ColdFusion Consulting: Architecture Reviews, Performance Audits and Code Health Assessments
A slow application gets blamed on the server when the actual cause is a query running against a table that grew from 200,000 rows to 30 million without anyone revisiting the index. A failed upgrade gets blamed on the developer when the actual cause is a CFX tag from a vendor who went out of business in 2013. A security incident gets blamed on ColdFusion itself when the actual cause is a CF Administrator configuration that was never hardened after the initial install.
These misdiagnoses are expensive. They lead to the wrong solution, applied with confidence, at full cost. Our consulting practice exists to stop that from happening.
We don’t write code during consulting engagements. The deliverable is a written assessment and a conversation. A consulting engagement costs a fraction of a development engagement, and it consistently prevents the category of expensive problems that come from starting development before the diagnosis is right.
What You Actually Get
For architecture engagements, the deliverable is a component relationship diagram, a risk register of the highest-priority structural issues, and a prioritised remediation roadmap. The structural problems we find most often in CF environments: Application.cfc implementations that reinitialise expensive objects on every application restart instead of on demand; CFC inheritance hierarchies that create tight coupling across unrelated business domains; direct database access scattered across page templates rather than abstracted behind a data access layer; CFThread implementations that create race conditions under concurrent load. Each looks fine in isolation. Together, they explain why the application is hard to change without breaking things. Issues are categorised by urgency as well as severity, because some things that look alarming can wait, and some that look minor need to happen this sprint.
For performance engagements, the deliverable is a numbered findings list ranked by estimated impact, with the specific file, query, or JVM flag responsible for each issue and the exact step to fix it. Not “improve your database queries.” The specific query. The specific index. We use ColdFusion’s built-in request debugger, FusionReactor profiling where available, SQL execution plans from your database server, and JVM garbage collection logs. The findings list is usually short. That’s not because we missed things. Performance problems in CF applications almost always have a small number of root causes that account for most of the problem.
For code health assessments, the deliverable is a severity-rated findings report: critical, high, medium, low. Every finding includes a specific file and line reference, a risk explanation, and the exact remediation step. The report also includes a codebase health score your team can use to communicate technical debt risk to non-technical leadership. Automated tools like SonarQube flag safe ColdFusion patterns as problems and miss CF-specific risks entirely. The most common SQL injection vector in ColdFusion applications, CFQUERYPARAM with an incorrect cfsqltype, is invisible to every automated scanner. Our architects catch it because they know what a cfsqltype mismatch does at the database level.
When to Call Us
Before a major version upgrade: a compatibility audit prevents the “everything broke in staging” problem that derails most CF upgrades attempted without one.
When the application has slowed down unexpectedly and nobody can agree on why.
When you’ve inherited an undocumented legacy codebase and the team is afraid to touch it.
Before committing to a Lucee migration: the compatibility matrix tells you whether it’s viable and what it will actually cost.
How the Engagement Works
Starts with a free discovery call, 30 to 60 minutes. Fixed-price quote within 24 hours. Before we see anything, we sign a mutual NDA. Codebase, architecture docs, database schema: none of it before the NDA is signed.
Assessment work typically takes three to ten business days depending on codebase size and type. Every finding is verified by a human architect before it goes into the report. The written findings report is structured so your development team can act on it the day after the readout call.
The readout call is 60 minutes with your technical lead. The goal is to leave with clarity on what to fix first, why, and what the development effort looks like.
“We’ve partnered with IT Landmark for about seven years to manage our entire technical infrastructure. Their team handles everything from complex programming and PCI compliance to the daily management of our servers and front-end software.”
— Owner, Class Creator
| Case Study: Government-Adjacent Agency, DC Metro Area | |
|---|---|
| Challenge | ColdFusion 11 application, end-of-life since February 2020. FISMA compliance review flagged the unsupported software. Zero architecture documentation for a 14-year-old application. |
| What we did | Architecture review and compatibility assessment against CF 2023. Produced component relationship diagram (first in the application’s history). Identified 31 deprecated function calls, 2 CFX dependencies, and 7 Application.cfc scope issues causing intermittent session corruption under load. |
| Result | Architecture documentation accepted by compliance officer. Upgrade completed in 14 weeks. Session corruption issue occurring monthly for three years resolved at root cause. Zero post-launch issues. |
Frequently Asked Questions
How long does a ColdFusion consulting engagement take?
A focused performance audit typically takes 3–5 business days from access to written report. A full code health assessment of a mid-sized legacy codebase (200–500 CFML files) typically takes 7–10 business days. Large legacy applications (1,000+ files) require a scoping conversation before we can commit to a timeline.
Do you sign an NDA before reviewing our code?
Yes, always. We execute a mutual NDA before receiving any codebase access, architecture documentation, or database schema information. IP ownership of your existing code remains entirely with you throughout and after the engagement.
Can you work with ColdFusion versions as old as CF 7 or CF 8?
Yes. A significant portion of our consulting work involves codebases running on versions of ColdFusion that are no longer supported by Adobe. Our architects have working knowledge of ColdFusion from version 4.5 through the current 2025 release.
We already have an internal development team — do we still need external consulting?
