- Client: A national insurance regulatory association
- Industry: Insurance and Government Regulatory Technology
- Services: Legacy Application Modernization, Software Architecture, Microservices Consulting, Custom Software Development
- Outcome: A near decade-long modernization partnership that rebuilt legacy C++ and Java securities systems on a test-first foundation, then carried that discipline into a build-system overhaul, migrating more than 200 mission-critical applications from Ant to Maven ahead of schedule, and into breaking apart a legacy monolith into independently deployable microservices.
Regulators in any industry run on systems that value accuracy over speed. In insurance, securities valuation engines, filing trackers, and case management tools accumulate years of embedded business rules, and much of that logic exists only in the code itself rather than in current documentation. Rewriting or modernizing those systems carries real risk: get a valuation rule wrong, or lose track of a filing deadline, and the consequences reach beyond a single application.
In this legacy Java application modernization case study, Keyhole Software worked with a national insurance regulatory association over a period spanning 2012 through 2021, modernizing a portfolio of legacy C++ and Java applications used to value securities, track insurance filings, and manage regulatory case work. The engagement expanded over time from rewriting individual legacy systems into a broader initiative: standardizing the build toolchain across the organization’s application estate and decomposing a legacy monolith into independently deployable services.
Legacy Java Application Modernization at a Glance
- Rewrote legacy C++ and Java securities valuation systems used to price mortgage-backed securities, using test-first development practices.
- Built and expanded a suite of insurance regulatory applications, including a filing-estimation tool and an enterprise financial reporting application.
- Migrated more than 200 mission-critical enterprise applications from Ant to Maven build systems, completing the modernization ahead of schedule.
- Rebuilt a legacy insurance-regulator tool with full unit and integration test coverage running in continuous integration on every check-in.
- Refactored project-tracking functionality out of a legacy monolith into an independently deployable microservice, and rebuilt its interface in Angular 8.
- Trained the client’s own quality engineers on modern automated testing practices to sustain the work after the engagement.
The Challenge
The association’s core systems for valuing insurer securities holdings had been built up over many years in C++ and early Java. The logic for valuing residential and commercial mortgage-backed securities was accurate and load-bearing for state insurance regulators, but it existed largely inside the implementation itself, with limited automated test coverage to confirm behavior during any future change.
As the relationship grew, the same pattern showed up elsewhere in the organization. Insurance filing tools, financial reporting applications, and case management systems for state regulators had each grown independently, often without a shared build process or consistent testing discipline. The organization’s build system, based on Ant and Ivy, tied application builds to specific machine configurations rather than a portable, repeatable process, which made every deployment more fragile than it needed to be.
The mandate across this long-running engagement was to modernize these systems without losing the regulatory logic embedded in them, bring consistent engineering discipline (testing, continuous integration, a portable build system) to a large and growing application portfolio, and eventually reduce the risk concentrated in a single legacy monolith by breaking it into independently deployable pieces.
The Approach
Phase 1: Test-First Rewrites of Legacy Securities Systems
The earliest phase of the engagement focused on the organization’s securities valuation systems, used to value residential and commercial mortgage-backed securities held in insurer portfolios. A small team of Keyhole consultants rewrote these systems on Java, Spring, and JPA against Oracle, using test-first development practices from the outset rather than adding tests after the fact.
This phase also modernized a 12-year-old C++ and Java securities application onto JPA, JSF, Seam, and Spring, replacing legacy architecture with a layered design that made the valuation logic easier to verify and extend.
Phase 2: Expanding the Application Portfolio
As trust in the team’s work grew, the engagement expanded into new systems. A filing-estimation web application, used to help insurance companies estimate their regulatory filings, was built on JSF, PrimeFaces, and JPA running on JBoss, with a dedicated Scrum team managing sprint-based delivery.
The team also worked on an enterprise financial reporting application built on Java EE, EJB, JSF, and Spring Batch, focusing on Spring Batch optimization within a layered architecture. Separately, a legacy insurance-regulator tool was rebuilt from the ground up with full unit and Cucumber integration test coverage, running in Jenkins CI on every check-in.
Phase 3: Standardizing the Build System
By 2018, the organization’s Ant and Ivy based build process had become a scaling problem in its own right: it tied builds to specific platform configurations rather than a standard, repeatable process, which limited how cloud-ready the applications could become.
Keyhole treated this as a dedicated modernization effort. One engagement converted a platform-specific Ant and Ivy build into a standard, cloud-ready configuration. A separate two-person team then led the migration of more than 200 mission-critical enterprise applications from Ant to Maven, completing the work ahead of schedule.
Phase 4: Breaking Apart the Legacy Monolith
The organization’s case-management platform, used by regulatory analysts across the country to track cases against insurance companies, had grown into a legacy monolith. Extracting functionality from it safely required understanding which pieces could be pulled out without disrupting the rest of the system.
Keyhole refactored the system’s project-tracking functionality out of the monolith into an independently deployable cloud microservice, then rebuilt its user interface in Angular 8 running against a Java API, working as a mixed team of client and Keyhole developers.
