The security flaw is already there
An unsupported component, a password in the code, exposed customer data. Nobody saw it because nobody looked.
Why assess
The system works. Nobody can say how much risk it carries. So every decision about it is made in the dark.
Before asking for a rewrite budget, hiring support or answering the auditor, someone has to measure what is there. That is what we deliver.
Two people hold the system together
If one of them leaves, the company loses the ability to change what brings in revenue. That risk shows up in no report.
The budget is a guess
Rewrite, support or modernize? Without a measure, the choice becomes the opinion of whichever vendor arrived first.
What you get
A well-grounded decision, not a pile of alerts.
The scan finds things. The value is in who reads the result, with 26 years of critical systems behind them, and tells you what matters for your business.
01
Read by people who support and modernize
The engineers who run the assessment are the same ones who maintain and modernize critical systems at DB1. They know what turns into an incident and what is just ugly.
02
Your code never leaves your control
Read-only access, nothing installed in your environment, analysis in a certified environment and access revoked at the end.
ISO 27001certified information security
03
A plan that already has a path
Every risk gets a destination: fix now, support safely or modernize. If it is modernization, Core Up does it without stopping operations.
04
Two readings, one report
An executive summary for whoever approves the budget and a technical list for whoever fixes, each in their own language, pointing to the same risk.
05
A baseline to measure against
The assessment becomes your reference. At the reassessment, you show the board what improved and what still worries you.
How we differ from the market
A tool finds. An audit reports. An assessment has to lead to a decision.
There are two common ways to look at the health of a system. Both help, and both stop before the decision.
How to engage
Three formats, based on the decision you need to make.
All with scope and timeline agreed before we start, read-only access and the plan handed to you.
Fast decision
Express
Who it is for: For those with a scheduled decision about a system: renewing a contract, approving a budget, responding to an incident.
About 1 week
- One system
- Scan with Legacy Analyzer
- Critical risks confirmed by an engineer
- Executive summary with a recommendation
Most chosen
Full
Who it is for: Leadership that needs to decide the future of a critical system: fix, support or modernize.
2 to 3 weeks
- Quality, security, architecture and dependencies
- Interviews and key-person risk
- Risk map and three-path plan
- Technical list and component inventory
- Optional reassessment against the baseline
M&A and audit
Technical due diligence
Who it is for: An investor, buyer or board that needs an independent view of the software before signing.
On the deal's timeline
- Independent, documented report
- Security, license and intellectual property risks
- Dependence on people and maintenance cost
- Presentation to the board or committee
Scope and price come out of the alignment conversation, based on size and number of systems.
BRK · Sanitation
BRK & DB1 case: from the Minha BRK app to agentic engineering.
A partnership that started with the app and reached the migration of a real portal, run by 1 engineer with Clovis Agentic, 4x faster.
Your code analyzed by people whose process and security are audited by outsiders.
After the assessment
The plan points the way. We can walk it with you.
Frequently asked questions
Before you assess.
How long does it take and what do I need to provide?
Express takes about a week; Full takes 2 to 3 weeks, depending on the size of the system. We need read access to the repository and a few hours of your team's time for interviews. Nothing is installed or changed in your environment.
We already use SonarQube or another tool. What changes?
Static analysis tools are great day to day, but on legacy code they produce many false positives and do not assess architecture, business context or dependence on people. We use the scan as a starting point and deliver an engineer's reading: what is real, what matters and in which order to tackle it.
Does the assessment replace a pentest?
No. A pentest attacks the system in production; the assessment reads the code, architecture and dependencies. The two complement each other, and the plan tells you when a pentest is worth it.
Does it work for due diligence, M&A or audit?
Yes. The technical due diligence format gives an independent, documented view of quality, security, licenses, maintenance cost and dependence on people, useful for buyers, investors, boards and auditors. We work under NDA and on the deal's timeline.
How is it different from the free Legacy Analyzer?
The free Analyzer shows a first automated snapshot of the code. The assessment adds the engineers' review, the architecture and key-person assessment, the business risk map and the action plan.
After the assessment, do I have to hire DB1?
No. The plan is yours and your team can carry it out. If you want support, we can follow up by fixing the critical points, with Legacy Support or with modernization through Core Up.