Executive Overview
Sample Organization · Sample data · as of
Value at Stake
one-time cost to fix · estimated
annual tooling spend · measured
annual risk exposure · modeled (estimate)
- Ready$25K–$60K
- Safeest.$85K–$225K/yr
- Efficient$30K–$75K + $168K/yr
How this is calculated
The dollars your technology posture puts in play, in 3 parts we keep strictly separate — a one-time cost to fix, an annual tooling spend, and an annual risk exposure:
- Cost to fix — an estimate driven by measured signals: the technical debt we detected, converted to effort and priced at a default loaded engineering cost. A one-time cost to remediate.
- Tooling spend — connector-metered AI API cost over 12 months. A measured run-rate bill, never a one-time cost to remediate.
- Modeled — risk-adjusted expected loss = modeled annual probability × impact. A weaker score raises the modeled probability. These are estimates from fixed default assumptions, never guaranteed losses.
From your IT Modernization score. Estimated one-time engineering cost to close the measured IT-modernization gaps (IaC, paved-road, cloud, automation, containers) to a healthy bar: effort × loaded engineering cost. A measured cost, not a guaranteed spend.
From your Technical Debt score. Estimated remediation exposure of $30K–$75K (2–5 engineer-months) to bring technical debt to a healthy bar, measured across 5 of 6 dimensions. Confidence: high. Primary drivers: Architecture Debt, Legacy Code, Dependency Debt. This is an estimated exposure, not a guaranteed cost.
From your AI-spend connector (OpenAI / Anthropic). Measured AI API spend from the OpenAI / Anthropic connector ($14,000/mo × 12 months). Connector-metered only — typed Copilot, Cursor, Gemini, and other seats are excluded. A run-rate bill, not a one-time cost to fix.
From your Security Readiness score. Modeled annual breach expected-loss at a 50/100 security posture (~19% modeled annual probability × $500,000 impact). Estimate, not a measured loss.
From your Lifecycle Risk score. Modeled annual EOL/lifecycle incident expected-loss at a 60/100 lifecycle posture (~19% modeled annual probability × $250,000 impact). Estimate, not a measured loss.
Assumptions (breach/incident impact, annual probabilities, loaded engineering cost) are coarse platform defaults shown in each line above. They cannot yet be set per organization, so treat these figures as starting points, never as measured truth.
Measured cost-to-fix is a one-time remediation effort; measured spend is a 12-month run-rate, not a cost to fix; modeled is an annual risk estimate from tunable assumptions, not a guaranteed loss. The figures are never added together.
ShipReady Score
The ShipReady Score is 68/100 (Developing) — a weighted composite of AI readiness, ROI, agents, debt, modernization, lifecycle, security, delivery, and cloud health.
Target 75 (Strong) · 7 to close
Priorities
Ranked · owner · highest impact- could add about 25 pointscriticalBring down the most serious known security flawsCISO
The count of serious known security flaws is high for the size of your technology estate. Fix the most serious ones on customer-facing and business-critical systems first.
- could add about 8 pointscriticalReplace unsupported system: Windows Server 2012 R2CIO
Windows Server 2012 R2 (Infrastructure) no longer receives any support or security fixes from its maker, leaving it exposed to known attacks and likely to fail an audit. Upgrade to Windows Server 2022, or replace it or buy extended support.
- could add about 4 pointscriticalReplace aging core systemsCIO
Some of the servers and core systems the business runs on are at or past the point where their vendors stop providing fixes and security updates. Plan replacements or paid extended support before one fails an audit or causes an outage. At risk now: Windows Server 2012 R2 (all vendor support ended Oct 2025) — upgrade to Windows Server 2022, Ubuntu 18.04 LTS (standard support ended May 2025) — upgrade to Ubuntu 24.04 LTS. Support dates come from a curated industry catalog; the dated inventory lists each one.
- could add about 3 pointscriticalMove software onto supported versionsCIO
Some of the underlying technology the company's software is built on has reached, or is nearing, the point where its maker stops issuing security fixes — anything found after that stays open. Move to versions the maker still supports. At risk now: Node.js 18 (standard support ended Apr 2026) — upgrade to Node.js 24, Python 3.8 (standard support ended Oct 2025), .NET 6 (standard support ends Nov 2026). Support dates come from a curated industry catalog; the dated inventory lists each one.
- could add about 4 pointshighModernize the oldest parts of the systemCTO
A large share of the software is aging code that no one actively owns, which makes every change slower and riskier. Focus modernization on the parts that change most often.
What moved
vs the previous scored dayDelivery Health improved the most (+6) and Security Readiness slipped the most (-3) since the previous scored day.
Improved
- Delivery Health+684/100
- Technical Debt+563/100
- AI Readiness+468/100
Declined
- Security Readiness-350/100
- AI ROI-282/100
- IT Modernization-165/100
AI ROI board
One page to forward: spend per engineer, adoption, the AI-attributed floor, cost per merged PR, and the last three months. Every figure is tagged measured, declared, or not measured, with its source.
