Blocking frameworks
WebForms, WCF hosting, System.Web, Remoting, MVC 5. No counterpart on modern .NET, so these are re-architecture rather than a port.
Two questions, one scan
What does it cost to modernize, and what does portability cost on top?
Every report prices both futures. Flip the target below and watch which findings stop mattering. This is the Woodgrove Banking sample estate, scanned with the shipping build.
Findings
23
Estimated effort
29.3-88 engineer-days
Needs decision
1
What portability costs on this estate
MIG1006 COM reference
MIG4002 Windows Registry access (x2)
MIG4003 System.Management / WMI
MIG4013 P/Invoke to a Windows system DLL (x2)
MIG4002 Windows Registry access (x2)
MIG4003 System.Management / WMI
MIG4013 P/Invoke to a Windows system DLL (x2)
What the target never changes
Findings that break everywhere keep full severity either way: WebForms, BinaryFormatter, Remoting, MVC 5. Three blockers and two low-severity items are identical in both columns, and the one item needing an architectural decision stays unpriced in both.
Severity now: blocker 3 · high 7 · medium 11 · low 2
These figures are heuristic planning aids derived from static analysis and are not a quote.
33 rules, 8 categories
What the scan finds
Every rule has a page explaining why it fires and what to do about it. The scanner writes the link into the report.
Project and build
Non-SDK project files, packages.config, GAC and COM references, legacy project types. Mechanical, but everything else waits on it.
Runtime failures
The Registry, WMI, P/Invoke, Active Directory, the event log. The build stays green and the process throws in production. This is the category that ends up in the incident review.
Data access
System.Data.SqlClient, OleDb off Windows, and LINQ to SQL, which has no supported successor at all.
Serialization and security
BinaryFormatter, removed in .NET 9 and throwing at runtime, plus code access security and obsolete cryptography.
Dependencies
Packages with no version for the target, and vendored assemblies with no NuGet successor to upgrade to.
Globalization and encoding
Encoding.Default changing behaviour, and code-page encodings that throw unless a provider is registered first.
Configuration
ConfigurationManager and app.config reads that need a package or a move to Microsoft.Extensions.Configuration.
Reading the report
Three things that get conflated
A finding can be high impact and easy, or low impact and unbounded. Every row carries all three axes so you can sort by the one you actually care about.
Rule Severity Tier Effort Location
MIG1006 Medium Certain Medium Woodgrove.Interop.csproj:22
COM reference ('FabrikamImagingLib'). Works on
modern .NET only when targeting Windows.
MIG1010 High Certain Large Woodgrove.Interop.csproj:34
Vendored assembly ('Litware.ChequeScanner') from a
checked-in path, not a NuGet package.
MIG4003 High Probable Medium BranchHostInventory.cs:2
Uses WMI (System.Management). Windows-only on
modern .NET, throws elsewhere.
Estimated effort: 11.5-35 engineer-days
Confidence tier is how it was detected
Certain, read from project XML. Probable, matched on the syntax tree without a resolved compilation, so some are false positives. Verified, read from compiled assembly metadata. The tool says which, rather than presenting everything as fact.
Severity is impact
Blocker down to low. A blocker stops the migration proceeding, and it can still be a bounded piece of work. Replacing BinaryFormatter is high impact and perfectly estimable.
Effort band is estimability
Small, medium, large, or unbounded until somebody decides. Items in that last group are counted separately and left unpriced rather than folded in with a guess.
| Effort small or medium | Effort large or blocking | |
|---|---|---|
| Blocker or high | 6 | 4 |
| Medium or low | 13 | 0 |
Plus 1 item needing an architectural decision before it can be estimated at all. Effort figures are planning aids. They are never a quote.
What it will not size, and why that is the point
The expensive unknowns are usually somebody else's code. A scanner that quietly skipped them would produce a smaller number and a worse plan, so the report names them instead.
Not assessed, scope separately
Projects that are not C# or VB are named and counted, never skipped silently. They still need planning and they are not in the effort estimate.
Woodgrove.Database SQL Server database project Woodgrove.Database/Woodgrove.Database.sqlproj
Dependency inventory, no severity, no effort
Six distinct third-party references on this estate. Nothing here is counted or estimated. It is the list to research before anyone commits to a plan.
nuget Litware.Web.Controls 2018.2.611.40 nuget Microsoft.AspNet.Mvc 5.2.9 nuget Microsoft.AspNet.Web.Optimization 1.1.3 nuget Proseware.Json 9.1.2 [3 projects] dll Litware.ChequeScanner 3.0.0.0 com FabrikamImagingLib 3.0
I do not give you a number for work I have not sized. If something in your estate cannot be priced yet, it shows up as a named exclusion rather than an optimistic guess.
What the report contains
Written for the security review before you send it on. It should take thirty seconds to clear.
It includes
- Project paths, as they appear in your solution
- Line numbers of the code that matched a rule
- Rule identifiers, titles and remediation text
- Names and versions of declared dependencies
Dependency names stay on purpose. Nobody can assess a component without knowing which one it is.
It does not include
- Source file paths, replaced by stable opaque ids
- Source code or any file contents
- Connection strings, credentials, config values
- Web-service hosts and URLs, only the scheme survives
- Machine names, user names, environment details
Redaction covers the JSON, which is the file you send. Your console output, Markdown report and SARIF keep full paths, because those stay on your machine and your developers need them.
offline by default
no telemetry, no login
no AI in the analysis path
Apache-2.0 with patent grant
no source code in the report
signed and notarized binaries
When you want the number defended
The scanner gives you ranges. The assessment gives you a price, with the unknowns resolved and the exclusions written down.
Start smaller: a free 30-minute read of your report
Send the JSON, I read it, and we spend half an hour on what it means. No deck, no obligation.
Send a report for a free read$2,400fixed
Migration assessment, estates up to 50 projects. Larger estates quoted after a look at your scan.
Credited in full against the migration if you go ahead with me.
What arrives
- A full scan with the dependency inventory researched
- Every not-assessed project resolved to manual, deferred or excluded
- A scoped proposal with phases and explicit exclusions
- A working session on the findings with your engineers
Questions engineering leaders ask
Do you need our source code?
No. You run the scanner yourself and send me the JSON report. It carries no source code, and every source file path in it is replaced by an opaque id, so it clears a security review without an exception.
What if we are staying on Windows?
Then your number is the smaller one. COM, P/Invoke, the Registry and WMI keep working on modern .NET as long as you target Windows. The report prices both, so you can see what the choice is worth before you make it.
Most of our estate is not C#. Is this useful?
Partly, and the report says so. SQL, SSRS, SSIS, WiX and deployment projects are named and counted in a not-assessed section rather than skipped. Resolving them is part of the paid assessment.
How long does an assessment take?
About a week from receiving your scan, most of which is researching third-party components and resolving what the tool could not size. The working session is scheduled once the proposal is with you.
Do you do the migration, or only the assessment?
Both, and they are separate decisions. Plenty of clients take the proposal and run the work in-house. If you do want me on it, the assessment fee comes off the first invoice.
What happens if you cannot price part of it?
It becomes a named exclusion with the reason and what it would take to resolve. A dead vendor component with no successor is a decision for you, not a number I can invent.
Run it first. Talk to me second.
The scanner is free and it will tell you more in ten minutes than a discovery call will. If the number matters, I am one email away.