Contents
- The four cost bands, and what triggers each
- Why “it depends” is a sales tactic, not an answer
- What actually moves a quote
- The walk-away clause, and why it exists
- Which band do you need?
- FAQ
- What to do next
You are probably here because something is breaking, someone above you asked “what would it cost to fix this properly,” and every agency site you’ve opened so far has answered with a contact form.
So here are our actual numbers.
WebFix publishes five fixed price bands for modernization and rescue work. They are on our pricing page, they are in this article, and they are the same numbers we quote on a first call. Below is what each band costs, what situation triggers it, and what makes a quote move toward the top of its range.
We have been doing this since 2002. The ranges below come from that work, not from a pricing consultant.
The four cost bands, and what triggers each
| Engagement | Price | Duration | What triggers it |
|---|---|---|---|
| Code & Risk Review | No charge | 90 minutes | You suspect a problem but can’t yet name it. Two of our engineers, your codebase, your worst issue. |
| Systems Audit | $18K – $35K | 2 – 3 weeks | You need a defensible answer — to a board, an acquirer, an insurer — and internal opinion is split. |
| Stabilization Sprint | $85K – $180K | 8 – 12 weeks | Production is actively hurting you, or one AI pilot has been “two weeks from launch” for seven months. |
| Modernization Program | $250K – $750K | 6 – 12 months | The rebuild. Phased, milestone-billed, named architect, steering cadence you can take to a board. |
| Embedded Engineering Pod | $28K – $65K / month | Ongoing | Four to six engineers and a tech lead running your roadmap under our delivery process. |
Note what these bands are not. They are not tiers of the same product with more features bolted on. They are answers to structurally different questions. Buying a $250K rebuild when you needed a $95K stabilization sprint is not generous — it is a misdiagnosis that costs you eight months.
Code & Risk Review — no charge, 90 minutes
Live and recorded. Two engineers, your codebase open, and the problem that keeps you up. You keep the findings whether or not you hire us.
There are no salespeople on the call. That is not a tagline — it is a staffing decision. The ninety minutes is spent reading code, not qualifying you.
[INTERNAL LINK: /insights/what-two-engineers-find-in-90-minutes “what actually happens in those ninety minutes”]
Systems Audit — $18K to $35K, 2 to 3 weeks
Our named diagnostic. Fixed price against fixed scope, with a walk-away clause. You finish owning four artifacts: an architecture map, a risk register, a remediation plan, and a fixed-price build proposal.
You own all four regardless of what you do next. Take them to another firm if you want. That is the point of the clause.
Stabilization Sprint — $85K to $180K, 8 to 12 weeks
Stop the bleeding on a failing system, or take one stalled AI pilot the whole way into production. Most companies we meet have exactly one of these waiting.
This is the band people most often skip, and skipping it is expensive. A team that jumps straight from “our system is unstable” to “let’s rebuild” spends a year building a replacement on top of requirements they never stabilized enough to understand.
Modernization Program — $250K to $750K, 6 to 12 months
The rebuild. Phased and milestone-billed, with a named architect and a steering cadence.
Almost nobody buys this cold, and we do not sell it cold. It is bought by people who already sat through an audit with us and watched how we work. If a firm is quoting you $400K on a first call without a diagnostic, ask what that number is based on.
Embedded Engineering Pod — $28K to $65K/month
Four to six engineers plus a tech lead, running your roadmap under our delivery process. The rung that compounds, and the one we have been doing longest.
[INTERNAL LINK: /insights/embedded-pod-vs-staff-augmentation “pod vs staff augmentation vs agency vs offshore, compared on cost per shipped outcome”]
Why “it depends” is a sales tactic, not an answer
Search legacy system modernization cost and you will read a dozen articles that explain the variables affecting price, then end without a price.
The stated reason is that every system is different. That is true and it is not the reason. The real reason is that an unpriced conversation is a longer conversation, and a longer conversation is easier to sell into. Once you have invested three calls, you are less likely to walk.
Two things are true at once:
- A precise number requires reading your code. Nobody can quote your rebuild accurately from a discovery call.
- A range requires only honesty. Any firm that has done this fifty times knows within a factor of two what a given class of problem costs.
Refusing to publish the range is a choice about sales process, not a limit of knowledge. [EXTERNAL LINK: a competitor’s “legacy modernization cost” article that discusses cost drivers at length without naming a figure — useful as a neutral illustration of the pattern]
What actually moves a quote
Within any band, five things push a number toward the top of its range. None of them are surprises, and all of them are findable in an audit.
