Flamingos look silly when they eat, but new research suggests they're actually being smart.
(Image credit: Serhat Cetinkaya)
Over the last week, I’ve been tasked with testing the new Sony WH-1000XM6 headphones to their absolute limit. And yes, they’re pretty great. With class-leading noise cancelling capabilities, awesome audio and features for days, these compete against even some of the best headphones around. But should you buy them now?
For many, the answer will be a resounding yes – but, you wouldn’t be alone in having a few reservations or questions. So, if you’re on the fence, here are my top three reasons to pick up the Sony WH-1000XM6 right now… as well as three reasons to hold fire.
If you’d like to check out my full thoughts, head over to my Sony WH-1000XM6 review – but for the quicker takeaway, let’s dive straight into things…
(Image credit: Future) Why you should buy them 1. You get class-leading active noise cancelling capabilitiesNow, when it comes to noise cancelling, these are by far the best Sony headphones you can buy. But I’d go a step further. They’re also arguably the best noise cancelling headphones available – period.
The Japanese tech giant’s new cans use the fresh QN3 HD noise cancelling processor, which is seven times faster than the old QN1. It harnesses the capabilities of twelve mics in order to offer truly sound crushing ANC. Whether you’re looking for near-silence on your daily commute, an isolated listening session at the local café, or cans to help you lock in at the office, the WH-1000XM6 have you covered.
Even when compared to the noise-nixing legends that are the Bose QuietComfort Ultra Headphones, the XM6 are more than capable of holding their own.
I found them to be equally as good, if not better, than the Bose in my real-world testing, which included vacuuming my apartment, walking in traffic-heavy areas, and taking public transport. On occasion, you will hear sounds creep through, but fear not – the most harsh noises will be drastically dampened, meaning you can stay focused on your favorite tunes, at all times.
(Image credit: Future) 2. They sound fantastic and can mold to your specific tasteIn terms of sound quality, the Sony WH-1000XM6 perform very nicely indeed. There’s a fantastically balanced sound signature out of the box, which aims to get closer to the ‘flat’ presentation that many audio engineers seek out. No need to worry about over-zealous bass or harsh treble here.
But still, you’re able to get an exciting listen out of Sony’s new flagship cans. In my hours upon hours of testing, I was treated to clear highs, rich mids and driving low-end output, which kept me coming back time after time. And with Sony’s ‘noise shaper’ technology, these cans can pre-empt sudden sound changes for a distortion-free, controlled listen.
There’s also DSEE Extreme for upscaling lower quality audio files, and Sony’s proprietary LDAC codec for getting the best out of ‘hi-res’ tracks over Bluetooth. And if you really want to make the XM6 sound your own, you can have a play with EQ settings, which include a Find Your Equalizer test that creates a tailor-made sound, just for you.
(Image credit: Future) 3. You get access to a treasure trove of smart featuresBut wait… the smart features in the app don't stop there. Sony has added even more features to its Sound Connect app for WH-1000XM6 owners. There’s Auracast, a type of Bluetooth technology that enables you to tune into an audio broadcast transmitted from a phone, TV or similar device without pairing. But there’s also an instant mute function on the mic that's useful for calls, and Scene-based Listening, which can adjust ANC levels based on your environment.
And on top of these new additions, you’re getting the very best of everything that’s come before in the WH-1000X line. I’m talking multi-point connectivity, wear detection, voice assistant compatibility and adaptive sound control, which adjusts audio output depending on your location and movement.
There’s also an Ambient Sound mode and Speak to Chat for when you want to be more aware of your surroundings. Alternatively, just cover your hand over the right earcup and you’ll be able to hear everything around you super-clearly until you lift your hand away.
And I could go on… there’s a Cinema listening mode that up-mixes stereo sound into a more immersive, three-dimensional format, and Background Music mode, which makes it seem as if your tunes are playing in a café or living room.
(Image credit: Future) Why they might not be right for you at the moment 1. They’re not cheap… to say the leastOkay, I might’ve made the Sony WH-1000XM6 sound like the perfect pair of headphones so far. But still, they might not be right for everyone, at least at the minute. And perhaps the most obvious reason for that is they’re pretty pricey.
In fact, they’ll cost even more than their predecessor, the Sony WH-1000XM5, did at launch. The brand spanking new XM6 have a list price of $449 / £400 / AU$699, which is $50 / £20 / AU$50 more than the last flagship model at launch.