Phase 5: Sustaining the Testing Culture
Modern automated testing only holds up if the team maintaining the system keeps using it. Keyhole helped teams adopt Protractor end-to-end testing for Angular applications and trained the client’s own Software Quality Engineers directly on TypeScript and Jasmine, building automated tests that ran in GitLab pipelines for both standard Angular projects and Angular applications integrated with Okta.
Technologies Used
- Java, Java EE, and C++
- Spring Framework, Spring Batch, and Spring Security
- JPA and EclipseLink
- JSF, PrimeFaces, RichFaces, and Seam
- Struts and Apache Commons
- Oracle and MongoDB
- Angular, Angular.js, Angular 8, and TypeScript
- Protractor and Jasmine for automated testing
- Cucumber, JUnit, and Arquillian
- Jenkins and Jenkins CI
- Maven, migrated from Ant and Ivy
- GitLab and Subversion
- JBoss and Glassfish
- Okta
- Scrum
Legacy System Risks Uncovered During Java Modernization
Several of the organization’s applications carried risk that was not visible until the team worked directly with the systems. The Ant and Ivy build process tied application builds to specific platform configurations, which meant a build that worked on one machine could behave differently elsewhere. Standardizing this onto Maven reduced that inconsistency across the full application estate rather than one system at a time.
The case-management platform’s monolithic architecture concentrated risk in a single deployable unit. Any change anywhere in the system required redeploying and revalidating the whole application. Extracting project-tracking functionality into its own service reduced the blast radius of future changes to that specific capability.
Earlier in the relationship, the securities valuation systems carried embedded business logic without strong automated test coverage. Establishing test-first development on the rewrite gave the team, and the client, a way to confirm that valuation behavior was preserved as the systems were modernized rather than simply hoping it was.
Lessons from This Legacy Java Modernization Partnership
Test-First Development Reduces Risk in Legacy Rewrites
Applying test-first development to the earliest securities valuation rewrites gave the team a way to confirm that regulatory logic was preserved as the code changed. That same discipline carried forward into later projects, including the Cucumber and JUnit coverage built into the legacy insurance-regulator tool rebuild.
Modernizing the Build System Is Its Own Project
Migrating more than 200 applications from Ant to Maven was not a side effect of other modernization work. It required a dedicated team and its own scope, separate from any single application rewrite, because the build system affected every application in the portfolio at once.
Break Apart a Monolith One Service at a Time
Rather than attempting a full rewrite of the case-management platform, Keyhole extracted a single well-understood capability, project tracking, into its own microservice first. That incremental approach reduced risk compared to a wholesale rewrite of a system regulators depend on daily.
Long-Term Technical Partnerships Compound
Because the relationship spanned nearly a decade, later projects benefited from context built up during earlier ones. Consultants who had already modernized the securities valuation systems brought that architectural understanding into later work on the organization’s financial reporting and case management applications.
Results
Keyhole’s team migrated more than 200 mission-critical enterprise applications from Ant to Maven build systems, completing the work ahead of schedule, while also modernizing core securities valuation systems and extracting monolithic functionality into independently deployable microservices.
Beyond the build system migration, the engagement left the organization with a securities valuation platform rebuilt on test-first foundations, a filing-estimation tool and financial reporting application supporting day-to-day regulatory work, and a case-management platform with at least one major capability, project tracking, successfully extracted into its own deployable service.
On a related rollout of company address and contact management tools for insurance underwriters and agency affiliates, the team updated 8,245 addresses and 84 contacts across 943 cities with zero logged defects, a concrete example of the testing discipline carried through the broader engagement.
The organization also came away with its own quality engineers trained directly on Protractor, TypeScript, and Jasmine, giving the team the ability to sustain automated testing practices after the engagement’s active phases concluded.
| Metric | Before | Figure | Note |
|---|---|---|---|
| Build system | Platform-specific Ant and Ivy builds | Standardized on Maven | Migrated across more than 200 mission-critical applications, ahead of schedule |
| Case-management platform architecture | Single legacy monolith | Project tracking extracted as an independent microservice | Rebuilt in Angular 8 against a Java API |
| Securities valuation testing | Limited automated coverage | Test-first development across the rewrite | Applied to the organization’s securities valuation systems |
| Data migration accuracy | Baseline | Zero logged defects | 8,245 addresses and 84 contacts updated across 943 cities |
Key Takeaways from This Legacy Java Modernization Project
Modernizing a regulatory organization’s application portfolio is rarely a single project. It tends to start with one system that needs a stronger foundation, and it grows as that foundation proves itself, eventually reaching the build process and architecture decisions that affect every application in the estate.
- Test-first development pays off most clearly when the system being modernized carries embedded business rules that are not fully documented elsewhere.
- A shared build system is worth modernizing on its own, especially once an application portfolio grows past a handful of systems.
- Breaking apart a legacy monolith works better one capability at a time than as a single rewrite.
Organizations evaluating a similar legacy Java modernization effort should expect the scope to grow over time, and should plan for build and architecture modernization as deliberately as they plan for any single application rewrite.
Considering a legacy Java application modernization effort of your own? Explore Keyhole’s legacy system modernization services, microservices consulting, and software architecture services, or contact Keyhole to discuss assessing your current application portfolio and building an executable modernization plan.
