How We Work

Two assets that change the unit economics of modernization.

Aedeon, an agent platform, absorbs 60–70% of the engagement work that traditionally drove a pyramid of analysts. Forward-deployed engineers own architecture, judgment, and cutover personally. The combination is the firm. The contract carries the commitment.

60–70%

of engagement work absorbed by Aedeon

100%

agent-native FDEs

Fixed-date

contract

Built by our founders

Aedeon

Why the economics work.

Traditional consulting is a pyramid. A junior pool runs analysis under a thin senior layer. The economics depend on hours billed, which is why hourly billing is the dominant commercial structure. Agentic-era work breaks that model in one specific way: the analysis hours collapse. What used to take fifty analyst hours takes an agent platform an afternoon. The pyramid stops being justified, and the work that remains is judgment, architecture, and customer relationship, which the pyramid was never structured for in the first place.

Our structural answer is to make the analysis a platform, Aedeon, and the engagement a team of forward-deployed engineers who can each carry the architecture and the cutover. Aedeon absorbs the work that funded the pyramid. FDEs absorb the work the pyramid never had time for. The contract absorbs the risk.

Aedeon's Lane

  • Discovery across source systems
  • Schema mapping and dependency analysis
  • Validation harness generation
  • Observability and monitoring setup
  • Documentation and runbook creation

Forward-Deployed Engineers' Lane

  • Architecture decisions and trade-offs
  • Risk-weighted cutover sequencing
  • Customer relationship and alignment
  • Production sign-off and acceptance
  • Team handover and knowledge transfer

The division of labor that makes the fixed date possible.

Aedeon: our agent platform.

Built by the same founders who built Mactores. Aedeon Inc. is a separate business that builds and sells the platform; Mactores deploys it across engagements. The reason this matters: when we deploy Aedeon, we deploy a platform our own engineering team designed. That is a structural advantage versus partners who license their tooling.

Forward-Deployed Engineers: our senior delivery team.

Every FDE has delivered production agentic AI. Embedded with the customer's team for the engagement. Own architecture decisions. Own cutover. Own the customer-signed acceptance. Carry the commitment personally, not as account-team relay.

Fixed date. Fixed fee. Overage on us.

Mactores absorbs overage cost on delays inside our control. Customer-caused delays convert to T&M at standard rates. The clause is standard in our SOW and is shared during commercial discussions. The commercial structure exists because the delivery model justifies it: 60–70% fewer hours than a traditional proposal of equivalent scope is what makes a fixed price hold.

The contract carries the commitment. We absorb the risk so the customer's CFO can budget against it.

Want to see this on a real engagement?

How we work: the delivery method behind a fixed ship date

This page walks a Mactores engagement end to end. What happens inside each of the five phases, who does which half of the work, what you put your signature on at every gate, and what the engagement leaves behind for your auditor.

The short version: automation carries the repetitive bulk of the engagement, forward-deployed engineers carry every judgment call, and the ship date is written into the statement of work before build begins.

Have an engineer walk you through it.

Thirty minutes with a forward-deployed engineer who runs this method on live engagements. Ask how a phase closes, what the automation covers, and where it has gone wrong before.

  • 60 to 70 percent of the hours automated
  • Five signed phase gates
  • Ship date named in the contract
If a form is not how you work, write to lets-talk@mactores.com and ask for the method walkthrough. It reaches the same people.
rail-icon-conversation-3

Ask the awkward one first

How the fixed date survives a discovery surprise in week three.

Your question goes to a delivery lead, not a marketing list. We reply inside one business day.

Talk to an FDE
aws-premier-tier-3
AWS Services Partner
Premier Tier
AWS Specialization
Agentic AI
Incl. Migration & Modernization
7 Competencies
AWS Service Validations
17 Validations

What Does This Method Have Behind It?

Five figures, each of them checkable, and the reason the rest of this page can describe a date as a commitment rather than an ambition.

60–70%

of the engagement hours a traditional proposal of equivalent scope staffs for, absorbed by automation

12 wks

median time to production across Mactores engagements

21

public case studies with named customers and named outcomes

200+

AWS-certified engineers, with 7 competencies and 17 service validations behind them

2008

building on AWS since, which is 18 years of production migrations

Numbers-4

Start with the deadline

Bring the date you are working against and we will tell you what reaching it takes.

