TSB Bank2018
£48.65M
In regulatory fines after a core-banking migration that the regulators found had not been adequately controlled.4
Failure: migration and dependency mapping
Why now
Five pressures are now converging on the technology estate.
Cost targets, regulators, retirements, AI plans and acquisitions used to arrive one at a time. Now they arrive together, and each exposes the same gap: most institutions cannot fully describe the technology they run.
Cost
The application portfolio is the largest line in the budget that nobody has examined closely.
Regulation
Examiners expect a current inventory on request, not a plan to build one.
Knowledge
The engineers who understand the core systems are retiring faster than they can be replaced.
AI
Model-risk teams won’t approve AI that touches systems no one can map.
Acquisitions
Integration problems that were visible in the code before signing tend to surface after close.
20–40%Share of a technology estate’s value that CIOs estimate is tech debt1
15–20%Typical savings from finding and removing redundancy in the portfolio2
$300K+Cost of one hour of downtime at more than 90% of mid-size and large enterprises3
Industry benchmarks, for orientation. The diagnostic measures each one for your own estate.
The cost of not knowing
The most expensive thing in banking technology is what you don’t know you’re running.
Knight Capital2012
$460M+
Lost in 45 minutes when a repurposed flag switched on code that had been dormant since 2003 and was still live on one of eight servers.5
Failure: dead code and configuration drift
Equifax2017
147.9M
Consumer records exposed. The patch was available, but no inventory showed which systems needed it.6
Failure: component inventory
In each case the gap could have been found before it became a loss. No one was in a position to see it.
A CMDB records what someone reported about a system. The code and runtime behavior show what it actually does.
Tools of recordCMDB · APM · EA · TBM
- Each holds a fragment of the estate.
- Built from surveys and attestations, so they go stale within months.
- They record what someone entered and stop there.
AxiareteBuilt from the systems themselves
- One model, assembled from every artifact.
- Derived continuously from code, configuration and runtime behavior.
- Ranks the options and supports execution.
How it works
Axiarete reads your systems instead of interviewing your teams.
Staff retire and move on; the code, logs and configuration they worked on stay with the institution. Axiarete builds its model of the estate from those artifacts, so the model stays accurate as the estate changes.
Full visibility
Home-grown, packaged, SaaS and AI tools, including the ones nobody remembers deploying.
One measure of risk, quality and cost
A 300-point health check for every application, the business risk behind each issue, and the true total cost.
Recommendations with a rationale
Consolidate, retire, modernize or renegotiate, ranked by impact, feasibility and effort.
A Digital SME for every application
Staff can question any system as if its original architect were still in the building.
For fifty years, fully understanding a technology estate cost more than most institutions could justify. AI has changed that calculation.
Software can now read all of the code, configuration and logs, and keep the resulting model current. Institutions that build it first will make each later decision faster.
Solutions
Where the model pays back
Portfolio intelligence
An inventory that examiners and boards can rely on
Every application and dependency, kept current rather than rebuilt once a year.
- Discovery, including shadow IT
- Dependencies taken from code and runtime
- Business processes mapped to applications
“Where do we run this, and what’s exposed?” Answered in minutes.
Technical debt and risk
Every technical issue priced in business terms
Debt found in code, open-source components, runtime behavior and change history, and tied to the processes and channels it puts at risk.
- Blast radius and cost for each finding
- A remediation agent to help with fixes
- New risk caught as it is introduced
Debt that could cause an outage is flagged while there is still time to fix it.
Rationalization
Find the savings in the portfolio
Real usage, overlap, dependencies and run cost, with each decision to retire or consolidate ranked by savings.
- Overlap across business lines
- License and SaaS waste found before renewal
- Business cases and migration sequencing
Removing redundancy typically saves 15–20%.2 On a $40M application budget, that is $6–8M a year.
Modernization and migration
Modernize on evidence, in the right order
A full picture of each application before any workload moves, and the numbers to defend leaving a system where it is.
- Feature-level replaceability
- Sequencing that respects dependencies
- Test plans based on real behavior
Large IT projects run 45% over budget on average and deliver 56% less value than planned.7
Technology due diligence
Diligence at the pace of the deal
Assess the target’s actual estate before signing, and start integration with the map already drawn.
- Debt, security and key-person risk
- A day-one overlap and integration plan
- Separation planning for carve-outs
AI strategy and roadmap
An AI roadmap that survives model-risk review
Use cases drawn from your own processes, systems and data, ranked by impact, feasibility and effort.
- Built from your actual estate
- Informed by industry and competitor research
- Sequenced, with an ROI case
Each use case arrives mapped to the systems and data it would touch.
Featured: the mainframe
The mainframe was never the weak point.
What made COBOL estates feel risky was the shrinking number of people who understood them. AI models now read COBOL well, which removes much of that constraint.
Mainframes still deliver decades of uptime and consistent transaction processing. Before committing $30–100M and four years to replace one, consider making it permanently maintainable and spending the capital on the channels customers use.
