No not security patches. Upgrades. Like ‘oh the newest best version of React was released yesterday and I’ve just GOT to have those and management doesn’t understand how productive I’ll be and they shorted us on our last upgrade by not letting us go all in’
This endless treadmill of half baked framework features and ui refreshes streaming in the root problem.
I really think a team that can close the gate and seal the seams from the problem would be the most effective.
That would mean your most important KPIs would be something like:
* number of new features imported from frameworks (close to zero is ideal). These are expensive, like millions of dollars each.
* number of security patches applied/response time/etc (maximize these)
* eliminate things with no or short LTS, measure weighted lts: (LOC using framework multiplied by framework LTS)
Now this in and out itself isn’t sufficient to measure an organization’s productivity, but these would would keep it on the straight and narrow so other measures would become effective.