A renewal, an end-of-support cliff, an audit finding, or a programme that already stalled once.

Book a scoping call

Why Can Mactores Commit to a Date Instead of a Range?

Traditional consulting is priced as a pyramid. A large junior pool runs the analysis under a thin senior layer, and the commercial model depends on those hours being billed, which is why time and materials remains the industry default. Agentic delivery breaks that arithmetic in one specific place. The analysis hours collapse. Work that used to occupy a team of analysts for weeks now runs in an afternoon, and what remains is architecture, judgment and the customer relationship, which is precisely the work a pyramid was never shaped to do.

So we reshaped delivery around the work that is left. Automation takes the repetitive majority. Senior engineers take everything that requires a decision. The commitment then moves out of the pitch and into the contract, because a model with fewer billable hours in it can afford to carry a date.

The traditional shape

Hours are the product, so the model resists its own deadline.

  • Revenue scales with hours, so the incentive runs against finishing early.
  • Estimates arrive as ranges, because the range is where the commercial risk hides.
  • The people who scoped the work are rarely the people who land it.

The shape we run

Automation removes the billable middle, so a date can carry a consequence.

  • The repetitive work is automated, so the hours it used to consume are not in the price.
  • Scope, date and fee are fixed in the statement of work before the build starts.
  • The engineer who scoped it is the engineer who signs off in production.
The 60 to 70 percent figure is measured against a traditional consulting proposal of equivalent scope, which is the only comparison that means anything. Those hours leave the estimate because the work is automated, and the scope in the statement of work stays the same.
rail-icon-commitment-3

The clause behind the number

The date carries a consequence, and the consequence is written down.

Read the overage terms before any conversation about scope. They govern every engagement we sign.

Read the commitment

Who Does What on a Mactores Engagement?

Both halves are named in the statement of work, and the split is identical on every engagement, so you always know who owns the thing in front of you.
60–70% automated
Engineer judgment
Your review

automated

Discovery, mapping, schema analysis, harness generation, documentation

Engineer judgment

Architecture, sequencing, risk calls, cutover, sign-off

Your review

Domain validation and acceptance

WHO

Scope and design

Phases 01 and 02

Build and validate

Phases 03 and 04

Cut over and retire

Phase 05

Automation

Repetitive at scale

Scope and design

Discovery across source systems, dependency graphs, schema and code complexity analysis

Build and validate

Test and validation harness generation, reconciliation runs, documentation and runbook drafts

Cut over and retire

Observability wiring, decommission inventory, evidence pack assembly

Forward-deployed engineers

Senior, embedded

Scope and design

Target architecture, trade-off calls, the ship date and the fee they are prepared to sign

Build and validate

Risk-weighted sequencing, exception handling, the calls the automation cannot make

Cut over and retire

Cutover command, rollback decision, production sign-off and handover

Your team

Reviewers and owners

Scope and design

Access, context on the systems only you know, and acceptance of the scope

Build and validate

Slice-by-slice review in your own environment

Cut over and retire

Go or no-go on the window, and the signature that closes the phase

Your team appears in this table because your effort is part of the plan. We would rather schedule it in week one than discover it in week nine.
rail-icon-conversation-4

Meet the person, not the org chart

The engineer who would own your engagement will take the first call.

Same person through scoping, build, cutover and the signature at the end.

Talk to an FDE

How Does a Mactores Engagement Run, Phase by Phase?

Five phases. Each one has an entry condition, a named output, and a gate that only your signature opens. Every phase exit produces a document, and those documents are what the audit section of this page is about.
  1. 01

    Scope and commit

    Automated discovery runs across your source systems while the forward-deployed engineer builds the target architecture on top of what it finds. You get a scope, a ship date and a fixed fee, all three written into the statement of work. This phase exists to produce a number your finance team can plan against instead of a range they have to hedge.

    Gate

    You sign the scope, the date and the fee before any build work begins.

  2. 02

    Design and prove the hard part first

    The target design is documented and then the riskiest assumption inside it is built and tested ahead of everything else. If a plan is going to break, it should break in week three on a proof rather than in month five on a deadline. Whatever we learn here is reflected in the plan before the build is funded.

    Gate

    You accept the design and the result of the proof.

