Every single point of failure, priced in downtime dollars.
The agent reads your infrastructure code, service map and incident history, finds what would take revenue down if it failed, and works out what each weak point costs a year. Architecture work gets ranked by what it protects, not by who argues best. Engineers decide what to fix.
The real world
- Drawn
The diagram is two years old
It shows two of everything. Since then, a hotfix pinned a cache to one zone and a migration left one NAT gateway carrying all outbound traffic.
- Assumed
Redundant, on paper
The orders database has a replica, so it counts as covered. Both run in the same zone, and promoting the replica is a manual step nobody has practised.
- Hidden
Written up four ways
Checkout has gone down four times in two years. The postmortems say "provider timeouts", "502s", "latency spike" and "upstream slow". Each reads as bad luck; together they are one missing timeout.
- Revealed
The outage finds it
A zone has a bad afternoon. The replica goes down with the primary, and payments stop in the healthy zone because their traffic went through the other one.
- Prioritized
Only afterwards
The fix is a few days of work and was always on someone’s list. It gets done the week after the outage, once the cost is known.
Watch it work
Loading…
What it’s worth
* On the fictional retailer above, the six fixes marked Fix now cost about $26K and avoid an estimated $518K of downtime a year. * (fictional estimates): Proof figures
- $706K
- · Expected downtime cost a year across nine weak points: outage hours by failure class, from incident history or a stated default, times the revenue per hour of each app that depends on them. Exposure, not a saving.
- $518K
- · Downtime avoided a year by the six top fixes, assuming each removes 80% of its expected downtime.
- $21K
- · Review hours saved a year: 138 hours across two architecture reviews, done by hand versus checking the agent’s work.
Compared
Cloud posture tools already check resources, and threat-modeling tools structure a review. Here is what each does, and where an agent adds something new. In every column, people make the final call.
| What it does | By hand | Cloud posture tools | Threat-modeling tools | Architecture Review Agent |
|---|---|---|---|---|
| Reads infrastructure state and follows every reference | Yesslowly | Yes | Nofrom diagrams you draw | Yes |
| Flags single-zone resources, databases without a standby, shared egress, expiring certificates | Yes | Partlyper resource, not per app | No | Yes |
| Maps what each app depends on, direct and indirect | Yesslowly | No | Partlyas drawn | Yes |
| Reads incident write-ups and finds one cause written four ways | Partly | No | No | Yes |
| Prices downtime in dollars per weak point | No | No | No | Yeswith the working shown |
| Proposes a fix design with its cost and payback | Yes | Partlyremediation steps | Partlymitigations | Yesranked by return |
| Security threat modeling of each design | Yes | Partly | Yesits core job | Partlyresilience first |
| Accepts the design and owns the change | Yespeople | Yespeople | Yespeople | Yespeople |
● Yes◐ Partly— No
People’s hours a year, two reviews
82% fewer hours than by hand, and 75% fewer than with posture tools and people: 215.4 hours, about $32K.
See the hours by activity, and how each is reached
| Activity | By hand | Posture tools and people | Agent and people |
|---|---|---|---|
| Read the infrastructure34 resources, 2 reviews. By hand: 1.5 h a resource. Posture tools: findings arrive per resource but still need reading. Agent: 0.2 h a resource to check its work. | 102 h | 40 h | 13.6 h |
| Map the apps5 apps, 2 reviews. By hand: 6 h an app. Agent: 1 h an app to check its map. | 60 h | 60 h | 10 h |
| Read the incident historyAgent: it groups causes written in different words. | 16 h | 16 h | 2 h |
| Price and rank the weak pointsAgent: outage hours times revenue per hour, with the working attached. | 24 h | 24 h | 3 h |
| Design the fixes and write the memoAgent: a fix design per weak point and a one-page memo; an engineer edits and accepts. | 52 h | 42 h | 10 h |
| DecideThe same in every column. | 8 h | 8 h | 8 h |
| Total | 262 h | 190 h | 46.6 h |
Estimates for the fictional Northwind Outfitters at an assumed $150 an hour, on the same assumptions as the business case above. Categories, not products: individual tools vary. Verify against your own environment.
