Live System Review
An engineering audit of a live system before anyone quotes a rescue or an integration.
An Old System Hides Its State
An old system hides its state. The code may have no tests, the database may hold undocumented tables, and a previous vendor may have left secrets in the repository.
The review gives you a factual picture of the system and a verdict you can act on. It comes before a rescue or integration quote, not after.
What You Get
You end with a scorecard, a dependency map and a fixed-price proposal for the work that follows. The evidence is in your hands.
An Engineering Scorecard
Each part of the system scored for maintainability, test coverage, data quality and security, with the evidence behind the score.
A Dependency and Data Map
Every service, database table, API and scheduled job the system depends on, including the ones nobody documented.
A Security and Cryptography Finding List
Leaked secrets, unpatched libraries, weak encryption and non-human identities, each with its location and severity.
A Rescue, Refactor or Rebuild Verdict
The evidence leads to one decision. If you go ahead, you receive a Rescue, Refactor or Rebuild verdict with a fixed-price remediation proposal.
How the Review Runs
The review runs in five stages. Each stage ends with something you can read, and you decide whether it continues.
Access and Inventory
We list the repositories, environments, databases and the people who know them. You decide which systems are in scope. End: a signed inventory and an access record.
Code and Architecture Audit
We build the system from source, read its architecture and measure test coverage. End: a scorecard with the build and test evidence.
Data and Integration Audit
We read the schemas, trace the interfaces and reconcile a sample of records. End: a dependency map and a reconciliation report.
Security and Cryptography Scan
We scan for leaked secrets, unpatched libraries, weak encryption and exposed interfaces. End: a finding list with severity and location.
Verdict and Proposal
We weigh the findings and write one verdict with a costed route. You decide whether to stop, fix in place or replace. End: the scorecard and a fixed-price proposal.
What We Need From You
The review depends on access and on the people who know the system.
Read Access to the System
Repository, test environment, database read access and infrastructure logs, plus a named person for each system.
The People Who Run It Today
At least one engineer or administrator who knows the system, and a business owner who can explain what must not break.
A Decision at Each Stage
A named approver for the scope, the access, the verdict and any rescue work that follows.
Where These Reviews Fail
Three problems are common. Each has a control built into the review.
No Safe Place to Test
A live system may have no test environment. We agree a read-only or isolated copy before any scan runs, and we never change production data.
Undocumented Business Rules
Critical rules may live only in code or in one person's memory. We trace them from the data and write them down, with that person in the room.
A Scan Finds an Active Problem
A scan may find an exposed secret or an unpatched hole. We report it immediately, agree a containment step and pause the wider review if needed.
What Good Looks Like
You can check these signals against the evidence we leave.
The System Builds From Source
A clean build and a test run prove the codebase is complete, or show exactly what is missing.
The Reconciliation Balances
A sample of records matches across the systems, or the exceptions are named and explained.
No Live Secret Remains
Exposed keys and passwords are revoked and replaced before the report is closed.
You Can Defend the Verdict
Each verdict point cites a finding, a file or a test result. Your team can check it without asking us.
Questions and Answers
When is a Live System Review the right choice?
When a system is failing, undocumented or needs integration, and no one can quote a safe price without looking inside. It also fits before a merger, a vendor change or a major upgrade.
What access do you need?
Read access to the repositories, the test environment, the database and the infrastructure logs. We sign the confidentiality terms your rules require before access starts.
The current vendor still runs the system. Can you still review it?
Yes, with access agreed by you and the vendor. We work read-only where the contract requires it, and we document what we could not see.
Does the review include the fixes?
No. The review ends with the verdict and a proposal. Fixes are a separate fixed-scope project or a managed service, scoped from the evidence.
What does the verdict mean?
Rescue keeps the system and fixes it. Refactor changes its structure while it keeps running. Rebuild replaces it. Each verdict comes with its evidence, its risks and a fixed-price remediation proposal.
A Live System That Is Failing or Undocumented?
The Live System Review audits the code, the data and the bottlenecks before anything is rescued or refactored.
What Happens Next
Readiness Review
In a free 48-hour Readiness Review, a Principal Architect checks your project against What we need before we start and recommends the track that fits.
Live System Review
In 1 to 2 weeks, our principal engineers audit your code, your ERP and database schemas, your APIs and your infrastructure, and scan for leaked secrets and weak cryptography.
Rescue, Refactor or Rebuild
You receive a candid engineering scorecard and a Rescue, Refactor or Rebuild verdict with a fixed-price remediation proposal.
Fee Credited to the Rescue
100% of the diagnostic fee is credited toward the rescue or integration when XSIS carries it out. The work then runs through the same five delivery stages.