Software updates can trigger a whole range of emotions in IT experts, from headaches caused by uncertainty about the consequences, to stress due to the urgent need to act, right through to relief when critical vulnerabilities are finally patched. The IT service provider Avision has taken a closer look at why updates actually have such a paradoxical effect and what possible best practices might look like.

Installing software updates is essential for IT security and is rightly regarded as the universal silver bullet. At the same time, however, it also represents a risk factor that should not be underestimated, one that can lead to new vulnerabilities. So what should be done? Because there is no alternative to most updates, companies should be fully aware of the pros and cons in order to achieve a robust level of protection through the best possible risk management. Upon closer inspection, the balancing act between risk and security naturally reveals a number of contradictions:

1. Updates close security gaps – and open new ones

Every update reduces a known risk and, at the same time, may introduce a new, unknown one. This is because any change to existing software, be it through new features, adjustments or bug fixes, can create unexpected side effects and new points of vulnerability. Security is not established once and for all by a new patch; it must be rebalanced with every update.

2. The more well-known the vulnerability, the greater the risk

If a vulnerability is discovered and a corresponding patch is released, that is good news at first. At the same time, however, a race against time begins. Attackers specifically analyse updates to derive exploits from them. Cases such as CrackArmor show just how narrow the window between release and attacks can be.

3. The most secure tools are often the riskiest

Security software requires extensive system privileges to perform its tasks. Unfortunately, it is precisely this fact that makes its updates particularly critical, as the example of Trivy has clearly demonstrated. Every patch alters not only an application, but potentially a highly sensitive access point within the system. If an update is installed incorrectly or even tampered with, the effect can spread immediately across the entire system.

4. Faulty updates can cause more damage than attacks

Whilst cyberattacks often specifically target individual systems, faulty updates can bring entire infrastructures to their knees simultaneously. The CrowdStrike incident in 2024 impressively demonstrated the impact a single faulty rollout can have on global IT systems. The difference: an attack exploits existing weaknesses, whilst a faulty update can destabilise various systems simultaneously. This creates a systemic risk that is difficult to predict and almost impossible to isolate.

So far, so contradictory. Nadine Riederer, CEO of Avision, puts these facts into perspective:

“Even if there is no ultimate solution to the general update paradox, companies can still derive some best practices from past incidents. These include, for example, safeguarding major updates with backups and the ability to quickly revert to a previous version in the event of an error.
It is equally sensible to check release notes and feedback from the community to identify known issues at an early stage, as well as to validate updates initially in secure test environments. However, a risk-based assessment is also crucial: critical systems should generally be updated quickly, whilst less exposed systems can, where appropriate, be monitored initially and updated in stages. In hindsight, such decisions are usually easy to assess, but in practice it remains a continuous balancing act between security, stability and availability.”

This press release is also available at www.pr-com.de/de/avision.

Press contact

Avision GmbH
Christina Karl
Marketing
Bajuwarenring 14
D-82041 Oberhaching
Phone +49-89-623037-967
christina.karl@avision-it.de 

www.avision-it.de     

PR-COM GmbH
Melissa Gemmrich
Sendlinger-Tor-Platz 6
D-80336 München
Phone +49-89-59997-759
melissa.gemmrich@pr-com.de

www.pr-com.de

Completely scrapping legacy systems is rarely a good solution. Legacy applications often contain critical structures and unique business expertise that must be preserved. IT service provider Avision explains which aspects of legacy systems are worth preserving.

They are difficult to maintain, expensive to run and often stand in the way of innovation: companies view legacy applications as a burden and would like to get rid of them. But beware: not everything about legacy systems is dispensable per se. They often contain critical structures and business processes that should be preserved. The IT service provider Avision specialises in the modernisation of legacy applications and highlights where companies need to look more closely:

1. User interfaces

People are creatures of habit and react sensitively to change. New user interfaces can therefore cause major difficulties. They often require significant training effort, and even technically superior interfaces frequently fail due to a lack of user acceptance. However, this does not mean that companies should leave the interfaces untouched. They should simply not be radically changed, but rather adapted in a targeted manner. This allows efficiency gains to be achieved that significantly outweigh the costs of the transition.