  3. 03

    Build in vertical slices

    Work ships in slices that run end to end, each one demonstrable in your own environment. You review something working rather than a status percentage, which means progress is observable and a slipping slice is visible the week it slips instead of the month it lands.

    Gate

    You review each slice in your environment as it completes.

  4. 04

    Validate against the system you are replacing

    A generated validation harness runs the new system beside the old one on real data and reconciles the difference object by object and field by field. Where the two disagree, the engineer explains why before anyone signs. This is the phase that turns a migration from an act of faith into a reconciliation you can read.

     

    Gate

    You accept the reconciliation, including every explained variance.

  5. 05

    Cut over, then retire the legacy estate

    Cutover follows a rehearsed runbook with rollback criteria agreed in advance, so the decision on the night is a check against criteria rather than a judgment made under pressure. Then the old environment is switched off. Retirement is written in as a deliverable, because a modernization that leaves the legacy system running has moved cost rather than removed it.

    Gate

    You sign production acceptance, and the decommission record closes the engagement.

rail-icon-phase-2

The commercial half of this method

The date, the fee and the overage terms are contract language, not positioning.

Our commitment page sets out exactly what goes into the statement of work at each of these five gates.

Read the commitment

What Has This Method Already Delivered?

Twenty-one case studies are published with named customers. The three below each stress a different part of this method: the phase gate that asks for evidence, the rehearsed cutover, and the split between what automation runs and what a person decides. Every figure is the customer's own, published on their case study.

Full detail on each is published on the case studies index. Named accounts and audited figures are shared under NDA during commercial discussions.

Top Mactores Clients

All 21 case studies
Top Mactores Clients Safaricom, Synaptics, Flipboard, Poshmark, Seagate, HP, Adani, Docusign, KlearTrust, Tilia, Sterne Kessler, Total Expert.
rail-reference-2

Ask for the closest reference

We will name the engagement nearest your stack, not the category.

If nothing in our history is close enough, that is a useful answer too, and you will get it on the first call.

Request a reference

Which AWS Services Does Mactores Work In Every Week?

These are the tools our engineers build agents with most weeks, which is why estimating work on them is a matter of record rather than research. The 17 services below each carry an AWS Service Delivery validation — AWS grants it only after watching that service run in production for a named customer — so discovery starts from what we already know rather than from a blank page.

Moving the data — 7 validated

  • amazon-redshift-delivery-1
  • amazon-emr-delivery-1
  • aws-glue-delivery-1
  • amazon-kinesis-delivery-1
  • amazon-msk-delivery-1
  • amazon-quicksight-delivery-1
  • migration-services-competency-1

Carrying the application — 5 validated

  • amazon-rds-delivery-1
  • amazon-dynamodb-delivery-1
  • aws-lambda-delivery-1
  • amazon-api-gateway-delivery-1
  • amazon-ec2-windows-server-delivery-1

Holding the platform — 5 validated

  • aws-cloudformation-delivery-1
  • aws-control-tower-delivery-1
  • aws-service-catalog-delivery-1
  • aws-config-delivery-1
  • aws-waf-delivery-1

Validation is retrospective. AWS grants it for work already in production, so every badge above is a service one of our engineers has run under real load, at a named customer, against a real date. What came out of those engagements — the mapping rules, the failure modes, the reconciliation queries — is what our automation replays during discovery. It is why week one hands you a map instead of a questionnaire.

And the agent build stack itself

The services we assemble agents from every week. AWS issues no Service Delivery validation for these, so they are named in type rather than shown as badges.

Agent build stack

Build stack

  • Amazon Bedrock
  • Bedrock AgentCore
  • Strands Agents
  • Amazon SageMaker
  • Model Context Protocol

And the estates we move off

The source estate sets the sequence, so the list below matters as much as the target. Each of these is a system our engineers have moved to production more than once, which is why the migration plan arrives with an order of operations already in it.
  • Oracle, including Exadata and RAC
  • Self-managed Hadoop and Cloudera
  • Self-managed Spark and Hive
  • Microsoft SQL Server
  • On-premise warehouses and appliance estates
  • Licence renewals that no longer earn their cost
rail-icon-refactor-2

Your estate, not a reference architecture

Send us the estate you actually have, including the parts nobody documented.

Discovery starts from the real dependency graph, which is usually where the surprises live.

Start a conversation

The competencies behind the delivery

The 7 AWS Competencies behind every phase gate.

