Fixed price · Agreed scope · Independent assessment

Forensic Code Assessment Scope and fixed prices

The Forensic Code Assessment provides documented findings and a prioritized roadmap for your existing system. Standard costs €5,000 and Full Forensic €9,000, both net plus VAT. Questions about AI and agentic code are covered in the separate AI Forensic Assessment below.

Oliver Fries Senior Software Forensic Analyst and Engineer
  • Forensic Code Assessment from €5,000Excluding VAT, agreed scope
  • Defined timelinesOnce all agreed access and data are available
  • Personal deliveryOliver Fries · Senior Software Forensic Analyst and Engineer
  • Decision supportEvidence, priorities and next checks

Audit discipline 01

Forensic Code Assessment for business-critical software systems

In the Forensic Code Assessment, I examine established, business-critical software systems. I connect the available evidence from code, architecture, Git history, tests, build and deployment. You receive documented findings and a prioritized roadmap to inform stabilization and modernization decisions. We agree on technologies, questions and examination depth before starting.

Package 01Standard

Standard

up to 3 repositories (up to 500,000 LOC)

5 working days from complete access

€5,000 fixed price, net plus VAT

Audit scope and outcomes

  • Forensic audit layers: Layers L1 to L3 (static analysis, churn, baseline)
  • Git history & bus factor analysis: Module level
  • Concurrency & thread safety check: Pattern analysis through sampling
  • Runtime profiling & memory leak detection: Not included
  • Mutation testing (test quality audit): Coverage statistics & sanity check
  • Documentation format: 10–15-page decision memo
  • Live closing presentation: 1 × 60-minute combined briefing
  • Follow-up after 30 days: Available as an optional booking
Enquire about Standard →
Package 02Full Forensic

Full Forensic

up to 8 repositories / unlimited LOC

10 working days from complete access

€9,000 fixed price, net plus VAT

Audit scope and outcomes

  • Forensic audit layers: Extended audit layers excluding runtime/dump analysis
  • Git history & bus factor analysis: Module & subsystem level including Conway audit
  • Concurrency & thread safety check: In-depth audit of synchronous & asynchronous locks
  • Runtime profiling & memory leak detection: Planned extension, not included
  • Mutation testing (test quality audit): Mutation analysis of core domains
  • Documentation format: 30+ page dossier including ROI prioritization
  • Live closing presentation: 2 sessions (90-minute management briefing + 120-minute developer deep dive)
  • Follow-up after 30 days: Included (45-minute follow-up)
Enquire about Full Forensic →

Repository and LOC figures describe the codebase that can be included. We agree on questions, technologies and examination depth before starting. The assessment does not include an exhaustive review of every line of code.

Comparison matrix

Direct comparison of scope by criterion

Audit matrix according to DIN EN ISO/IEC 25010

Audit dimension / criterion Standard Full Forensic
Repository & code scopeCodebase and services examined up to 3 repositories (up to 500,000 LOC) up to 8 repositories / unlimited LOC
Forensic audit layersArchitecture, churn, concurrency, tests, organization Layers L1 to L3 (static analysis, churn, baseline) Extended audit layers excluding runtime/dump analysis
Git history & bus factor analysisIdentify risks from dependence on individuals Module level Module & subsystem level including Conway audit
Concurrency & thread safety checkDeadlocks, race conditions, async/await pitfalls Pattern analysis through sampling In-depth audit of synchronous & asynchronous locks
Runtime profiling & memory leak detectionHeap dumps, GC spikes, unmanaged resource tracking Not included Planned extension, not included
Mutation testing (test quality audit)Automated injection of artificial faults to assess test quality Coverage statistics & sanity check Mutation analysis of core domains
Documentation formatWritten findings for management & development 10–15-page decision memo 30+ page dossier including ROI prioritization
Live closing presentationInteractive explanation & Q&A 1 × 60-minute combined briefing 2 sessions (90-minute management briefing + 120-minute developer deep dive)
Follow-up after 30 daysReview of initial implementation measures Available as an optional booking Included (45-minute follow-up)
Requirements, limits and frequently asked questions

I am Oliver Fries from Lemgo, OWL, a Senior Software Forensic Analyst and Engineer. My focus is the Forensic Code Assessment for CTOs and IT leaders facing stabilization and modernization decisions. More than 14 years working with .NET systems inform my technical analysis. We establish which technologies and evidence I can examine in your system before starting.

When is this service a good fit?

  • Releases take a long time, are difficult to plan, or their technical risks are unclear before deployment.
  • Your business-critical software system has evolved over years and contains unclear dependencies or technical hotspots.
  • You need a reliable basis for decisions before budgeting or implementing technical measures.

What I examine

We define the exact assessment scope before the work starts. I use the information that is actually available for the agreed system.