1. Regulated data. HIPAA, SOC 2, PCI, or anything with a retention and audit-trail obligation. The engineering isn’t harder; the evidence requirement is. Every migration step has to be provable after the fact. Budget a meaningful premium and a longer calendar. [INTERNAL LINK: /insights/legacy-modernization-compliance “modernizing regulated systems without losing compliance”]
2. Data migration with no clean cutover. Moving code is a known quantity. Moving live data while both systems serve traffic, then proving the two agree, is where rebuild budgets actually go.
3. No test suite. If there are no tests, there is no definition of “still works.” The first weeks of any serious engagement go into building enough of a safety net to change anything at all. This is the single most common reason a quote lands high.
4. Undocumented business logic in one person’s head. The “only Dave knows why that runs at 3am” problem. Every such rule has to be excavated, written down and verified before it can be ported.
5. A live vendor relationship you’re exiting. Taking over another firm’s codebase mid-flight adds a handover cost that has nothing to do with the code and everything to do with access, credentials and goodwill.
Conversely, one thing reliably pushes a quote down: an audit. A firm quoting blind prices in its own risk. A firm quoting from an architecture map it built itself does not have to.
[INTERNAL LINK: /insights/fixed-price-vs-time-and-materials “how a paid diagnostic makes fixed-price quoting possible”]
The walk-away clause, and why it exists
Every Systems Audit carries one. You own the architecture map, the risk register, the remediation plan and the build proposal regardless of what you do next — including hiring someone else, or doing nothing.
Firms don’t usually offer this, because a diagnostic that can’t be taken elsewhere is a better sales funnel. We offer it for a straightforward commercial reason: it changes who buys. A client who feels locked in negotiates like a hostage. A client who could walk and chooses to stay is a client who actually believes the plan. The second kind of engagement goes better, and it is the only kind we want to be in for six to twelve months.
It also disciplines us. An audit that has to stand on its own — readable by a rival firm who would love to find a hole in it — is a better audit.
Which band do you need?
| If this is true | Start here | Typical spend |
|---|---|---|
| Something feels wrong, you can’t articulate it yet | Code & Risk Review | $0 |
| Leadership is split on rebuild vs repair | Systems Audit | $18K – $35K |
| You need a number a board will accept | Systems Audit | $18K – $35K |
| Someone is buying or investing and wants diligence | Systems Audit | $18K – $35K |
| Production incidents are eating your sprint capacity | Stabilization Sprint | $85K – $180K |
| An AI pilot has been nearly-done for months | Stabilization Sprint | $85K – $180K |
| The architecture itself is the constraint, and you know it | Modernization Program | $250K – $750K |
| You need durable capacity, not a project | Embedded Pod | $28K – $65K/mo |
Still unsure between repair and rebuild? That argument is usually happening inside your own engineering team already, and it rarely resolves internally because both sides are arguing from the same missing evidence. [INTERNAL LINK: /insights/rebuild-vs-refactor-vs-replace “a scoring rubric for rebuild vs refactor vs replace”]
Not sure whether you need the free review or the paid audit? The audit page covers where that line falls
FAQ
What is the average cost of legacy system modernization?
There isn’t a meaningful average, because the work spans a diagnostic and a full rebuild. What is meaningful is the band. A fixed-scope Systems Audit runs $18K–$35K. Stabilizing a failing production system runs $85K–$180K. A phased rebuild runs $250K–$750K. Ongoing embedded capacity runs $28K–$65K per month.
Why do most firms refuse to publish modernization prices?
Partly because a precise quote genuinely requires reading the code. Mostly because an unpriced conversation keeps a prospect in the funnel longer. The range is knowable; publishing it is a choice.
Can you quote a fixed price on a legacy system you haven’t seen?
No, and neither can anyone else. What makes fixed pricing possible is doing a paid diagnostic first, then quoting the build against the architecture map that diagnostic produced. A fixed price offered before any code has been read is a guess wearing a suit.
What does the walk-away clause on the Systems Audit mean?
You own all four deliverables — architecture map, risk register, remediation plan, fixed-price build proposal — whether or not you hire us afterward. You can hand them to a competitor. No clawback, no conditions.
Is the 90-minute Code & Risk Review really free?
Yes, and there are no salespeople on it. Two engineers, ninety minutes, live and recorded, and you keep the findings. The commercial logic is simple: the engagements we want are the ones where a client has already seen how we work.
What to do next
If you can name your problem precisely, book the Systems Audit — you’ll own a defensible answer in two to three weeks regardless of what you decide.
If you can’t yet, book the 90-minute Code & Risk Review. It costs nothing, two engineers show up, and you keep whatever they find.