2. Interfaces

Most legacy applications are not isolated systems, but part of complex IT landscapes: they communicate continuously with other applications and systems via interfaces. Changes to these often have a direct impact on the connected IT landscape and can result in significant follow-on costs. Instead of simply replacing interfaces, new versions should be introduced in parallel and different data formats supported simultaneously. This ensures that the connected systems remain as stable as possible.

3. Processes

Some processes in legacy systems contain unique know-how that has grown over decades and forms the basis of companies’ competitive advantages. They deserve special protection because they represent a key success factor, even if they are not always modern. The switch from a proprietary legacy application to standard software can therefore pose a significant risk, as it robs companies of their individual strengths and can thus weaken them decisively.

4. Certifications

In highly regulated sectors such as the pharmaceutical industry, medical technology, aviation or the financial sector, software solutions are often certified. The certification processes required for this are extremely time-consuming and costly. It therefore often makes sense not to replace such solutions entirely, but to keep the certified core systems stable and to design modernisation steps on top of or around them. Modernisation should not jeopardise existing certifications.

“Not everything that is old is automatically worth preserving. At the same time, however, not everything that is modern is automatically better,” explains Nadine Riederer, Managing Director at Avision. “Companies must determine for themselves what has genuine value and is critical to their success – and where preserving the status quo stands in the way of necessary further development. A good legacy strategy preserves what is valuable and modernises in a targeted manner.”

 

This press release is also available at www.pr-com.de/de/avision.

 

Press contact

Avision GmbH
Christina Karl
Marketing
Bajuwarenring 14
D-82041 Oberhaching
Phone +49-89-623037-967
christina.karl@avision-it.de 

www.avision-it.de     

PR-COM GmbH
Melissa Gemmrich
Sendlinger-Tor-Platz 6
D-80336 München
Phone +49-89-59997-759
melissa.gemmrich@pr-com.de

www.pr-com.de

Refactoring is nothing less than an intervention in the code base of systems, which can create stability or generate new risks. The right approach is therefore crucial. IT service provider Avision summarises the most important steps for successful surgery on live code.

In practice, refactoring is much more than a purely technical measure. For improvements to the code base to have a long-term effect, a clear understanding of goals, limitations and processes is required. Based on many years of project experience, Avision has summarised the principles that are important and how refactoring can be integrated into everyday development in a structured manner:

1. Set clear limits and proceed step by step

Refactoring should be deliberately limited and controlled. Instead of large-scale changes, clearly defined, smaller changes that can be verified are crucial. In practice, a step-by-step approach with small commits has proven successful, allowing adjustments to be tested and traced directly. It is equally important to clearly define the scope: Which areas should be optimised and which should not? Without these boundaries, there is a risk that the refactoring project will get out of hand. This not only leads to increasing complexity, but also jeopardises schedules and acceptance within the team.

2. Introduce a comprehensive testing concept

Tests are not a nice-to-have, but a central prerequisite for refactoring to be responsible in the first place. Practical experience has shown that companies benefit from creating tests before the actual refactoring in order to safeguard the existing behaviour of the software. Only this basis makes it possible to see whether changes unintentionally alter functionality. Depending on the criticality of the code area, different types of tests can be considered, with unit tests, integration tests and end-to-end tests being particularly important.

3. Understanding refactoring as a process

Refactoring is most effective when it is not seen as a one-off large-scale project, but as an integral part of continuous software development. This prevents technical debt from accumulating over years and eventually becoming impossible to reduce without considerable effort. A proven approach is to leave the code a little better than you found it with every change. However, if refactoring has been neglected for a long time, a purely incremental approach is often not enough. In such cases, it makes sense to plan additional phases, such as technical sprints or dedicated projects to reduce technical debt.

4. Use AI only in a targeted manner

Artificial intelligence can effectively support refactoring when used deliberately. AI is particularly helpful when it relieves developers of clearly defined tasks, such as creating unit tests, restructuring methods or reducing code duplication. Less effective is the attempt to have large areas of code or entire applications completely optimised by AI using a refactoring approach. Especially in the case of mature legacy systems, technical evaluation by specialists and developers remains indispensable. AI is therefore not effective as an autopilot, but as a supporting tool. Humans remain responsible for architecture, logic and quality.