  • Code and architecture: responsibilities, system boundaries, coupling, technical dependencies, and hotspots.
  • Git history, code metrics, and bug metrics: change patterns, frequently affected areas, and recurring defects where the data is available.
  • Tests: which business-critical paths they actually protect and where changes lack an adequate safety net.
  • Build and CI: reproducibility, existing quality gates, manual steps, and feedback bottlenecks.
  • Deployment and release: existing deployment and recovery procedures, relevant logs, and known release events. Production access is not required.

What you provide

  • All agreed access and data are available in full before work starts. Analysis and the report are provided within 5 working days for Code Forensic Standard and 10 working days for Full Forensic from that point.
  • Access to the agreed repositories with their Git history, plus any existing architecture and dependency information.
  • Available information on tests, build, CI, deployment, recovery, relevant logs, and known defects.
  • People who can explain the system context, current problems, release history, and known dependencies during the kickoff.

You can reuse the report, dynamic audit, decision memo, dossier, and roadmap internally or with other service providers. A follow-up engagement with Oliver Fries is not required.

Scope limits and exclusions

  • A general review of your entire IT infrastructure, organization, or all business applications is outside the Forensic Code Assessment.
  • The assessment examines existing software systems against agreed questions. Greenfield development is not included. We establish the suitability of your technologies and the available analysis tools in advance.
  • Production access, interventions in live systems, and implementation of changes are not part of the audit.
  • Implementation of prioritized measures is a separate stabilization project.
  • Standard covers audit layers L1 to L3. Full Forensic adds deeper architecture, concurrency, test and organizational analysis, including mutation analysis. Runtime/dump analysis is a planned extension and is not included in either package. Missing data or unproven causes are documented as open questions. Investigations beyond the selected package scope are agreed separately.
  • The time-boxed audit cannot guarantee that it will find every technical risk or that later measures will achieve a particular technical or commercial outcome.

Frequently asked questions

Do you need access to the production environment?

No. I work with the agreed repositories, technical documentation, build and release information, relevant logs, and your team's knowledge.

When is the audit completed?

I provide the analysis and report within 5 working days for Code Forensic Standard and 10 working days for Full Forensic once all agreed access and data are available. If documents or access are missing, this period begins only when they have been provided in full. Full Forensic also includes a 45-minute follow-up after 30 days.

How is the assessment scope defined?

Standard covers up to three repositories; Full Forensic covers up to 8. Before the work starts, we record which repositories, data sources, and questions will actually be examined.

Is implementation of the measures included?

Standard ends with handover and the combined 60-minute briefing. Full Forensic includes the two closing sessions and a 45-minute follow-up after 30 days. Implementation can subsequently be scoped as a separate stabilization project. It is not a required follow-up engagement.

How does the Forensic Code Assessment differ from the free Release Risk-Check?

The free Release Risk-Check assesses your questionnaire responses and provides initial orientation. The Forensic Code Assessment examines the agreed data and code from your project.

When is a deeper follow-up investigation useful?

If an important risk cannot be resolved from the available data, the report records the open question. A focused code or runtime analysis can then be scoped separately.

Knowledge about this service

All technical articles →

Who performs an IT system analysis for medium-sized companies? →

Forensic Code Assessment for established .NET systems →

Which IT consultant can be recommended for a medium-sized company? →

Code forensics for AI-assisted software delivery →

Audit discipline 02

AI Forensic Assessment

The independent technical audit examines AI-generated, agent-developed and spec-driven codebases using the existing code and available development evidence. Before work starts, the audit question, included repositories, agent workflows and evidence are agreed. The result distinguishes substantiated findings, risks, hypotheses and open questions.

Package 01Standard

AI Code Integrity Check

Single repository & representative PRs

2–3 days once all agreed access and data are available

€4,000 fixed price, net plus VAT

Audit scope and outcomes

  • Hallucination & logic error audit: Manual & heuristic
  • Tautological test detection: Included
  • Prompt & .cursorrules governance: Basic check
  • CI/CD guardrails & linter gates: Catalog of recommendations
  • IP & license risk assessment: Sampling
  • Format & enablement: Audit report + 60-minute webinar
Enquire about AI Code Integrity Check →
Package 02Enterprise

Agentic Architecture Audit

Entire agent pipeline & toolchain

4–5 days once all agreed access and data are available

€7,000 fixed price, net plus VAT

Audit scope and outcomes

  • Hallucination & logic error audit: Deep inspection & boundary analysis
  • Tautological test detection: Including mutation audit
  • Prompt & .cursorrules governance: Complete rule-set redesign
  • CI/CD guardrails & linter gates: Ready-to-use pipeline templates & rules
  • IP & license risk assessment: Full IP compliance audit
  • Format & enablement: Assessment + 2-hour hands-on technical workshop
Enquire about Agentic Architecture Audit →

