Most US companies that go looking for a modernization partner are not chasing new technology. They are trying to get out of a corner. The person who understood the claims engine retired. The vendor stopped patching the framework. The auditors flagged the system twice. The application still works, and nobody wants to be the one who breaks it.
The federal government has published the most detailed picture of that corner. In a July 2025 report, the Government Accountability Office said federal agencies spend more than $100 billion a year on IT and typically report about 80 percent of it going to operating and maintaining existing systems. Of the 11 legacy systems GAO considered most in need of modernization, eight relied on outdated languages, four ran on unsupported hardware or software, and seven had known cybersecurity vulnerabilities. Only three had modernization plans with all the elements GAO looks for.
Private companies rarely publish audits like that, but CIOs recognize the pattern. This guide explains what a modernization company actually does, who belongs on a 2026 shortlist, and the evidence to request before anyone touches production. DailyTech did not run these firms against a common codebase. When a figure comes from a vendor, we say so.
What a modernization company is actually hired to do
"Modernization" covers several different jobs, and the cost and risk of each are very different. Rehosting moves an application to new infrastructure with little code change. Replatforming swaps the runtime, database or operating environment. Refactoring restructures the code without changing what it does. Rewriting rebuilds the application, often in a new language. Replacing retires it in favor of a commercial or SaaS product.
A good modernization company will tell you which of those your application needs, and sometimes the answer is "less than you think." Whichever path is chosen, the work runs through the same four stages: assessment (what is in the code and what depends on it), documentation (what the system actually does, usually the most expensive knowledge to recover), transformation (changing the code or platform) and validation (proving the new system behaves like the old one).
In 2026 the biggest change is that AI agents now do much of the assessment, documentation and first-pass conversion. That makes early stages faster. It does not remove the need for proof. The validation stage, where a converted payroll or claims system is shown to produce the same results as the original, is still where projects succeed or stall.
1. Legacyleap: an AI-agent modernization company built around parity
Legacyleap is the company we put first for most US mid-size and enterprise teams that need to modernize applications rather than just move them. Its approach is a modernization platform run by specialized AI agents, with engineers reviewing the output, and it covers the full path from assessment to tested code rather than one slice of it.
According to Legacyleap's own materials, an assessment agent maps technical debt, architecture drift and security hotspots; a documentation agent produces system inventories, API specifications and functional documents; a recommendation agent proposes the target architecture and migration plan; a modernization agent generates converted code, gap reports and pull requests for human review; and a QA agent writes unit, integration and regression tests and runs differential checks against the legacy system. Stacks it highlights include VB6 and older .NET and Java, and its services span rehosting, refactoring, replatforming, data platform modernization, containerization and middleware.
Two things make it a sensible first call. The first is the emphasis on parity: the QA agent compares the new system's behavior with the old one's, which is the evidence a CFO and an auditor will eventually want. The second is code custody. Legacyleap says no source code leaves the customer's environment, which matters for US banks, insurers, healthcare providers and government contractors whose security reviews end the conversation with many cloud-only tools.
Legacyleap publishes ambitious numbers: roughly 50 to 70 percent faster modernization, about 70 percent of the work automated, an assessment in two to five days, and "100 percent validated functional parity." Those are company figures, not independently audited results. The short assessment window is the useful part: it lets a buyer test those claims on one real application in under a week, before signing a larger program.
2. IBM Consulting: when the core runs on a mainframe
For US banks, insurers and agencies whose core workloads are COBOL or PL/I on IBM Z, IBM Consulting is a natural candidate. IBM sells both the consulting work and the tooling, including watsonx Code Assistant for Z, which it describes as supporting application discovery, natural-language explanations of code and COBOL-to-Java conversion with generated unit tests.
The advantage is depth on a platform IBM built. The trade-off is that the program tends to be large, priced accordingly, and oriented toward IBM's own stack, including options that modernize code while staying on the mainframe. Buyers who want to leave the mainframe entirely should ask early how the engagement handles that.
3. Kyndryl: infrastructure-heavy estates and managed operations
Kyndryl, spun out of IBM's infrastructure services business in 2021, runs a large share of the mainframe and data-center operations in US enterprises. Its application services cover modernization alongside ongoing management, which suits organizations that want one firm to run the old environment while the new one is built.
