before any longer-term decision is made, because those risks do not wait for a budget cycle.
-
Weeks 3–5
Document what it does
AI-assisted reading of the CFML into behaviour documentation your business can verify. This artefact is useful under every one of the three routes.
-
Week 6
Cost the options honestly
Maintain, upgrade and migrate each costed against the same scope, so the comparison is real rather than rhetorical.
-
Ongoing
Whichever you chose
A support retainer, an upgrade project or a staged migration — run by engineers who have worked in CFML since 2003, with a named person who knows your system.
Twenty-three years of ColdFusion, written up.
Our engineers have been publishing on CFML for as long as they have been writing it. The archive lives on the blog.
Before you decide on ColdFusion.
The three below are the ones this page does not already answer. Anything more specific, put it to us directly.
Is ColdFusion actually dead?
No, though the question is fair. Adobe continues to release and support ColdFusion, and Lucee provides an actively developed open-source engine that runs most CFML with modest changes. What has declined is the labour market: very few developers have learned CFML in the last decade, so the constraint on your system is people, not platform. That is a real risk and it justifies planning, but it does not justify panic. A documented, patched, supported ColdFusion application with a maintenance arrangement in place is a manageable position; an undocumented one on an unsupported engine with a single maintainer is not.
If we migrate, what should we migrate to?
Whatever your organisation can hire for and operate, which is usually the deciding factor instead of technical merit. .NET, Java, Node.js and PHP will all host the kind of application ColdFusion typically runs; the differences that matter are your existing skills, your hosting strategy and your integration landscape. We deliver in all of them, so the recommendation is not steered by what we happen to staff. The one thing we would push back on is choosing a target because it is currently fashionable — that is precisely how you end up in this position again in twelve years.
Can you take over support from a departing developer?
Yes, and the handover window is the most valuable and most frequently wasted asset in that situation. If the person is still available, even for a few hours, we want structured sessions with them while we read the code, because the questions worth asking only surface once you are inside the system. Where they have already gone we reconstruct from the code, the database and the people who use the application daily. Either way the output is documentation you own, so you are not simply transferring the single-point-of-failure from one individual to another.