‘Refactoring is a necessary investment in the future viability of software,’ says Nadine Riederer, Managing Director at Avision. ‘It’s about systematically cleaning up your own code and modernising it in a meaningful way before real problems arise. Sure, refactoring takes time and usually doesn’t deliver any exciting new features. But it creates the basis for further developing software in a stable manner, avoiding technical debt and reliably implementing new requirements.’

This press release is also available at www.pr-com.de/de/avision.

Pressekontakt

Avision GmbH
Christina Karl
Marketing
Bajuwarenring 14
D-82041 Oberhaching
Phone +49-89-623037-967
christina.karl@avision-it.de 

www.avision-it.de     

PR-COM GmbH
Melissa Gemmrich
Sendlinger-Tor-Platz 6
D-80336 München
Phone +49-89-59997-759
melissa.gemmrich@pr-com.de

www.pr-com.de

Ageing IT systems need help. But because modernisation initially costs time, energy and money, many decision-makers recognise the need to act, but are surprisingly creative when it comes to glossing over the facts. IT service provider Avision reveals that behind the sugarcoating lies a failure to provide digital assistance.

Most companies have long been aware that their legacy software will not meet the requirements of the coming years. Technically, this is rarely a secret, and organisationally, it is usually not a secret either. And yet, surprisingly little is often done about it. Instead of making clear decisions, experience from the and the hope is spread that the problem will somehow resolve itself. This is also dangerous because legacy systems rarely explode spectacularly overnight, but slowly but steadily become more expensive, cumbersome and risky. Avision has collected the five most common spurious arguments from practice that slow down active countermeasures.

‘It still works.’

Yes, for now. At first glance, a system that is running often still appears to be stable. But simply functioning has nothing to do with scalability, security and future viability. If there are more users on the system than it can handle, backups have not been tested for years and new legal requirements can only be implemented with a lot of luck or not at all, then the system is no longer really running – it is somehow keeping its head above water. At the latest when an audit is passed only because no one has looked closely, action must be taken. But that is only possible if the system is still alive at all.

‘There is no business case.’

Modernisation often feels like pure money spending without any visible added value; after all, companies are not selling anything new afterwards. However, it is often overlooked that legacy systems make even the smallest change extremely complex, unnecessarily increase the cost of infrastructure and pose security risks that, in the event of an emergency, can cost many times more than the cost of modernisation. The business case rarely lies in the modernisation itself, but in the costs that would continue to accrue without it.

‘It’s so old, no one would hack it anymore.’

Old systems are inconspicuous and, as a result, are often dismissed as uninteresting to attackers. Added to this are arguments such as firewalls, internal networks or a lack of appeal to attackers. This is fatal, because the reality is different: outdated software often means unpatched vulnerabilities, missing updates and dependencies that no one can keep track of anymore. Each factor is a potential gateway for cybercriminals. Security comes from maintainability and transparency – and that’s exactly what neglected legacy systems lack.

‘No one can do that.’

When crucial expertise is concentrated in one or two people, every change becomes a risk. The absence of a single person can be enough to bring systems, processes or projects to a standstill. This problem is often ‘solved’ by leaving everything as it is. It has always worked well so far. The problem is that the longer nothing happens, the more difficult it becomes to build up knowledge or purchase it externally. At some point, a change in the law or a failure will force action – but then under maximum pressure and stress for everyone involved.

‘Never change a running system.’

This phrase sounds like experience and serenity, but it is usually an expression of fear of costs, complexity and the huge amount of work involved. While long-standing employees have learned to live with the idiosyncrasies of the system, new colleagues fail to do so or quickly move on. At the same time, the competition is pulling ahead. A system may still be running today – but without innovation, it will only be lagging behind tomorrow.

‘When it comes to maintenance and modernisation, software is not much different from areas such as road construction or real estate,’ explains Nadine Riederer, Managing Director of Avision. ‘If urgent measures are always put on the back burner and investments are avoided, at some point nothing will work anymore – and then it will become really expensive. There are many excuses, but they cost a lot of time and ultimately money as well.’

This press release is also available at www.pr-com.de/de/avision.

