On February 23, 2026, IBM’s stock dropped 13% in a single day — its worst day since October 2000 — after Anthropic announced Claude Code could map dependencies, document workflows, and surface technical debt across COBOL mainframe codebases. Markets treated an AI coding announcement as a systemic threat to a business built on legacy modernization services. That reaction alone tells enterprise leaders something important: agentic AI-driven legacy modernization has moved from experimental IT initiative to a force capital markets now price in.
When modernization speed becomes a systemic risk
IBM pushed back publicly, and its rebuttal is worth taking seriously: “translating COBOL is the easy part,” the company said, according to CNBC. “The real work is data architecture redesign, runtime replacement, transaction processing integrity, and hardware-accelerated performance.” That distinction matters more than the headline stock drop. Agent-augmented modernization can cut rewrite costs by 30-50% and compress timelines by 50-80% compared to manual rewrites, according to Centric Consulting — but only when agents are used to compress discovery and comprehension, not to skip architectural decisions entirely.
The real risk isn’t speed — it’s security debt
The vendor narrative around AI legacy modernization is almost entirely about cost and speed. The practitioner narrative tells a different story. Penetration testing on AI-accelerated modernization projects “regularly finds vulnerabilities that didn’t exist in the legacy system but were introduced during modernization,” Centric Consulting’s VP of Cybersecurity told Forbes Technology Council. Teams that skip mapping actual legacy system behavior before generating replacement code are the ones most exposed.
This compounds a known accuracy gap. AI-driven refactoring has reportedly reached 93%+ syntactic accuracy converting COBOL to Java in industry benchmarks, but high syntactic accuracy does not guarantee functional business-logic equivalence — a distinction that matters enormously in banking, where a technically correct translation with a subtly wrong business rule can pass every unit test and still misprice a loan.
What Experian’s 687,600-line migration actually proves
Concrete numbers beat vendor marketing. Experian’s Data Office used AWS Transform to migrate seven legacy applications to .NET 8.0, transforming 687,600 lines of code with 80% automation, according to an AWS case study. Per-project effort dropped from 15 sprints to 8 — a 47% productivity gain — saving roughly 300 engineering days across the seven projects.
What made that result repeatable wasn’t the AI model alone. It was a structured, phased migration with defined checkpoints — the same governance discipline that separates a modernization framework from a modernization gamble.
A governance-first framework for regulated fintech modernization
Financial institutions cannot treat legacy modernization as “point the agent at the codebase and ship.” A framework built for regulated environments needs compliance guardrails, structured human handovers, and explainable decision chains defined before agentic code is written — some organizations spend up to four months on governance alone before implementation starts, per Microsoft’s regulated-industries modernization guidance. Four phases separate teams that ship safely from teams that make headlines for the wrong reason:
- AI-driven discovery and dependency mapping — document what the legacy system actually does before touching a line of replacement code.
- Governance and compliance guardrails defined upfront — audit trails, human sign-off gates, and rollback plans built before agentic execution, not bolted on after.
- Narrow-scope, agent-assisted refactoring with mandatory human-in-the-loop validation on every business-logic decision, not just code syntax.
- Continuous security and functional-equivalence testing — including adversarial penetration testing aimed specifically at vulnerabilities introduced by the migration itself.
Conclusion
The IBM stock drop was a signal, not a verdict: agentic AI can compress the hardest part of legacy modernization, but only in the hands of teams that treat governance as a prerequisite, not a formality. For financial services companies evaluating a modernization partner, the right question isn’t “how fast can you convert our code?” It’s “can you show me the framework that keeps a fast migration from becoming next quarter’s security incident?”