Advanced technical & security audit
Our tech team is moving forward, but we lack perspective on some choices: which risks and which debt really deserve our attention?
On quote - Timeline: On quote
As the product and the tech team grow, some historical choices, dependencies or practices become hard to challenge from the inside. We bring an outside senior perspective on the application architecture, infrastructure, configurations, access, sensitive data and main technical choices, with security as the guiding thread. Findings are discussed with the tech team in three stages, at kick-off, mid-way and at the debrief, then turned into prioritised recommendations and a remediation plan. We prioritise; effort estimates stay with your team, who know their code better than we do.
For example, Your product has grown and you want to challenge its architecture before a new stage, A junior team built a large part of the product and you want an outside senior perspective, You have accumulated technical debt and want to determine what really needs addressing first...
What's included
- Application architecture analysis: service breakdown, data flows, exposed entry points, session and permission management
- Infrastructure analysis: hosting, network, backups, secrets and environment management
- Review of configurations, access and sensitive data
- Analysis of technologies and dependencies
- Identification of the main technical and security risks
- Targeted analysis of the technical debt tied to those risks
- Three touchpoints with the tech team: kick-off, mid-way check-in, debrief
- Prioritised recommendations
- Help defining a remediation plan
What's not included
- Exhaustive pentest, unless included in the quote
- Performance, scalability or code quality audit beyond security topics
- Remediation effort estimates
- Legal or GDPR audit
- Certification
- Implementation of the remediation plan
- Architecture redesign and development
- Exhaustive audit of the whole information system
- Ongoing support after the debrief
Prerequisites
- Access to the code, architecture and relevant environments
- Availability of the technical contacts
- Existing documentation when available
Frequently asked questions
Why on quote?
The scope depends on the size of the product, the number of environments and your team's availability. We define it together during a first call.
How is this different from the Technical & security audit?
The fixed-price audit covers up to 10 pages or screens and is mostly done on our side. Here, we go up to the architecture and infrastructure, we work with your team in three stages and you leave with a remediation plan.
Do you also look at performance and code quality?
Mainly security. Technical debt is analysed when it creates a risk; performance and scalability can be added to the quote if you need them.
Do you estimate the remediation effort?
No, we prioritise. Effort estimates stay with your team, who know their code.