Common questions about ColdFusion consulting.

Is ColdFusion still used in 2026?

Yes. Adobe shipped ColdFusion 2025 on Java 21, and thousands of enterprises, government agencies, courts, and universities still run mission-critical CFML applications. The platform is mature and stable — the challenge is the shrinking talent pool and end-of-life security pressure on older versions. ColdFusion 2021 left core support on 10 November 2025 and leaves extended support on 10 November 2026. Extended support does not include security patches. Adobe's lifecycle dates.

Who am I actually hiring?

Dave DeVol, working alone. Before this practice I spent twenty-two years as co-founder and CTO of DealerPeak, a bootstrapped B2B SaaS CRM that grew from a single dealer to hundreds of dealerships and roughly $8M in annual revenue, where I remain a Board Advisor.

That matters mainly because I have been the person accountable for uptime, security, infrastructure cost, and the P&L at the same time — so I weigh migration risk the way an owner does rather than the way a billable contractor does. Alongside that, 20+ years of production ColdFusion across every major version. More background.

What does a ColdFusion security audit involve?

A review of your ColdFusion version, patch level, server configuration hardening, known CVE exposure (including CISA KEV catalog status), OWASP Top 10 code review, and SQL injection surface. You receive a prioritized written report with remediation steps, ranked so you can act on the top items immediately rather than waiting for a full remediation budget.

How much does ColdFusion consulting cost?

Advisory and architecture work is billed hourly at $185–$225/hr. Fixed-scope audits run $3,500–$12,000 depending on codebase size and depth. Upgrade and migration projects run $18,000–$65,000+, scoped and quoted before work begins.

Ongoing maintenance is priced from a fixed monthly retainer, scoped to coverage and response requirements. The initial 30-minute technical assessment is free. Full breakdown on the services page.

Can you migrate ColdFusion to AWS without downtime?

I have done it — including a production CRM serving 500+ businesses and 2,000+ users during my time as a CTO, and a separate migration of 100M+ files from Microsoft DFS to Amazon S3 with no service interruption.

What I'll commit to for your system is the method rather than the outcome. Migrations are designed for phased cutover and rollback: a parallel AWS environment validated alongside production, a soak period, a rollback path rehearsed before cutover, and a DNS switch made as a decision against evidence. Anyone guaranteeing zero downtime before they've seen your integrations and data volumes is guessing.

Should I upgrade ColdFusion or switch to Lucee or BoxLang?

It depends on your support requirements, licensing position, engine-specific dependencies, and risk tolerance — and there is no universal answer. Adobe ColdFusion remains right for organizations that need a commercial support agreement or whose procurement requires a named vendor. Lucee removes per-server licensing but moves operational responsibility to you. BoxLang is a newer JVM-based option with the smallest talent pool today.

The CFML Engine Fit Assessment produces a written recommendation for your specific codebase, including the option of staying exactly where you are.

Can you migrate Adobe ColdFusion to Lucee?

Yes, where the assessment supports it. Both are CFML engines, so a large portion of ordinary application code tends to move with little or no change. The effort concentrates where the application depends on the engine rather than the language: Adobe-specific tags and functions, administrator and datasource configuration, scheduled tasks, caching, PDF and mail features, and Java or third-party extensions.

No one can honestly promise that all CFML runs unchanged. The compatibility matrix produced during the assessment answers that for your codebase specifically. How the migration works →

Do you work with government agencies?

Yes — it is work this practice is built for: federal contractors, state agencies, courts, and higher education institutions. Delivery is 100% US-based from Portland, Oregon with no offshore subcontractors, which addresses most data-residency requirements, and I'm experienced with AWS GovCloud architecture and CISA KEV compliance.

To be explicit about what I don't have: I do not hold a security clearance and I do not claim FedRAMP authorization. More on public-sector work.

Do you do work beyond ColdFusion?

Yes, in the areas adjacent to a legacy-dependent application: cloud cost and architecture review of an AWS footprint; technical due diligence for acquirers, boards, and executives; legacy integration and API modernization, which is usually the real source of pain people attribute to CFML; fractional technical leadership as advisory days or one defined initiative; and a narrow AI agent security and governance review for teams already experimenting with autonomous agents. All of them are on the services page.

What ColdFusion versions do you support?

All of them — from the earliest versions through ColdFusion 2025, plus Lucee and BoxLang. I've maintained production CFML since the platform's early days and have hands-on experience with every major release, including the C++ to Java migration era.

Do I have to rewrite my legacy ColdFusion application?

Usually not. Full rewrites are expensive and risky, and I've been on the side that has to fund one. Incremental modernization — stabilize the existing codebase, apply security patches, upgrade the runtime, then migrate to the cloud — solves the immediate risks at a fraction of the cost and time. If a rewrite genuinely is warranted, the assessment will say so.

How do I get started?

Book a free 30-minute technical assessment. I'll review your CFML engine and version, licensing status, and known-vulnerability exposure, and send you a short written summary afterward — no obligation, no sales pressure. If you'd rather write it down first, the contact form works equally well and I reply within one business day. Pick a time →