How it works
- Read
The code, not the diagram
Plain code reads your infrastructure exports (Terraform state in JSON), the service map, the restore-test log and your incident history. It follows every reference: DNS to load balancer to certificate, subnet to route to NAT gateway.
- Map
What depends on what
For each app, the resources it needs to stay up, direct and indirect. A NAT gateway only counts for apps that call out to the internet.
- Find
Rules first, then judgment
Fixed rules flag single-zone resources on a revenue path, databases without a standby or point-in-time recovery, groups that can shrink to one instance, shared egress, certificates close to expiry, third parties with no timeout or fallback, and backups never restored. The agent then looks for "redundant" pairs that share one zone or one upstream, which the rules cannot see.
- Price
Downtime dollars, with the working shown
Outage hours a year for each failure class come from your incident history where it has that class, otherwise from a default you set. The agent reads incident causes written in different words and names the failure behind them. Hours times the revenue per hour of every affected app gives the expected cost a year.
- Propose
A fix design with its trade-off
For each weak point: what to change, what it costs in engineer days and running cost, what it avoids, and how fast it pays back. Ranked by return.
- Memo
One page for the decision
What to fix first, what to accept with eyes open, and what goes into next quarter’s plan.
Where it runs
- In your environment
- · Read-only access to infrastructure state, the service catalogue and incident records. Nothing is changed.
- Your numbers
- · Revenue per hour, outage defaults, day rates and thresholds are yours, written down in one file.
- Into your plan
- · Findings and fix designs go into your tracker and architecture backlog, with the working attached.
- People decide
- · Every verdict and fix design is a proposal. An engineer accepts the design and owns the change.
On your data
The demonstration above runs on a fictional company. On yours, the agent runs inside your environment with read-only access. Design partners can pilot it on their own data.
The engagement
Architecture ReviewA priced memo in 2 weeks
- 1 · Week 1
Connect
- Agents
- Read infrastructure code, the service map, incident history and restore logs.
- Our people
- Deploy, and confirm the service map with each app’s owner.
- Your people
- Grant access and name app owners.
- 2 · Week 2
Price
- Agents
- Find weak points, price them in downtime, rank fixes by return.
- Our people
- Our architects judge shared failure domains and design each fix with its trade-offs.
- Your people
- Confirm revenue figures with finance.
- 3 · Next quarter
Fix
- Agents
- Re-check after every change.
- Our people
- Our program manager tracks fixes against their return.
- Your people
- Engineers build.
- 4 · Every release
Watch
- Agents
- Flag new single points of failure as infrastructure changes.
- Our people
- Train your platform team; quarterly review.
- Your people
- Own the risk register.
What agents don’t speed up: Building redundancy. The memo ranks it; engineers still have to build it.
What you keep
- Priced risk register
- Every weak point, its apps and its cost a year.
- Architecture memo
- Fix first, accept with eyes open, next quarter.
- Fix roadmap
- Ordered by return, with payback.
- Review runbook
- What re-runs on every change.
- Accuracy record
- Every verdict and every override, logged. Planted-answer scores on every run.
Questions
Where do the dollar figures come from?
Your revenue per hour for each app, your incident history, and defaults you set where the history is silent. Every figure shows its working, and changing an assumption changes the ranking.
Does it change our infrastructure?
No. It reads infrastructure state and records with read-only access. Fix designs are proposals for your engineers, who make the change through your usual review.
What does expected cost miss?
Rare, large events. A region-wide outage or the loss of a database with no backups can cost far more than its yearly average. The memo names these separately so they get a decision of their own, rather than a low number.
How does it relate to System Architecture & Planning?
It produces the current-state map and the priced list of weak points that the engagement starts from, and it re-runs after each change so the map stays true.