The Copilot StackTechnical Academy

Assessments

Team Readiness Assessment

Designed so it can tell you not yet. Four blocking questions stop the score from mattering; the rest name the weakest area and the free lessons that address it.

Half an hour with one person from engineering leadership, one from security and one engineer who will use the tool. Score each as a group. Nothing here is saved or sent — take a screenshot of the result if you want it.

Part 0 — Blocking questions

Any "No" here caps the result at early stage, whatever the score below.

B1 Do we know which repositories contain code we are contractually or legally forbidden to send to a third-party service?

Content exclusion is configured per repository and is not retroactive. Decide before the pilot which repositories are excluded; deciding after means the exclusion was not in force while they were open.

B2 Does someone own the answer to "was this code AI-assisted?" for audit or customer-assurance purposes?

The question will be asked by a customer or an auditor. An owner who can answer it is a precondition, not a nice-to-have.

B3 Do we have a named owner for the Copilot configuration — organisation settings, policies, content exclusion — who is not "whoever set it up"?

Policies drift when nobody owns them. Name the owner before the first seat is provisioned.

B4 If a developer pastes a secret into a chat prompt today, do we have a process that would catch it?

Secret handling is the failure that happens in week one. A detection or a rotation process has to exist before the tool does.

Engineering practice

E1 Do most repositories have a test suite that runs in CI and gates merges?

E2 Is code review required before merge on the repositories in scope?

E3 Do we have a linter and formatter enforced in CI rather than by convention?

E4 Would a reviewer today notice a plausible-looking change that is subtly wrong?

Security posture

S1 Do we scan for committed secrets, and does the scan block rather than warn?

S2 Do we run dependency vulnerability scanning on the repositories in scope?

S3 Is there a defined process for reviewing a new third-party tool integration?

S4 Does anyone review what an agent is permitted to do before it is permitted to do it?

Organisational readiness

O1 Is there an executive sponsor who will still be sponsoring this in six months?

O2 Have we agreed what success looks like, in a sentence, before starting?

O3 Do we have a channel where developers will actually say it is not working?

O4 Can we afford the licences at full team size, not just for the pilot?

Data and compliance

D1 Do we know which plan tier's data-handling terms we need?

D2 Has legal or compliance seen the terms for the tier we intend to buy?

D3 Do we know what is logged, by whom, and for how long?

Answer every question first — to go.

Stage

By area

What to do with this

Start with the lessons above — they are free and they are the whole of what is needed at this stage. Documents and templates do not help until the practices exist.

The documents a rollout needs from here — policies, a pilot plan with decision criteria, a security checklist, a 30/60/90 plan and a measurement framework — are what the Enterprise Deployment Toolkit contains ($149; preview four of them first). If you would rather have the readiness and governance reviews done with you, Team Rollout starts at $999 and includes the Toolkit.

Keep a dated copy of your answers. When somebody asks in nine months why adoption stalled, the answer is usually in them.