AI governance matrix

Package comparison: AI Forensic Assessment

Audit matrix for synthetic software development

Audit dimension / AI criterion AI Code Integrity Check Agentic Architecture Audit
Focus & integrationLevel of examination within the development cycle Single repository & representative PRs Entire agent pipeline & toolchain
Hallucination & logic error auditSemantically incorrect model assumptions Manual & heuristic Deep inspection & boundary analysis
Tautological test detectionIdentify ineffective tests with weak assertions Included Including mutation audit
Prompt & .cursorrules governanceValidation of local agent configurations Basic check Complete rule-set redesign
CI/CD guardrails & linter gatesAutomated rejection of faulty AI code in PRs Catalog of recommendations Ready-to-use pipeline templates & rules
IP & license risk assessmentGPL contamination & third-party copyrights in AI snippets Sampling Full IP compliance audit
Format & enablementTransfer of findings into your organization Audit report + 60-minute webinar Assessment + 2-hour hands-on technical workshop
Requirements, limits and frequently asked questions

I am Oliver Fries from Lemgo in OWL, a Senior Software Forensic Analyst and Engineer with more than 14 years of .NET experience. The audit is for CTOs, heads of engineering and IT leaders who need to assess AI-assisted software using the code and the development evidence that is actually available.

When is this service a good fit?

  • AI agents or spec-driven development already produce production-adjacent code, but the technical evidence chain is incomplete or difficult to assess.
  • You need to decide whether tests, reviews, permissions and quality gates are sufficient to expand AI-assisted development.
  • Architecture drift, inconsistent patterns, package risks or security signals need to be classified using available evidence.
  • You need an independent basis for technical priorities before approving more agent workflows or releases.

What I examine using the available evidence

Before work starts, the specific audit question, included code areas and available evidence are recorded in writing. The audit examines only the areas from the following list that are relevant to that question. A complete review of every area is included only when expressly agreed. Missing sources are recorded as evidence gaps or open questions rather than replaced with assumptions.

  • Specification and implementation: consistency between requirements, acceptance criteria, prompt and specification changes, code and observable behavior.
  • Agent artifacts, logs and other development evidence: where available, they show which tasks, tools, rules and verification steps were actually used in the agent workflow.
  • Git history and pull requests: change size, review and approval traces, frequently changed areas and the traceability of individual decisions.
  • Architecture and architecture drift: system boundaries, coupling, and duplicated or inconsistent implementation patterns.
  • Tests and the verification funnel: which requirements, risks and failure paths the tests cover, and how specification, implementation, verification and release connect.
  • Integration, build, CI/CD and release process: existing quality gates, manual handoffs, reproducible checks and gaps between a code change and delivery.
  • AI code reviews and human reviews: which classes of defect the current controls can detect, and where context, review depth or sample size limits their value.
  • Dependencies and packages: known vulnerabilities, versions, provenance and update risks based on the available package and scanner information.
  • Security boundaries, permissions and secrets: access boundaries, tool permissions and visible signs of secret or credential exposure.
  • Risks in agent-produced code and generated-code hotspots: suspicious areas are attributed to an agent workflow only when logs, pull requests or agent artifacts support that connection.

What you provide

  • Access to the agreed repositories with their Git history and available pull requests.
  • Available specifications, prompts, acceptance criteria, agent artifacts and logs. Missing material does not automatically exclude the audit, but it limits the conclusions that can be supported.
  • Available information on tests, integration, build, CI/CD, the release process, dependencies and scanners in use.
  • Existing rules for permissions, tool access, secrets, approvals and failure cases in the agent workflows.
  • People who can explain the system context, working method, review process and the technical decision ahead.

Scope limits and exclusions

  • The use of AI proves neither good nor poor code quality. The code, its behavior and the available technical evidence determine the assessment.
  • Agent contributions cannot be attributed reliably from source code or Git history alone. Provenance statements rely exclusively on available logs, pull requests and agent artifacts.
  • Missing specifications or development evidence are recorded as evidence gaps. They prove neither a defect nor a controlled process.
  • The AI Forensic Assessment focuses on the quality and security gaps of the agents and their working method. It does not constitute a complete code-forensic examination of the entire system.
  • The AI Forensic Assessment and Code & Architecture Forensic can share individual audit areas. The complete Code & Architecture Forensic must be commissioned separately or in addition.
  • Examining visible security boundaries, permissions and exposure signals does not replace a separately commissioned penetration test or complete security audit.
  • The time-boxed and scoped audit cannot identify every defect or risk across the entire codebase. Its results apply to the agreed scope and the evidence available.
  • The fixed prices apply to the repositories, workflows and audit questions agreed in advance. Additional repositories, further workflows or a later extension of the assignment are agreed separately.

