Why software built with AI tools needs one
AI coding tools are very good at producing software that works in a demo. What they can't decide for you is everything a demo doesn't show: who is allowed to see which data, where secret keys are kept, what happens when a server fails, and who finds out when something breaks. Those decisions tend to be left at their defaults, and the defaults are built for getting started, not for customers.
None of that makes the software bad. It means nobody has checked it yet, which is true of any software written quickly, by anyone.
The UK's National Cyber Security Centre (NCSC) takes a similar view. Its guidance on AI-assisted development argues that the right level of care depends on what the code does: more AI freedom is reasonable for prototypes and internal tools, while sign-in, credentials and other security-critical code call for more human review, understanding and testing.
In March 2026 the NCSC's chief executive described vibe coding as a chance to break the long pattern of vulnerable software, provided the tools are built from the start not to introduce vulnerabilities. Until that is true of every tool, a check before launch is how you find out what yours produced.
What we check
Eleven areas, the same ones every one of our reports is delivered on:
- Hosting, infrastructure & estate
- Security & secrets
- Authentication, access & tenancy
- APIs, integrations & vendors
- Data, privacy & GDPR
- Code control & handover
- Deployment & change management
- AI / prompt layer
- Operational readiness & incident response
- Accessibility & inclusive experience
- Performance & user experience
The three areas that carry the most business risk count double, which is how the report can give you one number out of 100 and still show exactly where it came from. The security areas are measured against recognised starting standards: OWASP ASVS Level 1, the UK's Cyber Essentials and CIS Controls IG1.
What it costs, and what you get
| What | Price | What it covers |
|---|---|---|
| Essential Review | £1,500 | Automated scan plus focused human validation; Plain-English RAG report with prioritised findings; ROI figure and an instant fix quote; Upgrade credit toward a Deep-Dive within 60 days |
| Deep-Dive Assessment | £3,500 | Full manual + automated review across all eleven areas; Scored RAG risk register with your number out of 100; Architecture notes and prioritised roadmap; Always-on ROI model, the cost of fixing vs the cost of doing nothing; One-hour findings walkthrough; Itemised fix quote, build your own remediation plan |
| Tender Enabler | £7,500 | Everything in the Deep-Dive Assessment; Build-ready tender / remediation specification any firm can quote against; Light penetration test of the exposed surface; Scalability and compliance-gap review; Investor / due-diligence-ready summary |
Prices exclude VAT. UK customers pay 20% VAT at checkout; customers outside the UK pay none. An Essential Review includes credit toward a Deep-Dive taken within 60 days.
What fixing costs
Every red area maps to a fixed-price fix, so the report ends with a price rather than a proposal. Single problems are handled by Fix Packs; bigger clean-ups come as Hardening Sprints: Starter Harden from £3,000, Standard Harden from £7,500, Full Production Harden £12,000–£15,000.
Which one do you need?
- Essential Review: you want to know where you stand before real users arrive, and what to fix first.
- Deep-Dive: the software already holds customer data, or you need a score and a plan you can put in front of a board.
- Tender Enabler: a customer, tender or investor has asked for security evidence. It adds a light penetration test and a specification any firm can quote against.
Who signs it
Every report is signed by a named engineer. If a finding is in the report, a person has checked it.
Not sure which you need? Answer a few questions and we'll recommend one. It's free and takes under ten minutes.