Category: Startup

The Truth About “Ghost Engineers”: A Critical Analysis

The Truth About “Ghost Engineers”: A Critical Analysis

By | | Comments 0 Comment

Disclaimer:
This article is not intended to discredit Boris Denisov, Stanford University, McKinsey, or any other entities referenced herein. I hold immense respect for their contributions to research and industry discourse. While findings like these may resonate with practices in FAANG companies, large organizations, and mature startups, this critique seeks to explore the broader implications of relying on narrow metrics to evaluate productivity in software engineering.

The “Ghost Engineer” Narrative

The term “ghost engineers,” popularized by a recent Stanford study, describes software engineers who allegedly contribute minimally to codebases. Analyzing data from over 50,000 engineers, the study concludes that 9.5% of engineers fall into this category, with the prevalence rising to 14% among remote workers​.

While the findings spark interesting discussions, they rely heavily on the flawed assumption that code commit frequency equates to productivity. As I argued in No, McKinsey, You Got It All Wrong About Developer Productivity, this narrow perspective risks undervaluing critical aspects of software engineering that don’t leave a visible footprint in version control systems​​.

Unintended Amplification: The Snowball Effect

One of the most significant risks of such conclusions—especially before peer review—is their unintended amplification. Articles on Yahoo, TechCrunch, and Newsday have already simplified these findings, creating narratives that could ripple through the industry:

  1. Unnecessary Layoffs: Misinterpreting data might lead organizations to hastily classify engineers as unproductive, ignoring less visible but valuable contributions.
  2. Remote Work Stigma: By associating remote work with reduced productivity, these claims risk undermining one of the most effective workforce models when well-managed.
  3. Toxic Metrics Culture: Over-reliance on activity metrics like commit counts can encourage engineers to game the system by prioritizing volume over meaningful work, as discussed in Business Value Delivery by Engineering Teams in Startups (Part 2)​.

History offers cautionary examples, such as McKinsey’s controversial reliance on lines of code as a productivity measure—a practice criticized in my earlier article for ignoring the multifaceted nature of modern software engineering​​.

Engineering Productivity: Beyond Output Metrics

As outlined in Is the Myth of a 10x Developer Real?, productivity in software engineering extends far beyond raw output. Effective engineers don’t just code—they align stakeholders, resolve ambiguity, and reduce future risks. These invisible contributions often lead to:

  • Improved Collaboration: Engineers who mentor, review code, or resolve cross-team dependencies amplify the impact of their teams.
  • Strategic Outcomes: Refactoring technical debt or implementing security frameworks might reduce visible code output while significantly improving system health​​.

Commit Frequency Misses Critical Context

  • Quality Over Quantity: A single commit that eliminates 1,000 lines of redundant code can be more impactful than 10 minor feature updates.
  • Diverse Roles: Roles like DevOps, QA, and security often contribute indirectly to engineering success but rarely generate frequent commits.

By focusing solely on visible metrics, we risk reinforcing flawed incentives, a point I emphasized in Business Value Delivery by Engineering Teams in Startups (Part 1)​​.

Analyzing the Stanford Study’s Claims

Claim 1: Engineers with Low Commit Activity Are Unproductive

Rebuttal: This assumption ignores the cognitive and collaborative aspects of engineering. As noted in No, McKinsey, You Got It All Wrong About Developer Productivity, activities like design discussions, documentation, and mentoring are essential but invisible in commit logs​.

Claim 2: Remote Engineers Are More Likely to Be “Ghost Engineers”

Rebuttal: Remote work relies on asynchronous collaboration, where documentation and long-term planning take precedence over immediate outputs. Simplistic comparisons risk stigmatizing effective remote models​​.

Claim 3: Low Commit Activity Correlates with Poor Team Performance

Rebuttal: High-performing teams often include specialists whose contributions are less visible but critical. For example, a security engineer resolving vulnerabilities or a DevOps engineer optimizing CI/CD pipelines may not show up in commit logs​.

Claim 4: Organizations Could Save Billions by Addressing the “Ghost Engineer” Problem

Rebuttal: Cost-cutting measures based on flawed metrics often lead to higher technical debt, increased turnover, and diminished morale. As argued in Business Value Delivery by Engineering Teams in Startups (Part 2), true cost efficiency lies in maximizing impact, not minimizing headcount​.

