Analysis – An Honest Assessment

Artificial intelligence has sharply raised the pace of software development: what used to take months now takes weeks. But speed removes no risk – it hides it. A prototype that's convincing in a demo reveals nothing about whether its code is secure, its architecture sound, and its data processing lawful. Before the real investment begins – scaling, hardening, launch – you therefore need an honest assessment: the Analysis, Step A in the ANVIL system. It examines what actually exists and turns a gut feeling into a dependable basis for decisions.

45%

of AI-generated code contains security vulnerabilities (Veracode 2025)

2.74x

more security issues in AI code than in human code (CodeRabbit)

€3.87M

average cost of a data breach in Germany (IBM 2025)

29,500

German companies fall under documented NIS2 duties since Dec 2025 (BSI)

Why speed hides the risk

AI assistance accelerates the writing of code enormously – and reproduces the same weaknesses systematically in the process. Veracode found that 45% of AI-generated code contains security vulnerabilities; a CodeRabbit analysis of 470 pull requests recorded up to 2.74x more security issues in AI code than in code written by humans alone. Veracode: GenAI Code Security Report 2025 CodeRabbit: State of AI vs. Human Code Generation Report That attackers target exactly this is borne out by the Verizon DBIR 2025: the exploitation of vulnerabilities as an initial attack vector rose by 34%. Verizon: Data Breach Investigations Report 2025

The risk is not theoretical. Escape.tech found more than 2,000 vulnerabilities across 5,600 vibe-coded applications; in 2025 alone, more than 28.6 million new secrets were exposed in public GitHub repositories. Escape.tech: Vulnerabilities in Vibe-Coded Apps (2025) GitGuardian: State of Secrets Sprawl 2026 And the price of a mistake is concrete: according to IBM, a data breach in Germany costs €3.87M on average. IBM: Cost of a Data Breach Report 2025

The real problem: none of this is visible from the outside. A working demo doesn't show whether authorization checks exist, whether keys sit in plaintext in the code, or whether the architecture survives the tenth customer. Decisions on that invisible foundation are decisions made on hope – and they fail expensively. A study cited by MIT concludes that 95% of enterprise AI pilots achieve no measurable ROI, often because they scaled before they understood what they had built. Fortune: MIT report, 95% of AI pilots with no measurable ROI (2025)

What an honest assessment examines

A thorough assessment examines four dimensions – not superficially, but tied to your actual code:

Code & security. Systematic review against the OWASP Top 10:2025: broken access control, hardcoded keys, missing input validation, exposed admin routes, personal data in log files, missing rate limits. OWASP Top 10 (2025) These are the patterns AI-generated code contains above average.
Architecture & scalability. Does the system's structure hold when ten users become ten thousand? What would be a deliberate decision today costs many times more later: McKinsey puts technical debt at 20–40% of a company's entire technology estate, and Martin Fowler describes how it becomes the bottleneck of scaling companies. McKinsey: Tech debt – Reclaiming tech equity Martin Fowler: Bottleneck #01 – Tech Debt Premature scaling is the most common reason startups fail – according to Startup Genome, that applies to 74% of fast-growing ones. Startup Genome: Why Startups Fail, Premature Scaling
Infrastructure & sovereignty. Where does your data live, and under which law is it processed? The US CLOUD Act gives US authorities access to the data of US providers, even when the servers sit in Frankfurt; an internal report by the German Federal Ministry of the Interior confirms this risk to German data sovereignty. Exoscale: CLOUD Act vs. GDPR Igor's Lab: BMI report on US data access (2025)
Compliance. GDPR violations can be penalized with fines of up to 4% of global annual revenue; since December 2025, NIS2 has required documented cybersecurity measures from roughly 29,500 German companies. GDPR Art. 83: fines up to 4% of annual revenue BSI: NIS2 Implementation in Germany

Your prototype is the most precise spec

An honest analysis is never aimed at your work, but at the risks that arise under time pressure. A working prototype is, on the contrary, a genuine head start: it shows more precisely than any requirements document or workshop what your product needs to do. That groundwork is the foundation we build on.

Our approach is deliberately AI-positive: AI delivers the pace, senior expertise delivers the hardening. The Analysis separates what's valuable – your product idea, your groundwork – from what has quietly become a liability under speed. For how such technical due diligence works in detail, see our guide to technical due diligence.

From findings to decision: three deliverables

The Analysis is not a mere audit PDF you file away in a drawer. It translates the findings into three concrete deliverables:

Audit report: the state of your code, architecture, infrastructure, and compliance, with security vulnerabilities, architectural weaknesses, and bottlenecks named concretely.
Prioritized roadmap: what has to happen, and in what order, for your system to hold up in production – ordered by impact and effort, not a wish list but the shortest path to the goal.
Dependable cost plan: a realistic order of magnitude for what the path into production requires – so your investment decision rests on facts.

The result is clarity: you know in black and white where you stand, which risks are real, and what the path into production demands. You decide with prioritized risks and a realistic cost range in view.

Whatever your starting point, the Analysis comes first

An assessment is the right first step regardless of where you begin:

Idea: no code exists yet. The Analysis clarifies feasibility, target architecture, and scope before moving on to New Design.
Concept or design: you have mockups or a specification. The Analysis leads straight into Validation.
Prototype: you've built something that works. The Analysis sets the path into Implementation & Hardening.
Existing platform: your system is running but insecure, not scalable, or not sovereign. The Analysis prioritizes hardening and launch & operations on EU infrastructure.

However different the starting point, the Analysis ensures that every step that follows starts on facts rather than guesswork. For details on the regulatory requirements, see our pages on the NIS2 obligations and the GDPR vendor audit.

Want to know where your project really stands? Send us a short description – we'll get back to you within 24 hours and discuss what an Analysis would make visible for your project.

Frequently asked questions

What does a technical analysis examine?

Four dimensions: code and security, architecture and scalability, infrastructure and sovereignty, and compliance (GDPR, NIS2). We name security vulnerabilities, architectural weaknesses, and regulatory risks concretely – not as general notes, but tied to your actual code.

Why do AI-generated prototypes in particular need an analysis?

Because AI tools reproduce the same weaknesses systematically. According to Veracode (2025), 45% of AI-generated code contains security vulnerabilities; a CodeRabbit analysis found up to 2.74x more security issues in AI code than in purely human-written code. A prototype that's convincing in a demo says nothing about these risks – the Analysis makes them visible.

What sets the Analysis apart from a plain code audit?

A classic audit hands you findings and stops there. The Analysis translates the findings into a prioritized roadmap and a verifiable cost plan – it sets the shortest path into production and makes the commercial risk of every step that follows plannable.

What do I receive at the end of the Analysis?

Three concrete deliverables: an audit report on the state of your code, architecture, infrastructure, and compliance; a prioritized roadmap with the shortest path into production; and a verifiable cost plan. With those, you decide on the basis of facts, not hope.

What happens to my code during the Analysis?

We treat your code in strict confidence. Repository access is used solely for the Analysis and removed once it is complete. On request, we sign a non-disclosure agreement (NDA) beforehand.

How long does the Analysis take?

Typically two to five working days, depending on the scope of your project. Your existing prototype is valuable groundwork: it shows more precisely than any requirements document what your product needs to do, and it shortens the assessment considerably.