How CIOs can shift from patch and pray to risk-based software change

Let me be clear from the outset: this is not an argument against upgrading. Progress matters. New capabilities matter. Security improvements matter. What’s dangerous is not upgrading, but upgrading by reflex, on someone else’s timeline, in the hope that motion equals safety.

That distinction matters, because recent events have shown what happens when choice, visibility and judgment quietly disappear.

When Airbus grounded A320-family jets over a flight-control fault linked to solar radiation, it looked like a niche aviation issue. It wasn’t. It was a reminder that even industries built on obsessive safety engineering and change control can be exposed by software risk buried inside critical dependencies.

And if that can happen in aviation ...