A year or two ago I would have replied that ColdFusion is actually dead, and that using it or really, even, maintaining applications in it is irresponsible, because it's virtually impossible to secure. But I think it may have become so archaic that vulnerability researchers aren't really hitting it as much any more? Maybe you've weathered the storm, and CF will be safe to use from here on out?

(Obviously: don't use ColdFusion).