Independent - senior engineer - no vendor in the loop
Does what you shipped hold up in production?
Not a strategy deck about where you should apply AI. An independent engineering read on whether your pipeline, your infrastructure and your agents survive contact with production: eight dimensions rated 1-5, and a prioritized 90-day roadmap for the ones that do not.
Your AI & DevOps Status Report. 1,900 EUR, delivered in 1-2 weeks, three live sessions included.
Why this page exists
Gartner expects more than 40% of agentic AI projects to be cancelled by the end of 2027, citing escalating costs, unclear business value and inadequate risk controls.
Gartner press release, 25 June 2025
Note what is not on that list: the model. Gartner's analysts describe projects stalling on the cost and complexity of getting agents into production, not on capability. That is an engineering problem, and it is the reason this page exists.
The projects that get cancelled are rarely the ones with the weaker model. They are the ones where nobody could say what the agent was actually doing, nobody had scoped what it could reach, and nobody could ship a fix fast enough when it went wrong. Those are pipeline, observability and permission problems. They are assessable, they are fixable, and they are what the eight dimensions below cover.A strategy consultancy cannot help you with any of them.
What the report covers
Included
Eight dimensions, each rated 1-5:
- +CI/CD pipeline: build, test, deploy automation and reliability
- +Infrastructure and IaC: how infra is provisioned and reproduced
- +Release and environments: deployment flow, parity, rollback
- +Observability: logging, metrics, alerting, incident visibility
- +Security and secrets: secrets handling, access, dependency hygiene
- +Testing and quality: automated checks and gates in the pipeline
- +AI and agent engineering: usage, leverage, generated-code supply chain
- +AI security and governance: agent blast radius, MCP exposure, human-in-the-loop
Not running agents yet? Dimensions 1-7 are rated as normal, and dimension 8 becomes a forward-looking readiness read: what needs to be true before an agent reaches production. Rating controls you have not built yet would not tell you anything.
Not included
- -No penetration test or formal security audit
- -No source-code audit or code review
- -No implementation or hands-on changes
- -No compliance certification (SOC2, ISO, ...)
- -No conformity assessment or compliance verdict of any kind
What you receive
A production-readiness review written by an engineer, not a strategy deck
A decision-making tool, not documentation. There is no page-count promise: the report is as long as the roadmap justifies and no longer.
- +A one-page executive summary
- +A maturity rating (1-5) on each of the eight dimensions, including the AI assessment
- +Risks classified critical, high, medium or low
- +Launch blockers separated from risks that can wait
- +Evidence and an explanation for every finding
- +Quick wins that need limited effort
- +A prioritized 90-day roadmap, the spine of the report
- +Questions to ask your developer or agency
Plus three included 45-minute sessions with your team or tech lead: a kickoff call, a closing roadmap walkthrough, and a 90-day re-check. The maturity ratings are an expert assessment based on the evidence available, not a formal industry certification.
AI and agent engineering
A straight read on how your team uses AI: is it governed, is it safe, and is it actually paying off? Two of the eight dimensions, rated 1-5 like everything else, because for most CTOs right now this is the highest-leverage question.
88% of organizations reported AI agent security incidents last year. 82% of executives believed their existing policies already covered it. That gap is the reason this is worth an outside read. This is an assessment of your engineering posture, not a compliance verdict and not a penetration test.
Usage and leverage
Where AI genuinely saves your team time today, where it quietly adds risk or rework, and a few concrete, low-risk ways to get more out of it for your stack.
Generated-code supply chain
Whether AI-generated code is reviewed and tested to the same bar as hand-written code, the dependencies these tools suggest, and the IP and licensing status of what they produce.
Agent blast radius
What your agents can reach, what they can write to, and what happens when they are wrong. Which actions run without a person in the loop, and how a bad output is caught and rolled back.
MCP exposure
Which MCP servers are connected, what they expose, how they authenticate, and what a compromised or hostile server could reach from inside your setup.
Secrets in agent contexts
What ends up in prompts and logs: credentials, customer data, proprietary code. Which tools train on your inputs, and whether these are business tenancies or personal accounts.
Governance
Who approved the agent going to production, what is logged, and whether there is a usage policy, or whether it is ad-hoc per engineer.
Dated, and already in force
EU AI Act Article 50 took effect on 2 August 2026
It was not postponed. If you ship AI features into the European market, the transparency and disclosure obligations it carries are live now, and they rest on mechanisms your engineers have to actually build: telling users they are dealing with an AI system, marking generated output, logging what happened, and being able to trace it afterwards.
Dimensions 7 and 8 look at whether those mechanisms exist and work in your system. Not whether a document says they do.
Where this stops. This is an engineering assessment, not legal advice. I look at whether the mechanisms your obligations depend on actually work in your system. Whether those obligations apply to you, and whether you meet them, is a question for your legal counsel.
No certification, no conformity assessment, and no statement that you are or are not compliant. That is not what I am qualified to give you, and an engineer who claims otherwise is worth less to you, not more.
How it works
Intake
You fill the short form below with the initial details about your team and setup (about 2 minutes).
