Yo Motherboard

How do you make the case for server updates when management says it still works?

November 15, 2026 5 answers
Asked by Javrel-4p

Two managed file transfer servers are running software from around 2015. Their perpetual licenses still work, but upgrade protection has expired. Renewing it would cost about €2,000 including VAT. I'm still checking whether support is included and which external file exchanges depend on the servers.

Management is reluctant to spend the money, even though the company has paid for an office renovation and an AI system that went largely unused. How would you make the case for updating without assuming the worst?

server updates System Operations software lifecycle managed file transfer IT budget justification

Answers

u.392!hingeclip

Start with the dependency work you're already doing. Which customers or internal processes use each server, what data passes through them, and how long could those exchanges be interrupted before it hurts? That makes the risk more concrete than the age of the software alone.

Then check the vendor's release notes and security advisories against the installed versions. Note any relevant vulnerabilities, support status and compatibility issues, but don't call the servers compromised or easily hackable unless the evidence supports that. Confirm what the renewal actually buys, including whether technical support is part of it.

Put the findings and options in writing for the person who owns the risk. Include the renewal cost, potential disruption, any interim mitigations and a request for a decision. If they decline, record that decision and revisit it when the facts or budget change.

Javrel-4p:

That gives me a clearer way to present the dependency findings. I'll check the vendor information before making claims about specific vulnerabilities.

Reply to this answer
Lervik-3x

The renovation comparison is frustrating, but it may not help get this approved. A large planned expense and a smaller unplanned one can come from different budgets. Ask whether the renewal can be funded now, and if not, put it into the next budget cycle with an explanation of the risk in the meantime.

Reply to this answer
4b+ticketmuffin_716

Check the paperwork too. Customer contracts, internal security policies, certifications or cyber insurance terms may have requirements about supported software or patching. None of those automatically means you're out of compliance, so find the actual wording and ask whoever owns the policy or contract to interpret it.

Reply to this answer
Veskar-4j

Renewal isn't the only possible route. If the servers turn out to do fairly simple transfers, a hardened OpenSSH setup with key-based access might be worth evaluating against the managed product.

Don't assume it's a drop-in replacement, though. Check the existing integrations, access controls and operational requirements, then include migration and ongoing administration in the comparison. €2,000 may be cheap compared with replacing a service that has a lot of hidden dependencies.

Jorvex-3n:

Also check which partners use FTP versus SFTP before proposing a replacement. They may not all be able to switch on the same schedule.

Reply to this answer
Vorlix-6c

If management accepts the risk, don't stop at filing the decision away. Ask what can be done to reduce exposure while the old version remains in use, and make sure there's a recovery plan for the affected exchanges. The people dealing with an outage will need something more useful than an old email chain.

Reply to this answer

Add your answer

Answers are reviewed before publication.

Related Discussions