- Digital SMEAsk any COBOL program how it works
- Maintenance engineerImpact analysis, change guidance and tests
- Security scannerContinuous checks against PCI DSS, GDPR and SOX
- Technical writerDocumentation and business-rule catalogs kept current
- OptimizerTuning, retirement and cost reduction
Migration, risk-adjusted
$125.7M
- Break-even in year 9 to 11
- First customer-visible release in year 4 or 5
- Assumes a 60% chance of overrun
AI-maintained
$76.0M
- Lower cost from the first month
- No cutover risk; the core is untouched
- 15 engineers freed for customer-facing work
The question is whether replacing a system that works is the best use of the next four years.
Regulation
Supervisors now expect you to describe your estate on request.
The wording differs from one regulator to the next, but the expectation is the same: show what you run, how it connects and how it would fail. Axiarete produces that evidence.
MandateWhat it expectsWhat Axiarete provides
FFIEC IT Handbook United StatesAn authoritative technology inventoryAn inventory derived from evidence and kept current, never rebuilt for each exam
OCC Heightened Standards United StatesDemonstrable risk governance over technologyRisk for each application, tied to business impact
Federal Reserve SR 11-7 United StatesModel inventory, dependencies and governanceThe system and data dependencies needed to scope and approve AI deployments
NYDFS Part 500 amended · United StatesAn explicit asset inventoryAn automated asset and component inventory, maintained continuously
DORA European UnionICT risk management, a register of information and resilience testingDependency graphs and third-party visibility, available on demand
PRA / FCA Operational Resilience United KingdomImportant business services mapped to their systemsProcess-to-application maps based on how systems actually behave
APRA CPS 230 AustraliaOperational risk and service-provider managementVendor and SaaS visibility, with concentration and usage evidence
PCI DSS 4.0 GlobalAccurate scoping of the cardholder data environmentComponent-level evidence of where regulated data flows
Axiarete does not certify compliance. It gives your compliance function evidence it can put in front of an examiner.
Who uses it
One evidence base for every executive at the table
CIO / CTO
Make every estate decision on evidence.
CFO
Find recoverable spend in the portfolio.
CRO / CISO
Shrink the attack surface you can’t currently see.
Audit & Compliance
Answer examiners from one current source.
Corporate Development
Complete technology diligence at deal speed.
Transformation
Sequence programs by what is actually ready.
Security and model governance
Built to pass a bank’s vendor security review
We ask to read some of your most sensitive artifacts, so the platform and the company are built to earn that access.
- Independently attestedSOC 2 Type II, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 for AI management.
- A dedicated environmentA separate AWS environment per client, with AES-256 encryption, customer-managed keys and zero-trust access.
- No training on your dataYour data is never used to train Axiarete or third-party models.
- Your change controlChanges reach production only through your own pipelines, with human approval.
- Every finding citedEach conclusion traces to the file, commit, log or configuration behind it.
- Your experts decideYour own specialists confirm every material finding before it drives a decision.
Model risk (SR 11-7)
Your model-risk team will ask how Axiarete’s own AI is governed. Structural analysis runs on deterministic models; LLMs and agents work on top of that verified base; and every output can be traced to its source.
How Axiarete governs AI →Financial institutions seldom allow vendors to name them, so this page carries no logos. Judge the platform by what it finds in your own estate.
Get started
Start with 30 days on one part of your estate.
Start here
30-day Portfolio Diagnostic
Choose a slice of your estate. Within 30 days Axiarete reconstructs its purpose, architecture, health, risk and cost, along with the opportunities inside it, and you judge the evidence yourself.
Talk it through
Strategic briefing
A working session that applies this to your regulatory position, modernization plans, savings targets and deal pipeline.
- 30 daysFirst findings
- 8–12 weeksFully operational
- No migrationYour estate keeps running
FAQ
Common questions
How is this different from our CMDB, EA repository or APM tools?
Those are systems of record: they hold what people entered, and they drift as the estate changes. Axiarete builds its picture from code, configuration and runtime behavior, then ranks the options and helps carry them out. It also gives your existing tools accurate data to reconcile against.
What does Axiarete need access to?
Read access to things you already have: repositories, configuration, logs, ticketing exports and financial data. Each client runs in its own dedicated environment. See security and model governance.
How do we know the AI’s conclusions are right?
You check them, and the product is designed for that. Every finding links to the evidence behind it, your own specialists confirm material findings, and the analytical core is deterministic, so your model-risk validators can trace any output to its source.
We’re already partway through a migration. Is this still useful?
Yes, arguably more so. Migrations lose most of their time in discovery and sequencing, which is where Axiarete helps most. It shows what you are actually moving, orders the work by real dependencies, and identifies workloads that shouldn’t move at all.
We’re a mid-size institution. Is this for us?
Yes. Mid-size institutions face much of the same regulatory scrutiny as the largest banks with far smaller teams, so an inventory that maintains itself is worth more per person. The platform deploys in weeks and doesn’t need a large team to run.
How quickly will we see results?
The Portfolio Diagnostic produces first findings in 30 days, with evidence your teams can check. The platform is fully operational in 8 to 12 weeks, with no migration and no disruption.