Valeo · security governance / February 2026

ActiveX migration: invisible dependencies are always the expensive part

Replacing old Office controls was not mainly about finding substitute components. The difficult work was discovering everything that depended on the old behaviour.

2 min read
Valeo · security governance
ActiveXmigrationlegacyExcel

Situation

Several objects and controls in the legacy Excel process had worked for years and therefore no longer looked like active risk. Modernization revealed that a visible button could hide event handlers, cell references and established user routines. A one-for-one visual replacement could easily have broken the behaviour behind it.

Approach

I decomposed the migration by behaviour. First I documented what the old element did, which inputs it read and which state it changed; only then did I choose a technical replacement. Behaviour that was no longer needed was not migrated by reflex. Compatibility was checked in small steps rather than through one large substitution.

Outcome

Fewer legacy elements survived than initially appeared 'mandatory'. Required behaviour remained, while the document became simpler and easier to understand. The exercise also exposed several old rules that had never been documented before.