Usually more than the team estimates, and it's rarely visible until an upgrade or incident forces it. A code audit against dependency age, test coverage, and JVM version gives a concrete number instead of a guess – worth doing before committing to a roadmap.

Depends on duration and risk tolerance. Hiring makes sense for core, long-term ownership. Augmenting with an external team makes sense for scaling fast, covering a skills gap (e.g., Spring migration, performance tuning), or de-risking a deadline, without the 3–6 month hiring cycle.

With guardrails, yes – but not unsupervised. The gains show up in test coverage and documentation more than in raw feature code, since a senior engineer still needs to review architectural decisions. One production engagement raised test coverage from 85% to 95% in a quarter using this approach, without it functioning as autopilot.

Security patches stop, hiring gets harder (fewer engineers want to work in an outdated stack), and every new dependency has to be checked for compatibility. It compounds quietly until a security audit or a hiring freeze forces the conversation.