What Breaks If the Project Does Not Finish: Security, Compliance and ERP Work You Cannot Pause

Last updated: October 23, 2026

By Jennifer Burdick, Recruiting Manager, KORE1

Some IT projects cost more to stop than to finish: security remediation tied to audit findings, ERP cutovers already in motion, and platforms leaving vendor support. Windows Server 2016 extended support ends January 12, 2027, and SQL Server 2016 support ended July 14, 2026. Keep those staffed on contract. A mid-level contract security engineer bills $90 to $116 an hour nationally, per the KORE1 Contract Rate Index.

Every budget season produces the same spreadsheet. A column of projects, a column of costs, and a column someone labels “defer?” with a lot of yes answers in it.

I run recruiting and delivery at KORE1, and this is the time of year when hiring managers call to ask which of their contractors they can let go in December. Usually they mean the ones on projects that look unfinished, which is the wrong list to cut from. A paused project does not sit still. It keeps billing you in other forms, and the bill is rarely on the spreadsheet that made the decision.

Devin Hornick, a partner here, put the question to our team in an email this month in the plainest way I have seen it put: “What breaks if the company doesn’t spend the money or finish the project?” That is the question this post tries to answer, project type by project type, with the dates that will not move and what it costs to keep each one staffed through contract staffing with KORE1 or anyone else.

One honest note before the detail. We place contractors, so a post arguing against deferral is not neutral ground for us. Weigh it that way. Plenty of projects should wait, and I will say which ones.

What Breaks If This Project Does Not Finish?

The cost of delaying an IT project is everything the organization pays because the work stopped: the risk that stays open, the old system it keeps running, the people who relearn it on restart, and any penalty or audit consequence tied to a date. It is often larger than the cost of finishing.

Most deferral decisions only count the first number. What you save by stopping. They skip the second one. Entirely.

Look at what each kind of unfinished project leaves behind. A security fix that stops halfway leaves a known gap with your name on the ticket. An ERP cutover that stops after data migration leaves two systems to reconcile. A server migration that stops in December leaves production on an operating system that stops getting patches in January. None of those costs disappears in a hiring freeze. They move to a different budget line, usually one owned by the CFO, the auditor, or the insurance carrier.

Not every project works that way, which is the useful part. A dashboard rebuild can wait. So can a reporting migration that nobody is waiting on, or a portal redesign with no compliance hook. Stopping those saves real money and breaks very little.

Which Deadlines Will Not Move?

The vendor dates. Microsoft publishes them years in advance. It does not negotiate. As of October 23, 2026, here is where the common ones stand.

• Windows Server 2016 reaches the end of extended support on January 12, 2027, per Microsoft Lifecycle. That is 81 days out as I write this. Microsoft announced paid Extended Security Updates for it, delivered through Azure Arc.
• SQL Server 2016 already passed its date. Extended support ended July 14, 2026, and paid ESUs run in yearly terms through July 2029.
• SharePoint Server 2016 and SharePoint Server 2019 ended the same day, July 14, 2026, for both, so a farm on either version is already off support.
• Closer than any of them: .NET 8 and .NET 9 both end support November 10, 2026. Eighteen days.

Do the arithmetic on the first one. A contractor who accepts an offer this week starts, at KORE1, a median of 3 days later, which leaves roughly eleven calendar weeks before the Windows Server deadline, minus the holidays, minus change freezes, minus the week in January when half the infrastructure team is out. A migration that has not started by mid-November is already an ESU conversation.

For the database side, our SQL Server 2016 end of life breakdown prices the ESU against an upgrade server by server. For the application side, see the .NET 8 upgrade plan. I will not repeat either here.

Why Is a Half-Finished Security Remediation Worse Than None?

Because the finding is now documented. That changes everything. Before the assessment, a weakness was a risk you did not know about, and once it is written into a pentest report or an audit letter it becomes a risk you knew about and chose not to fix, which reads very differently to an auditor, a cyber insurance underwriter, or a plaintiff’s lawyer reconstructing who knew what and when. Remediation that stops at 60% leaves you with the paper trail of the full problem and the protection of part of the fix. The open items usually turn into formal exceptions, and exceptions need an owner, a compensating control, and a renewal date. Someone has to write all of that. Then the next audit cycle arrives and the scope grows, because the auditor now has a prior-year finding to follow up on and a reason to look harder at the areas around it.