Impact vs Code-Commits: Understanding the Misalignment

A recurring issue with productivity metrics like code-commit frequency is their inability to reflect the true impact of an engineer’s work. The volume of code changes often says little about the value delivered, as demonstrated by the following examples:

Example 1: A Cosmetic UI Change vs. A Critical API Update

Imagine a product manager requests a seemingly simple change: update a button’s color from purple to orange. While this may sound trivial, it could involve:

  • Updating CSS libraries: A cascade of dependencies might require 1,000+ lines of revisions.
  • Testing for accessibility: Ensuring compliance with color-contrast guidelines adds complexity.
  • Regression testing: Updating snapshot tests or fixing broken visual diffs.

This cosmetic change could result in dozens of commits, each addressing a specific dependency or edge case.

Contrast this with a backend engineer’s work on the API gateway to improve application concurrency. This might involve:

  • Identifying bottlenecks: Profiling existing workloads and implementing a solution to reduce latency.
  • Optimizing database connections: Reducing round trips or improving query performance.
  • Deploying with minimal disruption: A single, concise commit could encapsulate weeks of planning and testing.

Here, the backend change’s impact far outweighs the UI update, even though it appears smaller in terms of commit frequency.

Example 2: Bulk Refactoring vs. Precise Bug Fixing

A mid-level engineer is tasked with refactoring a legacy module, updating deprecated methods, and restructuring a monolithic codebase for better readability. This effort generates hundreds of commits and thousands of lines of changes, none of which immediately improve the product’s features.

On the other hand, a senior engineer identifies and fixes a critical bug that intermittently crashes the application. The solution, a one-line code change after hours of debugging, resolves a high-severity issue affecting thousands of users.

From a commit-count perspective, the refactoring task appears more productive. However, the senior engineer’s single-line fix has a far greater immediate impact.

Example 3: Feature Addition vs. Security Enhancement

A frontend developer introduces a new feature, such as a user profile editor. This entails:

  • New UI components: HTML and CSS for the form.
  • Frontend validations: JavaScript-based constraints for data inputs.
  • Integration tests: Mock API responses for various test cases.

The addition spans 2,000 lines of code across 20 commits.

Meanwhile, a DevSecOps engineer works on a critical security vulnerability. The task involves:

  • Rotating access tokens: Updating key secrets stored in the CI/CD pipeline.
  • Implementing security headers: Adding CSPs to prevent XSS attacks.
  • Hardening configurations: Minor changes in deployment scripts to reduce attack surfaces.

Although the security enhancement generates fewer than 10 commits, its value in preventing potential breaches and compliance penalties is enormous.

Key Takeaways

  • Context Matters: Evaluating productivity requires understanding the context and complexity of the task, not just the output volume.
  • Quality Over Quantity: High-impact changes often involve fewer commits, while low-value tasks may inflate commit counts.
  • Recognizing Diverse Contributions: Engineers working on performance, security, or architecture frequently produce less visible yet highly impactful work.

This misalignment underscores the need for organizations to adopt holistic evaluation metrics that consider both quantitative output and qualitative impact. By focusing on the latter, teams can better recognize and reward meaningful contributions.

The Danger of Flawed Productivity Metrics

Simplistic metrics can have cascading negative effects:

  1. Burnout: Engineers may feel pressured to prioritize activity over quality.
  2. Stifled Innovation: Overemphasis on visible output discourages experimentation and risk-taking.
  3. Loss of Talent: Talented engineers in specialized roles may leave if their contributions are undervalued.

As emphasized in Is the Myth of a 10x Developer Real?, effective engineering is about multiplying impact, not maximizing visible output​​.

A Holistic Approach to Productivity

To address these issues, organizations must adopt nuanced evaluation frameworks:

  1. Impact-Driven Metrics: Evaluate contributions based on outcomes, such as improved system reliability or customer satisfaction.
  2. Recognize Invisible Work: Acknowledge tasks like mentorship, technical debt reduction, and long-term strategic planning.
  3. Foster a Culture of Trust: Empower teams to experiment and innovate without fear of being misjudged by flawed metrics.