The XM5 are now widely available for closer to $300 / £250 and rivals like the aforementioned Bose QuietComfort Ultra are also on sale for under $350 / £350 pretty regularly.
I also need to note here that they cost the same as the Bowers & Wilkins PX7 S3, and those have clearly superior sound quality, though the Sony beat them on ANC power and features.
So, even though the XM6 offer better sound quality than their predecessor and ANC that stands up to Bose’s recent supremacy, it might take a discount for some to take the plunge on a purchase.
Sony WH-1000XM6 headphones next to their predecessor, the Sony WH-1000XM5 (Image credit: Future) 2. They don’t supply the best battery life aroundThe Sony WH-1000XM6 dish out 30 hours of playtime with ANC on. Is that bad? Not at all. But is it particularly impressive? Again, no, not really. To be frank, 30 hours is pretty average for a pricier pair of headphones like these.
For instance, it's the same amount you’ll get out of the five-star rated Bowers & Wilkins Px7 S3, as well as the Sonos Ace headphones.
On the flip side, there are some competitors that totally blow that 30 hours of playtime out of the water. The fantastic Cambridge Audio Melomania P100 boast a battery life of 60 hours with ANC on and as the name suggests, a mind-boggling 100 hours with noise cancelling off. Another pair that manages 60 hours is the Sennheiser Momentum 4 Wireless, which are great all-rounders with a significantly lower price than the WH-1000XM6.
(Image credit: Future) 3. You might not be bowled over by their looksSo this last one is a lot more subjective, but the design of the Sony WH-1000XM6 might not be for you. See, I do like the look of these new cans overall, but I can’t help but feel that the earcups are quite chunky. So, if you’re after a more curved or low-key look, these might not be the absolute best headphones for you.
In addition, Sony has only opted to launch the XM6 in three colorways: Black; Midnight Blue; and Platinum Silver. There’s no Smoky Pink variant at the point of release, which was a popular addition to the XM5 lineup after entering the fray in September 2024. Fans of a more vibrant look may also be better served by the Bose QuietComfort Headphones (hold the Ultra – these are the cheaper model), which you can grab in green, blue and lilac.
If I was picking some headphones on looks alone, I’d have to go with the Marshall Monitor III ANC. They have a faux leather casing on the earcups, discreet buttons and a luxury-looking carry case. When it comes to style alone, they’re among the best.
(Image credit: Future) You might also likeWe've already seen a bunch of updates for Apple products in honor of Global Accessibility Awareness Day this week, and now it's Google's turn – with four important upgrades on the way to Android and Chrome.
As per the official blog post, the TalkBack screen reader feature in Android is getting some extra smarts, on top of the existing Gemini-powered functionality. The feature provides image descriptions for blind and low-vision users, even when no alt text is provided.
Now, you'll be able to ask Gemini follow-up questions about the image that's showing on screen – so if you need to know what color something is, or what else is showing in the picture, Gemini will be able to help out.
There's also an update to Expressive Captions, which provides on-screen subtitles for anything with audio on your phone. Those subtitles will now reflect drawn on words, so you'll be able to tell the difference between "no" and "noooooooooo", Google says.
Chrome and language support Page Zoom in Android can now zoom on text only (Image credit: Google)We've got some accessibility improvements to talk about with Google Chrome, too. First up, scanned PDFs are getting Optical Character Recognition (OCR), which means you'll be able to search for text inside them, and copy that text somewhere else.
For Chrome on Android, Page Zoom (above) is adding a feature to let you increase the size of text on pages, without affecting anything else (like images or layouts). To set up the feature, tap the three dots (top right) in a tab, then Settings > Accessibility.
Google is also improving speech recognition technologies around the world, giving developers more resources for non-standard speech patterns and non-English languages, as part of its ongoing Project Euphoria initiative.
Finally, a full suite of accessibility features are on the way to Google's Bluebook app, which can be used as a testing platform. Upgrades for dictation and the screen reader tech should make the app more accessible than ever.
You might also likeMicrosoft has failed to deliver a special, EU-specific version of Azure – a milestone it was meant to achieve by mid-April 2025.
The Washington tech giant had previously committed to building a Hoster Product for EU providers, promising features like multi tenancy support, unlimited virtualization and pay-as-you-go SQL Server licensing.
