In this talk, I summarize the evidence that shows how engineering performance drives commercial performance, including Visma's own internal research. I'll show why and how we measure Software Delivery and Operational Performance across ~100 teams and how we use it to improve commercial results.

Small software companies may have personal and sensitive data on millions of users and process millions of euros worth of transactions, but many have appaling application security. In this talk, I'll mention some of the common shortcomings we come across and what can be done to address them.

Based on analysis of hundreds of acquisition targets, vendors, customers and partners, it is clear that most small software companies are underinvesting in security to the detriment their future and customers. Based on our analysis, the danger zone seems to be <40 FTEs, <5 MEUR revenue. The good news is that major improvements in security can be made without the need for huge investments.

Visma is the largest cloud software developer in Northern Europe with 8000+ employees. Over the past four years, Visma has worked in a focused and structured way to modernize how we design, develop, deliver and operate our cloud services. We now have 40 autonomous teams that are responsible for both development and operations of their cloud services. How did we get here, and what have we learned along the way?

This is an updated version of a talk I held at DevOpsDays Oslo 2018.