External deadlines make it sharper. CISA’s Known Exploited Vulnerabilities catalog attaches a due date to every listed flaw, and some of those dates arrive within days of the listing. Federal agencies are bound by them. Many private security programs, and many of the questionnaires your customers send you, treat the same list as the floor.

And the downside has a number. IBM and the Ponemon Institute put the global average cost of a data breach at $4.99 million in the Cost of a Data Breach Report 2026. Against that, three months of a contract remediation squad is small. Not free. Small.

Which parts can wait? The roadmap items. A new SIEM, a zero-trust architecture study, a tooling consolidation. Those are investments. Closing the findings is not an investment. It is the debt from the last assessment. Our cybersecurity remediation staffing page covers the seats that close findings, and our post on what a contract cybersecurity team costs prices squads and SOC coverage in more detail than I can here.

What Happens to a Paused ERP Cutover?

You end up running two systems. That is the short version.

Here is a composite of what I have watched happen more than once. A manufacturer is six weeks from go-live on a new ERP. Data migration has run twice in test. The finance team has been trained. Then the budget review lands, the contract functional consultants roll off in December, and the go-live slides to “Q2, probably.” By March, the legacy system and the new one have both been taking transactions, the item master no longer matches, the open purchase orders exist in two places, and the trained users have forgotten most of what they learned. Nobody decided to pay for any of that. Nobody had to. It just happened.

Dual running is the expensive part. Two sets of licenses, two sets of reconciliations at every month-end close, and the data drifting further apart every week, so that the restart begins with another migration rehearsal instead of a cutover. Our guide to how long an ERP implementation really takes shows how approval delays alone stretch a timeline. A full pause stretches it more. The ERP implementation checklist lists the staffing items that usually go unbudgeted.

If the project has already stalled and you are trying to restart it, that is a different engagement with its own playbook. See ERP project rescue staffing.

Funded Initiatives You Cannot Push Into 2027: How Do You Rank Them?

Devin’s email to our team framed the market well: focus “where companies are still investing and where they simply can’t afford to have projects fail or go unfinished.” He followed it with the question I now ask every client in October. “What technology initiatives are already funded that you can’t push into 2027?”

Already funded is the important phrase. In the same email he made the point that companies “may not approve three or four permanent hires, but they may absolutely approve the resources or project team necessary to complete a $300K or $500K initiative that has already been funded.” The money exists. The question is whether it buys a finish or pays for a pause.

Here is the ranking I use with clients, in order. It is blunt on purpose.

1. Does a date outside your control apply? A vendor end of support, a KEV due date, an audit, a regulator, a contract with a customer. If yes, this one finishes. Full stop.
2. Has a finding been written down? Documented risk outranks undocumented risk, even when the undocumented one is larger.
3. Would stopping force you to run two of something? Two ERPs, two identity systems, two data centers. Dual running is a cost you pay every month the pause lasts.
4. How much of the knowledge walks out the door if the team rolls off? If the answer is “most of it,” the restart costs more than the savings. If the answer is “it is all in the runbook,” you can probably wait.

A project that answers no to all four is a genuine candidate for 2027. Defer it. Do not feel bad about it.

What Does It Cost to Keep the Project Staffed on Contract?

Less than most people guess. The crews are small. These are typical finishing crews, priced at the national median of each seat in the KORE1 Contract Rate Index.

Source: KORE1 Contract Rate Index 2026-Q4, effective October 16, 2026. National cells are modeled from BLS OEWS May 2025 wages at a 24% employer burden and KORE1 observed bill bands. Ranges are the 25th to 75th percentile bill rate. Three-month cost is 13 weeks at 40 hours a week at each seat’s median (security engineer $102 mid and $126 senior, systems engineer $79, ERP consultant $84, project manager $81). For reference, KORE1’s own observed cells, all levels: security engineers billed $70 to $124, median $82 (n=7, primarily Southern California), and ERP, NetSuite, and Salesforce consultants billed $73 to $123, median $91 (n=15, multi-state).

Keep the project staffed. Get a bill rate quote and send us the project type, the roles, your metro, the start date, and how long you need the seats.

