Why Many Enterprises Still Run on Apache Struts 1 & 2 (and How to Stay Secure)

Apache Struts 1 reached end-of-life in 2013. Struts 2.x is no longer actively supported. But across government, finance, SaaS, and healthcare, mission-critical applications are still running on both. Why? Because replacing them is expensive, risky, and in many cases—not necessary. Yet running unsupported software brings its own set of problems.

This article explains why organizations stay on legacy Struts, the risks associated with them, and how to keep those systems secure and compliant without a complete rewrite.

‍

Why Struts Still Lives in Enterprise Environments

‍
‍Some software stacks never die—they just stabilize. Struts applications still handle internal workflows, backend admin portals, insurance systems, government forms, and more. Why?

• Long software lifecycles: In regulated industries, software isn’t updated unless required. Think certification, audits, and decades-long SLAs.
  
  
• If it works, don’t touch it: Many internal apps built on Struts have minimal user interfaces and few integration points. They just work, and no one wants to break them.
  
  
• Cost of change is high: Replacing a large Struts app isn’t just a dev task. It’s a multi-team, multi-quarter undertaking that often doesn’t have executive buy-in.
  
  
• Risk of migration: Introducing a new framework or rewriting a live system carries significant risk. Uptime is more important than framework flavor.
  
  

In fact, large companies and governments still rely on Struts-based systems because those systems are embedded deep into mission-critical operations.

‍

The Risks: What Happens When You Stay on Unsupported Software

While the apps may work, the tooling around them is increasingly fragile:

• No official patches or CVE coverage
  
  
• Security scanners flag unsupported dependencies
  
  
• Compliance teams raise red flags
  
  
• New Java versions create compatibility gaps
  
  
• Talent pool is shrinking—fewer devs want to touch Struts
  
  

Even if the app is stable, these risks surface in audits, in PRs, and internal stakeholder meetings.

‍

How to Stay Secure Without Rewriting Everything

Here’s the good news: you don’t have to rewrite your entire system to stay secure. HeroDevs offers Never-Ending Support (NES) for Apache Struts, which delivers ongoing patches, compliance-grade updates, and long-term support for EOL frameworks.

With HeroDevs NES for Struts, you get:

• Security updates for Struts 1 and 2
  
  
• Coverage for vulnerabilities post-EOL
  
  
• SLA-backed support for regulated environments
  
  
• The ability to delay a rewrite until you’re actually ready
  
  

This isn’t a bandaid—it’s a strategic buffer. It gives your team time to plan and migrate on your timeline, not because a scanner forced your hand.

‍

Final Word

Enterprises stay on legacy frameworks because change is expensive, risky, and often unnecessary—until it becomes a compliance liability. HeroDevs helps you buy time and stay protected while you modernize intentionally.

You’re not alone in still running Struts. But you don’t have to run it unsupported.

‍