It all stems from a November 2022 antitrust complaint, when CISPE accused Microsoft of engaging in anticompetitive business practices that saw it favor its own Azure cloud over competitors.
Microsoft missed a major CISPE antitrust milestoneCISPE complained that it was more expensive to run Microsoft software on rival cloud platforms than on Azure, thus the company pledged to tweak some of its licensing terms to open up competition.
The European Cloud Competition Observatory (ECCO) published its second report on Microsoft, maintaining its amber rating – not a good look for a company that's been the subject of antitrust investigations on a global scale. "Some concerns exist but corrective actions have been proposed," ECCO explains.
"Although there have been setbacks, specifically in the delivery of a product-based resolution, both sides continue to engage in positive discussions," CISPE wrote.
CISPE Secretary General Francisco Mignorance commented: "It is disappointing that the proposed product did not deliver, but this is in not the end of the Agreement. Phase 2 opens the door to discuss alternative, commercially equivalent solutions that enable CISPE members and Europe’s cloud infrastructure providers to compete fairly, while still offering Microsoft’s productivity tools to their customers."
Microsoft must now propose alternatives – a Plan B – by July 10, 2025, or face potential new legal action. In the meantime, the UK's CMA continues to review the company's licensing tactics.
TechRadar Pro has asked the company for more details on the missed deadline, but we did not receive an immediate response.
You might also likeJames Gunn has set tongues wagging among DC comic-book fans after he teased that Wonder Woman's DC Universe (DCU) debut might not as far away as many people think.
Posting on Threads yesterday (May 15), the DC Studios co-chief dropped the biggest hint yet that Diana Prince could be part of his and Peter Safran's new-look cinematic universe sooner than expected.
Asked by a fan if he could share any news on Wonder Woman's possible arrival in the DCU, Gunn replied: "Not to be shared publicly yet but yes. Encouraging."
Gunn shared a promising update on Wonder Woman's DCU debut on May 15 (Image credit: Threads)Admittedly, it's not much to go on. However, given that Wonder Woman is the only member of DC Comics' Trinity – that trinity being, the company's three most popular heroes in Superman, Batman, and Wonder Woman – not to get her own DCU project yet, it's nonetheless intriguing to hear Gunn talk up her eventual appearance in the DCU.
Fans have long questioned the decision not to announce a Wonder Woman film as part of Gunn and Safran's initial DCU movie and TV show lineup in early 2023.
At the time, Gunn's Superman movie, which arrives on July 11, was confirmed to be the first of numerous superhero flicks that'll comprise DCU Chapter One. The Brave and the Bold, a Batman film inspired by its comic-book namesake, was also unveiled alongside Chapter One's initial 11-strong slate.
Gunn did reveal a Wonder Woman-esque TV series as part of Chapter One's original lineup. However, while that show – Paradise Lost – is billed as a Game of Thrones-inspired story that'll be set on Themyscria, aka Prince's idyllic home island, the Amazonian won't be its lead character. Unsurprisingly, that irked some DC aficionados who felt that, despite Wonder Woman's enduring popularity, she was being overlooked.
Why Gunn's Wonder Woman tease has sent DC fans into a frenzy Gal Gadot is the latest actor to play Diana Prince/Wonder Woman (Image credit: Warner Bros)Gunn's Threads post comes hot on the heels of Warner Bros. Discovery (WBD) CEO David Zaslav's own comments about the company's desire to capitalize on the popularity of four specific DC superheroes.
Speaking during WBD's Q1 2025 earnings call (as reported by Yahoo), Zaslav said: "When you look at the major characters... that James Gunn and Peter Safran are developing with their 10-year plan around DC, that is to build asset value globally [with] Wonder Woman, Batman, Superman, [and] Supergirl. So, we look at those as big asset builders and big differentiators."
Clearly, Zaslav wants WBD subsidiary DC Studios to take a more proactive approach to building the DCU around its most iconic metahumans – and, surprising no-one, that includes Wonder Woman.
Batman, Wonder Woman, and Superman teamed up twice in the now-defunct DCEU (Image credit: Netflix)With Zaslav and Gunn publicly responding to queries about Diana Prince in recent days, fans have renewed hope that it won't be too long until the Princess of Themyscira is back on the big screen. And, if a new fan theory is to be believed, some observers believe she'll return in Gunn's next project, which – whisper it quietly – could be a team-up between Wonder Woman, Superman, and Batman.
