Qualimetry
Enterprise
The executive view: health, risk, and where agents pay off
Engineering reporting tells a team what to fix. Strategic Insights tells a leadership team what is actually happening to the estate, what it should worry about, and where an agentic programme would pay back fastest. Findings are produced overnight, so the answer is waiting rather than being assembled on request.
Strategic Health, from 0 to 100
A weighted blend of seven sub-scores: quality, security, coverage, dependencies, standards compliance, end of life, and known-exploited vulnerabilities. Banded A to E, so the conversation starts with a letter rather than a spreadsheet.
- Seven weighted sub-scores, each shown alongside the headline so the number can be interrogated.
- Bands A to E with the thresholds published, not hidden.
- Unmeasurable sub-scores are dropped and the remaining weights rescale, rather than being scored zero.
- Per-category health across your own business structure, with the comparison table behind it.
Rank the risk, then fix the right things first
Composite risk blends quality gate, coverage, security, dependencies, technical debt and duplication into one banded figure per project, then ranks what to do about it by how much risk each fix actually clears.
- Risk matrix by your own category axis, so a domain owner sees their own exposure.
- Highest-leverage fixes ranked by risk points cleared, not by issue count.
- Shared causes where one change resolves findings across many projects.
- Single-owner critical systems, the organisational risk that never shows up in a code metric.
A short, ordered list of what to do next
Grouped by the reason it matters, so a priority arrives with its justification attached rather than as a bare ranking.
Security and dependencies
Where exposure is real and a safe upgrade exists.
Coverage and quality gates
Where the safety net is thin enough to make change risky.
Debt and duplication
Where accumulated debt is now slowing delivery measurably.
End of life
Where a platform or runtime is running out of support runway.
Priorities export to Excel and CSV in a column order that imports cleanly into Jira, so the list becomes backlog rather than a screenshot.
End-of-life and known-exploited risk, up front
The risks that come from outside your codebase and change without you touching anything. Fed by public catalogues rather than by our own opinion.
- End of life today and in twelve months, plus what has already passed its long-term support window.
- Known-exploited vulnerabilities from the CISA KEV catalogue, separated from ordinary CVEs.
- Blast radius across direct and transitive dependencies.
- Concentration by category, so you can see whether the exposure is spread or clustered.
Sources: the National Vulnerability Database, the CISA Known Exploited Vulnerabilities catalogue, and endoflife.date.
Where agents should go next, and whether adoption is real
Two of the seven Insights areas exist specifically to answer the questions leadership is being asked about AI. Both are covered in full on the Agentic Engineering page.
Agentic disposition on two axes
Every system is placed on two axes. Replacement pressure is how much the business is paying to keep it as it is. Replacement feasibility is how safely agents could take it on, given test coverage, interface clarity, specification stability and the risk of cutting over. The four resulting verdicts are Rebuild, Contain, AI-maintain and Maintain.
- Rebuild Pressure: High Feasibility: High It costs you to keep, and agents can safely take it on. This is where an agentic programme pays back fastest.
- Contain Pressure: High Feasibility: Low It costs you to keep, but it is not safe to hand over yet. Limit the blast radius and fix the things blocking feasibility.
- AI-maintain Pressure: Low Feasibility: High It is not hurting, and agents could work on it comfortably. Let agents carry the routine maintenance.
- Maintain Pressure: Low Feasibility: Low It works, it is cheap to keep, and there is no case for disturbing it. Leave it alone.
How the organisation is actually delivering
Built deliberately as a coaching and risk surface rather than a ranking tool, because the alternative destroys trust faster than it produces insight.
- Leaderboards use descriptive measures only, and are never sorted on rework or issue rate.
- Boards with too few measured contributors are withheld rather than shown.
- Organisation-level views are anonymised and name no individual.
- Key-person risk is banded by team, which is where it is actionable.
Nine kinds of finding, waiting when you arrive
Rather than asking you to interrogate a dashboard, Insights runs discovery overnight and presents what changed. A badge shows what is new since the last run.
Unexpected change
An anomaly against the estate's own recent behaviour, not against an arbitrary threshold.
Linked signals
Two measures moving together in a way that suggests a shared cause.
Sustained deterioration
A regression that has persisted long enough to be a trend rather than noise.
Projected risk
Where a current trajectory ends up if nothing changes.
Shared cause
One root cause producing findings across many projects, and therefore one fix.
Licence policy
A component licence that conflicts with the policy you set.
Team pattern
A pattern in how a team works that is worth a conversation.
AI adoption
A meaningful movement in how much agentic work is being attributed.
AI outcome
A difference in how agentic work performs against everything else.
Each project also gets a dossier: its composite risk, the dimensions contributing most to it, and the lowest-effort change with the projected risk after it lands.
Export the whole view as a board pack
The figures leaders present should be the figures the engineering organisation actually runs on. Exporting the view directly is how you keep those two things the same.
Where this sits in Continuous Analysis
None of this works as a separate product. Each stage exists because of the one before it and is only worth doing because of the one after it.
Strategic Insights, answered
How is the Strategic Health score built?
What are the bands?
Who is this for?
Does it tell us what our AI tooling costs?
Give leaders the whole picture
Book a demo and see a health score, a risk map and a board pack built from your own estate.