Find out what you are actually running
Before you commit to building anything, or to us, we assess the platform, rank what is putting you at risk, and tell you whether to build, buy or partner. You keep the report either way.
Start the conversationWhat you get
One written report, presented live, and yours to share inside your business without asking us first.
Current-state architecture
What is actually running and how it fits together, including the parts nobody wrote down and the ones only one person understands.
Ranked risk register
Every finding with its severity, what happens if it goes wrong, the systems affected, and an order-of-magnitude effort to address it. Each one cites its evidence, so nothing in it is an opinion you cannot trace.
Build, buy or partner
The realistic options with indicative costs and timelines, our recommendation, and the part most reports leave out: what would change our mind.
A live readout
Ninety minutes with whoever you want in the room. The written report matters more: it is what gets forwarded after we leave.
Week one: discovery
A kickoff workshop, then up to six interviews across engineering, operations, compliance and support. In parallel we read the code, the cloud configuration, the monitoring and the incident history, and we use your product the way your customers do. We also look at what it costs you to run.
Week two: synthesis
We draw the architecture, build the risk register and cost the options. A second senior engineer challenges the findings before you ever see them. No assessment of an unfamiliar system should have a single author. Then we write it up and present it.
What we need from you
The two weeks do not start until these are in place. That is deliberate: a clock running against access that does not work yet produces a thin report, and you are the one who would have to live with it.
- Read-only access to your code, cloud, monitoring and ticketing
- About an hour each from five or six of your people
- A named contact who can unblock access and scheduling
- Vendor contracts for the core systems, if lock-in is a question
- Any open audit or examination findings
The fee
Fixed, and agreed before we start. No hourly billing, no overage, and the number does not move because the platform turned out to be bigger than anyone expected.
Included
- All discovery, interviews and analysis
- The written report, yours to keep and to share
- The readout presentation
- A second senior reviewer on every engagement
What this is not
Worth being explicit, so nothing at the readout is a surprise.
- Not a build proposal. We identify options and ranges; a quote to do the work is separate, and separately priced.
- Not a penetration test. We report what ordinary review surfaces, and we do not attempt exploitation.
- Not a compliance audit or a legal opinion. Regulatory observations are engineering observations, and should never be handed to an examiner as assurance.
- Not a change to anything. Our access stays read-only for the whole engagement.
If two weeks is too much
We also run a three-to-five day architecture review: the same discovery and the same risk register, without the options analysis and the cost modelling. Less complete, quicker to schedule, and it upgrades into the full assessment whenever you want it to.
Book an assessment
Tell us what you are running and what you need it to do. If an assessment is not the right first step for you, we will say so.
Start the conversation