Development
What Custom Software Actually Costs To Own
The Two Questions That Decide The Bill
Who Can Change It Later
- What language the rules are written in
- Whether anyone can read them in five years
- Whether you can hire someone who knows it
Decides What Changes Cost
Who Can See What It Holds
- Who can view each record
- Who can change one
- What happens when that is set wrong
Decides What A Mistake Costs
Two questions decide what a piece of custom software costs after it is delivered. Who is allowed to change it, and who is allowed to use what it holds. Neither is a feature, and neither appears on a quote priced per screen.
Both questions have published answers worth reading before you commission anything. Brandon Byars, on integration, argues that integration products are programming languages bundled with a toolchain and a runtime, which makes buying one a decision about who can read your rules in five years. OWASP, on applications, puts Broken Access Control at the top of its 2025 list and reports that 100% of the applications tested were found to have some form of it.
This section is the two pieces of work that follow from those two findings.
What Should You Settle Before A Custom Build?
Ask who can change the software and who can use what it holds, and get both answers written down before design starts.
Everything else in a build can be revised later at roughly the cost of doing it. Those two cannot, because both spread themselves through the whole codebase as it is written. Retrofitting either one means revisiting every decision that assumed the old answer.
Two Questions That Decide The Bill
The first is about the people who maintain the thing. If your business rules live in a vendor dialect that only one editor can open, then reading a change, reviewing it, testing it and hiring for it all get harder every year. Byars makes the point sharply: the ability to diff changes between source code commits is a developer superpower, and a markup based dialect gives it up.
The second is about the people who use it. Authentication is one component with a clear boundary. Authorisation is a separate decision at every endpoint, every query and every identifier in a URL, made correctly a few hundred times over several years. That is why OWASP's top category is not going anywhere.
Both questions have the same shape. They are cheap to answer on paper and expensive to answer in code, and both get skipped because neither one is a screen.
Integration, Web Applications And The Build Or Buy Call
Three pieces. Two answer a question each, and one sits above both.
Systems Integration Is A Language Choice, Not A Purchase covers the first, working from Byars' argument that an integration product is a programming language, and the cost curve that follows from connecting systems to each other rather than to interfaces you own.
What Decides Whether A Web Application Is Safe To Ship covers the second, working from the OWASP Top 10:2025 and the four things worth putting in a brief before anyone draws a screen.
The decision that sits above both is whether to build at all. How To Decide Whether To Build Or Buy works through Martin Fowler's differentiator test, and then through Byars again on the cost buying does not remove.
Signs Your Custom Build Is Underspecified
- The quote is priced per screen and there is no line for roles and permissions.
- Your integration shortlist compares connector counts and nobody has written down which capability is being exposed.
- One person can safely change the integration, and everyone knows who it is.
- A system you want to replace cannot be replaced, because everything is coupled to its internal shape.
- You would learn about a serious failure from a customer rather than from an alert.
Signal four is the expensive one, and it is usually discovered years after the work was signed off as finished, at the moment somebody wants to change something else.
Common Questions About Custom Development
What Is Custom Software Development?
Building software shaped around one organisation’s processes rather than adapting the organisation to a package. In practice the work is mostly rules: who may change the system, who may use what it holds, and what happens when something it depends on fails. Screens are the visible part, not the expensive part.
When Is Custom Software Worth It?
Martin Fowler’s published test is whether the business function is a differentiator. If the process is part of your competitive advantage, build. If it is not, buy a package and adjust the process to fit the way the package works. That question is about your business, not about software.
Why Does Integration Cost More Than Expected?
Because the connector is the easy part. Brandon Byars describes integration products as programming languages bundled with a toolchain and a runtime, so the tool supplies the plumbing while the interface, the business rules and the failure handling stay yours to write and maintain either way.
What Is The Top Web Application Security Risk?
Broken access control. It is category A01 in the OWASP Top 10:2025, with 40 mapped weakness types and more than 1.8 million recorded occurrences in the contributed data. OWASP reports that 100% of the applications tested were found to have some form of it.
What Should A Software Brief Contain?
A role and permission table covering read, write and delete for each type of record. What the software does when each external dependency is slow, down or answering wrongly. A named owner for the dependency tree. What gets logged, kept how long, and what raises an alert rather than a line nobody reads.
Free Development Resources
Three checklists and decision tables, one per piece below. Two pages each, free, no email required.
Bring The Constraint, Not The Platform Shortlist
In my experience these conversations arrive as a set of screens, or a shortlist of platforms with a preference already attached. The more useful thing to bring is the rules: who changes it, who uses it, and what has to keep working when something else is replaced. The scoping audit costs nothing. The form asks for your website or store URL and a note on what is eating the time.
Every free audit has a redacted sample on The Audits Section, if you would rather see the output first.
Request The Free Scoping Audit