Why Software Needs Care — and What Happens When It Gets None

"But the site works fine" is the most common argument against maintenance — and it is even true, often for years. The problem: software does not age through use but through its environment. Three forces work relentlessly against every installation, whether it is maintained or not.

Force 1: security vulnerabilities keep being found — constantly

Every piece of software is built on components in which weaknesses are regularly discovered. What matters is what happens next: maintained installations receive the security update; unmaintained ones stay vulnerable — and get found by automated attack tools that systematically scan the internet for known gaps. It is precisely small organisations that are affected: attackers do not pick the practice or the association — they pick the gap.

Force 2: the technical environment moves on

Browsers change their behaviour, hosting providers switch to new PHP versions, encryption standards are retired. An installation that runs flawlessly today can show errors after a hosting migration — not because it got worse, but because the world around it has moved. Maintenance means tracking these movements in good time instead of improvising when things break.

Force 3: the law changes too

Legal-notice and privacy requirements, new rulings on consent, changed information duties: what a law firm, a cultural centre, or a practice offers online has to keep pace legally — sometimes that affects the copy, sometimes the software itself.

What sensible maintenance covers — and what it costs

Three things: security updates applied promptly, compatibility kept in view, and a point of contact for questions. For small organisations, maintenance retainers usually sit in the low three-figure range per year — a fraction of what a single security incident costs. Whether the vendor or a service provider of your own choosing does the caring is secondary; what matters is that someone does it at all. A note on my own products: maintenance is an optional contract, cancellable yearly – and a service provider of your choice may do it instead.

In short

Maintenance is the normal state of software in operation — the only question is whether it happens as a plan or as an emergency. How it belongs in the total calculation of a purchase is shown in Renting or Buying Software.

Frequently asked questions

My website has been running for years without updates — is that a problem?

Possibly yes, even if nothing is visible: outdated systems are the main gateway for automated attacks.

What does maintenance usually cost?

For small installations, usually a low three-figure amount per year. Be suspicious of "free forever" — care costs working time.

What belongs in a maintenance agreement?

Scope (updates, compatibility, support), response times, price and term, access rules including confidentiality — and, where data is accessed, a DPA under Art. 28 GDPR.

Last updated: August 2026

Ask a question — I always reply personally.