The Software Efficiency Report | 2026 Week 28

Metric of the week

The Reactive Code Maintenance Burden: 84%

Deep dive

Developer experience is now a retention metric.

Software Efficiency Metric of the Week

The Reactive Code Maintenance Burden: 84%

The biggest blocker to engineering velocity isn’t writing code. It’s fixing it.

My take: Many engineering teams spend more time debugging, resolving legacy dependency issues, and handling production fixes than building new capabilities. The latest data reveals developers spend 84% of their time on non-coding tasks and maintenance, leaving only 16% for building. When a massive part of engineering capacity goes into reactive work, feature delivery naturally slows down.

This is why I feel measuring productivity by lines of code or story points doesn’t tell the full picture. Improving flow, reducing rework rates, and catching issues earlier through better platform standards, unified tools, and observability can have a much bigger impact.

How much of your team’s time goes into building vs. fixing?

More details: Source Source

Reader Poll

Is your team reducing infrastructure complexity?

My take: Multi-cloud Kubernetes was the gold standard for years. But many platform teams are now hitting operational limits. Managing cross-cloud networking, identity, observability and platform overhead is becoming expensive, leading many teams to simplify their infrastructure. Source Source Source

Where is your team today?

A)Consolidating to a single cloud provider

B)Moving smaller workloads away from Kubernetes

C)Standardizing on an Internal Developer Platform (IDP)

D) Doubling down with GitOps, observability & automation

Which direction is your team taking?

Engineering Tip of the Week

Don’t wait for security alerts or emergency upgrades to address outdated dependencies. Define an Automated Dependency Staleness Budget that continuously tracks how far behind your packages are. If a service exceeds a set threshold (for example, one major version behind), reserve a small portion of the next sprint for upgrades. Regular, planned maintenance is usually much less disruptive than large upgrade projects later.

Note : Another tip added after the end of the Deep Dive article.

Technology Ecosystem Trends

Ten Developments/Trends for this week Shaping Modern Engineering Operations

• Companies are increasingly replacing traditional static threshold alerts with machine learning models that analyze live telemetry to detect true operational anomalies and eliminate alert fatigue. Source
• Continuous Validation for Embedded Linux: Hardware-first methodologies are being replaced by continuous validation pipelines to regularly update long-lived embedded environments in the field. Source.
• Telemetry Auditing for AIOps: Organizations are prioritizing comprehensive data readiness audits to feed clean, historical telemetry data into AIOps tools before deploying automation. Further reading is available viaSource.
• Automated Security Remediation: DevSecOps has progressed beyond basic vulnerability detection to leverage artificial intelligence that automatically patches risks directly inside the software delivery pipeline. Further reading is available via Source.
• Driven by a 33.4% surge in spending, Cloud Security Posture Management (CSPM) has become the fastest-growing enterprise defense category, focused on mapping complex, cross-cloud attack vulnerabilities in real time. Source
• Multi-agent orchestration architectures have become the newest operational control plane, allowing distinct, task-specific digital agents to communicate and execute multi-step workflows across split enterprise databases.Source
• Open-Source Compliance Automation: Open Policy Agent is widely used to enforce runtime compliance rules, control software supply chain risks, and verify open-source dependencies directly inside the build pipeline.Source.
• Multi-agent systems (MAS) have quickly emerged as the core design pattern for complex business processes, coordinating independent, highly specialized digital workers that handle long-horizon tasks like incident triage and escalation chains.Source
• Pre-deployment infrastructure-as-code (IaC) scanning has become mandatory to catch misconfigured cloud templates and network vulnerabilities before resources are provisioned. Source
• SLO-Based Error Budget Burn Alerting: Traditional static threshold alerts (e.g., CPU hitting 80%) have been largely phased out by elite SRE teams. They are being replaced by automated SLO tooling that tracks error budget burn rates in real time, alerting engineers only when the consumption pace threatens the monthly availability target.Source

Deep Dive: Developer experience is now a retention metric.

Most engineering leaders are still measuring the wrong thing.

I’ve spent most of my career working with engineering teams on how they build and release software. One thing I’ve noticed is that developers rarely complain about tools first. They talk about everything that gets in the way of getting work done.

