Compare approaches
PYD ENTERPRISES vs. a manual code audit
A manual audit puts experienced consultants in front of the code for months and produces a specification document. PYD ENTERPRISES parses every program first, then puts those same experts to work reviewing extracted rules instead of finding them.
THE SHORT VERSION
Use people for judgment and tools for enumeration. A manual audit is only as complete as the paths its readers happened to follow; PYD ENTERPRISES accounts for every executable path, then asks your experts to confirm the ones that matter.
Side by side
Manual code audit vs. PYD ENTERPRISES
| Dimension | Manual code audit | PYD ENTERPRISES |
|---|---|---|
| Time for 1M LOC | 4 to 9 months, depending on team size and SME access | Parse in about an hour; reviewed rule inventory in 2 to 3 weeks |
| Cost model | Consultant months; PYD ENTERPRISES' engagement benchmarks put it at $0.40 to $0.75 per LOC | $25,000 flat per system up to 500,000 LOC, or $85,000/year for a portfolio |
| Coverage | Paths the readers chose to follow; sampling is unavoidable at scale | Every executable path is extracted as a rule, classified as plumbing, or flagged for review |
| Traceability | Prose with occasional program references | Every rule links to file and line range |
| Output format | Word documents, spreadsheets, Visio | DMN 1.5, OpenAPI 3.1, JSON Schema, Mermaid, JSON test fixtures |
| Staleness | Out of date as soon as the next release ships | Re-run the scan on the next Endevor or Git baseline and diff |
| Business context | Strong: interviews capture why a rule exists | None on its own: business intent comes from your reviewers |
What a manual audit actually involves
A typical audit staffs four to twelve consultants, ideally with mainframe or Java EE experience, for several months. They pull source from Endevor or Git, read programs starting from the online transactions and batch jobs they consider most important, interview whoever still knows the system, and write specification documents organized by business function.
The quality of the output depends on two things that are hard to control: which paths the readers chose to follow, and how carefully they handled constructs that hide control flow. A PERFORM THRU range that falls through into a paragraph someone added in 1997, a GO TO DEPENDING ON dispatch table, an ALTER that changes a branch target at runtime, a REDEFINES that lets two programs write the same bytes under different names: each of these is easy to miss on page 40 of a listing.
Where the two approaches differ
PYD ENTERPRISES does not read selectively. It parses every program into an abstract syntax tree, expands every copybook, resolves CALL, EXEC CICS LINK and XCTL targets and JCL step dependencies into one symbol graph, and builds control-flow and data-flow graphs across programs. The rule extractor then works from the graph: each executable path ends up as a business rule, as plumbing (file status checks, logging, abend handling), or on a review list when something cannot be resolved statically, such as a CALL whose target is read from a table at runtime.
The practical difference is what your senior people spend their time on. In a manual audit they find rules. With PYD ENTERPRISES they review rules that have already been found, one DMN row beside the source lines it came from, and add the context that code cannot carry: why the rule exists, whether it is still required, and who owns it.
Cost arithmetic
Using PYD ENTERPRISES' engagement benchmarks of $0.40 to $0.75 per line for manual discovery, a 1,000,000 line system costs $400,000 to $750,000 to audit by hand. Six consultants for four months at a blended $20,000 per consultant month is $480,000, inside that range. A PYD ENTERPRISES Discovery Scan for a system up to 500,000 lines is $25,000; a larger system or several systems fit an Enterprise Portfolio license at $85,000 per year. Your analysts' review time is a real cost in both cases and should be budgeted either way.
Fair is fair
When manual code audit is the right call.
We would rather lose a deal than sell PYD ENTERPRISES where it does not fit.
- The system is small, under roughly 50,000 lines, and one experienced engineer can read it end to end in a few weeks.
- The goal is a business process review rather than a code specification, so interviews and workshops matter more than code coverage.
- The language or dialect is outside PYD ENTERPRISES' supported stack and a parser customization would not pay back for a single system.
- You need an independent attestation from a named audit firm for a regulator, in which case PYD ENTERPRISES output can feed that audit rather than replace it.
FAQ
Common questions.
Does PYD ENTERPRISES replace our consultants?
No. It replaces the enumeration part of their work. Consultants and SMEs still review every extracted rule, resolve flagged paths and add business intent; they just start from a complete inventory instead of a blank document.
Can we combine a manual audit with PYD ENTERPRISES?
Yes, and many teams do. Run the scan first, then scope interviews and workshops around the rule inventory, the dead code report and the review list.
How do we check PYD ENTERPRISES did not miss something?
Every executable path is accounted for in the output: extracted as a rule, classified as plumbing, or flagged for review. The coverage report lists paths in each category, so reviewers can audit the plumbing classification as well as the rules.
Other comparisons
- PYD ENTERPRISES vs. generic llm migrationUse language models to describe rules, not to find them.
- PYD ENTERPRISES vs. automated transpilersTranspilation moves the code; specification extraction moves the knowledge.
- PYD ENTERPRISES vs. rewrite from scratchRewrite the system, not the knowledge.
- PYD ENTERPRISES vs. lift-and-shift rehostingRehosting changes where the code runs; it does not change what you know about it.
Compare on your own code.
Run PYD ENTERPRISES on up to 100,000 lines for 14 days in your VPC and put the output next to whatever you use today.