Why Legacy Dragon Ships as a Single Binary: Parsing COBOL Where the Network Doesn't Reach

The Legacy Estate Isn’t Optional About Being Locked Down

The organizations still running COBOL, JCL, and PL/I in production aren’t running them by accident — they’re running them because these systems sit under compliance regimes that make “rewrite it” a multi-year project, not a sprint. A U.S. Government Accountability Office report published in February 2025 (GAO-25-107795) found that agencies planned to spend about 79 percent of federal IT investment for fiscal year 2025 on operating and maintaining existing systems rather than modernizing them. Of the 11 federal legacy systems GAO flagged as most in need of modernization, eight run on outdated languages, and both of the Department of the Treasury’s selected systems run on COBOL and Assembly language code.

Banking looks similar. Reuters’ widely cited 2015 estimate — still the reference point most of the industry repeats because nobody has run a more rigorous count since — put COBOL at roughly 220 billion lines still in production, running 43 percent of the world’s banking systems and 95 percent of its automated teller machine transactions. Whatever the exact figure is today, the shape of the fact hasn’t changed: the sectors with the largest COBOL estates — banking, insurance, government — are also the sectors with the strictest rules about what’s allowed to touch that code.

Air-Gapped Isn’t a Preference, It’s a Procurement Requirement

That’s the part general-purpose developer tooling tends to miss. A parsing tool that assumes npm install, a language-server download, or a call out to a cloud API isn’t just less convenient in these environments — it’s frequently disqualifying before a security review even starts. Coverage of air-gapped and regulated-industry deployments this year has made the operating reality explicit: in a genuinely air-gapped environment, every dependency update and every patch has to be manually vetted, transferred across the gap via approved physical media, and reintroduced into the isolated network — a review cycle regulated organizations measure in weeks, not minutes. A tool with a deep dependency tree doesn’t just risk breaking when it can’t reach the internet; it hands the security team a longer list of things to vet before the tool is allowed anywhere near production code.

2026 Kept Reinforcing Why That Caution Exists

This isn’t a hypothetical risk being used to justify an architecture decision after the fact — 2026 has been a rough year for the npm ecosystem specifically. In March 2026, a compromised maintainer account turned axios, one of the most widely used JavaScript HTTP libraries, into a malware delivery vector, serious enough that CISA issued a public alert on the incident. Weeks later, tainted node-ipc releases followed, and in June, attackers used a compromised GitHub credential to push malicious code into 32 packages inside the @redhat-cloud-services namespace. Security researchers tracking the pattern (Zscaler’s ThreatLabz among them) now count multiple distinct, sometimes state-linked groups actively targeting the npm and PyPI ecosystems and the managed service providers that sit downstream of them.

None of that is exotic — it’s the mainstream JavaScript package ecosystem, the one nearly every modern web-based developer tool sits on top of. For a bank or a federal agency deciding what’s allowed to run against production COBOL, “how many transitive dependencies does this tool pull in, and who’s auditing all of them” isn’t paranoia. It’s this year’s headlines.

What Single-Binary Actually Buys You

This is the environment Legacy Dragon is built for, not around. It ships as a single binary and parses ten mainframe-era languages — COBOL, JCL, PL/I, VB6, VB.NET, PowerBuilder, Assembly, SQL/DB2, CICS, and REXX — without a package manager tree to install, a cloud endpoint to reach, or a runtime dependency chain for a security team to trace through six levels of transitive packages before signing off. It handles the encodings this code actually shows up in — Shift-JIS, EBCDIC, DBCS — because mainframe estates weren’t written assuming UTF-8, and a parser that chokes on encoding before it even gets to syntax isn’t useful in the shops that need it most.

None of that is a performance optimization dressed up as a security story. It’s a direct response to who’s actually buying this category of tool: teams inside exactly the kind of institutions the GAO report and the Reuters banking estimate describe, where the software bill of materials for a code-analysis tool gets read as carefully as the code it’s analyzing. A smaller, self-contained artifact isn’t just easier to ship — it’s easier to say yes to, in the specific rooms where this modernization work actually has to happen.

---

Working on a legacy modernization project and want to see how Legacy Dragon handles your codebase? Read more about the parsing bottleneck it was built to solve, explore it at dragon.aitytech.com, or reach us at [email protected].