ColdFusion Consulting: Architecture Reviews, Performance Audits & Code Health | IT Landmark

Before a major version upgrade

ColdFusion version upgrades – particularly jumps from CF 9, 10, or 11 to CF 2023 or 2025 – are not simple installer runs. The differences in Java runtime requirements, session management behaviour, deprecated tag handling, and third-party component compatibility between legacy and current versions are significant. An architecture review before you begin the upgrade identifies every breaking change specific to your codebase before your first staging environment failure, not after.

Clients who skip the pre-upgrade assessment and go straight to migration consistently report the same pattern: the first two weeks go smoothly, then a cascade of small compatibility issues surfaces in week three that nobody anticipated. The consulting engagement typically costs less than two weeks of troubleshooting time.

When application performance has degraded

ColdFusion applications accumulate performance debt the same way they accumulate technical debt – gradually, and then suddenly. A query that ran in 200 milliseconds in 2018 may now take 4 seconds because the data volume has grown tenfold and nobody has revisited the index strategy. A page that loaded quickly when 50 users were concurrent is now timing out under 500.

Our performance audit uses ColdFusion’s built-in debugging output, FusionReactor profiling, and SQL query analysis to identify the specific bottlenecks. We do not give you a general recommendation to “optimise your database queries.” We give you a numbered list of the 10 queries on your application that account for 80% of your page load time, with the exact index changes or query rewrites that will resolve each one.

Before a Lucee migration decision

A Lucee migration can reduce your annual infrastructure costs significantly by eliminating Adobe ColdFusion licensing fees. But it is not the right decision for every application. Certain Adobe CF-specific features – particularly PDF generation via CFDocument, certain CFX tags, and specific ORM implementations – do not have direct Lucee equivalents. Making the migration decision without a compatibility assessment is how teams end up committed to a migration they cannot complete on the timeline they promised.

Our Lucee migration consulting engagement produces a formal compatibility matrix: a line-by-line assessment of your codebase’s reliance on Adobe-specific features, with a recommendation on whether a full Lucee migration, a partial migration, or staying on Adobe CF is the most cost-effective path. We have run this assessment on applications ranging from 50 CFML files to over 2,000.

When you have inherited a codebase with no documentation

Every organisation has one. The ColdFusion application that has been running since 2004, that three developers have touched, that has no documentation, and that the person who originally wrote it left the company in 2011. Your current team is maintaining it by reading the code, making small changes, and hoping nothing breaks.

A code health assessment of an undocumented legacy codebase produces three things: a map of the application’s component structure, a risk register of the highest-priority issues (security vulnerabilities, deprecated functions, single points of failure), and a prioritised remediation plan that your team can execute incrementally without a big-bang rewrite.

Every IT Landmark consulting engagement follows a structured process regardless of scope.

Step 1 – Discovery call (60 minutes). We review your ColdFusion version, hosting environment, application architecture at a high level, and the specific concern that prompted the engagement. This call is also where we scope the assessment – a 50-file application requires a different depth of review than a 2,000-file one.

Step 2 – Access and data collection. For a code health assessment we request read-only access to your repository after signing a confidentiality agreement. For a performance audit we need FusionReactor or CF debug output from a representative production traffic period, plus database query logs. For an architecture review we work from codebase access and documentation you already have.

Step 3 – Assessment work. Our architects conduct the review. Timeline varies by scope – a focused performance audit typically takes 3 to 5 business days. A full code health assessment of a large legacy codebase may take 10 to 15 business days.

Step 4 – Written findings report. The deliverable is a written document, not a slide deck. It contains a severity-rated findings list (critical, high, medium, low), specific recommendations for each finding, estimated effort for remediation, and a suggested prioritisation sequence. For architecture reviews, it also includes a proposed target-state architecture diagram.

Step 5 – Readout call (60 minutes). We walk through the findings with your technical lead and answer questions. The goal is to leave this call with clarity on what needs to happen next and in what order.

Most code review tools – SonarQube, Code Climate, and similar static analysis platforms – are not built for CFML. They flag issues in the Java layer of a ColdFusion application but cannot assess the CFML-specific patterns that actually cause problems in legacy CF codebases: improper use of Application.cfc, scope leakage across sessions, CFC instantiation patterns that create memory pressure, or tag-based CFML patterns that break under CF 2023’s stricter parser.

Our assessments are conducted by architects who have worked exclusively in ColdFusion environments for their entire careers. They recognise the difference between a coding pattern that looks bad in a generic code review and a pattern that is genuinely dangerous in a high-traffic CFML application. They also recognise the patterns that look unusual to an outside reviewer but are standard ColdFusion idioms that should not be changed.

This matters most in legacy codebases where the original developer had strong opinions about how ColdFusion should be used. A reviewer without deep CF experience will flag those decisions as problems. An experienced CF architect will distinguish between a genuinely risky pattern and a defensible choice made in a different era of the platform.

The most common outcome of a ColdFusion consulting engagement is a scoped development project. Clients who complete an architecture review or code health assessment with us typically have the information they need to make a confident decision on whether to upgrade, migrate, refactor, or rebuild – and they have a written document they can use to get internal approval for the work.

We do not require that consulting clients proceed to development with IT Landmark. The assessment deliverable is yours regardless of what you decide to do next. However, clients who move from consulting to development with us benefit from the fact that the developers who execute the work have read the architecture review and understand the specific constraints of the codebase before they write a single line.

If you already know you need development work and want to discuss that directly, our ColdFusion developers are available on flexible engagement models including hourly, dedicated, and fixed-scope.

For clients whose assessment surfaces legacy version issues, our legacy modernisation practice handles version upgrades and migration projects of any scale.