Often yes. Internal teams who have been working in the same codebase for several years develop blind spots — patterns that feel normal because they have always been there. An external architect who has seen 750 different ColdFusion codebases brings a calibration that is difficult for an internal team to replicate. We frequently work alongside internal teams as a specialist resource rather than a replacement.
What does a ColdFusion consulting engagement cost?
Consulting engagements are scoped individually. A discovery call is free and carries no obligation. We will give you a fixed-price quote for the assessment work before any paid engagement begins. There are no hourly billing surprises — you know the full cost before any work starts.
What deliverables do we receive from a ColdFusion consulting engagement?
Every engagement delivers a written findings document — not a slide deck. The document is structured as a severity-rated findings list (critical, high, medium, low) with the specific file, query, or configuration responsible for each finding, a written explanation of the risk or impact, the exact remediation step required, and an estimated development effort. For architecture reviews, the report additionally includes a component relationship diagram and a proposed target-state architecture. All engagements end with a 60-minute readout call where we walk your technical lead through every finding and answer questions.
What is the difference between a performance audit and a code health assessment?
A performance audit is targeted — it identifies the specific queries, templates, and server configurations causing your application to run slowly, and delivers a ranked list of bottlenecks with specific remediation steps for each. The focus is speed and throughput. A code health assessment is broader — it reviews the entire codebase for technical debt, deprecated function usage, security exposure, and maintainability risk regardless of whether those issues are currently affecting performance. Most clients with a performance problem benefit from a performance audit. Most clients inheriting a legacy codebase or planning a major upgrade benefit from a code health assessment.
How does IT Landmark’s ColdFusion performance audit work in practice?
We begin with ColdFusion’s built-in request debugger, FusionReactor profiling where available, SQL query execution plans from your database server, and JVM garbage collection logs. The most common findings are: N+1 query patterns executing one database call per loop iteration instead of a single joined query; queries running against tables with no index on the WHERE or JOIN columns; Application.cfc scope initialisation errors causing expensive objects to be recreated on every request; CFThread implementations creating thread pool exhaustion under concurrent load; and JVM heap settings left at ColdFusion installer defaults that are undersized for production traffic volumes.
Can you conduct a ColdFusion consulting engagement on an application running on Lucee?
Yes. Our consulting practice covers both Adobe ColdFusion and Lucee CFML environments. For clients considering a migration from Adobe CF to Lucee, we produce a compatibility matrix assessment — a structured review of your codebase’s reliance on Adobe-specific features including CFDocument, certain CFX tags, Hibernate ORM configuration, scheduled task management, and edge cases in string and date function behaviour. The compatibility assessment produces a clear go/no-go recommendation with a cost estimate for any remediation required before the migration is viable.
Do you provide ColdFusion consulting for regulated industries — healthcare, financial services, government?
Yes. We have active clients in healthcare (HIPAA), financial services (PCI-DSS), and government (FISMA-adjacent environments). For regulated clients, consulting findings are structured against the relevant compliance framework so the report is usable directly by your compliance team. A ColdFusion security assessment for a PCI-DSS environment produces findings mapped to the relevant PCI DSS controls. A HIPAA-context code review structures findings around the HIPAA Security Rule safeguard categories.
What happens after the consulting engagement — do you fix the issues you find?
Remediation is a separate engagement from consulting. The assessment deliverable is yours regardless of what you decide to do next — your internal team can address the findings, or you can scope a development engagement with us to address them. Many clients use the consulting findings report as the input to a fixed-scope remediation project. For clients proceeding to development with IT Landmark, the transition from consulting to development is seamless because the development team inherits the assessment findings directly and does not need a separate onboarding period.
Can you review a ColdFusion codebase we have inherited with no documentation?
Yes, and this is one of the most common consulting scenarios we handle. The majority of our code health assessments involve codebases with no existing architecture documentation, no inline code comments, and institutional knowledge that departed with the developer who originally built the system. The assessment process is designed to work from codebase access alone. For architecture reviews of undocumented systems, producing the first documentation of the application’s component structure is one of the primary deliverables.
How is IT Landmark’s consulting assessment different from running an automated scan?
Automated code analysis tools — SonarQube, Code Climate, Veracode — analyse code at a syntactic level and cannot understand ColdFusion context. They produce false positives on safe CFML idioms and miss CF-specific risks entirely. The most common example: CFQUERYPARAM with an incorrect cfsqltype parameter is invisible to every automated scanner — the scanner sees CFQUERYPARAM present and marks the query as safe, while a CF architect recognises the type mismatch means the database will cast rather than parameterise the value, leaving the query vulnerable to SQL injection. Our assessments are conducted by architects whose entire professional careers have been in ColdFusion. Every finding is verified by a human before it appears in the report.
IT Landmark has provided ColdFusion consulting services since 1999. Our clients include organisations in government, healthcare, financial services, higher education, and eCommerce across the United States and internationally. To discuss your situation, call us directly at +1-844-440-0059 or schedule a free 30-minute discovery call.
Ready to Talk?
1,000+ ColdFusion projects. Adobe Solution Partner. 25 years. East Windsor, NJ.