This post was originally published on this site

Throughout my career in cybersecurity and infrastructure protection — both in government and now at Google Cloud — I have consistently seen that friction between new and existing technology is often a barrier to progress. A new piece of software or service may work wonderfully on its own but then it’s placed within a complex, interconnected IT environment and lost in the operational inertia.

Today, enterprise technology is experiencing a historic transformation. Organizations globally are moving beyond integrating AI and LLMs, and are now utilizing AI to power autonomous, agentic workflows. Nearly 90% of the Fortune 100 are already using Gemini Enterprise to build, scale and govern agents. But as AI systems begin to plan, execute multi-step processes, and work alongside human teams, leaders are confronting this same tension between cutting-edge and legacy technology.

To understand how existing technology environments shape an organization’s ability to operationalize AI, Google Cloud partnered with Hypothesis Group to survey 1,250 enterprise IT and business decision-makers across the United States. The findings reveal a critical paradox: the legacy software systems enterprises rely on to deliver technology to their employees are simultaneously functioning as an innovation tax, actively holding back the AI transformation leaders are trying to achieve.

image 1_legacy software blog

image2_legacysoftwareblog

Legacy IT’s operational toll

In our study, we defined “legacy” technology as software running locally on computers and servers rather than natively in the cloud. Across industries, decision-makers report that maintaining this footprint exerts a constant friction on their AI ambitions.

The consequences to AI are not theoretical. Nearly half (49%) of respondents report that relying on on-premises software has actively delayed, reduced in scope, paused or canceled AI or other technology initiatives.

Digging deeper, routine patch application and maintenance emerged as a primary operational bottleneck. As AI-enabled vulnerability discovery accelerates, the rate at which flaws are surfaced in legacy codebases has outpaced what human security teams can realistically address.

This creates a zero-sum game between routine maintenance of legacy systems and AI modernization. Instead of directing engineer cycles toward AI modernization, IT teams are spending their time and resources on maintaining legacy systems.

Enterprise monoculture

Why do organizations continue to rely on legacy environments that constrain their modernization? As our research shows, it is not necessarily architectural preference — but the result of vendor lock-in.
 
Beyond narrowing technology choice, deep provider dependence introduces commercial constraints. In our study, 39% of decision-makers report that reliance on legacy software and cloud providers forces them to navigate complex licensing rules or contracts, or limited negotiating flexibility.
 
Even more concerning is the systemic operational risk created by single-vendor concentration. Concentrating operating systems, productivity applications, cloud hosting and emerging AI models within a single vendor’s monoculture creates an immense single point of failure. An autonomous AI agent is only as secure as the operating system and network it traverses. When that underlying stack is vulnerable, organizations are not deploying resilient intelligence; they are expanding their attack surface.

The_Innovation_Paradox_10

Customer choice

The solution to vendor lock-in is straightforward: enterprise buyers and policymakers must ensure organizations have genuine choice and interoperability in their software, cloud and AI architectures.

Furthermore, 80% of leaders agree that a provider’s installed base should not determine which AI technology an organization uses, while 78% believe that the providers who led the previous era of enterprise technology may not be best positioned to lead the AI era. Organizations want the freedom to choose best-of-breed intelligence on its own merits, rather than accepting bundled defaults tied to legacy desktop software.

image4_legacysoftwareblog

Accelerate agentic technology

Delivering this level of autonomous agility across the enterprise requires modern technology built to support the agentic era. Here are a few ideas to get there:

  • Demand architectural and provider choice: AI and cloud must never be held hostage by the legacy software running local servers, email or desktop operating systems. Organizations need the commercial and architectural freedom to select best-of-breed IT on its own merits.
  • Commit to secure-by-design foundations: The industry must move past the broken cycle of releasing insecure software and patching it after the fact. Software manufacturers must engineer durable, resilient architectures where entire vulnerability classes are eliminated before code ever ships — relieving understaffed IT teams from perpetual applying routine but necessary patches.
  • Deploy AI-driven defense to remediate legacy debt: For the millions of lines of vulnerable legacy software already running in production, organizations must shift from manual triage to proactive, AI-assisted defense. By deploying platforms like Security Command Center and Mandiant threat analytics, teams can use intelligence to continuously surface active exploit paths, prioritize critical exposure and automate remediation across complex, hybrid environments.

The promise of agentic AI is to help automate friction away, and accelerate human ingenuity. But that future cannot be built on top of software designed decades ago. As IT leaders plan their roadmaps, it is time to ask: Is your technology foundation accelerating your future, or are you paying a maintenance tax just to keep the past running?

Learn more about the research here.