Methodology

The Agentic Readiness Framework (ARF) scores how prepared an organisation is to deploy autonomous AI agents safely and effectively. Unlike survey-based reports, every ARF score is reproducible from the organisation's public domain plus opt-in code analysis - no self-report, no marketing claims.

ARF is composed of 18 dimensions grouped into 6 pillars (Foundation, Data, Operations, Security, Governance, Discoverability). The /framework page labels the Foundation pillar Infrastructure; the two names denote the same dimension set (D1, D2, D3, D12). Each dimension is graded on the L0–L3 maturity scale over the checks the scanner could evidence in this run, drawn from a 258-check framework. Dimension scores are aggregated to an overall 0–100 ARF score as a dimension-weighted mean (engine_v5.py compute_overall, DIMENSION_WEIGHTS). There are no pillar weights in the scorer - pillars are a presentation grouping. The dimension weights are author-derived working values - a permanent disclosure, not a placeholder for a pending derivation. A published Monte Carlo sensitivity analysis (docs/weights/SENSITIVITY_2026_4.md; +/-30% and Dirichlet reweighting over the served cohort) bounds their influence: mean rank correlation with the published ordering stays above 0.98 and average score movement is about one point, though exact ordinal positions near the top of the table do swap under reweighting. Weights are public in scoring/weights.py.

Two scales, one that scores. Every check carries a 4-level maturity definition (L0–L3) and a parallel, finer-grained Agentic Readiness Level scale (ARL 0–9). The L0–L3 definitions in scoring/framework.py are the rubric of record: they are what produces the published score, and a scoring dispute is adjudicated against them. ARL 0–9 is a descriptive scale used for display and by the LLM judge; it never scores directly. Wherever an ARL stage is surfaced, it has already been collapsed into an L0–L3 level before it reaches the number on the page (engine_v5._derive_maturity_from_arl_stage). The collapse thresholds and the L0–L3 encoding values live in that module and scoring/framework.py; this page deliberately does not restate them so a copied figure cannot go stale. A finer 0–9 encoding path exists in the engine but is off by default, and enabling it moves the scoring version and restates published scores — it never changes a number silently.

Tier thresholds (Initial 0-25 / Emerging 26-45 / Production-Ready 46-65 / Advanced 66-85 / Agent-Native 86+) are constant across editions to enable year-over-year comparison.

Measurement ceiling. This edition is a Tier-1/Tier-2 assessment: the public surface of the domain plus opt-in code analysis. 41 of the framework's 258 checks require an interview or privileged access and are never evidenced here; external-only reach is roughly 75-122 checks per organisation. Cloud scanning is AWS-only and code scanning is GitHub-only, so organisations on GCP, Azure or GitLab are systematically under-observed. Two dimensions - D16 (human-agent collaboration) and D18 (threat defence) - have almost no external reach. WAF-hardened origins are passively unobservable and are labelled, not penalised. The consequence: the Agent-Native band (86+) cannot be produced by this method at all, and every 0 in this report means no detectable public evidence, not a verified absence.

The — organisations were drawn from a benchmark seed of widely-used software companies and infrastructure providers. Industries are tagged from publicly-stated business categories and canonicalised by Jackfruit (e.g., the raw labels "AI/ML" and "AI & Machine Learning" are collapsed to "AI & ML").

Known cohort skews: developer-facing software companies are over-represented; large-enterprise IT, healthcare payers, government, and non-software industries (energy, manufacturing, retail HQs) remain under-represented in this edition. Industries with fewer than 10 organisations are dropped from headline charts.

Each dimension's score is computed only over the checks for which the scanner gathered evidence in this scan run. To prevent thin-evidence scores from polluting industry means we apply coverage gates:

• Not evidenced - no observation for a check. It is excluded from its dimension's denominator, not scored 0.
• A dimension is left unscored (Insufficient data) when coverage < 25% of its checks, OR fewer than 3 checks were attempted, OR fewer than 2 carried effective evidence, OR the grounded-evidence share gate trips (engine_v5.py DIM_COVERAGE_MIN=0.25, DIM_MIN_ASSESSED_CHECKS=3, DIM_MIN_EFFECTIVE_ASSESSED=2).
• 25-40% observed - scored and flagged preliminary (DIM_COVERAGE_PRELIMINARY=0.40).
• An overall score is withheld below 6 scored dimensions or 3 pillars (MIN_DIMS_FOR_OVERALL=6, MIN_PILLARS_FOR_OVERALL=3). Between 4 dimensions / 2 pillars and that floor, the score IS published, carries a Limited Coverage badge, and IS counted in aggregates - we disclose thin coverage rather than hide it. Only a small number of scored organisations carry that badge; they are counted in the aggregates rather than dropped - we disclose thin coverage rather than remove it from the mean.

Confidence is bucketed (high=1.0 / med=0.7 / low=0.4) per check observation. Multiple corroborating sources for the same check do not stack - the strongest single observation determines confidence - to avoid signal-count bias.

• Means are reported with 95% bootstrap confidence intervals where space allows; the Score difference by compliance signal figures cite explicit CIs.
• Correlations are computed Pearson and displayed only when n ≥ 10 common observations; cells below that are rendered neutral, not as no relationship.
• Industry rankings are reported alongside their outlier-removed equivalent (top + bottom org dropped) so readers can see which rankings are headline-driven by 1-2 standouts.
• Cluster archetypes are derived via k-means (k=5, n_init=10, random_state=42) on the standardised 11-dimension feature vector; clusters are auto-named by their z-profile shape so names stay stable across rescores.
• Simpson's-paradox sweep requires a corpus correlation with n ≥ 50 and an industry-level correlation with n ≥ 25 before flagging a sign-flip or magnitude swing.

• Not a survey. No self-report. No questionnaire bias.
• Not a complete view of an organisation's posture - internal capabilities not visible from public surface (or opt-in code analysis) are not graded.
• Not a year-over-year comparison yet - Edition 1 establishes the baseline. The 2027 edition will publish trajectory.
• Not an exhaustive industry sample - see Cohort composition for known skews.

Jackfruit. (2026). State of Agent-Readiness 2026 - current edition. Agentic Readiness Framework (ARF) v1.8. Scan run —, n=—. Retrieved from getjackfruit.ai/state-of-agent-readiness-2026.

Organisations can submit themselves for inclusion in the next edition's cohort or upgrade their assessment to Tier 2 (code analysis) or Tier 3 (privileged scan) for a richer profile. Get started.

Framework definitions, scoring code, and weights are public:

• scoring/framework.py - dimensions, checks, L0-L3 level descriptions
• scoring/weights.py - pillar weights, risk multipliers
• scoring/engine_v5.py - production scoring engine; its SCORING_VERSION constant is the source of truth for the engine version
• api/insights.py - every analysis on the report page

Version map. Public report edition: ARF v1.8 (ARF_PUBLIC_VERSION). Framework definitions: FRAMEWORK_VERSION 5.0.0 (framework.py). Production scoring engine: the file is named engine_v5.py for historical reasons and the module name does not track the engine version. We deliberately do not restate the engine version number on this page, because it moves every edition and a restated number goes stale silently: read it from SCORING_VERSION in that file, or from the scoring_version stamp that every published score carries.