Nothing is broken. Why would we spend money on it?

A director put this to me a couple of weeks ago about an online shop that has been running quietly for four years. Orders come in, money lands, nobody complains. His point was that money spent on something which already works is money not spent on something that does not, and he is right about that. So the honest version of my answer starts by agreeing with him.

The thing is, working and safe are two different states, and only one of them is visible from the outside.

What actually ages

The shop front was fine. Underneath it, the platform was a version from 2022, and the people who make that platform stopped supporting it a while back. That matters in three ways, none of which show up as a fault. There have been no security updates since then, so anything found in that version since 2022 is still sitting there. The two dozen paid add-ons bolted on are frozen at whatever they could do in 2022, which is why the newer phone payment methods cannot be switched on however much anybody wants them. And the developer who originally built it has moved on, so the only people who can safely change anything are learning it from scratch, at the client's cost, every single time.

So the shop works. It just cannot be changed, and it cannot be defended.

Old car, new engine

The way I put it to him was that this is an old car people actually like driving. The paintwork is fine, customers know where everything is, and it converts. You do not want to turn up with a different car. What you want is the engine swapped while the outside stays the way people recognise.

That framing mattered, because the first proposal I wrote for that business was a whole new website, and they told me it was unnecessary. They were right. Replacing the thing people are already used to is the expensive way to fix a problem that lives round the back.

So when is doing nothing the right answer?

More often than you would think. If the software is still supported, the person who built it is still reachable, and you are not being blocked from something you actually want to do, then leave it alone and put the money somewhere it earns. I have said exactly that to people and walked away from the work.

The reason I did not say it here is the shape of the risk. This kind of thing does not degrade gently. A platform four years past support does not get slower and slower. It works perfectly until the day something stops, and at that point there is no fix available, only a rebuild, done in a hurry, while the shop is shut. Prevent rather than cure is a worn out phrase because the arithmetic keeps being true. The unplanned version of the job costs more, and it happens on a date somebody else picks.

• Is the software you depend on still supported by the people who make it
• Can whoever built it still be reached, and would they take the call
• Is there something you want to do that the current setup will not let you do
• If it stopped on a Monday morning, what is the plan

If three of those answers are uncomfortable, this stopped being a features conversation and became a risk one. Nothing being broken is not the argument against doing the work. It is the reason you still get to choose when it happens.