Engineering Practitioner Brief / 18 May 2026

CAST Highlight Technical Debt Index

CAST Highlight is the dominant enterprise-portfolio tech-debt analysis tool. It is the source of many of the dollar figures that show up in industry reports and McKinsey decks, and the CRASH benchmark is one of the only large-N datasets of code-quality measurements in public circulation. This page explains how the tool calculates its numbers, how to read its output, and where its limits are.

What CAST Highlight Does

Highlight scans source code on a periodic schedule (commonly monthly for the largest enterprise deployments) and produces two main outputs. The first is a per-application scorecard across six axes: Software Health, Software Resiliency, Software Agility, Software Elegance, Open Source Safety, and Cloud Readiness. Each axis is scored on a 0 to 4 scale. The scores roll up to an overall application score.

The second output is a portfolio-level view: all applications sorted by overall score, with modernization-candidate flags, estimated remediation effort, and the dollar figure for the aggregated tech debt. Executives see the portfolio view; engineering managers see the per-application drill-downs.

The Six Scoring Axes

• Software Health. Aggregate code-quality measure based on the underlying rule violations: complexity, duplication, documentation, structural patterns. The axis most directly comparable to SonarQube's technical-debt ratio.
• Software Resiliency. Patterns that predict failure tolerance: exception handling, retry logic, transactional boundaries.
• Software Agility. Patterns that predict ease of change: coupling, cohesion, modularity, dependency-injection presence.
• Software Elegance. Patterns related to clarity and consistency: naming conventions, code organization, idiomatic-language usage.
• Open Source Safety. The software composition analysis (SCA) axis: outdated dependencies, known CVEs, license compatibility. The strongest axis in Highlight relative to SonarQube and Code Climate, which historically did SCA less thoroughly.
• Cloud Readiness. Heuristics for whether an application is ready to run in cloud environments: hardcoded paths, file-system assumptions, stateful sessions, container-friendly logging.

The six axes combine into the overall Highlight score and the dollar-denominated technical debt estimate. The same SQALE-style remediation-time accumulation underlies the dollar figure; the methodology is documented in the CAST whitepapers shipped with the tool.

The CRASH Benchmark

CRASH (CAST Research on Application Software Health) is a benchmark dataset CAST publishes periodically based on the codebases it has scanned. The CRASH reports cover thousands of applications across industries and languages, with distributions for the various health metrics. Highlight uses the CRASH dataset to position individual applications relative to peer benchmarks (top quartile, median, bottom quartile) per industry.

The peer benchmark is one of CAST's strongest differentiators. SonarQube and Code Climate produce codebase-internal numbers but do not have a comparable peer dataset to position the codebase against. For executive reporting ("we are in the bottom quartile of our industry for software resiliency") the CRASH dataset adds context that internal numbers alone do not provide.

The CRASH reports themselves are available from CAST as published industry research. They are a useful general reference for technical debt patterns at the application level, separate from any active relationship with CAST as a vendor.

How a Highlight Report Reads

A typical Highlight report for a single application includes:

1. An executive summary with the six axis scores and the overall position relative to industry peers.
2. A technical debt dollar figure: total estimated remediation effort multiplied by a configurable hourly cost, with a typical range of $10K to several million dollars per application depending on size and debt level.
3. A tactical recommendations list, ranked by impact on the score and estimated effort. The recommendations are usually phrased as "remove deprecated framework usage", "upgrade X library to current major", "reduce coupling between A and B".
4. An open-source composition section listing outdated dependencies and known CVEs, with risk-scoring.
5. A cloud-readiness section flagging the specific patterns blocking cloud migration if applicable.

For portfolio-level reporting, the same per-application data rolls into a portfolio dashboard that ranks applications by debt index, flags modernization candidates, and shows trends over time.

Where Highlight Fits in the Toolchain

CAST Highlight occupies a specific niche: enterprise portfolio analysis for executive audiences, often ahead of a modernization decision. It is rarely the only tool in an organization that uses it; the typical configuration is Highlight for the portfolio view plus a developer-facing tool (SonarQube or Code Climate) for day-to-day code-quality work.

The pairing makes sense because the audiences are different. Executives want a chart that ranks applications by debt index and shows trends. Engineers want a tool that integrates with their PR workflow and tells them what to fix in the file they have open. Trying to use one tool for both audiences usually fails because the UX optimisations are different.

CAST also sells the deeper CAST Imaging product for full-architecture analysis. Imaging looks beyond per-application code quality to the architectural structure of an application, mapping flows across components and identifying structural debt that Highlight alone misses. Imaging is typically used in the diagnostic phase of a major modernization project rather than as ongoing portfolio monitoring.

Caveats on the Dollar Figure

The same caveats that apply to all SQALE-derived dollar figures apply to Highlight. The underlying remediation-cost-per-rule numbers are estimates, not measurements. The cost-per-line of code in the denominator is configurable. Architectural debt is partially out of scope. The dollar figure is best read as "an order-of-magnitude estimate, useful for relative comparison and trend tracking, not for external benchmarking or precise budgeting."

For comparative reference: a typical mid-sized enterprise application (200K to 500K LOC) shows a Highlight technical debt estimate of $100K to $1M. A large legacy application (1M to 5M LOC) shows $500K to $10M. The CRASH benchmark distributions show wide ranges within each band, with industry and age both being significant factors.

The most useful comparison number from a Highlight report is usually not the absolute dollar figure but the per-axis score relative to the CRASH industry peer benchmark. "Below industry median on Software Resiliency" is actionable; "estimated $750K of technical debt" is harder to act on because the figure depends on too many configurations.

Related Reading

• SQALE method cost
• SonarQube technical debt ratio
• Code Climate maintainability score
• Building the business case for tech debt work
• Technical debt statistics 2026

Frequently Asked Questions