How much do bugs cost to fix during each phase of the SDLC?

Jan 10, 2017 / 3 min read

Table of Contents

For bug fixes, earlier is better (and cheaper)
The cost of fixing bugs in the real world
It’s time to build security into the SDLC

At Black Duck, we often say that it’s important to fix bugs and security issues early in the software development life cycle (SDLC) to save time and money. But how much of a cost difference does it really make to fix bugs during various SDLC phases? Let’s examine this question by highlighting the costs that you can incur when fixing bugs at various stages of the software life cycle.

For bug fixes, earlier is better (and cheaper)

They say prevention is better than a cure, and this definitely holds true when it comes to bugs and security issues. During the development process, it is more cost-effective and efficient to fix bugs in earlier stages rather than later ones. The cost of fixing an issue increases exponentially as the software moves forward in the SDLC.

The Systems Sciences Institute at IBM reported that it cost 6x more to fix a bug found during implementation than to fix one identified during design. Furthermore, according to IBM, the cost to fix bugs found during the testing phase could be 15x more than the cost of fixing those found during design.

Clearly, it’s harder to rectify issues as a product approaches the end of its development life cycle. The earlier bugs are introduced (e.g., during the design phase), the higher their potential impact, and the more complex they can be to resolve. The changes made for a bug fix can also affect the application’s functionality. In turn, developers may need to make further changes to the codebase, adding to the cost, time, and effort. So it’s important to find and fix bugs during the early stages of development.

Consider an example of a bank finding a security flaw after releasing an application used by thousands of customers. If the bank had found the issue earlier in development, there would have been some cost to fix it. But now, the bank will spend exponentially more effort, time, and money to fix it. Additionally, the complexity of implementing changes in a live production environment further increases the overall cost associated with late-stage maintenance.

The cost of fixing bugs in the real world

A real-world example of catching a bug in production is the Samsung Note 7 fiasco. Experts speculate that one of the problems with the Note 7 phones involved its battery management system. This system monitors electric current and stops the charging process when the battery is full. A fault in this system could lead the battery to overcharge, become unstable, and eventually explode.

This bug fix cost Samsung nearly $17 billion. Had the company caught the issue earlier, they could have saved a lot of money and headaches, as well as their reputation.

It’s time to build security into the SDLC

Improving security throughout the SDLC helps you create more reliable software. You can do this by conducting security assessments during all phases of software development.

In a traditional SDLC, security testing takes place at the end–after the required functionalities are in place. But with modern application security testing tools, you can easily integrate security testing throughout the SDLC. You can also conduct security activities and consider risk factors during earlier development phases. That way, you can prevent bugs from causing issues during later SDLC phases and in production.

To reduce the cost of fixing bugs, find them earlier in the SDLC with these security testing practices:

Perform an architecture risk analysis to identify issues during the design phase of software development.
Use an IDE plugin so developers can resolve security issues as they write code.
Conduct a source code review to identify issues within the code.
Add interactive application security testing to your functional tests.
Prior to release, conduct a penetration test to identify issues and make sure that you’ve resolved the issues you previously identified.

Bugs are unavoidable. But the above practices allow you to integrate security into all phases of your software development process. That way, you can reduce and resolve software issues early and avoid costly bug fixes later.