The short answer
Silverlight remediation means moving a business application off Microsoft Silverlight, or running it safely on supported infrastructure, now that the platform is out of support. Microsoft ended support for Silverlight on 12 October 2021, and in its final years it only ran in Internet Explorer 10 and 11.
There are four ways to remediate an application that depends on deprecated Silverlight components:
- Package it with the Silverlight runtime and other dependencies it needs, so it runs on current, supported Windows without code changes. Cloudhouse Alchemy takes this approach.
- Re-platform it with OpenSilver, an open source reimplementation of Silverlight that recompiles your existing C# and XAML to run in modern browsers.
- Rewrite or replace it with a modern web application, or move to the vendor’s newer product.
- Contain it in Microsoft Edge IE mode, a virtual desktop or an isolated virtual machine while you plan a longer-term fix.
For regulated IT teams that need a fast, low-risk fix, and for third-party applications where you do not own the source code, packaging is usually the quickest route to Silverlight application modernisation. OpenSilver and rewrites suit applications you built in-house and plan to keep developing.
What is Silverlight, and why do business applications still use it?
Silverlight was Microsoft’s browser plugin for rich internet applications, launched in 2007. Software vendors and in-house teams used it to build data-heavy interfaces that ran inside the browser: asset and housing management, finance, scheduling, reporting and internal portals.
Many of those applications are still in daily use. They hold years of data and process, users know them well, and replacing them is expensive. Civica Keystone, which UK councils and housing associations use to manage housing assets, is one well-known example.
Where Silverlight stands in 2026
Every route to running Silverlight has now either ended or has a deadline attached.
| Date |
What happened |
| 12 October 2021 |
Silverlight reaches end of support. Microsoft had already limited support to Internet Explorer 10 and 11, and dropped Chrome, Firefox and Mac browsers. |
| 15 June 2022 |
The Internet Explorer 11 desktop app is retired on certain versions of Windows 10. |
| 14 February 2023 |
A Microsoft Edge update permanently disables the IE11 desktop app on those versions of Windows 10. |
| 14 October 2025 |
Windows 10 reaches end of support. |
| At least 2029 |
Microsoft commits to supporting IE mode in Microsoft Edge, which still lists ActiveX controls such as Silverlight among the IE features it supports. |
In practice, many Silverlight applications now rely on IE mode, older Windows builds or an exception in the risk register. None of those is a long-term answer.
Why leaving Silverlight in place is a risk
- Security. Silverlight has received no fixes since October 2021. Browser plugins run code on the user’s device, which is one reason the industry moved away from them.
- Compliance. Cyber Essentials requires all in-scope software to be licensed and supported. Unsupported software must be removed, or moved into a sub-set of the network that blocks all traffic to and from the internet. That is hard to do for an application staff use every day. Auditors working to DORA, NIS2 and ISO 27001 ask similar questions.
- Upgrades. Silverlight dependencies hold back Windows and browser upgrades, and every workaround adds a configuration someone has to maintain.
- Skills. Fewer developers and support staff know Silverlight each year, so fixing problems gets slower and more expensive.
Silverlight alternatives: your four remediation options
Most application modernisation tools for Silverlight fit one of four approaches. They differ mainly in whether you need the source code, and how much of the application changes.
1. Package the application without code changes (Cloudhouse Alchemy)
Best for: third-party and in-house applications that must keep working on supported Windows, without a rewrite.
Cloudhouse Alchemy packages a legacy Windows application, together with the dependencies it needs, including the Silverlight runtime, into a self-contained, isolated environment. The package runs on a current, supported Windows operating system, and the Silverlight dependency is never installed on, or exposed to, the host. Nothing about the application changes, so users carry on as before and you do not need the source code.
- Strengths: no code changes and no source code needed; works for vendor applications as well as your own; no user retraining; takes the Silverlight dependency off the host operating system; backed by a money-back guarantee.
- Trade-offs: the application itself does not change, so it suits teams that need the app to keep working rather than teams that want new features. Set the long-term roadmap alongside it.
- Proven on: Civica Keystone for UK councils and housing associations, and other hard-to-fix applications across enterprise and government. AWS licensed the same underlying technology for its End-of-Support Migration Program for Windows Server.
2. Re-platform with OpenSilver
Best for: in-house Silverlight applications where you own the source code and want a browser-native future.
OpenSilver is an open source reimplementation of Silverlight, released under the MIT licence and supported commercially by Userware. It compiles your existing C# and XAML into HTML, CSS, JavaScript and WebAssembly, so the application runs in modern browsers with no plugin.
- Strengths: no plugin; keeps much of your existing code and skills; Userware offers a fixed-cost migration service.
- Trade-offs: you need the source code, so it does not help with third-party applications; some Silverlight features are not yet supported; back-end services such as WCF RIA Services need replacing; the browser sandbox limits local file access.
3. Rewrite or replace the application
Best for: applications due for a redesign anyway, or vendor products with a modern successor.