Kickoff call
We schedule your included 45-minute call so I can get the full context: your stack, workflow, and what you want out of the report.
Assess
I assess across the eight dimensions, at your access level, following up by email or a quick call whenever a detail needs clarifying.
Report
You get the report: an executive summary, maturity ratings across the eight dimensions, launch blockers separated from risks that can wait, the evidence behind every finding, and a prioritized 90-day roadmap.
Closing session
A second included 45-minute call to walk you through the roadmap, agree the priorities, and answer questions. Deeper sessions on request.
90-day re-check
A third included 45-minute call, 90 days later: we walk the roadmap, mark what shipped, and re-rate any dimension that moved. Included in the price, not an upsell.
1,900 EUR
fixed, per solution: one product, one deployment pipeline, one primary hosting environment
Includes the report and three 45-minute sessions with your team or tech lead: a kickoff call, a closing roadmap walkthrough, and a 90-day re-check. Deeper sessions on request.
More than one product? Ask for a bundle. Need more depth (security, QA, or hands-on implementation)? Ask for a quote.
I take a maximum of 3 projects at a time and personally produce every report, so each client gets my full attention.
Questions tech leads ask
Is this an audit? Are you grading my team?+
No. It is an independent read on where your DevOps stands today and what to fix in what order. You get the judgement of an outside senior engineer with no stake in the existing setup, which is a different thing from a grade on your team.
Will it disrupt my team's work?+
No. Your time commitment is a short questionnaire and three 45-minute sessions with you as the lead: a kickoff call, a closing walkthrough, and a 90-day re-check. I do not pull your engineers into a drawn-out audit.
Do you need access to our code and infrastructure?+
You choose. Level (a) needs no system access at all and still produces a useful report. Levels (b) and (c) add read-only repo/CI access or an infra walkthrough for a sharper read. Access is least-privilege and read-only wherever possible.
How do you protect our data and IP? Do you sign an NDA?+
Yes. I sign your NDA, or provide a short mutual one, before any access or sensitive details are shared, and I sign any other legal documents you require. Credentials are never stored, and access is revoked and data deleted after delivery.
What exactly do we receive?+
A one-page executive summary, a maturity rating (1-5) on each of the eight dimensions, risks classified critical to low with launch blockers separated from what can wait, the evidence behind every finding, quick wins, a prioritized 90-day roadmap, and a set of questions to ask your developer or agency. Plus three included 45-minute sessions with your team or tech lead: a kickoff call, a closing roadmap walkthrough, and a 90-day re-check. There is no page-count promise: the report is as long as the roadmap justifies and no longer.
Can this help with a security or compliance audit?+
It is not a formal audit and does not replace one, and it is not a certification. But because it checks your setup against the same engineering practices a security or compliance audit examines, it surfaces most of the technical gaps a formal audit would flag. It is a fast way to see where you would stand, and to close the obvious gaps before a formal SOC2 or ISO audit prices them for you.
What if we have more than one product, or want help implementing?+
The 1,900 EUR covers one solution. More than one product? Ask for a bundle. Want hands-on help implementing the roadmap, or a deeper security or QA session? Ask for a quote.
Is the maturity rating a certification?+
No. The rating (1-5 per dimension) is an expert assessment based on the evidence available during the engagement. It is not a formal industry certification, not a conformity assessment, and not a compliance verdict. It tells you where you stand and what to fix first, which is what it is for.
What exactly counts as one solution?+
One product, one deployment pipeline, and one primary hosting environment, named explicitly in the report. That boundary is what keeps the price fixed and the turnaround short. More products, pipelines or environments are quoted separately rather than absorbed.
Does this cover the EU AI Act?+
It covers the engineering half of it. Article 50 took effect on 2 August 2026 and its transparency and disclosure obligations rest on mechanisms that have to be built and have to work: AI disclosure, marking generated output, logging, traceability. Dimensions 7 and 8 assess whether those mechanisms exist and function in your system. What it is not: legal advice, a certification, a conformity assessment, or any statement that you are or are not compliant. Whether the obligations apply to you, and whether you meet them, is a question for your legal counsel.
Is this an AI readiness assessment?+
No, and the distinction matters. AI readiness work asks where you should apply AI, and it is strategy consulting. This asks whether what you already run holds up: does the pipeline catch bad changes, does the infrastructure come back, can an agent do damage nobody would notice. If you have not built anything yet, the report still rates dimensions 1-7 and gives you a readiness read on the eighth.
Is this suitable for a vibe-coded SaaS?+
Yes. The report is designed for products built with AI-assisted tools such as Cursor, Lovable, Bolt, Replit, Claude Code and similar platforms. Those products ship fast and tend to arrive in production with the pipeline, the environments and the rollback story unfinished, which is exactly what the eight dimensions cover.
Are we locked into anything afterward?+
No lock-in. You own the report and can act on it entirely on your own. If you would like help implementing it, that is a separate, optional engagement.
Request your report
About two minutes. It is a short form, not a qualification test: if your pipeline, infrastructure or release process is the thing that hurts, this report is for you whether or not there is any AI in your product yet.