How the ShipReady Score works

The ShipReady Score is a single 0–100 composite, graded A–F, that rolls up nine domain scores. Every number is computed from data you connect — the platform never shows sample data, and a domain with no connected source is left out of the composite rather than given a placeholder grade.

The composite

Each domain carries a relative weight; the composite normalizes by the sum of the weights of the domains that are actually measured. Security Readiness and AI Readiness carry the most weight; the Technical Debt and Lifecycle Risk scores are inverted, so lower real risk raises the score rather than lowering it.

The nine domains

Weights shown are each domain’s share of the composite when all nine are measured.

AI Readiness

14% of composite · higher is better

Organizational preparedness to adopt and scale AI across engineering, infra, data, security, governance, and workforce.

Measured from: GitHub, AI Readiness Pulse (first-party survey)

AI ROI

9% of composite · higher is better

Return realized on AI tooling spend, measured against productivity gains and delivered value.

Measured from: Org-entered AI ROI inputs

Agent Health

9% of composite · higher is better

Reliability, autonomy, and effectiveness of AI coding agents and internal agents.

Measured from: Agent execution telemetry

Technical Debt

12% of composite · lower risk is better

Inverse of accumulated debt across code, dependencies, security, docs, architecture, and tests.

Measured from: GitHub, GitLab, Gitea, Azure DevOps

IT Modernization

9% of composite · higher is better

Progress on cloud migration, automation, containerization, platform modernization, and IaC.

Measured from: GitHub

Lifecycle Risk

12% of composite · lower risk is better

Inverse of end-of-life / end-of-support exposure across infrastructure, runtimes, databases, and more.

Measured from: GitHub, Azure DevOps

Security Readiness

14% of composite · higher is better

Vulnerability management, configuration hygiene, compliance posture, and overall security posture.

Measured from: GitHub, GitLab, Amazon Web Services, Microsoft Azure, Google Cloud, Supabase, Elastic, OpenSearch, Splunk

Delivery Health

12% of composite · higher is better

Engineering delivery performance via DORA metrics and release predictability.

Measured from: GitHub, GitLab, Gitea, Atlassian (Jira + Bitbucket), Azure DevOps, Vercel, Datadog, Dynatrace

Cloud Health

9% of composite · higher is better

Cost efficiency, security, reliability, and architecture maturity across cloud providers.

Measured from: Amazon Web Services, Microsoft Azure, Google Cloud, Supabase, Datadog, Dynatrace, Elastic, OpenSearch, Splunk

Where the dollar Value at Stake comes from

Value at Stake translates the same domain scores into money, so a board conversation can happen in dollars instead of grades. It is not a separate data source: every figure is derived from scores that were themselves computed from your connected systems, and a signal that isn’t measured contributes nothing rather than a guess. If nothing you have connected produces a dollar figure, the headline says so instead of showing $0.

Two kinds of dollars go into it, and they are summed and shown separately — never added together:

  • Measured — money already committed or observable, like cloud spend and the engineer-months your technical debt represents. These need no probability priors.
  • Modeled— expected loss from risks that haven’t happened, like a material breach or an end-of-life incident. These are a posture-scaled probability times an impact figure, expressed as a low/base/high range rather than a single number.

The modeled half is driven by assumptions — the loaded cost of an engineer-month, your team size, breach and incident impact, and the annual probability priors at a leading versus a critical posture. The defaults are deliberately coarse and defensible, meant to be tuned to your business, and every estimate carries the exact assumptions it used so a reviewer can check the arithmetic or disagree with the inputs. A modeled dollar is an estimate, and the product labels it as one.

Why some domains read “not measured”

A domain activates only once a source that feeds it is connected and synced. Until then it shows a “connect a source” state instead of a number — a deliberate choice so the score reflects evidence, not guesses. See the connector guides for what each source pulls, or the FAQ for how to read the scores.

See your own score

Connect a source and your Executive Overview populates as the first sync completes — about a minute for small orgs, several minutes for large estates.