The economics of fixing defects early

One of the most durable findings in software engineering is that the cost to fix a defect grows the later it is discovered. A requirements or design flaw caught during design is cheap to correct; the same flaw discovered in production, after it has propagated through code, integrations, and data, is far more expensive.

Barry Boehm's foundational work on software economics established the shape of this curve, and practice has reflected it ever since. The exact multipliers vary by context, but the direction never does: later is costlier.

The cost is not only per-defect; it is systemic. A 2002 study commissioned by NIST estimated that an inadequate infrastructure for software testing cost the US economy on the order of tens of billions of dollars each year, and that a large share of that cost could be avoided by finding and fixing defects earlier in development.

That figure reframes testing and review from an overhead to be minimised into an investment with a measurable return.

'Shift left' is the shorthand for acting on this curve: moving testing, review, and security consideration earlier, toward design and coding, rather than concentrating them in a final phase. The goal is to catch defects when they are cheap.

The deeper point is that quality is designed in, not inspected in. Clear interfaces, automated tests, code review, and security-by-design reduce the number of defects that ever reach the expensive end of the curve. Treating security and correctness as late-stage gates is precisely how the costly defects slip through.