Portfolio Insights
The 23 fund-level Portfolio Insights in seven sections, with the unit, window and goal of each, and what computing, not measured and no data mean
On this page
- Sections
- Units, goals and windows
- Where each company stands and what changed
- Where to act
- Risk shared across companies
- How the companies build
- Capacity and value over the holding period
- Computing, not measured and no data
- Frequently asked questions
- Why does a company read off plan when we never set a goal?
- Why does an insight say it is computing?
- Are the money figures converted between currencies?
- Next steps
Portfolio Insights answers fund-level questions across the companies of a Portfolio Monitoring fund: what changed this quarter, where to act, which risks the companies share, how they build, and what value was created over the holding period. It is part of Portfolio Monitoring and covers the monitored companies you can see.
The same insights are served in the app (Portfolio → Insights), by the Enterprise Data API (GET /portcos/{id}/insights/, scope read:monitoring), by the in-app AI advisor and by the MCP server tool get_portfolio_insights. Each answers with the same figures; the MCP resource codedd://catalog/insights lists the sections and insights. Words such as goal, band and AI share are defined in the Glossary.
Sections#
Insights are read one section at a time. A section holds the insights below, in page order.
| Section | Title | Insights |
|---|---|---|
overview | Where each company stands | top_actions, company_risk |
changed | What changed this quarter | biggest_movers, liability_bridge, goal_attainment |
act | Where to act | momentum, remediation_payback, exit_readiness |
shared | Risk shared across companies | shared_dependencies, key_person, handover_risk, team_movement, cve_patch_speed, common_weaknesses |
build | How the companies build | speed_stability, growth_debt, ai_adoption, ai_review, ai_delivery |
capacity | Capacity and stack | capacity, tech_landscape |
story | Value over the holding period | value_created, platform_percentile |
A section covers the whole fund, or one company when you name it. ai_delivery is the one insight with a per-company view: it compares one company with itself over time, never companies with each other.
Units, goals and windows#
- Effort is in person-days of 8 hours. Money is in US dollars (
currency: "USD"), derived from each company's hourly rate (hourly_rate_usd, the one in its settings). Shares are percent and scores 0-100. - Goals are the scorecard goals in force: your own objective where you set one (
goalSource: account), else CodeDD's default (goalSource: default: code health 80, security 80, test coverage 80, key-person dependency at most 30%). A company that set its own target in its settings is held to it where you set none. The scorecard, the monitoring summary and Insights use the same goals. - Windows: every insight states the period it covers (calendar quarters, the 365-day key-person window, the 90 days before the latest audit, and so on). The tables below name each one.
- Comparable audits: insights that compare two audits use the same audit mode (full or light, never mixed) at least 28 days apart. A repository set that changed between them is flagged as a scope change rather than read as a move.
Where each company stands and what changed#
| Insight | What it shows | Unit and window | Goal |
|---|---|---|---|
top_actions | Suggested actions: at most one per company and three in all, the most urgent open area first, then the smallest effort | Person-days per action | The area's goal from company_risk |
company_risk | A company by risk-area grid: code health, security, CVEs, licences, key person, tests, AI review, end of life and delivery. Each cell is pass, fail, close to goal (within 10 points), measured or unknown, never a guessed pass | Latest audit; end of life within a year | Your goals or the defaults; CVEs: your critical + high goal, else none open |
biggest_movers | The companies whose scores moved most, up and down (at least 1 point), with what explains the move | Points, latest audit against the previous comparable one | None |
liability_bridge | The fix-effort bridge from last quarter to this one: like for like, added scope and removed scope, by company and category. Full audits only | Person-days (the dollar split backs the method only); calendar quarters | None |
goal_attainment | The share of scorecard goals met per quarter, per goal and company. Every past quarter is scored against today's goals | Percent of goals met; the last 6 calendar quarters | Your goals or the defaults |
Where to act#
| Insight | What it shows | Unit and window | Goal |
|---|---|---|---|
momentum | Where each company is heading: today's level against its change per quarter since the previous comparable audit (key person: against the git trend) | Points per quarter | Your goals or the defaults |
remediation_payback | Fix effort against team time freed a year, and the break-even in months. It uses the quality fix only (the one that lowers the yearly drag) | Months; the hourly rate cancels out | None |
exit_readiness | Exit-readiness checks per company (CVEs, licences, key person, tests, code health, delivery, AI review) and the estimated days to clear the failing checks. daysToReady is null when the work is not estimated | Person-days; latest audit, a newer complete pulse replaces its CVE counts | Your goals or the defaults; CVEs: direct critical + high at or under your goal, else none open; AI review 90% reviewed |
The exit-readiness CVE check counts direct (shipped) dependencies. It carries the transitive counts and a warning when there are any, but they never fail the check.
