Global mainframe trends, risks and opportunities: a personal view

By Gary Dulon, Services Delivery Director, Vertali

When I cast my mind back over a 40-year career in mainframes, two fundamentals are clear. First, the mainframe has proven itself to be one of (if not the) most efficient, resilient, and securable platforms on the planet. And second, the future of the mainframe is impossible to predict. That said, we can see trends and pointers for the short- and medium-term. Above all, the mainframe continues to develop and transform, keeping it relevant.

Mainframe growth worldwide

The mainframe is well used, and usage seems to be on the rise. A 2024 Forrester study reported that “among global infrastructure hardware decision-makers, 61% said that their firm uses a mainframe. Of those that use mainframes, 54% indicated that their organization would increase its use of a mainframe over the next two years”. It’s long been accepted that the majority of Fortune 100 companies use the mainframe, often guesstimated at around 70 percent. This generally means IBM Z.

And the market is growing. An IMARC Group report said the global mainframe market hit US$ 2.5 billion in 2023, and expects it to reach US$ 4.5 Billion by 2032, a growth rate (CAGR) of 6.4% between 2024 and 2032. Why? “A rising emphasis on continuously re-evaluating enterprise IT strategies to support an evolving marketplace is stimulating the market.” This was backed-up by BMC’s latest state-of-the-industry survey. 94% of respondents saw the mainframe as a long-term platform, or a platform for new workloads. BMC’s John McKenny said the mainframe’s “speed, processing capacity, and security continue to make the platform a key component of the ever-changing IT landscape.” He pointed to hardware improvements, such as the z16 Telum processor, and incorporating AI and machine learning (ML), as key developments in ongoing modernization. It’s still relevant.

Current trends

What issues are currently front of mind? These observations are in the main anecdotal, being based largely on my interactions with end users, clients and vendors. But they are also topics that crop up repeatedly in industry reports and surveys.

Most organizations today are deploying or planning to deploy AI technologies. Some already have them. With the Telum processor now enabling you to “infuse AI inferencing for real-time insights”, the opportunity is to “analyze real-time transactions, at scale, for mission-critical workloads such as credit card, healthcare and financial transactions.” There are important security applications for generative AI and ML, too. Indeed, security remains a primary concern across the industry, perhaps unsurprising in today’s heightened cyber threat landscape. Linked to that are increasing calls for improved cyber resiliency.

In general, companies are continuing to modernize in place rather than rip-and-replace. We see a continuing move towards hybrid IT strategies. And while enterprise-wide observability is highly desired, its recognized as being tricky to achieve. And woven throughout all this, the skills gap remains a perennial issue. The results of Kyndryl’s 2024 State of Mainframe Modernization survey bear out many of these trends.

• 86% of respondents are either deploying or planning to deploy AI technologies.
• In the move to hybrid IT strategies, 96% of organizations are moving an average of 36% of their workloads off the mainframe to cloud platforms.
• Security is a central concern driving modernization investments: two-thirds of respondents valued security as “the most crucial mainframe feature” (the top priorities identified in the BMC survey were compliance and security).
• 92% of respondents deemed enterprise-wide observability essential but many organizations are struggling to achieving it within their hybrid IT environments.
• The skills gap remains a barrier for more than a quarter of organizations, particularly in areas such as AI and security.

Focus on security

Delving a little deeper into security matters, you may have seen these statistics before but they are worth repeating. They come from IBM’s Cost of a Data Breach Report 2024. The average global cost of a data breach increased 10% over the previous year, hitting US $4.88 million, driven by “business disruption and post-breach customer support and remediation”. On the credit side, IBM’s report found that security AI and automation are starting to pay off, “lowering breach costs in some instances by an average of US $2.2 million”. While AI can help to detect and contain breaches faster, and so contain the costs associated with them, AI is a double-edged sword and a powerful tool in the hands of cyber criminals. My Vertali colleague Mark Wilson has written about this in an article for Planet Mainframe, The good, the bad and the ugly: generative AI and cybersecurity.

I think the vast majority of organizations do have underlying issues that can undermine both their security and their ability to comply with industry standards and cyber security regulations. Some issues can be serious and lead to breaches. From our own mainframe security practice and conversations with clients, we know that prevention is key. An important aspect is carrying out regular Security Assessment and Penetration Testing, to identify vulnerabilities and close them before a breach occurs. Such an approach lowers or removes the cost of the breach altogether, and will identify the issues that can make you non-compliant. These can be addressed to avoid penalties, improve the organization’s overall security posture, and help you become more cyber resilient.

