Every layer gets examined: infrastructure, backend services, data architecture, API surface, deployment pipeline, security posture, and the technical debt your team knows about plus the debt they don't. Each risk is documented, scored by business impact, and mapped to a prioritized action plan.