Taking to Threads on May 10, Gunn revealed that he'd started working a new DCU movie. Curiously, though, he confirmed that it was a new project, i.e., not one of the seven that currently make up DCU Chapter One, aka 'Gods and Monsters'.
That post, coupled with his comments about Wonder Woman, have unsurprisingly caused a stir. So much so, in fact, that some fans claim he must be penning the script for a Trinity film. Indeed, a thread on the DCULeaks Reddit page is full of people theorizing that this is what Gunn is secretly working on.
Comment from r/DCULeaksWhat's my take on the situation? A movie that brings DC Comics' three greatest heroes together would not only be (hopefully) absolutely brilliant, but would also help us to forget about the – how can I put this politely – less-than-ideal team-up we got with Zack Snyder's Justice League and Batman v Superman's undercooked third act.
Marvel has proved that people will flock to see their favorite superheroes unite on the silver screen, so there's no reason why the DCU wouldn't benefit from seeing Prince, The Dark Knight, and the Man of Steel join forces to take down a common foe.
That all said, it could be years before a Trinity film sees the light of day. Yes, Superman is ready to take flight in the DCU and, while Kara Zor-El isn't part of the Trinity, Supergirl: Woman of Tomorrow, which lands in theaters next June, will introduce wider audiences to the fourth main pillar Zaslav mentioned earlier this week.
But, until The Brave and the Bold's development gets off the ground, and either Paradise Lost or a standalone Wonder Woman film introduce us to the DCU's Diana Prince, I can't see a world where a Trinity movie would be the right project for Gunn to tackle next.
We live in hope, but if the now-defunct DC Extended Universe (DCEU) has taught us anything, it's that cinematic franchises need to walk before they can run, and making and releasing a Trinity movie before its legendary metahumans are all established in the DCU would be the opposite of that.
You might also likeLast week in San Francisco, design and development platform Figma unveiled four new tools aimed at giving users the full end-to-end package.
Figma Make, Figma Sites, Figma Draw, and Figma Buzz offers teams the ability to ideate and create everything from vector images to full-blown websites. And, as you’d expect, it’s all AI-powered for faster iteration.
At Config London, I got a more in-depth peek into exactly what these tools are capable of - and how they fit into Figma’s plans to create a platform that lets users go from idea to product launch without pause.
Create and launch at speedOne of the biggest issues facing businesses today is team siloing - where one hand doesn’t know what the other is doing (or, at least, has a different way of doing the same thing).
With that in mind, Figma has released four new tools alongside its beloved Figma Design and FigJam that almost entirely remove that problem.
Yuhki Yamashita, Figma’s Chief Product Officer, explained the thinking behind the new line-up, saying, “How do we help you do everything, going from an idea to a final product? And all the things that you will see in the future, too, will be anchored in this, in this framework of helping people go through this journey faster, explore more ideas, and make that process as efficient as possible.”
Figma CPO Yuhki Yamashita on stage during Config London (Image credit: Figma // Future)Figma Make is an overarching tool for content ideation. Here, you can start from scratch or copy and paste existing designs from Figma Design, and collaborate on these with the rest of the team (Figma calls this a “multiplayer” tool). You can then port over into other apps like Figma Sites to tailor the design to suit the product.
What’s interesting here is the concept of throwing away designs. Effectively, what Figma wants is to make it easy to rapidly ideate, that if something doesn’t work, you can throw it out and start afresh.
During the press briefing, Yamashita said: “Our thought experiment was, how can we make it so easy for you to go from the idea into your head to something that is actually you can put in front of users and validate really quickly. And if it doesn't work, that's great. You can then move on to the next idea, or you can keep iterating from there.”
Figma Sites is an AI-powered website builder for all-in-one design, prototyping, and publishing. One of the chief purposes behind this is saving time - a space where developers can work on templates, responsive design, custom interactions, and transitions and motion effects. Using grids, and with a little help from AI, designing responsive sites looks and feels easy (assuming you know what you're doing, that is).
During Config London, I was treated to a brief, playful example - taking static words and prompting the AI to come up with three different ways to add some design sparkle, for example, repelling each word as the cursor hovers over it. However, as Yamashita later noted, there are more practical uses here such as connecting an API to the back-end.