A competency is AWS reading our customer references and agreeing we have done this at production scale. On this page it answers a narrower question. When your design review lands in week two, which of our people has already built your kind of workload — and what did it look like when they were finished?
migration-services-competency-2

Legacy estate on the clock

Migration and Modernization Consulting

The engagements that start with something which has to be switched off — a licence renewal, an end-of-support date, a warehouse nobody runs new workloads on. We have taken this route often enough that the cutover rehearsal is a checklist rather than an invention. It is also the credential AWS requires before an engagement can draw on MAP funding.

Oracle · SQL Server · Hadoop · legacy warehouses

data-and-analytics-services-competency-1

The foundation everything else reads

Data & Analytics Consulting

Most programmes that arrive here are a data problem wearing another label. This covers collection, storage, governance and query at the sizes where a naive design quietly stops working — and it is why a platform we hand over still performs a year after the engagement closes.

100+ platforms delivered and handed over

ai-services-competency-2

Agents against real operations

AI Services

AWS's assessment track for AI delivery, and the one that shapes how we staff. It is judged on systems running against live data with people depending on the output — a different bar from a demo that answers questions about a document.

Bedrock under load, not in a sandbox

ml-services-competency-1

Models that have to keep running

Machine Learning Consulting

Covers the unglamorous half: feature pipelines, retraining, drift, and the handover to whoever operates the thing on Monday morning. We hold it because the models we ship are expected to survive a production release cycle without us.

70+ customers, models still in service

devops-services-competency-1

How the work reaches production

DevOps Consulting

Less a service line than a property of every engagement. Infrastructure as code, pipelines, monitoring and logging ship alongside whatever we built, because a system nobody on your team can deploy or observe is not a finished system.

Ships by default, never as a change request

healthcare-services-competency-1

When the data is someone's record

Healthcare Consulting

An industry credential, and AWS assesses it in a different order — what you do about privacy, access and audit trail comes before what you built. It matters when a reviewer will want to know who could see which record, and when.

HIPAA claims platform, audit cleared first pass

factory-1

Plant floor to query

Manufacturing and Industrial Services

The second industry credential. Operational and fab data arrives fast, dirty, and in formats nobody chose, so the engineering problem is usually ingestion rather than analysis. Earned against work of exactly that shape.

Fab data lake, 40% more throughput

200-certified-1

AWS-certified engineers

Fifteen certification types across the team, which is the practical reason the engineer assigned to your phase two is already qualified on your services rather than reading ahead of you. We staff from the people who hold the ticket.

clock1-1

AWS Immersion Day partner

Used at handover rather than at kickoff. Where your team will operate what we built, we run AWS's workshop format against your actual system, so knowledge transfer is a working session and not a slide deck.

rail-reference-3

Meet the engineer, not the logo

Ask which of our people would own your design review, and what they built last.

We will name the engagement nearest your stack and the engineer who signed it.

Request the match

Where Does the Audit Evidence Come From?

Regulated modernization has to produce a defensible record as well as a working system. In this method the record is a byproduct of the work rather than a workstream you fund afterwards, because the validation runs and the phase signatures already generate what a reviewer asks to see. Designing against a framework is a different thing from certifying you to it, and the certification stays yours and your auditor's.
  • HIPAA, a framework Mactores designs delivery work against
  • FFIEC, a framework Mactores designs delivery work against
  • SEC, a framework Mactores designs delivery work against
  • GDPR, a framework Mactores designs delivery work against

What each framework wants, and where the method already produces it

Framework
What it wants evidence of
Where the method produces it
PCI DSS

Wants evidence of

Cardholder data boundaries, change control, and evidence that scope did not quietly expand

Produced by

Dependency graph from phase 01, plus the signed scope that fixes the boundary

HIPAA

Wants evidence of

Where protected health information lives, who reached it, and what happened to it on decommission

Produced by

Field-level lineage from phase 04 and the decommission record from phase 05

FFIEC examination

Wants evidence of

Traceability from source of record to the output a person or an agent acted on

Produced by

Reconciliation output from phase 04, retained with its variance explanations

SEC reporting

Wants evidence of

That the numbers in a filing can be traced back to the system that produced them

Produced by

The same phase 04 reconciliation, retained with its lineage

SOC 2

Wants evidence of

That changes were authorised by someone with the authority to authorise them

Produced by

The customer-signed acceptance record that closes every phase gate

GDPR

Wants evidence of

Lawful handling of personal data through the migration, and proof of disposal afterwards