Press contact

Avision GmbH
Christina Karl
Marketing
Bajuwarenring 14
D-82041 Oberhaching
Phone +49-89-623037-967
christina.karl@avision-it.de 

www.avision-it.de     

PR-COM GmbH
Melissa Gemmrich
Sendlinger-Tor-Platz 6
D-80336 München
Phone +49-89-59997-759
melissa.gemmrich@pr-com.de

www.pr-com.de

With the end of the year just around the corner, it’s time for reflection and wish lists. Even in places where there’s usually little room for such things between deployments, ticket floods, and spontaneous “Can you just quickly…” requests. While the fairy lights are going up outside and the city centers smell of mulled wine and gingerbread, IT teams are hoping above all for stable systems and a few quiet days without alarm messages. So it’s time to take a look at the small and large wishes of those who keep IT operations running.

December is a difficult month in IT: On the one hand, many want to complete their projects, but on the other hand, everyone longs for a break from the hectic pace of IT operations. However, these continue unabated at full speed even during the Christmas season. So what’s on the wish list of developers who are trying to find a little peace and quiet between system crashes and last-minute changes during this often turbulent time of year?
We have compiled the most important wishes:

1. Fewer regulations, more fun coding

Every new guideline sounds like bureaucracy bingo: DORA, NIS2, CRA – at some point, no one knows anymore whether they are actually writing software or implementing regulations. Of course, security needs rules, but sometimes you wish the energy spent reading paragraphs could be converted directly into productivity.

2. Audits with long intervals

Christmas joy in its purest form: no checklists, no flood of meetings, no frantic “Who has the minutes from 2022 again?” Between security requirements and compliance updates, there’s hardly any room to breathe anyway. An audit-free year would be like a vacation.

3. A customer who voluntarily increases the daily rate

The probability of this happening lies somewhere between “the server remains stable after patch day” and “the specialist department has no change requests.” But we can dream: a customer who recognizes good work before the controlling department relativizes it—that would be true Christmas magic.

4. A VPN that ALWAYS works

Whether on the train, in the home office, or at the Christmas market – VPNs seem to have an aversion to the festive spirit. As soon as someone plays “Last Christmas,” the connection breaks down. If Santa could really bring one thing, it would be stable tunnels – without timeouts, without curses, without restarts.

5. A firewall that also blocks Christmas stress

Wouldn’t that be nice? A rule that automatically sends all “Quick query about project status” emails between December 23 and January 2 to snowy nirvana. Maybe even with an integrated meeting blocker. Anyone who manages to write this into the next security update would surely win the internal innovation award—at least from their colleagues.

6. A time machine for deployment

For those moments when just one tiny fix suddenly brings the whole system to a standstill. Anyone who has ever had a less than successful deployment on a Friday would give anything to have a time machine to go back 30 minutes before the button was pressed.

7. Finally, all tickets in the green zone

Every project manager’s dream—and a status that all development teams will still be telling their great-grandchildren about. In reality, tickets are not closed, they evolve: bugs become features, features become change requests, and at some point they are given low priority.

8. AI that finally understands what the customer really wants

Not what’s in the specifications – but what’s actually meant. If artificial intelligence could one day interpret customer wishes before they are rephrased three times and escalated five times, it would be the beginning of a more carefree era.

“As diverse as the wishes on our list are, in the end, everyone in IT wants the same thing: good health, good spirits, and a team you can rely on,” says Nadine Riederer, Managing Director of Avision. “Because without these three things, even the most wonderful IT miracles would only be worth half as much. With this in mind: Merry Christmas and best wishes for success and strong nerves to all developers.”

 

This press release can also be found at www.pr-com.de/de/avision.

Press contact

Avision GmbH
Christina Karl
Marketing
Bajuwarenring 14
D-82041 Oberhaching
Tel. +49-89-623037-967
christina.karl@avision-it.de 

www.avision-it.de     

PR-COM GmbH
Melissa Gemmrich
Sendlinger-Tor-Platz 6
D-80336 München
Tel. +49-89-59997-759
melissa.gemmrich@pr-com.de

www.pr-com.de

Many IT projects fail not because of technology or budget, but because of poor leadership. Between moderation mania, micromanagement and missed decisions, deadlines and motivation often fall by the wayside. Those who bear responsibility but do not take it on cause stagnation. IT service provider Avision presents five types of project managers that everyone knows from practical experience.