Frequently asked questions

Is the Release Risk-Check required first?

No. The free Release Risk-Check is a questionnaire, not a technical review or initial diagnosis. The AI Forensic Assessment can be requested directly.

How does the audit differ from a classic legacy audit?

The AI Forensic Assessment pays particular attention to specifications, agent workflows, provenance and controls for AI-assisted development. Code & Architecture Forensic examines an established system more broadly. Architecture, Git, tests, build and release can be relevant to both assignments.

Is the AI Forensic Assessment a complete code-forensic review?

No. It focuses on the quality and security gaps of the agents and their working method. A complete examination of the codebase is commissioned as Code & Architecture Forensic separately or in addition.

What happens when specifications or agent logs are missing?

I examine the other available evidence and state which connections cannot be supported. The gap is documented as a limitation or open question rather than filled retrospectively with an assumption.

Can the audit tell which code came from an agent?

Not reliably from source code and Git history alone. Attribution is supportable only where available logs, pull requests or agent artifacts document it.

Is AI-generated code automatically riskier?

AI use proves neither good nor poor code quality. The audit assesses the concrete implementation, its evidence and the controls that are effective within the agreed scope.

Can the AI Forensic Assessment be requested directly?

Yes. In the introductory call, we clarify the decision ahead, the available evidence and the appropriate scope. A prior Release Risk-Check is not required.

How do Standard and Enterprise differ?

Standard, the AI Code Integrity Check, examines a single repository and representative pull requests in 2–3 days. Enterprise, the Agentic Architecture Audit, examines the entire agreed agent pipeline and toolchain in 4–5 days. The individual audit modules and outcomes are listed in the package cards and comparison table. The timeline begins once all agreed access and data are available.

Knowledge about this service

All technical articles →

Test automation in established .NET systems →

Code forensics for AI-assisted software delivery →

Choose your scope

Which assessment fits your current situation?

The decision ahead and the available evidence determine the audit scope.

Include more repositories

Standard covers up to 3 repositories with a maximum of 500,000 LOC. Full Forensic covers up to 8 repositories with no LOC limit. Runtime/dump analysis is a planned extension and is not included. System boundaries and the evidence base are agreed before work starts.

Full Forensic →

Assess AI-assisted development

You need to decide whether tests, reviews, permissions and quality gates are sufficient to expand AI-assisted development.

02 // AI Forensic Assessment →

Transparent process

Four steps to an informed technical decision

The process is adapted to the chosen audit discipline. Timelines begin only when all agreed access and data are available.

Scope & access

Kickoff: we clarify the decision ahead, the system boundary, known problems, release risks, and the available data sources.

02 // AI Forensic Assessment

Agree the audit question and package: Standard examines a single repository and representative pull requests. Enterprise examines the entire agreed agent pipeline and toolchain. We also clarify whether a separate Code & Architecture Forensic is needed.

Evidence & analysis

Analysis: I examine the agreed system and connect technical findings with Git, code, and bug data where these are available.

02 // AI Forensic Assessment

Map the evidence chain: I classify available specifications, prompts, agent artifacts, logs, pull requests, Git history, tests, build data and release data, and document missing connections.

Findings & priorities

Assessment: I compare anomalies with architecture, tests, build, deployment, and your team's knowledge. Evidence-backed findings, risks, hypotheses, and open questions remain distinct.

02 // AI Forensic Assessment

Examine code and controls: within the agreed scope, I assess architecture, hotspots, dependencies, security boundaries, tests, reviews, integration and delivery. Every item is marked as an evidence-backed finding, risk, hypothesis or open question.

Review & next steps

Completion and handover: once all agreed access and data are available, I provide the analysis and report within 5 working days for Code Forensic Standard and 10 working days for Full Forensic. Briefings follow the selected package. Full Forensic also includes a 45-minute follow-up after 30 days.

02 // AI Forensic Assessment

Prepare decisions: Standard takes 2–3 days and Enterprise takes 4–5 days. The period begins once the agreed access and data are available. In the review, I explain evidence strength, limitations, priorities and the next verifiable steps.

Assessment inquiry

Request a Forensic Code Assessment or AI Forensic Assessment

Describe the system scope, technologies and your question. I review the information and agree the next steps with you.

Oliver FriesSenior Software Forensic Analyst and EngineerResponse within 1–2 working days
  • Non-binding initial check of your codebase size
  • NDA template available in advance on request
  • Agree the audit scope and schedule together

This does not commission a paid assessment. I reply within 1–2 working days. We agree on scope, fixed price and schedule before you commission the work.

Confidential inquiry processing via Brevo. Privacy Policy
Book an introductory call in the calendar →