A 2026 survey of 1,200 engineers put a number on this. Almost everyone said writing code and building new features is the part of the job they enjoy most. Yet they spend only 16% of their working week doing it.

The rest goes into maintenance, approvals, waiting for reviews, switching priorities and a long list of small tasks that slowly eat into engineering time.

The same survey found that 66% of technology leaders are worried about retaining engineering talent. Those two numbers do not feel unrelated.

When engineers spend most of their week working around the system instead of building software, retention becomes as much an engineering leadership issue as it is a people issue.

Developer experience is not really about tools

When people talk about Developer Experience, the conversation usually starts with better IDEs, internal documentation or AI coding assistants.

Those things help.

But they rarely solve the biggest source of frustration.

Developer experience comes down to one simple question.

How easy is it for engineers to get work done?

Research from DX, based on data from more than 800 engineering organisations, shows that even small improvements in developer experience save measurable engineering time every week. The highest-performing teams outperform the lowest by four to five times.

That isn’t because they hired smarter engineers.

They’ve simply made it easier for engineers to do their jobs.

I’ve seen talented teams struggle because work keeps getting stuck.

Waiting for reviews.    Waiting for approvals.     Waiting for an environment.

Sometimes just waiting for the one engineer who knows how the deployment pipeline actually works.

No tool can solve those problems if the delivery process itself has become too complicated.

What friction actually looks like

Engineering friction rarely arrives as one big problem.

It builds over time.

A new engineer takes three weeks to make their first production deployment because setting up the environment still depends on undocumented knowledge.

A pull request waits two days before someone reviews it because nobody owns the review queue.

A production deployment depends on the same senior engineer because only a handful of people fully understand the pipeline.

None of these feels like a big problem on its own.

Together, they slow delivery and create the kind of frustration that people eventually accept as normal.

Why this affects retention

Engineers rarely leave because of one difficult sprint.

They leave after months of small frustrations that never seem to improve.

The more time they spend waiting, repeating manual work or dealing with unnecessary process, the less time they spend solving interesting problems.

After a while, it’s easier to listen when another opportunity comes along.

Replacing experienced engineers is expensive.

Hiring, onboarding and lost productivity can easily cost one to two times a senior engineer’s annual salary.

Most organisations measure hiring costs carefully.

Far fewer measure the cost of the engineering systems that quietly drive people away in the first place.

Three metrics worth tracking

1. Time to first production deployment

Don’t measure onboarding completion.

Measure how long it takes before a new engineer ships a real production change without asking for help.

If it regularly takes more than a week, the platform probably depends too much on tribal knowledge.

That’s a platform design problem, not a training problem.

2. Time from pull request ready to first review

Don’t focus only on merge time.

Look at the first human response.

If the median is above 24 hours, engineers are waiting more than they are building.

That delay rarely shows up in sprint reports, but engineers feel it every day.

3. Engineers who can deploy to production without assistance

Giving someone deployment access doesn’t mean they’re comfortable using it.

If only two or three people on a twelve-person team can confidently deploy to production, you’ve created a knowledge bottleneck.

That risk grows every time one of those engineers goes on leave, changes teams or decides to move on.

These three numbers will tell you far more about the health of your engineering organisation than another satisfaction survey.

Tip: I have solved some of these with visibility using tool: Grafana and it is still relevant now.

The bigger picture

Most of this friction wasn’t created intentionally.

Teams grew.

Processes expanded.

Temporary workarounds became permanent.

Nobody planned for it to happen.

That’s exactly why it stays around for so long.

The organisations that keep experienced engineers aren’t always the ones paying the highest salaries.

More often, they’re the ones where engineers spend most of their time doing the work they came to do.

The 16% number is the one I keep coming back to.If engineers spend only 16% of their week on the work that made them choose this profession, it is worth asking what fills the other 84%.That’s usually where the biggest opportunities for improvement are.

Engineers notice that gap long before it shows up in a survey.

By the time it appears in engagement scores or retention data, it’s usually been there for months.

Improving the engineering environment is often the fastest way to improve both.

