Explainer video: https://youtu.be/PV-p2kLT4I0

Example Use Case- working with third-party development shops.

Here's an example of how users are using the Dashboard to keep third-party development shops in alignment. 

In particular, several organizations did not have the awareness they were looking for on who was working on their code, and how much staff turnover and activity level there is.   

Using the dashboard they can see the individual developers working on the product:

Too, the dashboard shows the trends in development activity (commits to master branch) to observe unusual variation:

At Sema we are passionate believers in looking at the data -- but also passionate about being curious rather than judgmental. We strongly advise the same when it comes to coding metrics, as software development is a craft, not a competition. Asking questions to get the context is essential.

In this particular case, what might look like a decline in productivity was actually an organization's push to release v1 of a new product in August/ September, followed by smaller, less frequent, more complicated refinements. This was expected and desired behavior.  

New Feature 1- Open Source metrics.

We added metrics from the 5th and 6th components (module) of our codebase health framework so that now there is a comprehensive picture.

Module #5 is Open Source risk -- the legal risk coming from using Open Source code with restrictive licenses like Copyleft. You can read more about this risk here. This data comes from Snyk and we'll be adding other Software Composition Analysis tools in the months ahead.

New Feature 2- Code quality metrics.

Module #6 of 6 is Code Quality. Here we added four charts from Codacy, too we'll be adding other code quality tools in the months ahead.

- Number of warnings about code style, security, error proneness, and performance 

- Duplicate code

- Code complexity

- Testing coverage

Here's an example:

You'll notice that we are considering Codacy's security warnings to be part of code quality, not code security.

Why? It is our view that organizations need an advanced security tool such as Snyk (but not just Snyk) to capture true security risk. So code quality tooling that also adds security risk-- Sonar is in this example, too-- is tracked in code quality.

Here and in so many places in the dashboard, we are opinionated about how to think about codebase health. We know you won't always agree-- but we commit to being transparent in our reasoning and approach, and to being sincerely open to feedback. 

New Feature 3- Full Codebase Health score.

As noted above, now that Open Source and Code Quality risk are included, we have representation from all six components of Codebase Health included in the overall Codebase Health Score.

As a result, companies who use GitHub, Codacy, Snyk and iRADAR can get a full Codebase Health score that updates in real time for quarterly reviews, sprint debriefs, even weekly check-ins with the team.

Not using all of those tools? The Codebase Health score doesn't "ding" you for not having a certain tool, it simply excludes those metrics from the numerator and the denominator.

Here's Beta version 1.3 release notes for the CTO Dashboard.

We're feeling frisky and skipped v1.2. ;0

Explainer Video

https://youtu.be/aWD1VB1fNT4

Part 1 of 3 -- More Metrics

We added a metric on developer retention, part of the Team section -- the most important single measure of codebase health. 

And we added a Cyber Security metric, this one a rollup of thirteen risk vectors such as incomplete email setup and breached credentials.

You can use the Executive Summary page standalone for your daily and weekly check-ins and prep for Board meetings, then dive into the detail on Product and Compliance as needed.

Part 3 of 3 -- Adding Another Engineering tool-- Codacy, for code quality and security

You can now connect Codacy through its API.

Happy Monday, all.

Here's what's new in v1.1 of the CTO Dashboard Beta.

Thanks to the Beta users who gave us quite helpful (and candid!!) feedback on v1.0. We have incorporated those improvements and are ready to add a few more users.

If your organization uses GitHub and at least one of Snyk for Code Security or Wati's i-RADAR for Cyber Security, and you'd like to join the beta, let us know.


In these release notes:

1. Repository summarization to make it easier to keep track of many repositories. 

2. New Executive Summary functionality.

3. A preview of the future of the Executive Summary.



You can also watch a 7.5 minute explainer video: link here.

1. Repository summarization to make it easier to keep track of many repositories. 

When organizations have fewer than 10 repos, we've found it's sensible to see all of those repos at once on a chart. Beyond 10, it becomes too much of an "eye chart." 

So now if there are 10 or more repos, you see the process charts showing the total activity, not by repo.

2. New Executive Summary functionality.

We are building this product to make it easier for CTOs to share a contextualized summary of their codebase -- whether it's at standup, at the end of a sprint, with the C-Suite or their Board.

To that end, we're introducing an Executive Summary, which summarizes the key metrics of codebase health and risk into overall scores, including a single 1-100 "Sema Score."

In the first iteration, we are summarizing the results of one metric, specifically a code security metric of high-risk SAST and DAST warnings, relative to codebases of similar sizes and stages.

In our Sandbox codebase example, the number of high-risk security warnings is in the lowest quartile of its comparison group, so the Sema Score gets the maximum 100 points. Trust us it won't always be 100, and shouldn't be -- scores of 30-70 reflect reasonable investments in non-functional requirements.

3. A preview of the future of the Executive Summary.

This is our second product, we've been working on collecting Executive-ready Engineering metrics for the last six years.

With our first product, we can capture information about Code Quality, Development Process, Development Team, Open Source Legal Risk, Code Security, and Cyber Security at once-- using our code scanning tools. WIth the CTO Dashboard, you'll be able to use your own existing tools to see the same kind of executive results.

Here's a view of a report from our first product so you can see what's coming for the Executive Summary.

All,

I’m very pleased to share that the CTO Dashboard is now available in Closed Beta = by invitation only.

If your organization uses GitHub AND (Snyk for Code Security OR WATI’s i-RADAR for Cyber Security), and you would like to participate in the Closed Beta, please Reply.

Details below.

Matt

The CTO Dashboard is designed to support CTOs and the other most senior leaders of technology teams in two ways:

1.    Delight the C-Suite and Board of Directors: make it easy to provide reports to the CEO, the Leadership Team, and the Board about the state, trends, risks and investment needs for the codebase.

2.    Coach Engineering Managers: help focus CTOs’ direct reports on the highest importance areas of the codebase to maintain, invest, or improve.

Key features of the current version of the Beta include: 

1.    Assessment of the codebase across: 

  a.    the Development Process including developer activity trends,

  b.    Code Security including SAST and CVE warnings, and

  c.    Cyber Security assessment of the organization’s domains and subdomains.

2.    Benchmarking of your results against a database of billions of lines of code and companies worth over $1 Trillion

3.    Cost and timing recommendations—what to fix, when, and how much it will cost

4.    Set up in minutes by connecting native API integrations (more to come growing)

5.    Two permission types: an Owner who can see the Insights and set up the API connections, and Settings Editors who can only handle settings.

We’d love to get your input shaping the next generation of CTO tooling.