Three months is a sensible planning unit, and our own records back it up. Across 1,887 ended KORE1 contract assignments from 2019 to 2026, the median assignment ran 116 days, a little under four months. IT assignments ran longer, 136 days at the median (n=410). So if you are funding the finish, fund four months, not six weeks. Short funding is how a finishing crew becomes a pausing crew.

Compare $124,000 with the alternative on the first row. Unpatched production servers, or ESUs followed by the migration anyway, a year later, with a team that has to be found again.

What Is Inside a Contract Bill Rate?

The number on the quote is not the number the contractor takes home. And the gap is not all profit. Devin walks clients through it with a round example.

Start with a contractor paid $100 an hour. Add the employer burden, which we model at 24%: payroll taxes, workers’ compensation, required insurance, and in California, mandatory paid sick leave. That is $124 an hour before the staffing firm has recruited anyone, run payroll, or carried any liability coverage. A bill rate for that contractor would land around $150 to $160 an hour. Devin’s version on our October call was three sentences long: “First off, it’s not a markup. Secondly, there’s a margin in there. And thirdly, there’s a bunch of other costs that you’re not thinking of.”

Here is the practical takeaway. When a firm quotes you a percentage, ask what it sits on. A percentage on the pay rate and the same percentage on the loaded cost produce two very different invoices, and burden is often left out of the quoted number entirely. Ask for the all-in hourly bill rate. Compare that. Our post on how to compare staffing quotes line by line walks through it with a worksheet.

The 2026 Contract Rate Card has bill ranges for every role and metro in the index, if you want to sanity-check a quote before the call.

Questions That Come Up When the CFO Asks What Can Wait

Which IT projects should we not defer into 2027?

The ones where stopping creates a new cost: security remediation tied to documented findings, ERP cutovers past data migration, and anything on a platform losing vendor support, like Windows Server 2016 on January 12, 2027.

Everything else is a fair candidate for deferral. Dashboards, redesigns, and exploratory work usually are.

Realistically, what does it cost to keep a stalled project staffed for three months?

$124,000 to $172,000 for a typical three-seat contract crew at KORE1 Contract Rate Index national medians, depending on whether it is a server migration, an ERP cutover, or a security remediation.

That is 13 weeks at 40 hours a week. A single mid-level security engineer runs about $53,300 for the same stretch, and a mid-level project manager about $42,200. Your metro moves those numbers. The contract staffing cost calculator does the math by role, level, and city.

Can we just buy Extended Security Updates and push the migration?

Extended Security Updates work as a bridge to a migration that is already scheduled, not as a plan, because they patch the old version while the migration you skipped still has to happen.

Microsoft sells SQL Server 2016 ESUs in yearly terms through July 2029, and Windows Server 2016 ESUs come through Azure Arc. Both cost money every year you stay. The useful version of an ESU purchase is one with a migration date already on the calendar and a crew already booked. I have seen the other version too. It tends to renew.

How long do contractors usually stay on a project like this?

KORE1 contract assignments last about four months: the median ended assignment ran 116 days, across 1,887 assignments from 2019 to 2026.

IT assignments ran a bit longer, a median of 136 days. Remediation and migration work often lands right in that window. Plan for it.

Would a full-time hire be cheaper than contracting the finish?

Not for work with an end date, because a permanent hire costs a placement fee plus a salary that continues after the project closes.

Direct hire at KORE1 is 20% of annual base salary with a 60-day replacement guarantee, and it is the right call when the seat outlives the project. If you are not sure, a contractor becomes eligible to convert to your payroll at no fee after 1,040 hours. That gives you the finish now and the hiring decision later, with real information.

Decide What Finishes Before You Decide What Waits

Run the four questions against every funded project on the defer list. Anything with an outside date, a written finding, or a second system attached to it finishes. The rest can wait for 2027, and you will have the budget to wait comfortably.

If the deferral conversation is part of a bigger 2027 headcount decision, our 2027 headcount plan for a higher-rate year covers the other half of it, and our contractor headcount planning framework for 2027 sizes the contract side.

And if one of your projects needs a crew to get over the line before January, talk to a recruiter about keeping the project staffed. Tell us the project, the roles, the metro, and the date that will not move. We will tell you honestly whether it can still be met.