Produced by

Lineage from phase 04 and the disposal detail inside the phase 05 decommission record

Marks appear as published by each body and are not recoloured. PCI DSS and SOC 2 are named in type throughout: PCI SSC issues no compliance logo and prohibits marks implying compliance, and the AICPA licenses its mark only to organisations holding their own unqualified report. Naming a standard indicates what the delivery work is designed against, and not endorsement or certification by that body.
file1-1

Bring your examiner's last finding

We will show you which phase exit would have produced the evidence for it.

The full audit evidence pack is available under NDA during commercial discussions.

Talk through your audit scope

Which Credentials Can You Check Without Asking Us?

AWS reviewed our delivery record, our certification depth and our customer references before granting Premier Tier, which is the highest tier in the partner network. Everything below is listed publicly, so procurement can confirm it before the first call rather than after it.
aws-premier-tier-4
Specialization
AWS Agentic AI Specialization
Consulting competencies
7, named above
Certified engineers
200+
Partner tier
Premier Tier Services Partner
Building on AWS since
2008

The certifications behind the staffing — 15 types

  • solutions-architect-professional-2 Solutions Architect – Professional
  • devops-engineer-professional-2 DevOps Engineer – Professional
  • solutions-architect-associate-1 Solutions Architect – Associate
  • developer-associate-1 Developer – Associate
  • sysops-administrator-associate-1 SysOps Administrator – Associate
  • data-analytics-specialty-1 Data Analytics – Specialty
  • machine-learning-specialty-1 Machine Learning – Specialty
  • security-specialty-1 Security – Specialty
  • cloud-practitioner-1 Cloud Practitioner
The Agentic AI Specialization is named in words because we hold the credential and not the badge artwork. We would rather name a credential you can verify than display a mark we cannot source. Full detail is on the partners page.
rail-icon-verified-1

Verified by AWS, not by us

Every credential here is granted by AWS, so you can check it without us.

The tier, the specialization and each competency are listed on our partnership page and in the Partner Solutions Finder.

See the AWS partnership

Frequently Asked Questions

What is a forward-deployed engineer?
A senior engineer who embeds with your team for the engagement, owns the architecture and the cutover, and signs for the delivery date personally. The person who scopes the work is the person who lands it, which removes the handoff between the team that sells and the team that delivers.
What does the automation do, and what does it not do?
It carries the repetitive work at scale: discovery across source systems, dependency graphs, schema and code complexity analysis, validation harness generation, reconciliation runs, documentation and runbook drafts, and assembly of the evidence pack. Choosing the target architecture, sequencing the work against risk, handling exceptions, calling a rollback and signing for production all stay with a named engineer.
How does a fixed ship date survive a surprise found in discovery?
Discovery finishes inside phase 01, before the scope, the date and the fee are signed, so most surprises land while all three are still open. Phase 02 then builds and tests the riskiest assumption in the design ahead of everything else, which is where the remaining ones tend to show up. Anything found after signature is handled under the change and overage terms on our commitment page, and delays we cause are ours to absorb.
How is audit evidence produced without a separate compliance workstream?
The artifacts a reviewer asks for are the artifacts the delivery work already produces: the phase 01 dependency graph and signed scope, the phase 04 reconciliation with its variance explanations and field-level lineage, the customer-signed acceptance record at every gate, and the phase 05 decommission record. They are retained as the work runs, so the evidence pack is assembled rather than reconstructed. Designing against a framework is a different thing from certifying you to it, and the certification stays yours and your auditor's.
What exactly is fixed in the contract?
The scope, the ship date and the fee, all three written into the statement of work at the close of phase 01, together with the five phase gates and the overage terms that say who carries the cost if the date moves. Legacy retirement is written in as a deliverable. Our commitment page sets out the contract language in full.
rail-icon-faq-1

Ask us directly

Holding a question this page did not answer? That is the one worth a call.

Thirty minutes with the forward-deployed engineer who would run the engagement.

Talk to an FDE

Signed, then shipped.

Bring us the deadline you have to hit and the system standing in its way.

Thirty minutes with the forward-deployed engineer who would run the engagement, and you leave with a real view on the date and the shape of the work.