AI tooling spend (measured)
$14,000/mo
AI-spend connector (OpenAI / Anthropic API)
AI tooling spend (declared)
$7,100/mo
AI ROI Inputs — typed monthly spend (Copilot, Cursor, Gemini, and other seats)
Spend per engineer (measured)
$117/eng/mo
AI-spend connector (OpenAI / Anthropic API) ÷ declared headcount (AI ROI Inputs)
Spend per engineer (declared)
$59/eng/mo
AI ROI Inputs — typed monthly spend (Copilot, Cursor, Gemini, and other seats) ÷ declared headcount (AI ROI Inputs)
Active AI users
37
GitHub Copilot Metrics API (28-day window)
Committers (90d)
118
VCS committer meter — distinct humans who committed in the last 90 days (github)
Adoption (active users / committers)
31.4%
GitHub Copilot Metrics API (28-day window) ÷ VCS committer meter — distinct humans who committed in the last 90 days (github)
AI-attributed share (floor)
≥ 28% · 42 repos
GitHub commit-history scan — explicit AI markers only (a floor, not a precise share)
AI-assisted share (declared)
31%
AI ROI Inputs — typed AI-assisted code share
Merged PRs (30d)
74
GitHub merged pull requests in the last 30 days
Cost per merged PR (measured spend)
$189/PR
monthly AI-spend connector (OpenAI / Anthropic API) ÷ GitHub merged pull requests in the last 30 days
Cost per merged PR (declared spend)
$96/PR
monthly AI ROI Inputs — typed monthly spend (Copilot, Cursor, Gemini, and other seats) ÷ GitHub merged pull requests in the last 30 days
AI-assisted PRs (n)
30
GitHub AI-vs-human PR cohorts (60 merged PRs classified)
Human-only PRs (n)
30
GitHub AI-vs-human PR cohorts (60 merged PRs classified)
AI-assisted vs human-authored pull requests
From 60 merged PRs. AI-assisted = at least one AI-attributed commit; human-only = none. Revert PRs are linked to the PR they undo and excluded from both cohorts (a fix is not a unit of output).
| Outcome | AI-assisted | Human-only | AI − human |
|---|---|---|---|
| Merged PRs (n) | 30 | 30 | |
| Median open → merge | 10.0 h | 20.0 h | -10 h |
| Median review time | 3.0 h | 8.0 h | -5 h |
| Median size (lines) | 100 | 100 | 0 |
| Reverted | 0 of 30 · 0% | 0 of 30 · 0% | 0 pts |
| Change-failed | — (no deploy signal) | — (no deploy signal) | — |
Medians are over the PRs that measured each outcome; rates are over the cohort (revert) or over PRs with a deploy signal (change-failure). A delta appears only when both cohorts hold at least 30 PRs. Measured from your GitHub commit history — nobody is ranked or graded on this.
3-month trend
-2 pts (84 → 82)
AI ROI score runs in the last 90 days. The score can mix measured and declared inputs — each figure on this page is tagged separately.
Domain scores
Each 0–100 score is a weighted, explainable composite — the same computation a real tenant gets from its connected data sources.
AI Readiness
Material gaps must close before the organization can adopt AI safely at scale — AI Readiness is developing at 68/100. Fix the weakest areas first.
AI ROI
Every dollar on AI tooling is returning an estimated 10x+ in engineering time — the clearest read on whether the AI budget is paying for itself. 82/100 on $21,100/mo of AI spend. Refine the inputs to sharpen the estimate. Hours saved and loaded cost are self-reported · not independently verified.
Agent Health
Reliable, mostly hands-off agents are shipping work end-to-end and adding delivery capacity. 85% success and 70% autonomous completion across 8,450 runs. Widen agent access to compound the gain.
Technical Debt
Rising technical debt is starting to slow delivery and push up maintenance cost. Debt health 63/100. Pay down the heaviest debt first.
IT Modernization
A modernization gap slows delivery, drives up cloud cost, and leaves operational risk in aging platforms. 65/100 overall, developing. Close the biggest modernization gaps first.
Lifecycle Risk
Running unsupported, end-of-life tech is a live security and audit exposure — an unpatched system can fail a customer or compliance review and turn into an outage. 5 asset groups past end-of-life/support. Grade held at C because Windows Server 2012 R2 (high-criticality) is past end-of-life — a critical/high end-of-life is not averaged away by supported assets. Upgrade or replace those first.
Security Readiness
6 critical exposures could stall an enterprise deal, fail a customer security review, or become an incident. 6 critical / 38 high / 142 medium — 186 distinct vulnerabilities and 71% compliance posture. Clear the criticals first. Score capped at 50 while a critical vulnerability remains open — it cannot rise above 50 until the criticals are resolved.
Delivery Health
How fast and reliably you ship sets your time-to-market and how quickly you recover when something breaks. Delivery Health is strong at 84/100 on release speed and reliability (DORA-style measures) from your connected sources. No dimension is below target.
Cloud Health
Your cloud estate drives monthly spend, uptime, and breach exposure — it's developing at 69/100 across cost, security, reliability, and architecture. Shore up the weakest of those first.
This is sample data. Yours would be real.
Connect your cloud, DevOps, security, and AI tooling to turn scattered signals into one executive view — scored the same way, from your own data.
Get started