One number tells the truth about your quality process: the escape rate. Of all the defects in what you ship, how many reached production instead of getting caught first? Most teams don't track it, so they manage quality by feel. This report covers why defects escape, what escapes actually cost, and the gates that bring the number down.
How most teams work: add tests here, a review policy there, and hope, without ever measuring the one number that shows whether it's landing. Meanwhile the defects that reach production are the most expensive ones to fix.
What changes the game: measure the escape rate, trace every escape back to the gate that should have caught it, and layer the gates in the right order, inspection first, then static analysis, then testing, so the expensive defects stop getting out.
Code review is the earliest and highest-efficiency gate, at 85%+ removal. Real review of small changes, not rubber-stamping large ones, is your strongest line of defense, and most escapes trace to a review that didn't go deep.
Automated SAST, dependency, and secret scanning catch a broad class of defects at 65%+ efficiency for near-zero human time per change. Run it on every commit as a second automatic layer.
Testing is essential, but it removes fewer defects than inspection, and no single gate exceeds about 95%, so layer all three. Small changes make every gate work, which is why batch size is the meta-gate.
Tag every defect with where it was caught: review, static analysis, test, or production. The production share is your escape rate, and it tells you more than any coverage percentage.
For every production defect, ask which gate should have caught it and why it didn't. The pattern in the answers points straight at the fix.
If most escapes trace to "no review caught it," the leverage is upstream, in stronger inspection and static analysis, not in more end-to-end tests.
Drive it toward the elite 5%. It's the escape rate in production terms, and it moves when the gates and batch sizes improve.
Every defect you stop before production is rework you never pay for at the stage where it's most expensive, and firefighting fewer production issues is capacity returned to building. Layer your gates, lead with inspection, keep changes small, and measure the number that matters.
The exact "100x" figure is widely quoted but has no verifiable primary source, so treat it as folklore. The reliable point is directional: later fixes cost more in rework and blast radius, which is exactly why escape rate matters.
Strengthen code review on small changes. It's the earliest and highest-efficiency gate, and most escapes trace to a review that either didn't happen or didn't go deep.
VPs of Engineering, Heads of Quality, and engineering directors who want to cut production defects by fixing the process, not just adding effort.
Only partly. Inspection removes more defects than testing, and no single gate exceeds about 95% removal, so you need inspection, static analysis, and testing layered. Teams that only add tests leave their strongest gate underused.
Tag each defect with where it was caught, from review through to production, and track the production share over time, paired with DORA's change failure rate as the outcome metric.
