Application Architecture
System boundaries, coupling and cohesion, dependency structure, architectural patterns, APIs and integrations, scalability, maintainability, and legacy components.
Architecture Assessment
Know what to fix before you start rebuilding.
Independent assessment of your application architecture, codebase, cloud infrastructure, and delivery process with a prioritized modernization roadmap.
Prefer to review the report style first? Start with our fictional Contoso assessment sample.
Technical Health Score
Architecture
72/100
Maintainability
58/100
Security
64/100
DevOps
81/100
Cloud
76/100
Observability
43/100
Overall
66/100
When to consider an assessment
Your application has become difficult or risky to change.
Releases take too long or regularly cause problems.
You are migrating from .NET Framework to modern .NET.
You are planning a cloud migration or major architectural change.
Technical debt is accumulating and nobody can quantify or prioritize it.
Development velocity has dropped.
Teams disagree on technical direction.
You inherited a system and need to understand its risks.
You are preparing for significant growth.
Security and compliance requirements are increasing.
You are considering a rewrite and want an independent opinion first.
The rewrite scenario is commercially significant. Organizations regularly spend large amounts on rewrites that turn out to be unnecessary.
What we assess
Codebase
Not a line-by-line review. We look for systemic issues: dependency age, framework versions, complexity hotspots, testability, error handling, configuration, logging, and common anti-patterns.
Cloud & Infrastructure
For Azure and cloud workloads: architecture, networking, identity, scalability, resilience, resource organization, configuration, cost, and Infrastructure as Code.
DevOps
The full delivery flow from commit to operation: branching, pipelines, artifact management, environment management, deployment strategy, rollback, secrets, approvals, and automation.
Security
Architecture-level security, not a penetration test: authentication, authorization, secret management, dependency vulnerabilities, SAST, infrastructure exposure, least privilege, data protection, and software supply chain.
Operations
Logging, metrics, tracing, alerting, health checks, backups, disaster recovery, and incident response.
What you receive
Executive Summary
2-4 pages written for CTOs and management. Includes a status table across all domains, top 5 risks, top 5 opportunities, and a recommended strategy.
Detailed Technical Assessment
Engineering-focused findings, each structured as: Finding -> Evidence -> Impact -> Recommendation -> Priority.
Architecture Diagrams
Current state and recommended target state using C4 model terminology (Context, Containers, Components where useful).
Final Workshop
60-120 minutes with relevant stakeholders. Covers current state, risks, options, recommendations, and roadmap. Trade-offs and disagreements are discussed explicitly.
Prioritized Modernization Roadmap
- 0-30 days (Critical): exposed secrets, critical dependencies, missing rollback, production monitoring.
- 1-3 months (Foundation): CI/CD, test coverage, Infrastructure as Code, observability.
- 3-6 months (Modernization): legacy components, authentication, tightly coupled services.
- 6-12 months (Strategic): platform modernization, scalability, architectural decomposition.
Example report
See some examples before you book
Review a sanitized assessment for a fictional order management platform or a health care provider search engine. You can check the score format, the finding style, and the remediation roadmap your team will receive.
What the sample includes
- Domain score table and maturity interpretation
- Cross-domain risk scenarios and impact framing
- Prioritized 90-day remediation plan
- 6-12 month modernization roadmap
How it works
1
Discovery
Gather documentation and access.
2
Technical analysis
Review code, infrastructure, and delivery.
3
Stakeholder interviews
Conversations with leadership, engineering, and product.
4
Findings and recommendations
Prepare the report and roadmap.
5
Final workshop
Present and discuss with your team.
Pricing & Packages
Compare assessment packages
Choose the right assessment scope for your system. Every engagement includes fixed pricing, concrete findings backed by code evidence, and a prioritized remediation roadmap.
Architecture Snapshot
Targeted review for single services, urgent second opinions, or pre-investment risk checks.
Starting from
€3,500
/ fixed scope
3–5 business days
- 1 core application or up to 2 code repositories
- Architecture patterns and codebase complexity hotspot scan
- Automated static code and dependency vulnerability analysis
- Top 5 high-priority technical risks and immediate gaps
- Executive summary and 30-day quick-win remediation list
- 60-minute findings walkthrough with lead architect
Most Selected
Technical Health Assessment
Full evaluation for multi-tier systems facing tech debt, slow releases, or planning modernization.
Starting from
€8,000
/ fixed scope
2–3 weeks
- Full multi-tier system (up to 5 repositories and cloud infrastructure)
- Full 8-domain NAAF rubric evaluation and numerical scoring
- In-depth code quality, static analysis, and architectural coupling
- Cloud architecture, IaC configuration, and security posture review
- 2–3 stakeholder and lead developer interview sessions
- Prioritized 30-60-90 day stabilization and modernization roadmap
- 90-minute interactive workshop with engineering and management
Enterprise Assessment
Multi-system analysis for distributed estates, multi-team platforms, or major rewrite decisions.