Conclusion

The “ghost engineer” narrative oversimplifies the multifaceted nature of software engineering. By relying on metrics like commit counts, it risks undervaluing critical contributions and fostering unhealthy workplace dynamics. As I’ve argued across multiple articles, effective engineering teams succeed by delivering value, not just output. The industry must move beyond flawed productivity metrics and adopt more comprehensive frameworks to recognize the true contributions of every engineer.

References and Further Reading

  1. Denisov-Blanch, Y. (2024). Twitter Thread on Ghost Engineers. Retrieved from link.
  2. Denisov-Blanch, Y. (2024). Stanford Research on Software Engineering Productivity. Stanford University. Retrieved from link.
  3. Polyakov, A. (2024). Ghost Engineers—Utter Non-Sense! Medium. Retrieved from link.
  4. No, McKinsey, You Got It All Wrong About Developer Productivity. Nocturnalknight.co. Retrieved from link.
  5. Is the Myth of a 10x Developer Real? Nocturnalknight.co. Retrieved from link.
  6. Bridgwater, A. (2024). Code Busters: Are Ghost Engineers Haunting DevOps Productivity? DevOps.com. Retrieved from link.
  7. Business Value Delivery by Engineering Teams in Startups (Part 1). Nocturnalknight.co. Retrieved from link.
  8. Business Value Delivery by Engineering Teams in Startups (Part 2). Nocturnalknight.co. Retrieved from link.
  9. Long, K. (2024). Are Ghost Engineers Undermining Tech Productivity? Business Insider. Retrieved from link.
  10. Passionate Geekz. (2024). Can a Company Increase Its Market Value by Laying Off Employees? Retrieved from link.
Why Startups Should Put Security First: Push from Five Eyes

Why Startups Should Put Security First: Push from Five Eyes

By | | Comments 0 Comment

Five Eyes intelligence chiefs warn of ‘sharp rise’ in commercial espionage

The Five Eyes nations—Australia, Canada, New Zealand, the UK, and the US—have launched a joint initiative, Secure Innovation, to encourage tech startups to adopt robust security practices. This collaborative effort aims to address the increasing cyber threats faced by emerging technology companies, particularly from sophisticated nation-state actors.

The Growing Threat Landscape

The rapid pace of technological innovation has made startups a prime target for cyberattacks. These attacks can range from intellectual property theft and data breaches to disruption of critical services. A recent report by the Five Eyes alliance highlights that emerging tech ecosystems are facing unprecedented threats. To mitigate these risks, the Five Eyes have outlined five key principles for startups to follow, as detailed in guidance from the National Cyber Security Centre (NCSC):

  1. Know the Threats: Startups must develop a strong understanding of the threat landscape, including potential vulnerabilities and emerging threats. This involves staying informed about the latest cyber threats, conducting regular risk assessments, and implementing effective threat intelligence practices.
  2. Secure the Business Environment: Establishing a strong security culture within the organization is essential. This includes appointing a dedicated security leader, implementing robust access controls, and conducting regular security awareness training for employees. Additionally, startups should prioritize incident response planning and testing to minimize the impact of potential cyberattacks.
  3. Secure Products by Design: Security should be integrated into the development process from the outset. This involves following secure coding practices, conducting regular security testing, and using secure software development frameworks. By prioritizing security from the beginning, startups can reduce the risk of vulnerabilities and data breaches.
  4. Secure Partnerships: When collaborating with third-party vendors and partners, startups must conduct thorough due diligence to assess their security practices. Sharing sensitive information with untrusted partners can expose the startup to significant risks, making it crucial to ensure all partners adhere to robust security standards.
  5. Secure Growth: As startups scale, they must continue to prioritize security. This involves expanding security teams, implementing advanced security technologies, and maintaining a strong security culture. Startups should also consider conducting regular security audits and penetration testing to identify and address potential vulnerabilities.

Why Is Secure by Design So Difficult for Startups?

