An overwhelming 97% of US-based database administrators continue running outdated database management system (DBMS) programs, according to Percona's 2026 State of Open Source Database Management Report. The open-source DBMS support company's survey reveals that organizations maintain these mission-critical systems beyond their official end-of-life dates despite the significant security vulnerabilities that accompany unsupported software. Companies persist with obsolete database systems primarily because transitioning to newer versions represents a high-stakes, organization-wide migration effort rather than a straightforward software update.
The report identifies cloud consumption expenses as the most frequently cited barrier to reducing total ownership costs and completing upgrades, with 31% of respondents naming it their top obstacle, ahead of licensing fees at 23%. On performance and operational challenges, 42% pointed to inefficiency or sluggish throughput as a key concern, while 41% cited squandered engineering hours. Downtime affected 40% of organizations, and 37% struggled with scaling difficulties. Regarding governance and security, 54% said vendor lock-in complicates their ability to adapt to evolving regulatory demands, while more than half reported fragmented tools or policies. Additionally, 46% identified both software supply-chain traceability and a reactive security approach as areas of concern.
According to Percona CEO Peter Farkas, "Cloud economics are changing, AI is introducing new workload patterns, regulations are becoming more complex, and organizations are increasingly conscious of where their data and technology are controlled." The report notes that database teams face constraints from mounting cloud expenses, performance issues, wasted engineering resources, downtime risks, scaling complexity, inconsistent policies, and talent shortages. On artificial intelligence readiness, the survey found that fragmented data architecture and skills shortages tied as the leading barriers at 23% each, outpacing concerns about missing database features. Farkas added that "database leaders need to build for change, not for a single version of the future."
The report explains that upgrades often expose dependencies throughout the application stack, forcing teams to identify and revise code that relies on deprecated or removed database features. For instance, MySQL 8.0's default caching_sha2_password authentication method can create compatibility problems for older clients and may demand configuration adjustments. A change in default character sets from latin1 to utf8mb4 cannot safely be assumed transparent to existing applications or data-handling processes. Organizations must assess the complete environment, including applications, operating systems, libraries, and configuration files, since a database migration typically affects far more than just the database server itself. Major release transitions add further difficulty—the upgrade from MySQL 5.7 to 8.0 brought a substantial data-dictionary redesign and eliminated the query cache, making "just upgrade" an inadequate strategy. These complexities elevate both the expense and the hazard of moving to a supported release, requiring teams to conduct pre-upgrade checks, validate migrations in staging environments, and schedule production work carefully to minimize disruption.
The report concludes that organizations best positioned for the future aren't necessarily those that can predict what's coming next, but rather those that preserve the flexibility to adapt when changes arrive. Unsupported software complicates vulnerability management and audit requirements, while fragmented controls and database sprawl make upgrades and migration planning harder to execute consistently across an organization. For AI readiness, the findings suggest that disconnected data estates and insufficient staff expertise pose more immediate obstacles than a shortage of database features such as vector search or embedding storage. As companies continue navigating rising cloud costs and regulatory complexity, the report emphasizes that control and flexibility should be core requirements rather than secondary considerations. The economics of postponement may appear favorable in the short term, but the security risks of end-of-life software grow more acute as AI-powered tools accelerate the discovery of vulnerabilities. Organizations that invest in open-source DBMS resources gain the adaptability needed to respond to an uncertain technological landscape without locking themselves into a single vendor's roadmap. The tension between operational stability and security exposure will only intensify as the gap widens between legacy systems and the threats they face.