There’s also the promise of future updates, with Yamashita saying, “we wanted to make sure that we could support scaled use cases, too. For example, a marketing site with tons of content, or maybe a blog. And with these kinds of content, it's much easier if we have a CMS, so that a non-designer can come in and comfortably edit that content in a way that's familiar to them. And this is something that's coming soon.”
(Image credit: Figma)Figma Draw is, in a sense, Figma’s AI-powered answer to Adobe Illustrator. But it goes a little deeper than that, with the company keen to help designers make content that doesn't have a generic look and feel, while letting them freely express themselves and elevate their craft.
I saw a few examples of what the Figma community has already created during the event, some in hand-drawn stylings, others photorealistic images - and it’s fair to say, they’re certainly impressive. Yamashita explained, “We add things like texture and noise to make it feel much more organic, while still being a vector.”
Figma Buzz tackles the social media marketing side - once a product is launched, Buzz is a tool for promoting it online. But more importantly, it's a way to help those on the team who can’t or don’t use Figma Design to create content that matches brand guidelines. Built for designers and marketing teams, Yamashita called this “the purpose-built tool for on-brand asset creation” for dynamic and custom assets at scale.
He and his team asked themselves “how could it feel as simple as filling out a form, so that you can actually create some dynamic content?” Figma Buzz is the answer to that. Helpfully, the tool also connects to Figma Design, serving up all the features designers use, without “complicating the experience” for non-designers.
I saw this one in action on stage and came away impressed. In a matter of seconds (ok, maybe ten or so seconds), a single post was automatically localized 80 different ways, switching language, image, and national flag for the correct territories - all without removing that on-brand element.
Figma Buzz demonstration in action, creating social media assets in real-time (Image credit: Figma // Future)You can check out Figma’s latest tools right now by clicking here and navigating to the Products section. To watch the full Config London keynote speech with Yamashita and Figma CEO Dylan Field, it's on YouTube here.
You might also likeCriticism of "activist" judges predates the term and has come from both ends of the political spectrum. Democratic and Republican presidents alike have accused the courts of exceeding their constitutional role.
(Image credit: )
Cathy Harris and Gwynne Wilcox, Democratic board members of independent agencies, argue that President Trump lacked the authority to fire them, citing federal law and Supreme Court precedent.
Federal judges are looking back to the 18th century to define what constitutes an invasion, weighing a key legal argument for the Trump administration's use of a wartime deportation authority.
(Image credit: Charly Triballeau)
The health care giant's shares are down more than 50% in the last month. That's hurting the powerful U.S. stock-market index.
(Image credit: TIMOTHY A. CLARY/AFP via Getty Images)
It can be intimidating to enter a new queer space, especially if you're starting to explore your gender and sexuality. Organizers share advice on how to find a support network with confidence.
(Image credit: Nickolai Hammar/ NPR)
New financial pressures on clinics that provide abortion are forcing some to close their doors, even in states that protect the right to abortion.
(Image credit: Bobby Anttila)
This week's quiz features real-life alchemy, nudity bans, expensive gifts, curriculum changes, and the new pope. Good luck!
UPDATE: AdGuard confirmed to TechRadar that Xiaomi also removed its VPN app from its Russian App Store at Roskomnadzor's request on May 16, 2025, after publication. We edit the article to reflect this.
Yet another VPN service has disappeared from official app stores in Russia.
This time, Samsung has removed the AdGuard VPN app from its Galaxy App Store in the country at the Roskomnadzor's demand.
A day after, on May 16, 2025, the tech giant Xiaomi also did the same, killing the provider's VPN application from its Russian app store after receiving a removal order from the country's censoring body.
This comes as part of the Kremlin's actions against VPNs that have seen over 100 apps disappear from the Russian Apple App Store, including some of the best VPN services on the market.
Despite Google seemingly resisting most of these demands so far, recent data shows that at least 53 VPNs are also currently unavailable in the Google Play Store in Russia. AdGuard VPN, however, hasn't been affected yet.
"A regrettable development""Our app has indeed been removed from the Samsung Store in Russia – a regrettable development, in our view," AdGuard CPO, Denis Vyazovoy, told TechRadar.
The VPN service has received a synthetic email from Samsung (see image below) to inform that its "application information has been modified."
The change? "Russia was excluded from the sales country lists according to Russian government's request. This app is banned by Russian government," reads the email.