Rebuild the application in a current framework such as Blazor, Angular or React, or move to the vendor’s replacement product. Either way, this is a full legacy application migration, with the cost and timeline that comes with it.
- Strengths: removes the legacy dependency for good; a chance to rethink workflows and the user interface.
- Trade-offs: the highest cost and longest timeline; needs full testing, data migration and user training; for vendor applications you depend on their roadmap and pricing.
4. Contain it: IE mode, virtual desktops and isolated VMs
Best for: short-term continuity while you plan a longer-term fix.
Microsoft Edge IE mode uses the Internet Explorer 11 engine for sites on your list and supports ActiveX controls such as Silverlight. Other teams publish the application from a virtual desktop running an older Windows build, or keep it on an isolated virtual machine.
- Strengths: quick to set up with tools many teams already have.
- Trade-offs: Silverlight itself stays unsupported; IE mode is only committed through at least 2029; virtual desktop and VM options often keep an unsupported operating system or browser in the estate, which is exactly what auditors and Cyber Essentials assessors look for.
Silverlight remediation options compared
Packaging and containment need no code changes. Only packaging also moves the application onto current, supported Windows.
| Approach |
Code changes |
Source code needed |
Works for vendor apps |
Long-term fit |
| Packaging (Cloudhouse Alchemy) |
None |
No |
Yes |
Runs on current Windows; Silverlight kept off the host |
| OpenSilver |
Some |
Yes |
No |
Plugin-free, runs in modern browsers |
| Rewrite or replace |
Full rebuild |
Yes, or a vendor successor |
Only if the vendor has one |
Fully modern |
| IE mode, VDI or isolated VM |
None |
No |
Yes |
Stopgap; Silverlight stays unsupported |
How to choose a remediation path
- It is a vendor application and you need it working on supported Windows now: package it, and keep talking to the vendor about their roadmap.
- You built it, own the code and plan to keep developing it: look at OpenSilver, or a rewrite if the design needs rethinking.
- The application is near the end of its life: package or contain it until you retire it, rather than paying for a rewrite.
- You face an audit or certification deadline: start with the option that needs no code changes, then plan the long term without the deadline hanging over you.
A five-step Silverlight remediation plan
Business application remediation goes faster when you treat it as a programme, not a series of one-off fixes.
- Find every dependency. Check your IE mode site list, browser plugin inventories and any applications that ship XAP files, the Silverlight package format.
- Classify each application. Record who owns the code, how critical it is, how many people use it and which compliance scope it sits in.
- Choose a path per application. Most estates end up using more than one approach.
- Test with real users and real data. Silverlight applications often hide printing, file access and integration quirks that only show up in daily use.
- Document the decision. Record what you did, why, and when you will review it, so auditors and assessors can see the risk is managed.
Silverlight in UK social housing: Civica Keystone
Civica Keystone is one of the most widely used Silverlight applications in the UK. It is the asset-management system for well over 100 social landlords, and its browser interface was built on Silverlight. With Cyber Essentials Plus treating unsupported software as a failure, Keystone users face the same choice as every Silverlight customer: rewrite, replace, contain or package.
Cloudhouse has packaged Keystone for housing providers including North Tyneside Council, CHP, Estuary and MHS Homes. As Charlotte Sontag, ICT Solutions Architect at MHS Homes, put it: “Isolating the components that posed a security risk removed our dependency on unsupported technology.”
Frequently asked questions
Is Microsoft Silverlight still supported?
No. Microsoft ended support for Silverlight on 12 October 2021, and it has received no updates since.
Can Silverlight run in Microsoft Edge?
Not natively. Edge IE mode lists ActiveX controls such as Silverlight among the Internet Explorer features it supports, but Silverlight itself is out of support, and Microsoft only commits to IE mode through at least 2029.
What is the best alternative to Silverlight?
It depends on who owns the application. For in-house applications, OpenSilver or a rewrite in a modern framework such as Blazor gives you a browser-native future. For vendor applications, packaging with a tool such as Cloudhouse Alchemy keeps them running on supported Windows without code changes.
Can you modernise a Silverlight application without rewriting it?
Yes. Application packaging runs the existing application, with the Silverlight runtime and other dependencies it needs, in a self-contained, isolated environment on current Windows. No source code or code changes are needed.
Do I need the source code to remediate a Silverlight application?
Only for OpenSilver and rewrites. Packaging and containment work with the application as it is installed today, which is why they suit third-party software.
Does Silverlight affect Cyber Essentials certification?
It can. Cyber Essentials requires all in-scope software to be licensed and supported. Unsupported software must be removed from devices, or removed from scope in a sub-set of the network that prevents all traffic to and from the internet.
Keep your Silverlight applications running
Silverlight applications rarely fail all at once. They become harder to secure, harder to certify and harder to move to new Windows builds, until something breaks. If you have Silverlight applications you cannot rewrite yet, talk to Cloudhouse about packaging them to run on supported Windows without changing a line of code.
