Legacy System Modernization Meets Its New Accelerator—and Its New Brake
Legacy system modernization is the process of transforming aging, brittle enterprise software estates into flexible, AI-ready architectures by replacing or refactoring old platforms, automating enterprise software migration, and standardizing workflows while preserving critical business logic and compliance requirements across complex, mission‑critical environments.
AI coding agents and agentic AI platforms are no longer side projects for curious developers; they are moving into the core delivery models of major service providers. Accenture and ServiceNow have launched a joint offering that combines managed security services on the ServiceNow AI Platform with an AI-powered migration solution to move clients off legacy risk systems. At the same time, NTT DATA is embedding AI coding agents from Cursor into its global engineering workflow to speed how it designs, builds, and modernizes enterprise systems. The takeaway: technology is finally fast enough to refactor legacy at scale—but organizational governance, not algorithms, now determines how far enterprises can safely push modernization velocity.
The urgency is clear. Data breach costs have reached USD 10.22 million (approx. RM47.0 million) per incident, up 9% year over year, while AI-driven attackers compress the time between vulnerability discovery and exploitation from months to hours. In that world, leaving critical risk platforms stranded on legacy technology is no longer conservative; it is reckless. Yet swapping human toil for AI-generated code without strong guardrails would only trade one form of risk for another. The real strategic question is not whether to use AI coding agents in legacy system modernization, but how tightly they should be governed.
Agentic AI Platforms Redraw the Risk Modernization Playbook
In risk and security, agentic AI platforms are turning once‑painful migrations into more automated enterprise software migration programs. Accenture and ServiceNow’s new joint services aim to remove two long‑standing obstacles to modernizing legacy risk platforms: the cost and complexity of moving off old cybersecurity systems. A managed security layer on the ServiceNow AI Platform is paired with an Accenture solution that automates migration from legacy risk platforms to ServiceNow, promising lower costs, less disruption, and faster time to value.
This is more than a tooling upgrade; it is a shift to agentic AI architectures, where AI agents continuously monitor vendors, regulatory changes, and operational technology risks, then automate lifecycle management and compliance workflows. ServiceNow already runs more than 100 billion workflows per year, and connecting that scale to AI-powered migration turns modernization into an ongoing, autonomous process instead of a one‑off project. In effect, the legacy risk system does not simply move; it is re‑composed into an AI‑coordinated control plane that spans IT, OT, and third‑party risk.
The promise is attractive: centralized risk visibility, faster deployments across critical infrastructure, and AI agents that help organizations stay ahead of escalating cyber threats and their financial impact. But there is an implicit trade: enterprises must accept that a growing share of their security posture depends on AI-generated workflows and automated decisions. That makes questions about model behavior, auditability, and override mechanisms far more than compliance box‑ticking—they become core design decisions for any serious legacy system modernization program in risk.
NTT DATA Shows AI Coding Agents Belong in the Delivery Factory, Not Just the IDE
If the ServiceNow–Accenture move is about agentic AI platforms, NTT DATA’s partnership with Cursor is about the messy middle: the code itself. The company plans to use Cursor Enterprise to bring AI coding agents into the daily work of its engineering teams so they can design, build, and modernize enterprise systems with more speed, consistency, and governance. Cursor’s agents operate with codebase‑wide context to write, review, refactor, and modernize code. For legacy estates, that means AI is pointed directly at the hardest tasks: untangling dependencies, rewriting brittle modules, and filling documentation gaps that have slowed modernization for years.
NTT DATA is deliberately treating AI coding agents as part of its global delivery model, not as optional developer plugins. Initial rollout will focus on priority engineering teams before expanding globally, backed by a planned Cursor Center of Excellence to spread practices across industries. This is a strategic signal to CIOs: AI coding agents are becoming part of the modernization workforce. They will sit inside structured delivery pipelines rather than in unsanctioned side tools, which is exactly where AI needs to live if it is going to touch mission‑critical enterprise software migration at scale.
The intent is not only to write code faster but to make modernization more repeatable. Legacy modernization has long been slowed by inconsistent delivery practices and high coordination overhead. Baked into NTT DATA’s framing is an acknowledgement that AI‑assisted engineering must improve quality, not only speed: the market will judge these agents on whether they reduce delivery friction without adding downstream support risk, security exposure, or technical debt. Without that, AI becomes a short‑term accelerator and a long‑term liability.
Governance Is the New Bottleneck for AI‑Driven Modernization
For all the excitement around AI coding agents, the most telling detail in NTT DATA’s move is where the emphasis lands: governance. Cursor Enterprise is described in terms of privacy mode, SSO, centralized administration, granular agent controls, and audit‑ready policy enforcement. Those are not afterthoughts; they are the enterprise filter. Legacy system modernization touches sensitive business logic, integration patterns, and often regulated data flows. Letting uncontrolled AI agents generate or refactor that code is unacceptable, no matter the productivity upside.
This is the central tension. AI coding tools can increase speed, but they introduce risks around code provenance, data exposure, inconsistent review, security defects, and blurred accountability. Enterprises now have to choose how much autonomy to grant AI agents and where to insert human checkpoints. The smarter players are treating governance as a design constraint, not a slowdown: they are embedding review policies into the AI platforms, logging every suggestion, and using policy engines to decide what agents may or may not touch.
The result is a new kind of bottleneck: not GPU capacity or model performance, but the pace at which organizations can define and operationalize guardrails. Service providers that solve this governance problem at scale will win the next phase of legacy system modernization. Those that chase short‑term velocity without controls will inherit opaque codebases, unclear accountability, and higher operational risk—the opposite of what modernization is meant to achieve.
How CIOs Should Exploit the Speed—Without Losing Control
The pattern across these moves is clear: AI coding agents and agentic AI platforms are shifting from experiment to infrastructure. Accenture and ServiceNow are tying AI-powered migration directly to enterprise risk outcomes, while NTT DATA is converting AI coding agents into a standard part of its modernization factory. For CIOs and transformation leaders, the worst response now is passive tolerance of shadow AI coding tools. The better strategy is aggressive, governed adoption.
That means treating AI agents as first‑class actors in legacy system modernization: defining where they are allowed to operate, which types of enterprise software migration they can automate end‑to‑end, and where humans must remain in the loop. It means insisting on platforms that provide organization‑wide privacy controls, auditable policies, and centralized administration. And it means measuring success not only in development hours saved but in fewer incidents, lower breach exposure, and reduced technical debt over time.
AI coding agents will not make legacy complexity disappear, but they can turn slow, brittle modernization programs into ongoing, adaptive change. The catch is that the true constraint has moved from computing power to corporate willpower. Enterprises that pair these tools with clear governance will gain a durable advantage in how fast—and how safely—they can reinvent their software estates. Those that fixate on speed alone will discover that the most dangerous legacy they carry forward is not their code, but their lack of control.
