Vulnerability Metrics Are an Operations Discipline
Vulnerability density, severity-tiered remediation clocks and hotspot review coverage - running the findings backlog as an operational queue with owners and deadlines, not an annual scare.
Archive
Every article
Newest first, grouped by year. Search or filter by topic.
- 556 articles
All
.NET
AI Engineering
Architecture
Azure & DevOps
Data Warehousing
Engineering Practice
Microservices
Web APIs
The Files That Keep Changing
Code churn, defect density and hotspot scoring - reading a repository's git history to find the files most likely to break next, and the thresholds I use to decide when movement has become rework.
Coverage Is Not Testing
Line, branch and condition coverage each assert less than you think - mutation testing is the honesty check that reveals whether your suite would actually notice a bug, and the thresholds worth enforcing are conventions, not laws.
Coupling, Cohesion and the Main Sequence
Measuring the lines between the boxes - afferent and efferent coupling, the instability ratio, Robert C. Martin's main sequence, and the cohesion metric that catches a class doing two jobs, plus where every one of them needs a human to overrule it.
The Maintainability Index and the Debt Ratio
The composite score that hides more than it shows and the percentage that translates code quality into money - where the maintainability index formula came from, why its logarithms flatten real problems, and how the technical debt ratio earns its place as a trend.
Cyclomatic Counts Paths, Cognitive Counts Pain
Two complexity metrics that look interchangeable and answer different questions - McCabe's 1976 path count is a testing instrument, SonarSource's cognitive score is a readability instrument, and only one of them earns a place in the merge gate.
When a Measure Becomes a Target
Dashboards go green while codebases rot - the opener of a fourteen-part series on measuring code quality and software delivery without staging the theatre that ruins both.
What a Scorecard Cannot See
The honest retrospective on two weighted competency frameworks - the blank templates at their centre, the qualities no weight can hold, the situations where a weighted model is the wrong tool, and what I would build differently.
Weighted Planning and the 90-Day Loop
How the framework becomes a form and the form becomes a plan - per-sub-discipline ratings with evidence, a 500-point ceiling, a gap-times-weight priority formula and a 90-day goal loop, walked through with a worked example.
The Supporting Disciplines
The four disciplines that operate across my AI competency stack rather than inside it - agent architecture, evaluation, governance and domain translation - and why 37 of the framework's 100 points live outside the core.
Why Specification Weighs 22 and Prompt Craft 8
The four core disciplines of my AI engineering framework and the argument behind their weights - why the prompt sits at the bottom of the stack at 8 points, why the specification sits at the apex at 22, and the sentence in my own document that its own table contradicts.
Seven Disciplines Become Eight
The transformation map between my two frameworks - what each of the seven traditional disciplines became among the AI-era eight, what split, what transferred with its weight intact, what dissolved into sub-disciplines, and the fifth learning-stack discipline that is deliberately not on the list.
Your Self-Assessment Is Lying to You
Two research results explain why self-ratings drift - METR's randomised trial of AI-assisted developers and Kruger and Dunning's calibration studies - plus the evidence fields, peer calibration notes and built-in warnings my templates use to correct for both.
Five Levels and Observable Evidence
Novice to Architect - the five-level ladder both of my frameworks share, why every cell of it demands evidence you can point at rather than a feeling about ability, and the Level 0 my own summary tables invented by mistake.
Leading Without the Title
Leadership weighs 15 in my competency framework and not one point of it requires authority - decision making, alignment, mentoring, process thinking and facilitation as evidenced skills, plus the two quiet disciplines that complete the model.
The Human Disciplines — Feedback and Collaboration
Feedback weighs 13 and Collaboration weighs 12 - together they match Engineering Craft point for point, and this part defends that arithmetic sub-discipline by sub-discipline, from effective communication to handling disagreement.
Delivery Is a Discipline, Not a Date
Delivery carries 18 points in the framework and none of them is a deadline - incremental value, work breakdown, prioritisation and ambiguity as four trainable skills that turn engineering capability into shipped outcomes.
Engineering Craft and Its Nine Sub-Disciplines
Engineering Craft carries 25 of the framework's 100 points and splits into nine sub-disciplines - why writing code earns only 18 of them, why architecture is the most leveraged skill in the model, and why reading code overtakes writing it by the time seniority arrives.
Why Weight a Competency Model at All
Most competency models fail the same way - everything matters equally, so nothing does. The case for a two-level weighting system, and a first look at the two mirrored frameworks this series unpacks.
An Honest Ledger for a Borrowed Skeleton
The series retrospective - what was borrowed and from whom, what my extensions add and what they cost, the gap between the workflow as described and the runs I can actually evidence, and what I would do differently.
PREVC Against the Methodologies
Where a five-phase agent workflow actually sits against PDCA, Scrum, waterfall, spec-driven development and the V-Model - one mapping table and five honest comparisons, because a workflow that cannot name its ancestors is hiding something.
Confirmation Closes the Circle
PREVC's fifth phase is the one most cycles skip - a structured retrospective that turns observations into harness changes, and release documentation that writes the next cycle's requirements before it starts.
Every Requirement Gets a Receipt
Validation traces every requirement to its implementation and every implementation back to a requirement - gap analysis, the traceability matrix, holdout scenarios the agent never sees, and the two feedback arrows that make the phase more than an audit.
The Mistakes That Compile
The scariest agent mistake is not the invented method that errors on first run - it is the polished code that passes. Simon Willison's argument about hallucinations, and the four failure patterns I review for.
Four Ways Out of an Infinite Loop
The Code-Review-Simplify loop has no natural end - an agent will polish forever if you let it. The four breakout constraints I arm around the loop, and how I match the exit to the risk of the work package.