Starting from
€15,000
/ fixed scope
3–6 weeks
- Multi-service platform, multiple repositories, and cloud subscriptions
- Multi-system architecture mapping with C4 Context and Container models
- Cross-domain incident retrospectives and outage financial modeling
- CI/CD delivery flow, supply chain security, and cloud cost audit
- Stakeholder interviews across Leadership, Product, and DevOps
- 12-month phased roadmap with rewrite vs modernize decision matrix
- 2 dedicated workshops (Executive + Engineering) plus 30-day review
Detailed package comparison
Compare evaluated areas, analysis depth, deliverables, and workshop formats across tiers.
| Feature & Scope | Architecture Snapshot from €3,500 | Technical Health from €8,000 | Enterprise from €15,000 |
|---|---|---|---|
| 1. Scope & System Coverage | |||
| Target System Scope | 1 core service or app | Full multi-tier system | Multi-service estate / portfolio |
| Source Repositories Scanned | Up to 2 repositories | Up to 5 repositories | Multiple repositories |
| Cloud & Environments | Single environment check | Dev, staging & production | Multi-subscription / hybrid cloud |
| Stakeholder Interviews | 1 Lead Engineer session | 2–3 Team & Lead sessions | 4+ Leadership & Team sessions |
| Engagement Duration | 3–5 business days | 2–3 weeks | 3–6 weeks |
| 2. Technical Analysis & NAAF Domains | |||
| NAAF 8-Domain Scoring | Top risk focus areas | Complete 8-domain rubric | Complete 8-domain rubric + cross-service heatmap |
| Code Quality & Hotspots | Static analysis & CVE scan | SonarQube, complexity & coupling | Multi-repo static analysis & dependency supply chain |
| Cloud & Infrastructure as Code | Basic resource inspection | Azure Advisor, IaC & security posture | Multi-account topology, drift & cloud spend audit |
| DevOps & Delivery Pipeline | Pipeline sanity check | CI/CD, artifact flow & rollback review | DORA metrics, release governance & automation |
| Observability & Resilience | Log setup verification | Logs, metrics, tracing & alert review | Outage cost modeling, SLO audit & DR test validation |
| Data Architecture & Integrity | Schema inspection | Migrations, foreign keys & query health | Data lineage, consistency & restore verification |
| 3. Deliverables & Artifacts | |||
| Executive Summary | 2-page risk memo | Executive report with domain scores | Executive briefing with business ROI & risk models |
| Engineering Finding Cards | Top 5 critical findings | All findings with code evidence | All findings + cross-domain cascade analysis |
| Architecture Diagrams | — | C4 Context & Container diagrams | Full C4 model (Context, Container, Component) |
| Actionable Roadmap | 30-day quick wins | 30-60-90 day prioritized backlog | Phased 12-month modernization roadmap |
| Rewrite vs Modernize Decision Matrix | — | Technical viability comparison | Financial model & risk-weighted decision matrix |
| 4. Workshops & Follow-Up | |||
| Findings Presentation Workshop | 60 minutes (Engineering) | 90 minutes (Engineering & Leads) | 2 workshops (Leadership + Engineering deep-dive) |
| Post-Assessment Follow-Up | Email Q&A support | Email Q&A + 30-day checkpoint call | 30-day implementation review session (60 min) |
| Select a package to start | Request Snapshot | Request Health Assessment | Discuss Enterprise |
Fixed-Fee Scoping
We agree on repository counts, environments, and interview scope during discovery. You receive a fixed-price proposal without surprise hourly billing.
Pricing Drivers
Final fees depend on total applications, source repositories, cloud subscriptions, background worker jobs, and stakeholder interview sessions.
Regulated & Custom Scopes
Teams with specific compliance needs (such as NIS2, DORA, or ISO 27001) or multi-region setups receive customized engagement proposals.
FAQ
How long does the assessment take?
Most projects run from 3 business days to 6 weeks, based on the package and system scope.
Do we need to grant repository and cloud access?
Yes. Access to code, infrastructure, and delivery tooling is required so we can produce findings with evidence.
Will this tell us if a rewrite is necessary?
Yes. We compare rewrite pressure against lower-risk modernization options so leadership can choose with clearer trade-offs.
What happens after the workshop?
You receive a prioritized action plan with immediate, 90-day, and 6-12 month recommendations your team can execute.
Request an Architecture Assessment
Automated tools identify symptoms. Senior engineers determine which findings matter, what to fix first, and what can wait.
Related services: IT Leadership & Strategy and Azure Cloud Services.