Exhibit AM&A
An acquisition to assess
Technical due diligence on a software target: architecture, code, team, technical debt, and the gap between the pitch deck and the repository.
Independent technical assessment & advisory
The truth about your technology, told straight.
I'm Nuutti Kotivuori, an independent senior engineer. People bring me in when they need to know what's actually going on — before a deal, after an incident, or when the roadmap has stopped making sense. I find out, and I say it plainly. And if needed, I stay and get it where it needs to be.
Bring me a hard technical question. Big or small.
§ 01
What people bring me
Exhibit BAI
“Where does AI actually pay off for us?”
An honest two-day read of where AI helps your engineering organization and where it is theater. If you want the team productive with modern tooling, I do hands-on training too.
Exhibit CSecurity
A security worry before a raise or a close
Threat model and real exposure, ranked by what can actually hurt you rather than by scanner output volume. For your own systems, or someone else’s you’re about to buy.
Exhibit DArchitecture
A system in trouble
An architecture read or a cloud rescue: scalability, resilience, build-versus-buy, and whether the roadmap can be delivered.
Don't read these as a menu. Whatever you bring, it starts the same way: a free scope call that ends in a straight answer — what I'd do and what it costs, or a no with a reason. How an engagement works, § 03.
§ 02
Approach
2.1
Independent
Nobody pays me but you: no reseller agreements, no upsell pipeline, no bench to keep billing. The assessment is the product, and I have no stake in the outcome.
2.2
Evidence-based
Conclusions come from the code, the infrastructure, and the people rather than from slideware. Every claim in my report traces back to something you can verify.
2.3
Full disclosure
You get everything I find — the good, the bad, and the awkward — stated plainly, with what each means for your decision. Nothing is softened for comfort.
§ 03
How an engagement works
Every engagement runs the same way, whatever the goal: a scope call, a day onsite, and the report in your hands about two weeks later. I come in, figure it out, and put it in writing.
3.1
a call
Goal
You bring a problem or a goal. The scope call is free and ends in a straight yes or no on whether I’m the right person for it. Contract and NDA, scope and price agreed before anything starts.
3.2
one day
Workshop
One day onsite with the people who matter: I interview, look at the systems directly, and leave with the full inventory of what I need to evaluate. Remote works too, if confidentiality or logistics demand it.
3.3
one week
Work
I work through that inventory: reading code, poking at systems, talking to people. Interim findings that would change your plans get raised immediately, not saved up for the end.
3.4
one week
Result
A layered deliverable: a summary for the decision-makers that answers the question you actually asked, an honest evaluation of what you’re getting (good and bad, weighed against your goal), and a technical appendix with the evidence. Every claim traces back to something you can check, and disagreeing with the conclusions is welcome. No boilerplate, and no pie charts nobody asked for.
3.5
after
Close
A walkthrough where anything can be challenged, plus a follow-up window while the decision or the fix is in motion. Then I destroy all the data, securely and on schedule, unless you want something kept.
§ 04
Confidentiality
The client list is, by definition, confidential. Work happens under NDA as a matter of course, and nothing about an engagement gets disclosed, including its existence.
Full disclosure: this cuts both ways. A one-person practice means exactly one pair of eyes on your material — no juniors, no offshore review team, no handoffs.
How I handle your material
- One custodian
- One named person handles your material under NDA: me.
- Sealed per client
- Each engagement runs in its own isolated workspace: identity, email, files, notes. Nothing crosses between clients.
- EU-resident
- Client material is kept primarily EU-resident at rest, and every access to it is logged.
- Verifiably destroyed
- On close, the workspace gets wiped on the agreed schedule, with a certificate of destruction that lists exactly what was kept at your request.
If your security team wants to see the full setup, honest limits included, just ask — happy to have that conversation.
§ 05
The person
Thirty years of building, breaking, and steering software — and an acquisition of my own, so I have sat on both sides of the due diligence table.
Full disclosure: this is a one-person practice, on purpose. The person you email is the person who reads the code.
Annex A — more about me →§ 06
Contact
An acquisition to assess, a security worry, a system in trouble — or just a hard technical question?
Email me the situation: the goal, the system, the deadline. If you'd rather talk first, ask for a call and we'll set one up. The scope call is free either way.
naked@fulldisclosure.fiReferences available on request — the client list is confidential.
— Naked