Guides

In-depth, vendor-neutral explainers on metrics and governance.

• Software development metrics: the full catalog, organized by lens
• AI development metrics: a catalog for AI-assisted SDLC and AI systems
• DORA metrics without spreadsheets: deriving the four from systems you already run
• No denominator, no score: a practical check before sharing delivery metrics
• KEV and EPSS: prioritizing vulnerabilities by exploitation, not severity
• Per-contributor pricing, explained
• SBOM blast radius: answering 'where do we use it?' honestly
• AI governing AI: how law and measurement are co-evolving
• California GovOps and its role in state AI governance
• Public-sector AI governance: how California's GovOps runs the model
• Public-sector GenAI procurement: how California buys AI safely
• Separation of duties when AI writes — and reviews — the code
• Test data management in the AI era: realistic data without the risk

Platform and category overviews.

• Technical due diligence software: measure the asset, not the pitch
• Engineering intelligence: measure delivery without gaming it
• Technical debt management software: make the cost visible
• AI governance software: inventory, oversight, and evidence
• AI readiness assessment software: measure, do not guess
• DORA metrics dashboard: the four keys, measured from real deployments
• Application modernization assessment: deciding what to modernize, and in what order
• Continuous compliance and continuous control monitoring, explained
• Software portfolio management: a practical guide
• Software risk management: measuring and treating the risk that lives in software
• Technology investment intelligence: allocating engineering spend on evidence
• Product roadmap: where we are, and where we are headed

What each compliance framework requires and how to run it.

• SOX compliance for ITGC and §302/§404 readiness
• SOC 2 compliance: what it requires and what auditors sample
• ISO 27001: the ISMS, Annex A, and the certification cycle
• The EU AI Act: risk tiers, obligations, and timeline
• ISO/IEC 42001: the AI management system standard
• NIST AI Risk Management Framework, explained
• The Colorado AI Act (SB 24-205), explained

Frameworks and approaches weighed side by side.

• Vanta vs Drata: a criteria-first way to choose
• DORA vs SPACE: two lenses on software delivery

Criteria-first evaluation guides for switching platforms.

• Vanta alternatives: an evaluation guide for compliance buyers
• Drata alternatives: an honest guide to evaluating your options
• DX alternatives: an engineering-metrics buyer's guide
• Secureframe alternatives: an evaluation guide for compliance buyers
• Hyperproof alternatives: an evaluation guide for GRC buyers
• LinearB alternatives: an engineering-metrics buyer's guide
• Jellyfish alternatives: an engineering-metrics buyer's guide
• Swarmia alternatives: an engineering-metrics buyer's guide

Category buying guides, criteria first.

• Best technical due diligence software: a criteria-first buyer's guide

The view from your seat — CTO, CISO, board, PE.

• CTO dashboard software: one honest view of engineering health and risk
• CIO dashboard software: the IT portfolio, governed and audit-ready
• Board reporting software: technology and cyber-risk oversight, made defensible
• Executive technology dashboard: one view you can defend to a board or a buyer
• VP of Engineering dashboard: delivery, debt, and risk you can defend
• CISO dashboard: security readiness you can show the board
• Engineering due diligence for private equity and M&A

Free templates and checklists to adapt.

• Vendor risk assessment template & checklist
• SOC 2 readiness checklist
• AI governance policy template
• User access review checklist

Plain-English definitions of the terms auditors use.

• IT general controls (ITGC), defined
• Segregation of duties (SoD), defined
• Section 302 certification, defined
• Information produced by the entity (IPE), defined
• DORA metrics, defined
• Technical debt, defined
• Continuous control monitoring, defined
• Technical due diligence, defined
• Enterprise readiness, defined
• What are complementary user entity controls (CUECs)?
• What is the SPACE framework?
• What is MTTR (mean time to restore)?
• What is change failure rate?
• What is lead time for changes?
• Agent health
• Control register
• COSO (Committee of Sponsoring Organizations)
• Deficiency evaluation
• Deployment frequency, defined
• Evidence-based compliance, defined
• Risk appetite, defined
• SBOM (software bill of materials)
• Statement of Applicability (SoA), defined
• Trust center, defined
• What is the bus factor?
• What is the CISA KEV catalog?
• What is EPSS (Exploit Prediction Scoring System)?
• What is shadow AI?
• What is Infrastructure as Code (IaC)?
• What is Software Composition Analysis (SCA)?
• What is CVSS (Common Vulnerability Scoring System)?
• What is SAST (Static Application Security Testing)?
• What is DAST (Dynamic Application Security Testing)?
• What is secret scanning?
• What is an AI Bill of Materials (AI-BOM)?
• What is model provenance?
• What is code churn?
• What is cyclomatic complexity?
• What is materiality?
• What is a control walkthrough?
• What is vulnerability management?