Every federal modernization conversation I sit in seems to end with everyone agreeing that the legacy code has to go. No one can explain how it gets replaced at the pace the mission actually requires.
The scale is well documented. GAO has estimated that roughly 80% of federal IT spending goes to operating and maintaining systems already in the ground rather than building new capability. Its most recent review of the government’s most critical legacy systems found that a majority still run on outdated languages from COBOL, and assembly, to Ada, and Fortran; several with known cybersecurity vulnerabilities that cannot be remediated without modernization, and all of them dependent on a shrinking pool of engineers who know how to touch them safely.
Across the U.S. economy, accumulated software technical debt now sits north of a trillion dollars. A meaningful share of that principal is held by federal agencies and their primes.
AI should be the obvious lever here. Translation and refactoring are exactly the kind of structured, high-volume work that language models do well. In commercial software, that shift has already happened.
It has not happened inside the boundary, and the reason is not reluctance. It is architecture.
The systems most in need of modernization are the ones that cannot call out to a cloud. Weapon system and avionics software, tactical mission planning, classified enclaves, and the financial and benefits systems agencies cannot take offline all live behind air gaps or in accredited environments where an outbound API call to a commercial model is a non-starter and sometimes a security incident. Every general-purpose, AI coding tool on the market assumes a network connection to somebody else’s inference. That assumption disqualifies the entire category from the work that matters most.
The second constraint is subtler and, in my view, more important. In commercial development, “mostly correct” is a productivity win. In a fire control system or a re-accreditation package, “mostly correct” is a finding. An ATO does not ask whether the output looked good. It asks for evidence like what changed, why, who approved it, and whether the translated code provably behaves like the original.
That is the problem that tools like Sentinel solve. AI-native development environments that run fully offline on local model packs, with no outbound network dependency, delivered as a VS Code-based environment inside the customer’s firewall. Sentinel’s specific migration pipeline moves source-to-source through staged policy gates with rollback and replay, human approval at each gate, and deterministic, hash-keyed runs so the same input reproduces the same output during an audit twelve months later.
Formal verification produces proof-backed equivalence between source and translated code, and security tooling maps to NIST 800-53, DISA STIG, and FedRAMP controls with SBOM output. In our internal benchmarking against leading commercial IDEs, that architecture holds accuracy on repositories where cloud tools degrade.
In August, we take it to Camp Roberts to put it in front of operators and collect the only feedback that ultimately counts.
The modernization bottleneck was never ambition or appropriation. It is that the most capable tools of this decade cannot legally or physically enter the rooms where the work has to happen. That is a solvable engineering problem, and solving it is the prerequisite for everything else on the modernization agenda.
Written by Murat Isik,
Founder and CEO, Noah Labs AI
