StepTo publishes practical thinking on nearshore development, AI-augmented teams, and engineering leadership, written for CTOs and tech decision-makers. Every post carries the byline of someone at StepTo: Igor Gazivoda (Founder & CEO), Darja Gazivoda (Senior Engineer & Technical Writer), Ivan (Senior Engineer), or the StepTo Editorial team.
Coding agents are optimised to turn a red test suite green, and when the honest route is hard, many of them take a shortcut: they edit the test, special-case the input or build a hollow implementation that only looks finished. Published research now measures how often this happens. Here is what the data shows, why a green CI run no longer proves much, and how to build a verification layer, from protected tests to mutation testing, that an agent cannot game.
Coding agents made writing code close to free, and estimates did not get better. They got worse. Story points, sprint commitments and fixed-price quotes were all built to measure how hard code is to write, and that is no longer where the time goes. Here is where the hours actually went, why your team's instincts are now miscalibrated, and how to estimate, plan and contract for software in 2026.
In the space of two weeks, Salesforce announced it will meter every call a registered AI agent makes to its APIs, Atlassian published overage pricing for agent credits, and Figma's allowlist for MCP clients reached the front page of Hacker News. The systems of record your agents depend on are turning into toll roads. Here is what that does to your agent architecture, your budget and your next software contract, and the engineering pattern that keeps you in control.
Researchers tested nine major AI assistants and found that six of their web clients passed conversation URLs, AI-generated titles, prompts or screenshots to third-party trackers, often alongside persistent identifiers. Nobody designed those leaks. They came from ordinary analytics tags meeting a new kind of page. If you are putting an AI assistant into your own product, here is how the same thing happens to you and how to engineer it out.
A randomised trial found developers who learned a new library with AI scored 17 points lower on a comprehension quiz, with the widest gap in debugging. Half of surveyed executives already see deskilling in their organisations, and only 10% have a strategy for it. Here is what the evidence shows, and how to keep an engineering team sharp while it ships with AI.
More than two thirds of companies that made AI-led layoffs have rehired at least a quarter of the roles they cut, and many spent more restaffing than they saved. Ford brought back 350 veteran engineers. The reversal is real, but rebuilding capacity in a rush creates a second mistake. Here is what the data shows, and how to restore engineering capacity on purpose.
AI coding agents at more than 300 organisations published over 13,000 internal screenshots to public GitHub repositories, not because anyone attacked them, but because a tool could not attach an image. OpenAI's own misalignment reports describe the same pattern: agents that hit a wall and route around it. Here is why agent resourcefulness is now a data-exposure risk, and the engineering controls that contain it.
Microsoft's September Patch Tuesday fixed 974 vulnerabilities, more than six times the count in May. AI models now find flaws faster than maintainers can fix them, and attackers are exploiting some before a patch even exists. Meanwhile, the median time to patch has gone up. Here is why remediation is now a question of delivery capacity, and how to build a pipeline that keeps up.
SpaceX closed its $60 billion Cursor acquisition in August, and OpenAI answered by scheduling a November 12 shutoff of its models inside Cursor. It is the third time in eighteen months that a corporate decision has changed which models a coding tool can offer. Here is how to make your engineering workflow survive the next one.
The PostgreSQL community ships its final PostgreSQL 14 release on November 12, 2026. AWS, Azure and Google Cloud will keep 14 running for a fee, but automatic enrolment turns an unplanned upgrade into a recurring bill. What changes, what it costs, and how to upgrade safely.
Upstream security support for Python 3.10 ends in October 2026, and Azure, Google Cloud and AWS all retire their Python 3.10 runtimes in the same month. The major libraries moved on long ago. What the deadline actually changes, why Ubuntu Pro does not cover your dependencies, and how to plan an upgrade that skips straight past 3.11.
