Talk to an engineerIntro call
02 - Evaluate & Secure

Evaluate, Audit & Secure

Independent evaluation of AI-generated code, security review and production-readiness checks - so teams ship faster with AI and know what is safe to release.

Talk to an engineerSee the practices
In short

23Minds provides independent evaluation and assurance for AI-generated code and AI-assisted engineering outputs. The evaluation practices audit code produced by coding assistants for correctness, security and maintainability; run security reviews of AI-touched systems; design test coverage strategies for AI-assisted projects; and certify production readiness before release. Studies of AI-generated code show what to look for: in Veracode's 2026 test of more than 100 models, the secure implementation was chosen in 56% of cases on average, and in a 2026 study of 6,299 GitHub repositories 22.7% of the issues introduced by AI-authored commits were still in the latest version. Security findings are assigned to OWASP Top 10 (2025 edition) categories and, for AI features, to the OWASP Top 10 for LLM Applications. The company's quality management system is certified by DNV to ISO 9001:2015 (certificate no. 10000439701-MSC-RvA-POL, valid until 3 March 2027).

Who it's for

Built for teams in these situations.

  • Engineering leaders shipping AI-assisted code who need an external assurance signal
  • CTOs of regulated companies (fintech, health, public sector) under scrutiny over AI in code
  • Security teams responsible for products built with AI coding assistants
  • Vendor management teams evaluating AI-touched deliverables from outside contractors
Problems we solve

The situations that bring teams to this area.

  • AI-generated code lands in PRs faster than humans can review it thoroughly
  • Compliance asks for proof that AI-assisted code meets the same bar as human-written code
  • Test coverage drops because AI tools generate plausible-looking but unverified code
  • Security teams cannot tell where AI contributions are concentrated in the codebase
Practices in this area

Where Evaluate & Secure meets your roadmap.

01Independent AI Code AuditIndependent audit of AI-generated code against a rubric published in full.Entry packagefrom EUR 5,600AI Code Audit: 1 Repository · up to 4 weeks from scoping02Security ReviewSecurity review of code written with AI coding assistants, and of the AI features it added to your product.Entry packagefrom EUR 6,100Security Review: 1 Application · up to 4 weeks from scoping03Tests for AI-Assisted CodeTest strategy for AI-assisted projects - what to test, what to mock, what to skip.Entry packagefrom EUR 3,800Test Strategy Audit: 1 Repository · up to 3 weeks from scoping04Production ReadinessPre-release certification: observability, runbooks, rollback paths, on-call signals.Entry packageEUR 3,700Production Readiness Scorecard · up to 3 weeks from scoping05LLM EvaluationIndependent evaluation of how well the AI you already deployed actually does its job.Entry packageEUR 7,000LLM Evaluation: one solution · up to 4 weeks from scoping
FAQ

Questions procurement teams ask.

Fixed fee, agreed once the scope is clear. We take a repo or set of PRs, sample AI-touched code, run our evaluation rubric (correctness, security, maintainability, test fitness), produce a written report with prioritized findings, and brief the team on the top issues. The package for one repository takes up to four weeks from scope approval.
No. The audit adds a periodic, independent report with findings and recommended fixes to your team's own reviews. It can be booked on a cycle, for example once a quarter, alongside your own process.
Any LLM-based coding assistant: Cursor, Claude Code, Cody, Copilot, Windsurf, Aider. The output is the artifact we evaluate, not the tool. In Stack Overflow's 2025 survey, 84% of the developers who answered that question used or planned to use AI tools, and 46% of those answering the trust question distrusted the accuracy of the output.
Yes. We work under standard NDA, can operate on isolated infrastructure, and can deliver in-person at client offices for highly sensitive engagements. In regulated industries we agree the list of requirements to check before the start and record the result in the report.
A structured PDF + prioritized issue tracker entries (or Linear, Jira, GitHub Issues). Each finding includes severity, reproduction, recommended fix and links to the offending code. We follow up on remediation if requested.
The Cyber Resilience Act (Regulation (EU) 2024/2847) has required manufacturers of products with digital elements to report actively exploited vulnerabilities since 11 September 2026, with an early warning within 24 hours, and applies in full from 11 December 2027. For high-risk AI systems, Article 15 of the AI Act (Regulation (EU) 2024/1689) sets requirements for accuracy, robustness and cybersecurity; after Regulation (EU) 2026/1744 they apply from 2 December 2027 for systems listed in Annex III and from 2 August 2028 for AI in regulated products. Whether a system is high-risk depends on its use; writing the code with an assistant does not decide it. An audit report does not make a product compliant: it documents what was checked, when and by whom.
Related areas

These practices often ship together.

01
Train, Adopt & Govern

“We want our team to use AI safely and effectively.”

Explore
04
Operate, Measure & Maintain

“We have AI in production and need to run it well.”

Explore
Sources

Where the dates and numbers come from.

Talk to an engineer.

Describe where you are with evaluate & secure. A reply within one business day.

Talk to an engineer
Szczecin - ul. Wawrzyniaka 6WWarszawaZielona GóraKraków