"People don't go to the hardware store to buy drills -- they go to buy holes"
When buying for a business, it always comes down to the bottom line - a problem must be solved, a pain alleviated, a cost saved or additional revenue made. Simply buying a tool won't solve any problem. When making a tool into a solution one must consider:
- Does this tool fit into my process? How will it be integrated?
- Who will install and configure this tool custom to my needs?
- Who will use this tool? Does the users' process require them to use the tool? What are the incentives to use it and consequences for not using the tool?
- Will the users be able to understand the tool? Will training be required and effective?
- Who will administrate the tool? How will they gain the expertise to administrate it well?
- Who will own the success and failure of the tool?
- Who will be able to evolve the tool as the group's priorities and environment shift?
At Code Integrity Solutions, we've see this often. Organizations have the best of intentions when purchasing a tool but fail to make the necessary investment to make it a success. The word "investment" covers a lot of ground - it not only means license cost but all the other associated costs in making it happen. When purchasing a tool, no one has the intention to see it fail, and yet if it's not given the right priority and investment, it's chances of success are slim.
With static analysis, it's common to underestimate the needed cost. Static analysis is not yet an established part of every software development organization. Many companies don't know what it takes to administrate the tool, configure it properly and to how to integrate it well into their process. Many firms take a "hope" strategy by making the tool available as a service, not realizing that the people who end up using the tool are usually the people who least need it.
Yet, leading companies see the advantage it brings and are using it to gain a competitive advantage but many get just a fraction of its benefits. Usually the solution settles into an implementation that is "good enough for now". It's not a bad place to be temporarily but a tool is always a tool no matter what the problems are. A solution can solve much bigger problems if the right approach, right expertise and right investment are made.