You will be told, usually by somebody selling you something, that a bug caught after release costs a hundred times more than one caught in design. There is a chart. One, six and a half, fifteen, a hundred.
It is not real.
Somebody pulled the thread. The chart traces to one line in a textbook, and that line cites a source printed in the textbook's own reference list: course notes, from an internal IBM training class, in 1981. Not a study. A handout. The two researchers who published a real version of it added the word often, and said the ratio is closer to five to one on small systems. The largest study anybody has run, one hundred and seventy-one projects, found no consistent effect.
The number this industry repeats most often, about the cost of not checking things, is a thing nobody checked.
You can write eighteen million lines of code, but if you do not test it you cannot deploy it.
Use the real cases instead. They are worse.
Boeing built the 737 MAX with bigger engines mounted further forward than on earlier models, which made the nose want to pitch up. Rather than redesign the aircraft, they added software called MCAS, the Maneuvering Characteristics Augmentation System, to sense when the nose was too high and automatically push it back down.
MCAS took its reading from a single sensor on the outside of the plane. When that one sensor lied, MCAS pushed the nose down. Each time the pilots pulled up, it pushed down again. And it was not in the flight manual, so the pilots did not know it existed.
Lion Air Flight 610. Ethiopian Airlines Flight 302. Three hundred and forty-six people died.
The international review afterward found that the aircraft was certified on revision E of that software while the safety analysis had stopped at revision C, and that no human factors test cases were ever designed for it. Boeing had not classified MCAS as safety-critical, which is the classification that would have forced regulators to look at it hard. By late 2020, the costs Boeing had itself disclosed came to twenty point seven billion dollars.
A trading firm called Knight Capital sent new software to eight servers and a technician copied it to seven. On the eighth, code nobody had used since 2003 woke up, and the part that told it when to stop had been moved years earlier and never retested. It traded for forty-five minutes and lost four hundred and forty million dollars. The system had sent ninety-seven warning emails before the market even opened. Nobody read them.
A sensor, a server, a routine update. Three small things. So why did none of the people responsible see any of it coming?
Every one of them was checked. That is the part nobody expects. The aircraft was certified. The trading code went out through a process. The update was routine, a word that means we have done this before. In each case the checking was real and narrower than the thing it checked, and nothing about a passing check tells you what it did not cover. So the job is not clicking buttons. It is deciding, in advance and in writing, what the list has to include, and being the person willing to stand up and say the list is not finished yet.