Xiaomi has sent a similar communication to the provider (see image below), noting that "Distribution of VPN applications in Russia is not allowed. Therefore, we have to remove your application from Russia."
AdGuard VPN was already among the virtual private network (VPN) services affected by the big purge from Russia's Apple App Store last year. Unavailable apps also include some of TechRadar's favorites, such as NordVPN, ExpressVPN, and Proton VPN, but also the popular Russian service Amnezia VPN.
The provider confirmed to TechRadar, though, that its app is still available in Russia's Google Play Store at the time of writing.
It's also worth noting that these removals only affect Russia-based users. The AdGuard VPN app is still available across all official app stores outside Russia.
Image 1 of 2(Image credit: AdGuard)Samsung's email to AdGuardImage 2 of 2(Image credit: AdGuard)Xiaomi's email to AdGuard"We see this as part of a broader trend of restricting access to tools that help people protect their privacy and maintain access to an open internet," Vyazovoy told TechRadar.
The Kremlin's actions against VPNs have intensified since a law enforced in March 2024 criminalized the spread of information about ways to circumvent internet restrictions. This is likely the legal basis upon which the Russian censor body is issuing these demands to Big Tech firms.
Yet, experts have long called on these companies to uphold Russian citizens' human rights by refraining from cooperating with these demands and restoring censored VPN apps.
Vyazovoy confirmed to TechRadar that the service continues to operate through other channels and the provider is actively looking for ways to remain accessible to all users.
If you are using a Galaxy or Xiaomi smartphone, I recommend downloading the AdGuard VPN app from the Google Play Store, where the service is still available at the time of writing.
The provider also suggests downloading it directly from their official website to be sure to get the latest and safest version.
TechRadar needs you! We want to know what you think about the world of VPNs. Whether you're a novice or a VPN pro, we want to hear your thoughts. Don't worry, though, your responses are completely anonymous, and it takes less than five minutes to complete!
To take part, click the link below: https://futurenet.questionpro.eu/tr-vpn
You might also likeISO 25000 defines "software security" as a key pillar of product quality, performance, maintainability, and reliability. But in practice, cybersecurity is often an afterthought, deprioritized in the name of speed and innovation, resulting in a growing disconnect between quality and security. The recent case of DeepSeek is a perfect example. Despite rapid product development and cost efficiency, the company failed most of its security tests, exposing major flaws in its risk posture.
This isn't an isolated incident. Across various stakeholders and industries, "quality" means different things depending on who you ask. Developers may view it as bug-free functionality, designers may point to user experience, and executives may care most about time to market, ROI, and customer satisfaction. Meanwhile, security often sits outside those priorities—treated as a compliance box or post-release concern.
The result? A widening divide. Organizations take an average of 55 days to fix just half of critical vulnerabilities. Attackers don't need nearly that long. Exploits from CISA's Known Exploited Vulnerabilities catalog often circulate within five days of discovery. That's a 50-day exposure window, and that's if you're among the faster teams. Most aren't.
To close this gap, teams must move beyond reactive security measures and adopt a proactive, integrated approach to quality—one that treats security as a core part of the development lifecycle, not something bolted on at the end.
Data Flow Vulnerabilities: The Hidden Security RiskModern quality assurance (QA) is built around fast, repeatable feedback. Fail a test, file a bug, and fix it before it hits production. Teams are fluent in this rhythm. But when it comes to security issues, the rhythm breaks. Often, the assumption is that vulnerabilities weren't detected in time. But the real problem isn’t just detection, it’s a breakdown in how security signals flow through the development lifecycle.
Security tools generate noisy and low-quality signals, leading to false positives and negatives. And, with the rise of proactive, left-sided practices—like threat modeling, IDE plugins, pre-commit hooks, and early scans—the volume of signals has only increased. Tools like SAST, DAST, and dependency scanners flood teams with thousands of alerts. Without a structured way to prioritize, sort, and assign these issues, developers fall back to what they know, and security becomes background noise, the divide deepens, and the path to resolution blurs.
To fix this, teams need to treat vulnerabilities like they treat bugs—because that's precisely what they are. Whether it's a flaky unit test or a known SQL injection risk, both represent a failure state and require prioritization. When security signals are pulled into the same systems developers already use—issue trackers, test automation, CI/CD pipelines—they get handled like any other failure, not ignored or delayed.
