Cosmos Series Part 2: Outcome-driven for Features and Capabilities
This is Part 2 of a four-part blog series sharing learnings from our journey to optimize the people, processes, and technology powering the platform for our Cosmos managed service. Watch this video to learn how Cosmos combines attack surface technology and expert testing to deliver continuous threat exposure management while reducing the burden on security teams.
Part 2: Outcome-driven for Features and Capabilities
In my earlier blog, I covered how the core engineering principles of the Cosmos platform improve scale, flexibility, and velocity of feature development. In this post, I will discuss how our feature and capability requirement process enables us to build better requirements with higher success rates on delivery.
Picture trying to build a house by looking at each brick individually, rather than working from a complete blueprint. That's the challenge we faced in 2023. Our teams were handling hundreds of isolated tickets, but it was challenging to see the bigger picture of how these pieces created value for our customers. We needed to shift from thinking about individual tasks to focusing on meaningful outcomes.
We have evolved our processes greatly since this time to focus on success criteria, feature and capability planning, continuous roadmapping, and data-driven stack ranking. Moving from the old days of ‘need a blue button’ to these more effective methods required training our team and building new processes and expectations together.
Success criteria was the most significant change to implement. Prior to maturing our processes, it was common for product analysts to approach new features thinking about how they may look and how they may work. By contrast, rather than starting with feature descriptions, we now begin with clear, measurable outcomes. What does success look like, and how will we measure it? This approach allows a team to quickly determine where to move next on the roadmap and where to recalibrate and ensures every development effort drives tangible value for our customers.
Feature and capability planning involves bringing disparate tickets together and grouping them by related work into features and capabilities. This enables us to better understand dependencies, build a longer roadmap, evaluate total impact, deliver more comprehensive solutions, and reduce development overheard. Proper management of features and capabilities has freed up our analysts and engineers so they can consider our larger goals.
Continuous roadmapping builds atop the features and capability work. By extending the roadmap out each quarter (our preferred planning segment), we continually challenge our assumptions as a company and continuously reconnect with our customers, sales, operations, and consulting teams. This cadence of review, restack, and evaluation, coupled with the significantly increased velocity we gained, as noted in my prior blog, has a great positive effect on our customers and the health of our business.
Data-driven stack ranking is a systematic approach to prioritization that shifts critical decision-making to the left, enabling teams to address challenges earlier, increase effectiveness, and reduce costs. At Bishop Fox, we draw on a wide range of inputs for each feature and capability, which are processed through our own algorithm to generate a prioritized score. The ranking for all features and capabilities under consideration is then reviewed by senior engineering and product leaders who look at considerations such as dependencies and possible technology spikes which may influence the final order. Stack ranking is not about the perfect algorithm; it’s about making informed decisions early to ensure the right priorities drive impactful results.
How our engineering and product teams approach their work on Cosmos has significantly improved their ability to deliver new features and capabilities more rapidly. In my next blog post, The Importance of Automation, we'll see how automation acts as a force multiplier, freeing our teams to move more quickly.
Subscribe to Bishop Fox's Security Blog
Be first to learn about latest tools, advisories, and findings.
Thank You! You have been subscribed.
Recommended Posts
You might be interested in these related posts.
Jan 07, 2025
Cosmos Series Part 3: The Importance of Automation
Dec 17, 2024
Cosmos Series Part 1: Principles for the New Platform
Dec 09, 2024
Bishop Fox ASM Delivers 24-Hour Head Start Against Critical PAN-OS Vulnerability
Nov 07, 2024
Application Pen Testing: Point-In-Time vs Ongoing Approaches Explained