Three assessment lines
Three engagements. Each one ends with a costed worklist.
Different buyers and different evidence, but the same shape every time. We open the system, find what is actually wrong, score it against the AuditTrax Index, and price the repair in the order it should happen.
In our clients' words
Find yourself in one of these and the choice is usually obvious.
“
We are three weeks from committee and nobody can tell me whether this platform survives ten times the load.
Partner, growth equity fund
“
It is early and competitive. We need a red flag read before we commit deal resources.
Corporate development lead
“
We are selling next year and I would rather find the problems before the buyer does.
CEO, software business
“
The regulator wants our data inside the country by next year. I have no idea what that costs us.
CIO, regulated lender
“
The vendor quoted the hardware. Nobody has quoted the three years after it.
Head of infrastructure, government supplier
“
We have agents writing into production systems and I cannot tell you what any of them can reach.
CISO, healthcare group
Choosing between them
One question at the top decides it, and it is rarely a close call.
Figure 1 · Which assessment fitsAuditTrax Labs
Most clients start with one and return for a second within the year, which is why the combined path exists and why it is cheaper than two separate engagements.
Side by side
Which one you need depends on what you are about to sign.
| Assessment 01Technology Due Diligence | Assessment 02Sovereign AI Cloud Design and Run-Cost | Assessment 03AI Governance and Security | |
|---|---|---|---|
| The question | Is the technology worth what you are about to pay for it? | Can we run our own AI cloud, and what will it really cost? | Can you vouch for every AI system and agent you run? |
| Who buys it | Investment committees, acquirers, lenders, sellers preparing for exit | Regulated CIOs, government suppliers, data centre operators | Boards, risk committees, CISOs, acquirers of AI-heavy companies |
| Trigger | A transaction with a deadline attached | A residency rule, a cost shock, or an AI programme with nowhere to run | A regulator, an auditor, an incident, or an agent nobody scoped |
| What we look at | Architecture, code, engineering organisation, security, licences, unit economics | Workload profile, residency boundary, site power and cooling, hardware design, three year cost | System inventory, agent permissions, model provenance, data paths, adversarial testing, governance |
| Main output | Scored findings and an eighteen month remediation plan, priced | A tenderable architecture and an open three year cost model | A ranked worklist across every system, each finding with a costed fix |
| Signature number | Cost of remediation before close | Measured cost per token and energy per result | Blast radius per agent |
| Fee | $22k to $65k, fixed at scope | $18,500 · $34,000 · $52,000 | $26k to $78k, fixed at scope |
| Turnaround | 2 to 4 weeks | 4 to 6 weeks, including a site visit | 3 to 5 weeks |
| Tiers | Screening, full diligence, full with hands-on testing | Feasibility read, design and run-cost, design with measured benchmark | Inventory and board readiness, full assessment, full with adversarial testing |
| Explore → | Explore → | Explore → |