top of page


A personal blog addressing software quality across all aspects of software development, testing, design, and people.
Search


Managing Open Source and Dependency Risk
Modern software development rarely starts from a blank page. Instead, applications are assembled from a vast ecosystem of frameworks, libraries, and open-source components that accelerate development and enable teams to build complex systems quickly. In many cases, the majority of an application’s functionality comes not from code written internally, but from external dependencies - and lately, AI. This shift has dramatically improved developer productivity, but it has also i
Craig Risi
May 224 min read


DevSecOps: Embedding Security into the Delivery Pipeline
Modern software delivery has transformed how quickly organizations can build and release software. Continuous integration and continuous delivery pipelines enable teams to deploy updates frequently, respond rapidly to customer needs, and iterate faster than ever before. However, this speed can expose a major weakness in traditional security models. Historically, security checks were performed as a final gate before release. Security specialists would review code, run vulnerab
Craig Risi
May 84 min read


Measuring AI Usage and Safety in the Software Development Lifecycle
We’ve explored a range of approaches to measuring software delivery and ensuring teams build effectively in my recent posts. From well-established engineering and testing practices to modern delivery metrics. The metrics we’ll explore today, however, are far newer, emerging in response to the rapidly evolving role of AI in the software development lifecycle. As AI becomes embedded in the software development process, from code generation to testing and documentation, engineer
Craig Risi
Apr 104 min read


Predictability and Planning Metrics: Measuring Confidence in Your Delivery Commitments
In my recent posts, we’ve looked at several ways of using metrics to help understand the delivery of teams across different aspects. Looking retrospectively is a great way of identifying ways to improve – but you also want to use your data to help you be more proactive and identify ways to better plan and predict the outcomes of your different delivery efforts. In software delivery, speed and quality mean little if outcomes are unpredictable. Leaders and stakeholders need to
Craig Risi
Mar 135 min read


Quality and Stability Metrics: Measuring What Keeps Your Software Standing
In my previous blog post , I spoke about the importance of measuring flow metrics and how they can unlock blockers in your development practices and help you deliver more quickly. However, while speed and flow get software into production, its quality and stability determine whether it stays there . High-performing engineering teams don’t optimise for velocity alone; they balance it with reliability, resilience, and customer trust. Quality and stability metrics reveal how sa
Craig Risi
Feb 205 min read


Turning Tool Data into Engineering Insight
I started writing in my previous blog post about the importance of metrics and how they provide detailed insight into the development life cycle and identify key areas for improvement in software delivery for teams. Before delving into the different metrics themselves, though, it’s important to look at how we actually gather the data in the first place. After all, there is no way we can gain insight into our delivery if we don’t have access to the data that provides it. How
Craig Risi
Jan 236 min read


Measuring Software Delivery: You are what you measure
The software world may be looking to always deliver innovation and new features faster. However, delivery speed alone is no longer a meaningful indicator of success. Teams are expected to deliver quickly and safely, sustainably, and predictably. Doing so though is a big challenge for many teams and the key to this improvement is understanding your software well and knowing what is going in in your software delivery process very well. This is where metrics play a critical rol
Craig Risi
Jan 94 min read


Learning the Art of Prompt Engineering
As the industry continues to rapidly adopt Large Language Models (LLMs) to power chatbots, copilots, search, automation, and decision support, one discipline has emerged as a critical success factor: prompt engineering. While LLMs are incredibly powerful, their outputs are highly sensitive to how they are instructed. The difference between a vague, unreliable response and a precise, trustworthy one often comes down to the quality of the prompt. Soemtihng which is a completely
Craig Risi
Dec 12, 20255 min read


The Testing Impact of Architecture in LLM-Powered Applications
In my previous post , we explored the big changes required in architecture to make LLMs successful. As those who are familiar with me will know that quality and testing are vital aspects of software architecture to me. So, I feel like I wouldn’t be able to explore the topic of software architecture without aspects of testing and quality. Testing and QA Must Be Built Into Architecture In classical software engineering – at least at a fundamental code level - testing often tend
Craig Risi
Nov 28, 20257 min read


Measuring and Enabling Change Communication: From Insights to Impact
I’ve spent the past two blog posts talking about the importance of change communication , particularly the transparency required to...
Craig Risi
Sep 19, 20255 min read


Communicating Change: Cadence, Transparency, and Engagement Matter
In my previous blog post I spoke about change management and why communication is the most important part of managing change. Change in...
Craig Risi
Sep 5, 20254 min read


The Communication of Change
Why Change Communication Matters More Than Ever I’m going to change tack a little and move away from some of my technical articles and...
Craig Risi
Aug 22, 20255 min read


Identity-Centric Security
In my previous post, I started to look at modernizing security, starting with software architecture. However, when looking at secure...
Craig Risi
Jun 21, 20254 min read


Green IT in Testing and Quality Engineering: Driving Sustainability Through Smart Quality Practices
In my previous blog post , I explored the concept of Green IT through the lens of development practices, highlighting the importance of...
Craig Risi
May 2, 20256 min read


Going Green: Building Sustainable Software Modernization Practices
As organizations modernize their software systems, there's an increasing responsibility to do so sustainably. Green IT emphasizes the...
Craig Risi
Apr 17, 20255 min read


The Journey to Modernization – Part 4 – Final steps of technical modernization preparation for your legacy application
In my last post, I started looking at the technical steps for preparation of technical modernization. It was a lot to cover, so I split...
Craig Risi
Dec 20, 202412 min read


The Journey to Modernization – Part 3 – Preparing a legacy application for technical modernization
In this series, we’ve looked at what to look at when approaching modernization and the importance of approaching modernization from a...
Craig Risi
Dec 14, 20249 min read


The Journey to Modernization – Part 2– Why you should embrace continuous modernization
This is the second of a multi-part blog series on modernization. In the first post, I discussed what needs to be modernized and the...
Craig Risi
Dec 6, 20248 min read


Is domain knowledge important for software engineers?
When it comes to performing technical work—such as designing, building, and testing software—the primary focus should generally be on an...
Craig Risi
Nov 1, 20249 min read


Integrating User Stories and Requirements
I’ve spent the last two blog posts (here and here) focusing on the importance of requirements in software delivery. Something very...
Craig Risi
Jul 19, 20248 min read
bottom of page