AWG Retired a 20-Year-Old MFT Server Without a Day of Downtime

Somewhere in Associated Wholesale Grocers (AWG)’s data center, there is a Windows Server 2003 box that is still running. It handles COBOL-based file processes that would take thousands of hours to rewrite. It’s been there a long time, and it’s not going anywhere soon.

But for years, this very same box wasn’t safe in a nice, secure data center. For years it sat in the DMZ — an externally facing portal accepting inbound FTP requests from the public internet.

That’s right. FTP. Plain FTP. Unencrypted. This was the protocol handling 80% of AWG’s orders.

And AWG handles a lot of orders: $14 billion in annual revenue, with 11 distribution centers across the Midwest. AWG provides grocery distribution for over 4,000 independent grocery stores. Stores send orders to AWG, and AWG distributes product back to the stores. If orders stop coming in, that means grocery stores with empty shelves and perishable food that has spoiled.

That is not a situation anyone wants to explain to a CEO.

When Jake Sizemore, AWG’s Senior IT Manager and Chief Enterprise Architect, started looking hard at that server, the problem was obvious. Decades-old, unencrypted FTP was not where you wanted your entire ordering infrastructure to live — and the server itself was old and exposed to the public internet. Any infrastructure engineer worth their salt, as Jake put it, would not be happy about that. The question was what to do about it.

Why “Just Migrate It” Wasn’t the Answer

The straightforward approach — rip out the old FTP infrastructure and rebuild it on SFTP — ran into a wall almost immediately.

AWG had been using Cleo Harmony on-prem for its file automations. Moving those automations from FTP to SFTP wasn’t trivial. Jake’s developers estimated it would take roughly eight hours to modify each Cleo action. Multiply that across the full scope of the migration and you had a multi-month engineering project — and at the end of it, you’d still be running on-prem, in the DMZ.

The server itself added another layer of complexity. Replacing a 2003 box means either changing the IP or orchestrating a hostname cutover. Either way, you’re doing risky infrastructure surgery on a system that 4,000 stores depend on. And you still haven’t solved the DMZ problem.

Jake decided he needed a third option.

The Third Option: Hide It Behind the SaaS Layer

The idea Jake landed on was simple. Instead of modernizing the backend first and migrating the frontend afterward, he asked a different question: what if that old server could be taken out of the DMZ altogether?

His solution was to pull the old server out of the insecure DMZ and move it deep into the secure data center. He then installed the Files.com remote server Agent, which connected the old server’s filesystem to the Files.com platform and made the on-prem server appear as native storage. External users connect to Files.com over SFTP. Files.com handles authentication, protocol handling, and access control. Behind the scenes, the Agent proxies file operations back to the on-prem server.

Every store that sends orders to AWG would keep doing exactly what it was doing — business as usual. But the server receiving those orders would move out of the DMZ and into the secure data center. From the retailer’s perspective, they’re connecting to a modern, secure SFTP endpoint. The 2003 server stays private.

Jake had never heard of Files.com before he started searching. He ran a three-part RFP, and couldn’t find anyone else at the time offering this kind of remote-mount capability. Files.com also came in at a significantly lower price point than Cleo, which mattered.

The key, for Jake, was the Files.com Agent running on that old server. He could move the legacy system out of the DMZ and then upgrade it whenever he wanted, without impacting his customers.

“You can phase out a legacy system hidden behind that platform, and not have to slam it in,” Jake said. “You can take your time.”

What They Built

The architecture AWG deployed is clean and simple. Files.com sits at the perimeter. All 4,000 member stores connect to it over SFTP using local Files.com accounts — AWG chose not to federate those accounts to its Active Directory or eDirectory environment, because local credentials were simpler and worked fine here.

Behind Files.com, the Agent runs on a Windows 2019 server inside the data center. The server is no longer in the DMZ, and the files uploaded by member stores are available locally through the Agent. The old, insecure infrastructure is gone.

That same architecture solved a second problem. AWG now uses Files.com as the gateway for its Azure environment. They run Azure Databricks for their data lake — 300 terabytes of purchasing, replenishment, and operational data. Automations pick up files and route them to vendors, third parties, and retailer-facing folders, all without exposing AWG’s Azure environment to the outside world.

Moving 4,000 Stores

The migration itself took six to ten months. The platform, Jake will tell you, wasn’t the hard part. The biggest challenge was operational: working through a retailer base of thousands of independent stores, each with its own scripts and processes, all of which had to move from FTP to SFTP.

AWG kept the friction low by design. Retailers weren’t changing their software or their workflows — they were changing a connection string. For most stores, that was the entire delta. Some retailers needed more hand-holding: a script modification here, an extra support call there.

AWG also had to work around the business moratorium windows the company observes throughout the year — roughly three months when no major changes go to production. That meant pacing the rollout carefully and leaving time for the stores that needed it. By the end, all 4,000 stores were on SFTP.

What Changed

AWG’s ordering infrastructure changed in ways that don’t show up on a balance sheet — but the business will feel the impact for years.

Thousands of orders per day, from 4,000 stores, represent the bulk of AWG’s $14 billion operation. All of them are now encrypted in transit. They weren’t before.

The 2003 server is no longer sitting in the DMZ waiting to be discovered by a bad actor. It’s inside the data center, connected to a platform that handles perimeter security on AWG’s behalf. About 80% of AWG’s order volume now comes through SFTP via Files.com; the remaining 20% arrives through other channels. The SFTP migration is done.

Jake had to sell this to a steering committee that included the CEO, and the pitch worked. “Now we’re a couple of years removed from that,” he said, “and it’s a successful implementation.”

Where AWG Is Headed

AWG still runs Cleo Harmony for its on-prem and on-prem-to-outbound file movements; those haven’t been migrated yet. But Jake’s rule now is that no new processes get built on the legacy system. Every new integration — every new SaaS-to-SaaS or cloud-to-cloud workflow — goes to Files.com. Cleo phases out gradually, naturally, as new work goes elsewhere.

The modernization program Jake is overseeing will accelerate that. AWG is rewriting legacy mainframe systems in a full Azure Kubernetes environment, and all file movements in and out of that new infrastructure will go through Files.com. The goal, as Jake describes it, is a fully private Azure environment with nothing facing the public internet — with Files.com as the security buffer at the edge.

If you’re looking at legacy infrastructure still facing the internet, the lesson from AWG is a simple one. You don’t have to modernize the backend before you can secure the perimeter. Put the SaaS layer in front, and take your time with everything else.

The 2003 server will eventually be retired — on AWG’s schedule, not anyone else’s.