The Lag Is in the Handoff, Not the DiscoveryDelayed security fixes put businesses, customers, and reputations at risk. It's tempting to think that catching vulnerabilities sooner will solve everything. But most teams already know where their weaknesses are. The current lag isn't about visibility. It's about propagation. Security alerts travel on a different track than everything else. QA teams test, triage, and file bugs as part of their day-to-day job. But AppSec alerts? They get forwarded. They live in separate tools. They sit on spreadsheets that no sprint team is ever going to open.
A single static scan can produce thousands of results; most go untouched without a structured way to sort through them. According to a Ponemon Institute survey, 61% of IT and security professionals struggle to remediate vulnerabilities effectively. Only 20% believe they can reliably detect vulnerabilities before an application is released.
Once a vulnerability is known to the public, the clock is ticking. Exploits circulate quickly. By the time a team triages the alert, assigns it, and discusses a fix, the damage may already be done. And the fallout can be painful.
Victims of data breaches underperform the NASDAQ by 8.6% after a year—and more than 11% after two years. Customers don't easily forget, either. More than half (66%) of U.S. consumers say they wouldn't trust a company again after a breach, and 44% believe cyber incidents directly result from poor security measures. That trust is hard to rebuild, and the "patch later" mindset won't cut it anymore. Businesses can't afford to wait until the next release cycle to address known issues. So, what's the better approach?
Everything changes if you reframe those alerts as just another signal source—equivalent to a failed unit test. Developers already know how to act on that kind of data. They know how to prioritize based on severity and reproducibility, when to flag issues for later, and when to fix them immediately. Security can fit that mold. It just hasn't been given a seat at the table.
Align Security with Agile and Continuous DeploymentPerfect software doesn't exist. Teams deploy with known bugs all the time because getting the product out the door matters more than perfecting every edge case. Security should be viewed similarly: not every vulnerability must be fixed before release, but every risk should be known, tracked, and managed. That's how mature teams work—not by pretending every build must be flawless but by making tradeoffs with their eyes open.
This doesn't mean every security issue needs to block deployment. Just like teams go to market with known minor bugs, they can also do it with low-priority vulnerabilities—so long as there's visibility and a plan.
Deploying with a known issue is one thing. Deploying with a critical vulnerability no one's aware of is something else entirely. When teams pull security data into the same locations they manage tests and bugs, those tradeoffs become more intentional. The product team knows what's at stake, the security team has visibility, and teams can jump on it fast if something changes.
Embed Security Testing Throughout the Development LifecycleSecurity is a lifecycle, not a checklist. It should be embedded into planning, implementation, testing, and monitoring. Address risks early in planning to prevent coding vulnerabilities, integrate testing findings into sprint cycles for timely remediation, and implement post-deployment scans to defend against new threats. This proactive, lifecycle-wide approach shifts security from a daunting challenge to a manageable process, prioritizing strategic risk mitigation over chasing perfection.
Additionally, all teams, regardless of size or resources, stand to gain from leveraging a comprehensive suite of tools that bring security, quality, and testing together under one roof. When signal sources are fragmented across disconnected systems, teams lose time chasing context and resolving conflicts between tools. But with a unified platform, organizations can centralize insights, reduce noise, and make faster, more informed decisions.
This integrated approach helps security shift from a bottleneck to a core enabler of speed and resilience. Instead of reacting to siloed alerts, teams can respond to prioritized, correlated findings within the workflows they already use—accelerating resolution without compromising risk management.
The Stakes Are Already Too High to WaitThe fastest, most effective teams don't just build quickly. They build securely by embedding security into the systems they already trust. They treat security bugs like any other failure and make tradeoffs based on visibility, not guesswork.
Teams that close the gap between security and quality will be better equipped to deliver resilient, high-performing software at speed. By integrating security throughout the development lifecycle—with structured prioritization, continuous feedback loops, and tools that unify signals across teams—organizations can reduce risk, protect their reputation, and earn lasting customer trust.
When done right, security becomes part of the rhythm of development, not a disruption.
We've made a list of the best patch management software.
This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
As a teenager, Joseph Bond fought in Vietnam. Later he started a family and worked for the city of Philadelphia for 35 years. After retiring, there was something he needed — to finish high school.
Ninety-two people were confirmed dead in the rubble of the building. The building was the only one in Thailand to collapse in the earthquake that was centered in neighboring Myanmar.
(Image credit: Sakchai Lalit)