Self assessment
How much trouble is your legacy system actually in?
Eleven questions, about two minutes, and no email address required to see the answer.
Most of what gets sold to companies in this position is urgency. This is the opposite: a plain reading of where the real risk sits, which is usually not where people have been told it sits. You get a written summary you can print and hand to whoever signs for the work. If nothing is wrong, it will say so.
How this is scored
Three things decide it, and the browser is not one of them.
Almost every enquiry we get opens with the thing that is least urgent. It is worth saying plainly what we weigh and why, so you can disagree with the reasoning rather than just the answer.
Can it come back tomorrow?
Old hardware with no spare and a restore nobody has tested is the combination that turns a dead power supply into a fortnight of downtime. It is the most common serious finding and the cheapest one to fix, which is why it is weighted hardest here.
Is anyone still patching it?
Extended support for Windows Server 2012 and 2012 R2 ended in October 2023, and the paid Extended Security Updates that bridged the gap finished on 13 October 2026. There is no longer a cheque that fixes this. Insurers and customer security questionnaires have started asking directly.
Could anyone else take it over?
Missing source code, an unreachable author and undocumented attached equipment are what decide whether this is a contained job or an excavation. They do not make it impossible. Reconstructing how a system works from its source is the core of what we do. They do change what it costs to find out, which is exactly why finding out should be a small fixed price of its own.
What this is not. It is not a quote, it is not a security audit, and it cannot see your systems. It is the same set of questions we would ask in the first fifteen minutes of a phone call, written down so you can answer them without one.
Questions
The things people ask before they call.
Do I have to give you my email address to see the result?
No. The questions are scored in your browser and the result appears on this page. Nothing leaves your computer unless you fill in the form underneath the result and press send. We built it that way because a self assessment you have to pay for with your contact details is an advertisement, not an assessment.
Will it just tell me everything is terrible so you can sell me something?
It will not. Answer that the application runs on a current server, as a virtual machine, with tested restores and the original developer still employed, and it will tell you that you are in good shape and that you do not need us. That outcome is in the scoring deliberately. A tool that only has one answer is worth nothing to the person using it.
Our application only runs in Internet Explorer mode. Is that the emergency?
Almost certainly not. Internet Explorer 11 as a standalone application was retired in June 2022, but IE mode inside Microsoft Edge is a separate thing, and Microsoft has committed to supporting it through at least the end of 2029, with a year of notice before it is retired. It is work to schedule. The unpatched server underneath it is the part with a date that has already passed. There is more detail on the IE mode dependency page.
I answered "I do not know" to half of it. Is the result useless?
No, and it is worth noticing which ones they were. A system nobody can answer basic questions about is itself the finding, and the result says so rather than guessing. In practice the unknowns are the cheapest thing to resolve, often in a single day of looking.
What happens if I send you the result?
It arrives in the inbox of the engineer who would do the work, not a sales team, because there is not one. You get a reply with what we think the realistic options are, including the ones that do not involve hiring us. If there is a fit, the next step is a fixed price assessment agreed before anything starts, so you know the cost of finding out.
How much does the assessment cost?
It is a fixed price agreed before we start and it scales with the size of what we are looking at, so a single application on one server and a plant with several interlinked systems are not priced the same. Tell us roughly what you have and we will give you the number before you commit to anything. The remediation, if you want it, is then quoted off the assessment, which means you approve a figure against a known scope rather than an estimate against guesswork.
Tell us what it does and what it's written in.
That's genuinely enough to start. We'll tell you what your realistic options are, including the ones that don't involve hiring us.