"Takeover" can sound vague. When we say we take over software that nobody else will support, what actually happens? This post walks through a takeover assessment in the order it unfolds, so you know what to expect before you start.
Before anything begins
We agree the scope in writing. That includes what we will look at, what we will not, how long it should take and the price, which is fixed. On the first call we also tell you how we use AI in the work. In short, tools help with first-pass reading and drafting, and a person reviews and signs off on everything. If you would rather that no code reach an AI model, there is a fully manual option.
Nothing is touched on your live system without your written approval. That is a rule, not a courtesy.
Week one: learning what you have
Reading the code and the setup
We read the application code, its configuration and how it is deployed. For each part we want to know what it does, what it depends on and who last changed it. For a small system this takes hours. For a larger one it takes days.
Mapping the system
We draw the system: the pieces, the data flows, the hosting, the domains and the third-party services it talks to. The map puts the whole picture on one page, including things that are easy to forget, such as an email provider nobody remembered or a scheduled job on a server in somebody's old account.
Finding the accounts and the people
For every part of the map, we record whose name the account is in and who can log in today. The result is an access and credential inventory that you own.
Week one and two: putting things in your hands
This is the part that changes your position the most, and it happens during the assessment, not after.
- Backups. We confirm backups exist, and where possible we restore one to see whether it actually works. We note the result honestly, including when the answer is that it does not.
- Hosting and access. Hosting and key accounts move into accounts you own. Credentials go into a vault in your name.
- Code repository. If there is no repository, we set one up so changes can be tracked and reviewed.
- Monitoring. Where the scope includes it, we add basic checks on the parts that matter.
Week two: writing it down
The documentation that should have existed all along gets written: how the software is deployed, how it is restored from a backup, what each part is for and which logins matter. If a new developer ever joins, this is where they start.
Stack and dependency health
We check what the software is built on: runtimes, frameworks, libraries and their end-of-life dates, licenses and hosting costs. This is where we spot a server that is oversized for what it does, or a paid license nobody uses. It is also where we flag unsupported versions, which our post on end-of-life PHP explains.
The findings and the price list
Each finding records what we saw, the evidence for it, why it matters for keeping the software running and what it would cost to fix. Severity reflects continuity impact, such as likelihood of an outage or difficulty of getting help, not any claim about attackers. Fixes are priced per item, so you can choose which to do and in what order. The priced list is described in more detail on our fixes and upgrades page.
The report and the readout
You receive a plain-English summary: what the software is, who supports it, what would break if the old vendor stayed gone, the top five items, a total priced fix cost and a 30, 60 and 90 day plan. A technical appendix is kept separate. We then hold a 45 to 60 minute readout, or a verbal-only one if you prefer. You have 14 days afterward for questions. The full layout is on What You Get.
We send proposals for fixes or a retainer after the readout, not during it, so the meeting is for understanding, not for a sales conversation.
What a takeover does not cover
- It is not a security review of any kind. We do not offer security assessments or security testing and will refer you elsewhere.
- It does not fix everything. It tells you what needs fixing and what each fix costs.
- It does not rebuild your software. If a rebuild is the right answer, we say so and quote it separately.
What it costs, and the credit
A small takeover assessment is $3,500 and a standard one is $7,500, in USD, with a fixed scope. If you move to a monthly retainer within 90 days of the report, 100% of the assessment fee is credited toward your first three months. The credit is non-cash, non-refundable and non-transferable, and it cannot exceed the fee. Details are on the takeover assessment page.
Every report states plainly that findings are as of a stated date and that the work is not a security review.
After the assessment
You can take the priced list and have us do a few fixes. You can move to a retainer. Or you can take the documentation and the accounts in your name and carry on with an in-house person. All of these are fine outcomes. The point of the assessment is that you decide with facts.
If you are wondering whether your situation fits, tell us about your software. A few lines about what it does and what has happened is enough to start.