How cyber resilient are you?

This is another key trend worldwide, driven by regulatory concerns and the increasing frequency and range of ransomware attacks. For example, the European Union’s Digital Operations Resilience Act (DORA) applied from January 2025. This seeks to strengthen the IT security of entities such as banks, insurers and investment firms, so they remain more resilient in the face of severe operational disruption including cyberattacks. Around 22,000 institutions have to comply. Perhaps the two most important things to remember about DORA are that (a) it extends to third party service providers, and (b) it seems that addressing the regulation has not been a priority for many mainframe users. Let’s see what happens.

True cyber resilience brings together business continuity, information systems security, and organizational resilience, to counter external attacks, insider threats and natural disasters. Preventing, detecting, and withstanding an attack is only part of the equation. Recovery is the other essential element. Today, organizations are making backups of data more regularly, believing they can then recover from any catastrophic loss quickly and effectively. If only things were that easy. In many cases, organizations are not really focusing on the recovery aspect, the point in time they can actually restore to, thereby maintaining the integrity of their business applications and data. The critical question to ask, when thinking about your ability to recover, is how far can I actually roll back to? The first step in developing an effective cyber resiliency strategy and roadmap is to review your data backup, protection, and restoration procedures.

Where are the mainframe professionals we need?

In 2024, Gartner Research reported that “Lack of mainframe skills among new generations is a key factor driving organizations away from the mainframe”. The Kyndryl survey also reported that the skills gap was a barrier for more than a quarter of organizations in terms of mainframe modernization. This longstanding issue affects mainframe houses around the globe.

But perhaps there is some light at the end of the tunnel. While 28% of respondents in the Kyndryl survey reported they were struggling with the skills gap, 2024 research by Futurum Group presented a more positive view of the mainframe skills pool. It described a 65% increase in trained mainframe-skilled trained professionals, while stressing the continued need for targeted training.

Recent years have seen many organizations starting to address the skills gap, including IBM, and here at Vertali. Our New to Z (NTZ) program is just one of many global initiatives that seek to introduce fresh talent to the industry. You can read about two recruits here. This trend is becoming more noticeable worldwide and, I think, a younger mainframe workforce is starting to emerge. Some universities and educational establishments are also now including the mainframe in their curriculum. However, we must be wary about focusing on specialisms: the industry needs fully rounded individuals, able to turn their hands to the many different facets of mainframe infrastructure, operations, security and resilience.

The current state of play – and gazing into my crystal ball

So, what about predicting the future for the mainframe? I can have a go. In April 2024, Gartner Research published The State of IBM Mainframe at 60, and had this to say: “Organizations that own a mainframe periodically question the future of the platform because it is perceived as outdated, difficult to manage and costly compared with alternatives such as client/server and public cloud computing.”

Well, despite observing that you can say much the same about people – we can become more outdated, difficult to manage and costly the older we get – this has been a longstanding opinion held by key decision makers in organizations for more than 30 years. But trends are starting to change, and some of those key decision makers are beginning to realize the previous misconceptions about the mainframe.

Gartner also said, “The IBM mainframe will continue to offer significant value to organizations for at least the next 15 years and probably longer, because many global enterprises prefer to continue relying on their mainframe due to its features, as well as the cost, complexity and risk of migrating off of it.” And that’s what it comes down to, the provision of “significant value” to the business. The mainframe is still good at what it does. Very good. Hence its continued usage (and market growth) globally. And in my view, the mainframe will be around for a lot longer than 15 years as it continues developing, and embracing the new technologies and innovations that are driving all IT forward. The platform is well-positioned to exploit these opportunities and more – and will continue to be so, well into the future.

(This article first appeared in SHARE’D Intelligence on March 5th 2025)

Gary Dulon is Services Delivery Director at Vertali Ltd. He has more than 40 years’ mainframe experience, from systems architect and programme manager roles to senior leadership. He combines extensive management experience with client-facing programming expertise, database design, security skills, and pre-sales and post-sales support for a huge range of ISV products. Gary also has significant platform transition experience.