How the AI readiness score works
The score is one number out of 10. Seven factors go into it. Each one carries a weight, and each one gets scored on the same 1 to 10 rubric our engineers use when they do the guided version, so when a client self-scores a 6.8 and we come back with a 6.5 after the scans, nobody is surprised.
Seven factors, weighted by risk
Identity and permissions carry the heaviest weights, and that's not a philosophical choice. A Copilot license acts as whoever is signed in. If Dave in sales can open the HR share (and in a lot of companies he can, because nobody ever checked), then so can Dave's Copilot. Governance and monitoring are next in line, because sooner or later a cyber insurer or an auditor is going to ask you to prove AI is being used the way your policy claims, and those two factors are the proof. The last three, data quality, people and technology, matter too, just less urgently.
Each factor is scored 1 to 10, then multiplied by its weight and added up. A perfect 10 on identity, at 20%, adds 2.0 to the total. A perfect 10 on technology, at 10%, adds 1.0. That's the whole formula; there's nothing hidden in it.
| Factor | Weight | What it measures |
|---|---|---|
| AI Governance & Policy | 15% | Policy maturity, enforcement, oversight, compliance alignment |
| Identity & Access Security | 20% | MFA, privileged access, conditional access, least privilege |
| Data Governance & Permissions | 20% | Effective permissions, oversharing, external sharing, ownership |
| Data Quality & ROT | 10% | Redundant, obsolete and trivial data; freshness; retention |
| Data Security Controls & Monitoring | 15% | DLP, audit logging, insider risk, alerting maturity |
| Organizational Readiness | 10% | Training, leadership alignment, use cases, ROI tracking |
| Technology & Integration Readiness | 10% | Cloud maturity, integration, legacy constraints, modernization |
The four readiness bands
Your overall score lands in one of four bands, and so does each factor on its own. The band is the advice. It says what you can safely do with AI this quarter, not someday.
⚠ AI Exposed
The governance and data foundations aren't there yet, and switching AI on now would mostly make the existing gaps easier to find.
▲ AI Vulnerable
AI can be used, carefully, but the exposure is real enough that we'd keep it to individual productivity work.
● AI Capable
You can roll AI out across the company here. The risk stays manageable provided the governance pieces (policy, approved tools, DLP) go in before the licenses do.
✓ AI Mature
AI is governed, monitored and tuned as part of how the business runs; this environment has earned the right to scale it.
The maturity rubric
Here's what each score range tends to look like when we walk into an actual office. The self-assessment puts you on this scale using three questions per factor. On the guided evaluation an engineer does the same thing from scans of your tenant, which takes longer and is a lot harder to argue with.
📋 AI Governance & Policy 15%
Is there a written AI policy? Does anyone enforce it, or is it a PDF on the intranet nobody has opened since the day it was approved? Who is watching, and does any of it line up with the regulations you already live under?
🔐 Identity & Access Security 20%
Multi-factor authentication, how admin accounts are handled, conditional access, and whether people hold more access than their job needs. On the guided evaluation we read this straight from an identity posture scan of the tenant.
🗃️ Data Governance & Permissions 20%
Who can actually open what, how much has been shared wider than anyone intended, how sharing with outsiders is controlled, and whether each library has an owner who'd notice. On the guided evaluation we don't guess at this; we pull a permissions report across the whole tenant and count.
🧹 Data Quality & ROT 10%
How much redundant, obsolete and trivial content (we call it ROT) is sitting in your libraries. The classic case is a price list with ten copies in ten folders, where Copilot cheerfully quotes the 2019 one. Also whether the rest is current, and whether retention rules exist and anyone enforces them. We inventory the workspace for this on the guided evaluation.
🛡️ Data Security Controls & Monitoring 15%
Data loss prevention, audit logging and insider-risk handling, and the question underneath all three: when something fires, does the alert reach a person who does something about it, or does it land in a mailbox nobody reads? The guided evaluation scores this from a data security posture report.
👥 Organizational Readiness 10%
Has leadership agreed on what AI is actually for here? Has anyone trained the staff, or did they learn from YouTube? Are the use cases written down anywhere, and is somebody measuring whether they paid off?
☁️ Technology & Integration Readiness 10%
How much of the stack lives in the cloud, whether the systems talk to each other or rely on someone re-keying data on Fridays, which legacy pieces are holding things back, and what it would cost to move them.
AI multiplies whatever strength is already in the building. Because it's a multiplication, a low number in any one term drags the whole product down, and that's why the rubric keeps steering you toward your weakest factor instead of toward buying more AI.
Read the strategy behind the score →See your own score
Twenty-one questions, about 15 minutes, and the results are scored on exactly the rubric you've just read.