COMPASSINDEPENDENT SOFTWARE ASSESSMENT
Blue Top Compass examines software at three levels: what can be observed from the outside, what the repository reveals, and what requires specialist examination.
Independent. Evidence-led. Decision-focused.THE COMPASS MODEL
Not every technical question requires the same access or effort. Start with external observations, move into the repository when needed, and add specialist examination for material decisions.
Automated external assessment
Compass Scan examines what can be observed from a deployed application, including security basics, privacy signals, runtime behaviour, performance, production readiness and public search visibility.
Customer-controlled repository assessment
Analyse repository and engineering evidence inside your controlled environment without requiring source code to be transferred to Blue Top.
Specialist independent assessment
Examine the software alongside its architecture, delivery history, vendor model, operating environment and business constraints.
Compass separates what was directly observed from what the evidence only indicates, so stronger conclusions are not drawn from weaker signals.
Directly established from the available evidence.
Evidence suggests a condition, but further context may be required.
The available evidence is insufficient for a reliable conclusion.
The activity used depends on what can be tested safely and what authority has been provided.
TECHNOLOGY LIABILITY
Small technical compromises can remain manageable for years. But as complexity, dependencies and operational risk accumulate, remediation becomes harder, more expensive and more disruptive.
Product owners, auditors, risk teams, developers and investors each need a different interpretation of technical condition.
Understand where technical risk is building, what is becoming harder to support, and what deserves attention next.
Explore for Software owners →Your client relationship. Our specialist technical capability.
Explore for IT audit →Connect vulnerabilities and control weaknesses to the architecture, dependencies and engineering practices that created or sustain them.
Explore for Security & risk →Inspect public configuration, runtime failures, dependency signals and production exposure, then move into the repository when the outside view is not enough.
Explore for Developers & AI builders →Examine supportability, technical debt and likely remediation exposure before a material investment or transaction.
Explore for Investors & due diligence →ANONYMISED CASE STUDY
A business-critical healthcare platform delivered through a large outsourced software programme.
Unsupported and end-of-life components
Vulnerable and unmanaged packages
Weak or bypassed controls
Testing, duplication and data-integrity concerns
Individual weaknesses reinforce one another across the software estate.
COMPARE PRODUCTS
| Capability | Compass Scan | Compass Code | Compass Assessment |
|---|---|---|---|
| Access | |||
| Public application review | Yes | Optional | Yes |
| Source-code assessment | No | In your environment | As agreed |
| Source code transferred to Blue Top | No | No | Only if explicitly agreed |
| Technical depth | |||
| Architecture review | External indicators | Yes | Yes |
| Dependency analysis | Limited | Yes | Yes |
| Testing maturity | No | Yes | Yes |
| Security observations | Public controls | Repository findings | Specialist examination |
| Operational review | Public signals | Repository findings | Stakeholder + delivery context |
| Context and decision support | |||
| Stakeholder interviews | No | No | Yes |
| Vendor assessment | No | No | Yes |
| Executive recommendations | Automated findings | Repository findings | Specialist recommendations |
| Availability | |||
| Availability | Available now | Coming soon | Bespoke engagement |
Automated external assessment
NEXT STEP
