Elephant factor is the smallest number of companies whose employees account for a set share, usually 50 percent, of a project's commits. A low number means work is spread across many organizations. A high number means a few companies carry the project, which creates risk if they step back.
Definition and the naming trap
CHAOSS, the community that defines open source health metrics, describes the metric as a view of how work is distributed across companies. The wording trips people up. A high elephant factor is the riskier result, because it means the project depends on only a few corporate contributors. A low one points to a more distributed base.
Compare it with the contributor absence factor, which counts people rather than companies. The two answer different questions:
| Metric | Counts | Risk it points to |
|---|---|---|
| Contributor absence factor (bus factor) | People | A few individuals leave |
| Elephant factor | Companies | A few employers change priorities |
A project can look healthy on one and weak on the other. Fifty developers from one employer give a decent head count but a fragile funding story.
A worked example
CHAOSS uses eight organizations with these commit counts: 1000, 202, 90, 33, 332, 343, 42 and 433, a total of 2,475. Half is 1,237.5. The top two organizations (1,000 and 433) add to 1,433, so the elephant factor is 2.
To run your own, you need commit authorship mapped to an employer, which usually means email domains or a contributor database. That mapping is imperfect. Personal email addresses hide employers, and people change jobs.
How to use it when choosing a dependency
- Pick a time window. CHAOSS warns that a lifetime figure may misrepresent present diversity, so use the last 12 months.
- Include every repository in the project if it has several.
- Treat the result as one input. The right threshold depends on size: a project with 1,000 contributing organizations needs different expectations than one with about 10.
- If the number is high, ask what the sponsor's commitment looks like and whether the license and governance would let a community continue the work.
- Write down a fallback: fork, vendor or replace.
A related Scorecard check, Contributors, looks at whether recent contributors come from multiple organizations. It is rated low risk on its own, which fits the idea that this is a signal for planning rather than a gate.
What it cannot tell you
It says nothing about code quality, vulnerability handling or release practice. A company-backed project may have strong security practices and funding. A volunteer project with a low elephant factor may be neglected. Use the metric to understand continuity, then check the rest with the signals in maintainer health signals before adopting a dependency.
Quick check
Is a high elephant factor good or bad?
Bad for resilience. It means a small number of companies produce half of the commits, so a change of strategy at one of them could stall the project.
How is it different from bus factor?
Bus factor counts individual people. Elephant factor counts the companies those people work for.
Safeguard's SBOM and dependency scanning lists the open source components you rely on, so you know which projects deserve this kind of review. A free scan shows your own list.
Sources
Last reviewed: 19 October 2026.