From September 30, certified Android devices in four countries will refuse normal installs of apps not registered to a verified developer, and unregistered Play apps face global removal. The rule is framed as security. For companies that outsourced their mobile app, it is really a question about who owns the identity, the package name and the signing key.
An LTS and an STS release lose security support on the same day for the first time. Changing one line in the project file is the easy part. What actually breaks on the way to .NET 10, what an upgrade agent can and cannot do, and a six-week plan for teams that have not started.
The most-quoted number in the 2026 architecture debate cannot be found in the report it is attributed to. The consolidation trend behind it is genuine, and coding agents have quietly added a new line to the cost of distribution.
Third-party providers now account for roughly two-thirds of publicly reported outages, fewer than a third of organisations run any failover test, and the AI layer is the least reliable dependency most products have. The engineering work that fixes it, and why nobody gets to it.
The same model scored 59.8% under one coding harness and 72.6% under another on identical tasks. Model choice is no longer the variable that decides whether your agents work.
Developers now use AI agents in most of their work and can fully delegate almost none of it. The gap is not model capability. It is that everything your organisation knows is stored in a format no agent can load.
Employees are creating agents faster than IT can list them, and fewer than one in five organisations has a complete inventory. The fix is boring: a registry, an owner per agent, and a retirement rule.
Coding agents execute untrusted code all day, and most teams are containing it with a Docker container that shares the host kernel. The isolation layer, what it costs, and who builds it.
Data centre energy labelling, a narrowed CSRD and AI inference in Scope 3 have turned software carbon into an engineering telemetry problem. What to instrument, and when.
Generic "dedicated team" hiring is stack-agnostic by design, and that's exactly where it fails on a React/TypeScript-heavy frontend. What to vet, staff and onboard for instead, backed by a real 5-engineer case study.
Team-level quotes bundle three seniority levels into a single monthly number. Here's what a single developer in Serbia actually costs, broken out by role and seniority band, with monthly cost examples and a comparison to Poland and Romania.
A ranked "best nearshore companies" list can't tell you which vendor fits your engagement, and the ranking mechanism itself is compromised by design. Here is a replicable framework, criteria, red flags, and first-call questions, for judging any nearshore provider on its own merits.
The EU Pay Transparency Directive turns levelling frameworks, job ads and payroll data into compliance artefacts. Why it lands on engineering leaders, not just HR.
Cross-platform mobile stopped being a two-horse race. What changed with Kotlin Multiplatform, where Flutter and React Native still win, and how to decide.
The Commission's own fitness check put digital consumer detriment at roughly €7.9 billion a year and found 97% of the most popular websites and apps using at least one deceptive pattern. The proposal lands this quarter, and almost every obligation it contemplates is a change to code, not to a policy page.
Most vendors selling a 'RAG system' have only built the easy part, a chat interface wrapped around a model call. A buyer's framework for what to ask before you sign anything.
Zero shipped 1.0, TanStack DB added persistence, and CRDTs stopped eating memory. Instant UI and offline capability are now library decisions rather than distributed-systems projects, which means the cost has moved somewhere most teams are not looking.
Enforcement trackers already record a NIS2 fine issued for missing supply chain controls. Article 21(2)(d) does not fine your software supplier, it obliges your client to police them, and that arrives as a contract clause, an audit right and a 24-hour clock.
The European Health Data Space turns EHR interoperability into a shipped software component with a CE mark on it. The specs land in 2027, the obligations bite in 2029, and the build starts now.
Agents now run for hours, not seconds, and the runtimes they were deployed on assume a request finishes in milliseconds. The missing piece is not a better model, it is a state layer, and every major platform has now shipped one.
Outstaffing, outsourcing and staff augmentation get used as if they mean the same thing. They don't. The difference is who manages the work, and it changes your contract, your risk, and your invoice.
The timeline between signing and shipping is the question every buyer asks last and regrets not asking first. Here's what actually determines it, and where the real delays hide.
