We maintain and run your legacy system as a whole, from the application down to the Linux server. One team is responsible for all of it, and the response times are in the contract.
- Security updatesin the maintenance windowinstalled
- IncidentsP2, databaseresolved
- End of supportPHP 8.2 on 31 Dec 2026planned
- NextUpgrade to PHP 8.4scheduled
You can use the report as evidence for your NISG duties.
When nobody is responsible
With many legacy systems, an agency or a single developer looks after the code and a hosting provider the server. The runtime, dependencies, database and configuration sit in between, and often nobody feels responsible for those layers.
When something breaks, the search for whoever is responsible begins. The hosting provider reports that the server is up, and the agency finds no error in the code. A runtime update stays on the shelf because neither side wants to carry the risk.
With Lobster Legacy Care we take over all five layers, from code to kernel. When something goes wrong, you open a ticket with us. Finding the layer it sits in is our job.
Move the mouse over a layer or tap it. Below it says who looks after that layer today.
Experience in the team
The team has over 15 years of PHP experience, and we look after 50+ IT services on more than 70 servers. That experience comes from the people in the team. The GmbH itself has existed since 2020. We handle incidents, changes and patches based on the ITIL® framework. How we work shows what that looks like day to day.
What Legacy Care includes
- We apply security updates for operating system, runtime, database and dependencies in agreed maintenance windows. Critical vulnerabilities get an extra slot outside that schedule.
- We give every incident a priority from P1 to P4. An engineer starts on it within the response time of your service level.
- When an incident comes back, we look for the cause and fix it for good with a planned change.
- We know when support ends for every component and plan the move before that date. We keep the dates in our EOL calendar.
- Depending on your service level, you get a monthly or quarterly report with applied patches, incidents and upcoming end of support dates.
From Legacy Check to ongoing care
You do not have to sign a maintenance contract straight away. We start with a Legacy Check. You can book each step on its own, and each builds on the one before.
- Legacy Check
Inventory, end of support, security, network and firewall, plus an action plan ranked by risk and a service level proposal. We only read; we change nothing on your system.
- Takeover
Access, runbooks and monitoring. We check the backup with a real restore.
- Care & operations
Patches in agreed windows, incidents by service level. You can use the regular report as evidence for your NISG duties.
- Modernisation
Runtime and OS upgrades, migrations, and replacing the parts that can no longer be maintained.
After the Legacy Check we take over your system. That takes 30 days, then the SLA begins. What we do in those 30 days is under Software takeover.
Move the mouse over a step or tap it. The step before and the one after stay highlighted.
What we take over, and what we do not
Before we sign, we agree which layers we cover and which versions run there. If more comes up later, we add it as an extension.
- Application
- PHP, Java, Node.js and Python, for example with WordPress, Laravel, Symfony, Payload CMS or Next.js
- Runtime & build
- Runtime upgrades, dependencies, CI/CD and containers, including SVN, Jenkins and Kubernetes
- Data
- PostgreSQL, MySQL/MariaDB, MongoDB, Redis, Elasticsearch/Solr
- Operating system
- Ubuntu and Debian, plus AlmaLinux as the CentOS successor
- Host network
- Host and cloud firewalls, nginx, Traefik and TLS, Varnish, load balancers, DNS, VPN to the host
We do not cover: Windows Server, firewall appliances, workplace IT and .NET Framework.
Service levels
Basic, Business and 24/7 Critical differ in service hours, response time, patch cadence and reporting.
Basic
from EUR 790 per month- Service hours
- Mon to Fri, 8:00 to 17:00
- P1 response
- 4 h
- P2 response
- next working day
- Patching
- monthly window
- Report
- quarterly
Business
from EUR 1,690 per month- Service hours
- Mon to Fri, 7:00 to 20:00
- P1 response
- 1 h
- P2 response
- 4 h
- Patching
- fortnightly, critical within 72 h
- Report
- monthly
24/7 Critical
from EUR 3,900 per month- Service hours
- P1 around the clock
- P1 response
- on request
- P2 response
- 4 h
- Patching
- as Business, plus emergency changes 24/7
- Report
- monthly, with incident reviews
Only a few places.
Response means an engineer is working on your incident. The hours count only within service hours.
References
- Tracking platform of an online service
We run and maintain the platform, and we migrated it while it was running.
- Java estate without vendor support
An inventory of every host and the nightly builds.
Evidence for NISG 2026
The Austrian NISG 2026 has been in force since 1 Oct 2026. Companies it covers have to look after the security of their supply chain and the maintenance of their systems, including how they deal with vulnerabilities (§ 32 NISG 2026). That is why they ask their suppliers about patch management, often with a supplier questionnaire.
According to the KPMG study Cybersecurity in Österreich 2026, ineffective patch management was the entry point in 40% of attacks on Austrian companies.
Our report lists which patches we applied and when, which incidents occurred and which end of support dates are coming up. You can use the report as evidence for your own NISG duties. It does not replace legal advice.