Modern IT projects depend on good leadership, decisiveness, empathy and foresight – all attributes that should be combined in project management. That’s the theory. Back in practice, however, IT teams, who are often not to be envied, find very different ‘strengths’ in project management. Decisions are postponed over and over again, responsibility is generously passed on, and meetings are scheduled ad nauseam.

In addition to the many capable and competent project managers in the world, Avision has identified five very specific types who are guaranteed to crash even the most promising IT project into the next wall.

The moderator – always trying

He never chairs a meeting alone and never makes a decision without consulting at least three colleagues. Everyone is allowed to have their say, and they are welcome to do so several times. And at length. His own comments bring even the smallest progress back to square one, and most employees dread the next ‘quick’ team update. After two hours, everything has been discussed, but nothing has been decided. The moderator likes to confuse leadership with physical presence and the length of the discussion with real progress. His strength lies in organising meetings, not in their effectiveness. Projects with him rarely end with a breakthrough, if they end at all. Perfect for those who don’t want to fail – because they never finish. And there’s another small catch: projects become increasingly expensive and the schedule is more of a well-intentioned guideline.

The speaker – a friend of his words

He confuses communication with constant noise. Every meeting begins with a monologue and ends with a repeat of the same. Anyone who tries to contribute triggers an hour-long digression. The speaker loves his own voice so much that he is reluctant to interrupt it – neither for arguments nor for results. At some point, no one in the team talks about problems anymore because they are afraid of provoking a new lecture. As a result, every topic is thoroughly discussed, every project is moderated to death – and every hour becomes one that you will never get back. True to the motto ‘This meeting could have been an email’, the team already looks with unease at the next appointment in the calendar.

The invisible one – camouflage mode on

He is formally the project manager, but in practice he is a myth. He is absent from meetings, offline in chats, and only present as a name in the project plan. While the team organises itself as best it can, the customer wonders about the remarkably long silence. In the best case scenario, the invisible one reappears shortly before go-live, usually to congratulate the team and sell their work as a joint success. For him, leadership is a concept that should work without him. And sometimes it even works, until someone notices that no one is talking to the customer anymore. The invisible one reliably causes escalations – both internally and externally.

The clueless one – a lot of hot air

Content? Nobody needs that! Instead of tackling problems and leading teams with his experience, he counts tickets, checks complicated tables and spends most of his time in mysterious meetings anyway. He takes technical questions ‘with him’ (wherever that may be) – and never brings them back (for whatever reason). For him, the project status is a number, not a state. His understanding of leadership is based on the idea that everyone must update each other at all times – even standing up in the morning. This way, he always remains superficially informed and can update the project plan. He reliably recognises risks only when the worst-case scenario has occurred and successes when someone else explains them to him. He has exactly zero ears for problems in the team and no interest in whatever his colleagues are actually working on in detail.

The dictator – everything stops at his command

He knows everything (better), especially when something is ‘finished’. Criticism is considered disloyalty, contradiction a weakness. Under his direction, tasks are completed rather than done. Pressure is his preferred management tool, and threats are part of his meeting culture. ‘I can see how you prioritise,’ is one of his favourite phrases – half cynicism, half warning. Teams under his leadership only function until the first ones leave. Which, strangely enough, happens very often. After that, he ensures a ‘breath of fresh air’ because new people are constantly joining. He confuses discipline with fear and does not realise that under his command, not only do projects fail, but people also lose motivation.

‘In the end, it’s not just new methods or powerful tools that determine the success or failure of IT projects, but people,’ says Nadine Riederer, managing director of Avision, with a wink. ‘Good project management keeps the team together, provides guidance and makes decisions when others hesitate.’

 

This press release can also be found at www.pr-com.de/de/avision.

Press contact

Avision GmbH
Christina Karl
Marketing
Bajuwarenring 14
D-82041 Oberhaching
phone +49-89-623037-967
christina.karl@avision-it.de 

www.avision-it.de     

PR-COM GmbH
Melissa Gemmrich
Sendlinger-Tor-Platz 6
D-80336 München
phone +49-89-59997-759
melissa.gemmrich@pr-com.de

www.pr-com.de