"We own everything you build for us" is not automatically true, in most jurisdictions it isn't true at all without a written assignment clause. Here's what the contract actually needs.
Postings for forward deployed engineers jumped roughly 800% in nine months and senior packages clear half a million dollars. The scarcity is not model talent. It is people who can land AI inside a real business.
NPU-equipped machines cross half of global PC shipments this year, and every flagship phone now exposes a local model runtime. Running inference on the device kills the token bill and the cross-border transfer problem, and hands you a fleet problem in exchange.
AI product gross margins average 52% against the 80-90% SaaS baseline. The gap does not close with a pricing page. It closes with metering, per-customer cost attribution and an outcome definition you can defend in a billing dispute.
European enterprises are being pushed off VMware by pricing and partner-programme decisions they did not choose. The platform swap is the easy part. The application archaeology underneath it is where the schedules die.
Truffle Security re-verified 10,616 publicly exposed AWS keys in August 2026 and 88% still authenticated. AI-assisted commits leak secrets at 3.2%, roughly double the platform-wide baseline. Credential hygiene has become an engineering discipline, not a security checkbox.
Enterprise buyers turned ISO/IEC 42001 into a supplier gate this year. Barely 350 organisations worldwide hold it, and the European Commission has said in writing that it does not meet the AI Act. Here is what the certificate proves, what it does not, and what to ask a development partner instead.
Belgium switched on in January, Poland in February, France on 1 September. Mandatory structured e-invoicing is filed as a tax project and staffed as a tax project. Every deliverable in it is systems integration with a statutory go-live date.
European teams spent 2026 planning around one AI Act. The rules that already bind software sold into the United States arrived one state at a time, and almost all of them are build tickets with dates attached.
From 12 January 2027 the EU Data Act bans cloud switching charges outright. The financial barrier to leaving disappears. The engineering barrier, which was always the real one, does not.
The 2024 default was a dedicated vector store bolted next to your database. In 2026 the benchmarks, the acquisitions and the erasure rules all point the other way.
Return-to-office mandates are usually argued as a culture question. For engineering organisations they are a talent question with measurable answers, and the measurements are not flattering.
Voice agents demo beautifully and break the moment a real person talks over them. The gap between a convincing demo and a production phone line is a real-time systems problem, and most teams staff it as a prompt-writing problem.
Iceberg v3 shipped and Polaris graduated, so the open table format argument is over. The bottleneck moved up a layer to catalogs, compaction and pipelines, which is exactly where AI projects are quietly dying.
The EU registry went live in July 2026 and the first hard deadline is 18 February 2027. A product passport is not a compliance document, it is a distributed system with a ten-year uptime commitment.
Only 39% of SAP's ECC customers had moved by the end of 2024. With mainstream support ending in 2027, the deadline is now a staffing problem, and a large part of the work does not need an SAP specialist.
Europe deferred the high-risk AI rules to December 2027, and most engineering teams heard 'the deadline moved.' Article 50 transparency obligations went live on 2 August 2026 exactly as scheduled, and they are a build task, not a policy memo.
curl shut its bug bounty, Ghostty banned drive-by AI pull requests, tldraw auto-closes external contributions. Meanwhile 93% of commercial codebases contain components nobody has touched in two years. These two facts are the same fact.
36% of organisations will spend over $1M on observability this year, and AI workloads emit an order of magnitude more telemetry than the services they replaced. The cost driver is cardinality, and sampling is the wrong fix.
All 27 member states must ship a digital identity wallet by the end of 2026, and regulated sectors must accept one by December 2027. It is not an SSO integration, and the parts that break are in your data model.
Average GPU utilisation across tens of thousands of Kubernetes clusters is 5%, and 93% of enterprises are revisiting where AI runs. The answer is a utilisation number per workload, not a strategy slide.
Computer-use agents now beat the human baseline on OSWorld. That says almost nothing about whether one should be driving your ERP, and the gap between the two is where the money goes.
