Assessment & Audit
Know exactly where you stand before you commit to changing anything.
Modernization programs, compliance deadlines and security investments all start from the same assumption — that you know what you have. Most organizations know it in outline, not at the code-level detail those decisions require.
Six assessment types, run individually or together. Each one is fixed in scope and ends in findings your teams can act on.
[01]
Value stream mapping and maturity evaluation across your delivery pipeline — including how AI is being used across it, and whether that use is governed.
[02]
Applications, APIs and infrastructure tested the way an attacker would approach them. Real exploitation paths, not theoretical severity scores.
[03]
Every dependency, container and build artifact mapped into a complete SBOM. A clear view of what you inherit from others.
[04]
Independent technical judgment on an acquisition, an investment or a vendor. What you are buying, and what comes with it.
[05]
Your current position against NIS2, DORA, the CRA, the EU AI Act or sector standards, with the gaps ranked by effort and exposure.
[06]
A scored, independent rating of how securely and repeatably you build software, against a defined model rather than an opinion. A baseline to show a board, a customer or an acquirer — and to re-rate against once the work is done.
Every assessment follows the same five steps, whatever its scope. You know at the outset what we will look at, what you will get back, and when.
Boundaries, systems and depth agreed in writing before we start. Fixed scope, time-boxed delivery.
Code, pipelines, infrastructure as code, architecture records and interviews with the people who run them.
Testing and review against recognized standards, with every finding traced back to what produced it.
Findings ranked by exposure and effort to fix, delivered as a risk-ranked backlog rather than a list.
A report your engineers can act on and your board can read, walked through with both.
An assessment ends with four things in your hands.
Every issue traced to its architectural root cause, scored by exposure and effort, ordered so the sequence of work is already decided.
Documentation and automated compliance artifacts that stand up in front of an auditor, a regulator, an acquirer or your own board.
What to fix, in what order, and what it will take — costed in effort rather than left as a wish list.
A recorded position to compare future assessments to, so progress is demonstrable rather than asserted.
The standards differ by sector, and so does what counts as evidence. We assess against what your regulator, your certification body or your customer will actually ask for.
Independent assessment of what vendors have delivered, before acceptance and before payment.
Device software assessed against IEC 62304 and MDR expectations, ahead of submission rather than after a finding.
Assessment against DO-178C and DO-254 objectives, with the evidence trail a certification authority will follow.
OT and IT assessed together, against NIS2 and CRA obligations that now cover both.
Operational resilience and model governance assessed against DORA and the EU AI Act, at supervisory depth.
Functional safety and cybersecurity assessed against ISO 26262, EN 50716 and ISO/SAE 21434 together.