Sources Source Source

Engineering Tip of the Week related to the above article

Treat your delivery pipeline like a production system by adding observability to it. Collect data from Git, CI/CD and deployment pipelines, store it in InfluxDB, and visualize it using Grafana. Tracking metrics like PR wait times, deployment frequency and pipeline blockers makes engineering friction visible. Once teams can see the bottlenecks, they become much easier to improve.

Tools, Resources and Community | Worth Knowing

Open Source Tool

Crossplane is an open-source, CNCF-graduated control plane framework that lets platform teams orchestrate multi-cloud infrastructure using standard Kubernetes custom resources. By abstracting away raw cloud APIs into high-level, developer-friendly declarative objects, it reduces configuration drift and streamlines developer self-service. Source

Commercial Tool

DX is an engineering intelligence platform designed specifically to measure Developer Experience by combining continuous workflow telemetry with qualitative developer sentiment surveys. It provides engineering leaders with clear dashboards mapping out qualitative friction points—such as “Verification Fatigue” and tool-chain lag—alongside standard DORA metrics to isolate structural bottlenecks. Source

Learning and Community

daily.dev is a developer-centric knowledge-sharing platform and community that programmatically curates technical articles, engineering blogs, and open-source updates into a single scannable feed. It acts as a collaborative learning space where developers can discuss industry trends, track tool developments, and filter content by specific engineering sub-disciplines. Source

SRE related resources: Here is a portal with many SRE related resources Source

Worth reading this report: Anthropic Releases 2026 Agentic Coding Trends Report on Software Lifecycle Shifts Source

Technology Ecosystem Weekly News Digest – Top Picks

Cloud and Platform Updates

Amazon Web Services (AWS) : AWS introduced its “Secret Cloud for Industry,” enabling defense contractors to run classified workloads natively in isolated environments. Alongside a $1 billion U.S. Intelligence Community modernization framework, AWS automatically cut its container management fees by up to 60% for accelerated GPU instances (G-series, P-series, and Trainium) on both ECS Managed Instances and EKS Auto Mode. Source

Microsoft Azure : Azure added a query-based data export function to Log Analytics, letting teams run targeted forensic searches and directly pipe historical logs into storage accounts. For multi-cloud operations, Azure Storage Mover now natively connects with Google Cloud Storage (GCS) via an S3-compatible interface, allowing secure, private-network data migrations directly into Azure Blob storage.Source

Google Cloud Platform (GCP) : Google Cloud moved its self-service Private Bucket Access into General Availability, allowing Cloud CDN and external load balancers to securely serve assets via automated service accounts without exposing the backend cloud storage to the public internet. Additionally, GCP introduced explicit IAM rules for Model Context Protocol (MCP) servers, letting platform teams restrict AI agents down to specific permitted tool attributes. Source

Companies are swapping out rigid, multi-million dollar SaaS contracts for custom internal tools built with AI. For example, pharma giant Sanofi cut its ServiceNow usage by 80 percent using agents built with Claude Code and Cursor, targeting 10 million dollars in savings. Gartner estimates this trend, called agentic arbitrage, will threaten 20 percent or 234 billion dollars of all enterprise SaaS spending by 2030.Source

Here is a portal to get other cloud news: Source

Open-Source and Linux Ecosystem Updates

OpenNebula and Waldur merged their cloud management and marketplace platforms. The project links European high performance computing centers and AI gigafactories into a unified marketplace, allowing organizations to scale AI workloads across multiple sites while keeping data strictly local.Source

IBM and Red Hat released new commercial upgrades to their Lightwell software platform. The integration gives enterprise build systems an automated path to pull signed, pre-patched open source software dependencies directly into their development loops to reduce manual security backlogs.Source

The stable Linux 7.1 kernel rolled out, featuring a completely rewritten, native NTFS storage driver that replaces outdated code with a modern layout. It brings built-in, high-performance read and write support for Windows-formatted drives, while dropping massive amounts of legacy hardware code to reduce system bloat This new is from June, sharing it as it is important. Source

Anthropic significantly expanded its access program for open-source developers. The company is granting six months of free Claude Max access to project maintainers and core contributors, intentionally lowering the previous “5,000 GitHub stars” requirement to support developers maintaining lower-profile packages that the broader software ecosystem quietly relies on.Source