AI SRE agents are already cutting investigation time dramatically — DoorDash reported up to an 87% reduction in time to root cause after deploying one. That is not the same metric as time-to-restore, and the gap between them is where your on-call engineers still live.
CISA's memory safety roadmap date was January 1, 2026. It was never legally binding, but it has arrived in procurement questionnaires anyway, and most C and C++ teams have nothing to send back.
Technical diligence has moved to the front of the deal and it now moves the price. Much of the code being bought is machine-written, and the signals buyers have relied on for twenty years no longer mean what they used to.
AI-referred traffic to retail sites rose 393% year over year and now converts 54% better than every other channel. 73% of merchants are not agent-ready, and the gap is backend work, not marketing.
AI-generated code carries 1.7x the defects and 81% more duplication, while QA ratios move from 1:4 to 1:9. The bill for that trade arrives about two quarters later.
The same agent returns very different value on a clean service than on a decade-old repo. The variable isn't the model. It's whether your codebase is agent-ready.
A $100,000 H-1B fee arrived, then a court struck it down. A wage-weighted lottery quietly closed the entry-level pipeline. How to staff when it's unplannable.
If your outsourcing contract prices developer-hours, AI has quietly changed what you're buying without changing what you pay. How to tell if you're overpaying.
Hiring a developer abroad as a contractor looks simple. It creates two liabilities most companies never price: permanent establishment and misclassification.
Published attrition rates at major IT services firms run 13-15% a year, a coin-flip chance of losing someone in year one. Most contracts say nothing about it.
Almost every outsourced engineering team touches real customer data without anyone deciding they should. What GDPR requires, and your fine-tier exposure.
The revised EU Product Liability Directive hits software sold after 9 December 2026, no-fault liability, forced source disclosure, 25-year liability tail.
European sovereign cloud spending rises 83% in 2026 as CADA turns sovereignty into law on August 4, requirements land on architecture, not procurement.
Gartner expects AI evaluation platform adoption to more than triple by 2028. Teams stuck in pilot purgatory aren't short of models. They're short of evals.
Your business logic now lives in prompts, tool schemas and embeddings tuned to one provider. Gartner expects 60% of organisations to face significant migration costs by 2027. Portability is an architecture, not a procurement clause.
The EU Cyber Resilience Act's 24-hour reporting duty begins September 11, 2026, years before the full deadline. Outsourcing doesn't transfer the obligation.
Agentjacking needs only a public Sentry DSN and an HTTP client, no stolen credentials, and hit 85% code-execution across Claude Code, Cursor, and Codex.
The agent frameworks are Python-native. Your product is TypeScript. Most production systems run both, and the only question that matters is where you draw the line between them.
Your margin is consumed within months of shipping. Your security update obligation runs at least five years. The Cyber Resilience Act just made that asymmetry a legal requirement rather than a business choice.
GitHub Copilot's June 2026 shift to usage-based billing had developers projecting $29 bills at $750, a symptom of costs becoming impossible to forecast.
Straight-through processing has moved from 15% to 70-90% and underwriting from three days to three minutes. The same systems delivering that are classified high-risk under the EU AI Act, with obligations now due in December 2027.
You are paying full rate from day one for output that arrives in week eight. Everything that determines whether that gap is six weeks or twelve happens before the engineer writes a line of code.
A €28 hour and a €50 hour are not competing on price. They are competing on how much of the real cost each one hides. Here is the model that makes them comparable, with the arithmetic worked through.
Poland has 400,000-600,000 developers depending on the count and premium pricing. Romania is the cheapest EU option. Serbia is the lowest-rate senior market in Europe and is not in the EU. Which trade-off you can absorb is the whole decision.
180ms versus 3.8 seconds to first request. 68MB versus 412MB under load. When compute got expensive, runtime footprint stopped being a benchmark curiosity and became a line item.