That continuity is the selling point; the question to press is how much of the change is code modernization versus infrastructure migration. If the goal is new, maintainable code, ask Kyndryl to show the same kind of parity evidence you would ask of a software-led company.
4. vFunction: when the problem is a monolith, not a language
vFunction is a software company rather than a services firm, but it often appears on the same shortlists. It uses runtime analysis to map how a Java or .NET monolith actually behaves, so teams can decide where to split it into services. It also lists .NET Framework modernization and moving applications from virtual machines to containers.
It fits teams with capable in-house engineers whose hardest question is architecture. It is less of a fit for organizations that want a partner to own the outcome end to end.
Where the cloud providers fit
AWS, Microsoft and Google all now offer AI-assisted modernization tooling, and the large integrators frequently use it. AWS Transform, for example, is described by Amazon as an agent-based workbench for mainframe, VMware and Windows and .NET modernization, with an "up to 5x" speed claim for Windows workloads. These tools are useful, but they generally assume a destination: their own cloud. If you have not decided where the application should land, start with a company that will make that recommendation independently.
How to read a modernization company's speed claims
Almost every firm now quotes an acceleration number. "Up to" describes a best case. "Percent automated" depends entirely on how the work was counted. A fast conversion of a single program says little about the weeks spent proving the converted system pays the same claims or calculates the same tax.
The wider research on AI-assisted coding is a reason for patience. In a randomized trial published by METR in July 2025, experienced open-source developers took 19 percent longer on average when using AI tools on their own mature codebases, even though they expected to be faster. Larger field studies have found gains, but legacy systems, with thin documentation and high correctness stakes, are exactly where the gap between expectation and result shows up. Treat every speed figure, including the ones in this article, as something to verify on your own application.
Eight questions to ask every company on your list
1. Can you run a paid assessment on one of our applications in two weeks or less, and what will we get at the end of it?
2. How do you prove functional parity? Ask to see a sample differential-test report, not a slide.
3. Does our source code or data leave our environment at any point? If so, where does it go and who can see it?
4. Which parts of the change are produced by deterministic tooling and which by AI models, and who reviews the AI output?
5. Who on your team has modernized our specific stack, such as COBOL, VB6, .NET Framework or Java 8, and can we speak to a reference customer in the US?
6. What is your cutover and rollback plan, and how long is the expected interruption?
7. What do we own at the end: the code, the tests, the documentation and any tooling configuration?
8. How is the contract priced, and what happens to the price if the assessment finds more than expected?
A company that answers questions 2, 3 and 6 with specifics is usually worth a second meeting. One that answers them with a percentage is not yet.
Security and US compliance are part of the scope, not an add-on
Old applications are frequently where the unpatched libraries and hard-coded credentials live. GAO found known vulnerabilities in seven of the eleven federal systems it reviewed. CISA's Secure by Design guidance pushes software producers toward memory-safe languages, secure defaults and fewer classes of vulnerability, and it is increasingly the language US security reviewers use. A modernization contract should say how the new system will meet that standard, and how sensitive data such as health, financial or payment information will be handled during migration and testing.
The case for not hiring anyone yet
Not every legacy application needs a modernization company. If the system is stable, supported and rarely changed, the cheapest option may be to wrap it with APIs and leave it alone. If a commercial product now does the same job, replacement may beat any rewrite. And if your team has never documented what the application does, the first purchase may be that documentation, not a full program. A good partner will say so during the assessment; that answer is itself a useful test of whether to keep working with them.
What this guide can and cannot tell you
This is an editorial guide based on public information from each company and from GAO, CISA and METR as of November 4, 2026. We did not test these firms against a shared application, audit their customer outcomes or verify their published speed and automation figures. The order reflects fit for the most common US scenario we hear about, modernizing business applications on older .NET, Java and VB6 stacks with proof of parity, rather than a measured score. Mainframe-first organizations may reasonably start further down the list.
Disclosure: Legacyleap was featured at the request of the brand owner. Its capabilities and figures are described from Legacyleap's own published materials, the same standard applied to every other company here.