Risk shared across companies#
| Insight | What it shows | Unit and window | Goal |
|---|---|---|---|
shared_dependencies | Runtime packages used by two or more companies, ranked by concentration of risk, with their critical and high advisories | Companies and repositories per package; the served CVE index | None |
key_person | Key-person exposure per company (the code only the top contributor knows) and how it changed in a year | Percent of attributed code; 365-day window | Key-person dependency at most 30% (or yours) |
handover_risk | Repositories that are hard to hand over: more than half the code on one expert and under half covered by unit tests | Percent; 365-day window; audited lines | None |
team_movement | Developers starting and going quiet (no commit for 90 days) per quarter, and the knowledge lost with leavers | People and lines of code; the last 8 quarters | None |
cve_patch_speed | The share of critical and high CVEs (and KEV-listed ones) fixed within 30 days per company, and the oldest open | Percent fixed within 30 days; the last 365 days | 80% fixed within 30 days |
common_weaknesses | OWASP Top 10 categories ranked by the number of companies with open critical or high findings in them | Companies and findings | None |
How the companies build#
| Insight | What it shows | Unit and window | Goal |
|---|---|---|---|
speed_stability | DORA delivery tiers per company: throughput against instability, only where measured | DORA tiers of the latest audit | None |
growth_debt | Whether growth is funded by technical debt: the innovation rate against the change in code health | Percent new work over the last 2 complete quarters; health points over about 5 months or more | None |
ai_adoption | AI-assisted development across the fund over time, like for like, with the agent mix (Cursor, Claude Code, Copilot, Codex, other) | Percent of added lines with agent evidence, measurable repositories only (basis: measurable_repositories, windowMonths: 3); 12-month chart | None |
ai_review | How much AI-written code reached the default branch with a pull request and a human review, and the unreviewed AI lines | Percent and lines; the 90 days before the latest audit | 90% reviewed |
ai_delivery | For one company, delivery before and after AI adoption, month by month: AI share, output per active developer and stability | Monthly; months with fewer than 5 active developers are withheld | None |
The AI share here is the same figure as the scorecard's AI adoption chip and the metric history: a minimum, because agent work committed without evidence looks human.
Capacity and value over the holding period#
| Insight | What it shows | Unit and window | Goal |
|---|---|---|---|
capacity | Lines of code per active developer against the company's own limit, and capacity by area | Lines per developer active in the 3 months before the audit (locBasis: whole repositories, else audited lines) | The company's workload_threshold_per_dev |
tech_landscape | Technology versions that need action (ended, or ending within a year) and the stacks companies share | Lines of code per technology | None |
value_created | Value created over the holding period: each metric from the initial audit to the latest one | Points and person-days; initial audit to now | None |
platform_percentile | Each company by area against the whole CodeDD platform, in quartiles, against companies of the same audit mode | Quartiles; ranked only with enough companies outside your portfolio | None |
Computing, not measured and no data#
Insights are built in the background from each company's audits. An insight that cannot show a figure says why, and never shows a guess or a zero:
| State | Meaning |
|---|---|
| computing | The company's figures are still being built (reason: computing; the company is listed in pendingCompanies, and pendingCount is above 0). Read the section again in about 15 seconds. Computing is not a measurement. |
not_measurable | The data cannot be measured for these companies, for example no repository that can disclose AI authorship. |
no_data | Audits exist, but none carries this insight's data yet. |
no_audits | No visible company has a completed audit. |
no_portcos | You see no company in this fund yet. |
error | The insight could not be computed. |
Inside an insight a value that was not measured is null, and a company cell reads unknown or not measured. A missing value is never "met" and stays out of every share's denominator. An audit that is still running is never read as finished: its company is listed as pending until the audit completes.
Frequently asked questions#
Why does a company read off plan when we never set a goal?#
Default goals are real goals. A company with no saved objective is held to CodeDD's defaults (code health 80, security 80, test coverage 80, key person at most 30%), marked goalSource: default. Set your own goals in the Scorecard tab of the Portfolio Monitoring settings.
Why does an insight say it is computing?#
The stored figures of one or more companies are being rebuilt, for example after a new audit. The rest of the section is served; read it again shortly.
Are the money figures converted between currencies?#
No. Insights money is in US dollars, derived from each company's hourly rate.
Next steps#
- Glossary: goals, bands, AI share, key person and data states
- Portfolio Monitoring: the audits and pulses behind the figures
- MCP Server: reading Insights from an AI assistant