North Korean IT worker fraud rose 220% in a year, deepfakes now pass live interviews, and the scheme reached Serbia. Why verified hiring is a security control.
Laravel sits at 64% framework adoption against Symfony's 23%. That gap tells you about hiring speed, not about which one survives a decade in your business. Here is the decision as it actually is.
Build quotes for an iOS app run $30K to $250K. The build is the part everyone prices. Apple's April 2026 SDK mandate, DMA distribution, age assurance and the maintenance curve are the parts nobody does.
Server DRAM contract prices roughly doubled in 2026 and memory now eats 30% of hyperscaler capex. Cloud passthrough is 5-10%. Here's what that repriced in your architecture.
StepTo's estimate: custom AI runs $5K for focused automation to $100K+ for full multi-system platforms. What drives prices up, and how to spot a real quote.
McKinsey calls humans working beside AI agents the biggest operating-model shift since the digital revolution. What it changes about building software.
Most outsourcing failures trace back to vetting, not code. Vetting questions, red flags, and how to structure a paid pilot before you sign a long-term contract.
Gartner: 40%+ of agentic AI projects will be canceled by 2027. The cascading failure problem behind broken automations, and what production-grade needs.
78% of surveyed Retool users expect to build more of their own tools in 2026. The ROI math for when building beats subscribing, and how to do it right.
60% of workers now have sanctioned AI tools; only 34% of companies have redesigned anything around them. You have an integration problem, not an AI problem.
Bolt, Lovable, and Cursor make software look effortless. When AI tools are the right call for your business, and when production reality says otherwise.
Outsourced builds usually fail at selection, not execution. A due diligence framework for non-technical buyers: red flags, green flags, and the right questions.
A vague brief is why software projects blow up. How to write one clearly enough for accurate proposals, and how to turn it into an RFP template for vendors.
A first-pass vetting framework for choosing a software or AI development agency in 2026: five questions, five red flags, and what good partnership looks like.
McKinsey: 88% of enterprises use AI, just 39% see any enterprise-level EBIT impact. It's a measurement failure, here's how value-capturing teams differ.
SaaS churn is accelerating as AI agents replace whole tool categories. A CTO framework for which subscriptions to cancel, and which replacements backfire.
A fine-tuned 7B model on your own infrastructure can beat GPT-4 on your domain at a fraction of the inference cost. What the SLM shift actually requires.
AI now drafts most of the code at high-adoption teams, yet working engagements are getting smaller, more senior, and pricier per head. The economics explained.
Reddit killed r/all and r/programming banned LLM posts in the same week. The open web's engineering knowledge layer has fractured, what CTOs should do.
81% of enterprise leaders worry about AI vendor dependency yet deepen it quarterly. What Big Three lock-in means for your architecture and exit options.
Tesla, Figure and Boston Dynamics are moving humanoids toward production. What that means for software teams and the disciplines about to get valuable.
Gartner logged a 1,445% surge in multi-agent inquiries. In production, coordinated agents behave like distributed systems, plan for those failure modes.
84% of developers use AI but only 32.7% trust it, and fewer than half always verify it before committing. Inside Stack Overflow's adoption-trust paradox.
AI tools made a coding task 55.8% faster in a controlled trial, yet team delivery has not kept pace. The delivery paradox has a specific, fixable cause.
77% of employees paste data into GenAI prompts, most of it from unmanaged accounts. Shadow AI, prompt injection, RAG poisoning, and the governance that works.
A step-by-step playbook for building a dedicated remote software team: geography, vendor vetting, interviews, real cost benchmarks, and the first 90 days.
45% of AI code-generation tasks introduce a security flaw, and experienced devs took 19% longer with AI. What the vibe coding research actually says for 2026.
Want senior engineers who move work forward, not just tickets?
Work with accountable, English-fluent professionals who communicate clearly, protect quality, and deliver with a steady operating rhythm. Cost efficiency matters, but performance is why clients stay with us.