While the concept of “Secure by Design” is critical, many startups find it challenging to implement due to several reasons:

  1. Limited Resources: Startups often operate on tight budgets, focusing on minimum viable products (MVPs) to prove market fit. Allocating funds to security can feel like a competing priority, especially when the immediate goal is rapid growth.
  2. Time Pressure: The urgency to get products to market quickly means that startups may overlook secure development practices, viewing them as “nice-to-haves” rather than essential components. This rush often leads to security gaps that may only become apparent later.
  3. Talent Shortage: Finding experienced security professionals is difficult, especially for startups with limited financial leverage. Skilled engineers who can integrate security into the development lifecycle are often more interested in established firms that can offer competitive salaries.
  4. Perceived Incompatibility with Innovation: Security measures are sometimes seen as inhibitors to creativity and innovation. Secure coding practices, frequent testing, and code reviews are viewed as processes that slow down development, making startups hesitant to incorporate them during their early stages.
  5. Complexity of Security Requirements: Startups often struggle to understand and implement comprehensive security measures without prior experience or guidance. Security requirements can be perceived as overwhelming, especially for small teams already juggling development, marketing, and scaling responsibilities.

This perceived incompatibility of security with growth, coupled with resource and talent constraints, results in many startups postponing a “secure by design” approach, potentially exposing them to higher risks down the line.

How Startups Can Achieve Secure by Design Architectures

Despite these challenges, achieving a Secure by Design architecture is both feasible and advantageous for startups. Here are key strategies to help build secure foundations:

  1. Hiring and Building a Security-Conscious Team:
    • Early Inclusion of Security Expertise: Hiring a security professional or appointing a security-focused technical co-founder can lay the groundwork for embedding security into the company’s DNA.
    • Upskilling Existing Teams: Startups may not be able to hire dedicated security engineers immediately, but they can train existing developers. Investing in security certifications like CISSP, CEH, or courses on secure coding will improve the team’s overall competency.
  2. Integrating Security into Design and Development:
    • Threat Modeling and Risk Assessment: Incorporate threat modeling sessions early in product development to identify potential risks. By understanding threats during the design phase, startups can adapt their architectures to minimize vulnerabilities.
    • Secure Development Lifecycle: Implement a secure software development lifecycle (SDLC) with consistent code reviews and static analysis tools to catch vulnerabilities during development. Automating security checks using tools like Snyk or OWASP ZAP can help catch issues without slowing development significantly.
  3. Focusing on Scalable Security Frameworks:
    • Microservices Architecture: Startups can consider using a microservices-based architecture. This allows them to isolate services, meaning that a compromise in one area of the product doesn’t necessarily lead to full-system exposure.
    • Zero Trust Principles: Startups should build products with Zero Trust principles, ensuring that every interaction—whether internal or external—is authenticated and validated. Even at an early stage, implementing identity management protocols and ensuring encrypted data flow will create a secure-by-default product.
  4. Investing in Security Tools and Automation:
    • Continuous Integration and Delivery (CI/CD) Pipeline Security: Integrating security checks into CI/CD processes ensures that every code commit is tested for vulnerabilities. Open-source tools like Jenkins can be configured with security plugins, making security an automated and natural part of the development workflow.
    • Use of DevSecOps: Adopting a DevSecOps culture can streamline security implementation. This ensures security practices evolve alongside development processes, rather than being bolted on afterward. DevSecOps also fosters collaboration between development, operations, and security teams.
  5. Leveraging External Support and Partnerships:
    • Partnering with Managed Security Providers: Startups lacking the capacity for in-house security can benefit from partnerships with managed security providers. This allows them to outsource their security needs to experts while they focus on core product development.
    • Utilize Government and Industry Resources: Programs like Secure Innovation and government grants provide startups with the frameworks and sometimes the financial resources needed to adopt security measures without excessive cost burdens.

Conclusion

The Five Eyes’ Secure Innovation initiative is a significant step forward in protecting the interests of tech startups. By embracing these principles and striving for a secure-by-design architecture, startups can not only mitigate cyber risks but also gain a competitive advantage in the marketplace. The key to startup success is integrating security into the heart of product development from the outset, recognizing it as a value-add rather than an impediment.

With the right strategies—whether through hiring, training, automation, or partnerships—startups can create secure and scalable products, build customer trust, and position themselves for long-term success in a competitive digital landscape.

References and Further Reading:

  1. Five Eyes launch Secure Innovation to protect tech sector – Open Access Government
  2. Five Eyes launch shared advice for tech startups – National Cyber Security Centre
  3. Five Eye collaboration at DoDIIS Worldwide – Clearance Jobs
  4. Five Eyes Alliance Unveils Secure Innovation Guidance – ExecutiveGov
Bitnami