DevOps, Platform Engineering and SRE

Perforce Software published its State of DevOps Report, revealing that 73% of mature platform engineering teams credit their structured internal platforms for successfully scaling AI. The study notes that standardizing infrastructure workflows is vital for managing AI-driven code deployments safely without sacrificing governance. Source Source

The Cloud Native Computing Foundation detailed a major structural shift toward “Platform Engineering 2.0” to support AI-driven coding assistants and autonomous agents that are currently choking legacy human-paced pipelines. The new blueprint integrates real-time cost attribution, pre-deployment cost gates, and automated infrastructure provisioning straight into the software runtime.Source

Researchers found that an attacker can rewrite a signed Git commit’s cryptographic hash without breaking its verified signature status. Even without the original signing key, a hacker can duplicate the commit data, and GitHub will still display a false “Verified” badge, exposing code review pipelines to manipulation.Source

A few Other portals to get DevOps news Source Source Source

Security and DevSecOps

Security researchers at runZero disclosed seven vulnerabilities in FatFs, a critical open-source file system library utilized across millions of embedded platforms including Espressif ESP-IDF, STM32Cube, and Zephyr RTOS. The flaws allow malformed storage data or faulty firmware updates to cause memory corruption and arbitrary code execution, requiring downstream hardware vendors to immediately patch their custom software lifecycles.Source

Accenture confirmed a security breach after a hacker offered 35GB of stolen internal data for sale online. The leaked cache allegedly contains proprietary source code, cryptographic keys, and active Azure Personal Access Tokens. Accenture stated the issue is remediated with no operational impact, but it highlights the vital importance of pipeline secrets management.Source

Sophos study found that AI assistants like Claude Code and Cursor routinely trip endpoint security rules because they scan local environments and inspect system credentials. This behavior mimics a live intrusion, forcing teams to redefine how they monitor developer workspaces.Source

Security researchers at Synacktiv uncovered an unpatched security vulnerability inside the Argo CD deployment engine. Because Argo CD is widely used to manage GitOps infrastructure pipelines, a threat actor targeting these exposed dashboards can manipulate active synchronization rules to gain complete administrative access over connected production Kubernetes clusters.Source

Latest Security news: Source

AI/ML & Agentic AI Updates

The UN’s first Global Dialogue on AI Governance shows that AI governance is becoming a global engineering priority, not just a policy discussion. With the EU AI Act also moving through phased implementation, engineering teams will increasingly need to build AI systems that balance innovation with security, compliance and trust from the start..Source

Cloudflare announced a new research pilot alongside OpenAI designed to optimize web crawling and indexing for AI systems. By leveraging Cloudflare’s global real-time network telemetry, traffic insights, and content freshness indicators, the project aims to improve the accuracy and processing efficiency of live web data ingestion.Source

NVIDIA & Hugging Face Partner on Robotics: Announced in early July 2026, the two companies are expanding their collaboration to bring a suite of new open-source AI models and frameworks directly to Hugging Face LeRobot, significantly boosting the open robotics developer community. Source

Three portals to get latest AI news : Source Source Source

Embedded Systems and IoT

Peridio released Avocado OS 1.0, an operating system built specifically to help developers easily manage AI on physical devices and robotics fleets. It features a built-in Model Context Protocol server that lets AI agents handle setup and package management natively using natural language. The system also automates critical security steps right out of the box, including secure OTA updates, automatic SBOM creation, and hardware encryption.Source

Global enterprise deployments are rapidly standardizing on a new hybrid architecture that blends localized LoRaWAN sensor networks with satellite backhauls to map rural environmental metrics. This framework allows platform infrastructure teams to track massive field machinery arrays and water-resource telemetry in deep dead zones without deploying complex local cellular towers or high-maintenance physical routing points.Source

High-performance compute vendor IBASE unveiled its newest rugged computing platform designed to process heavy sensor telemetry directly inside industrial vehicle fleets and distributed IoT installations. Built to withstand volatile environmental conditions, the platform aims to minimize cloud dependence by providing massive on-device data filtering pipelines before any info is transmitted over expensive telecom channels.Source