Skip to main content
Lornets

Insights

Research & Evidence

Standards, research and industry evidence relevant to production assurance, rapidly built software and technical risk.

Lornets reviews primary research, recognised engineering standards, government guidance and transparent industry evidence. Source findings, Lornets interpretation and material limitations are kept distinct.

Filter by topic

Selecting a topic filters the full library further down this page. Select it again to clear it.

Featured evidence

24 published evidence notes

Evidence signals

Each signal carries its source, response base, material limitation and attribution. Values are only ever taken from the published source data, and results from different questions or studies are never placed on one shared axis.

AI adoption is high. Trust in accuracy remains cautious.

AI adoption

84%

Using or planning to use AI tools in development

n = 33,662

Trust in output accuracy

Trust

33%

Distrust

46%

n = 33,244

Limitation
Survey respondents were recruited primarily through Stack Overflow channels. The two panels represent separate questions and different response bases. The results describe reported use and trust, not software quality or production readiness.
Attribution
Source: Stack Overflow Developer Survey 2025. Contains information made available under the Open Database License (ODbL) v1.0. Lornets visualisation of source data. AI-use and trust figures come from separate survey questions with different response bases.

Read the original research

Review burden differed by contributor-experience proxy in one large AI-assisted OSS dataset

Higher-experience group = 1x

Commits per PR

2.15x

Files changed per PR

1.47x

Review comments

4.52x

Resolution time

5.16x

Acceptance rate was 31% lower for the lower-experience group.

Limitation
The study uses historical GitHub contribution activity as a proxy for experience and examines AI-assisted pull requests in open-source repositories. The results should not be generalised directly to whole commercial applications or to developer skill generally.
Attribution
Source: Asdaque et al., "Novice Developers Produce Larger Review Overhead for Project Maintainers while Vibe Coding", MSR 2026, CC BY 4.0. Lornets visualisation adapted from reported results. Contributor experience is estimated using a GitHub activity proxy.

Read the original research

Where the evidence is not simple

AI-assisted development is often discussed as though it has one universal productivity effect. Current evidence indicates that the measured effect depends on the developer, task, repository, tool and outcome being measured.

When does AI actually make software development faster?

  1. Substantial gains in large field experiments

    Three randomised field experiments covering 4,867 professional developers found a positive combined effect on completed development tasks.

    EVD-0011

  2. A measured slowdown in experienced maintainers

    A controlled study of experienced open-source developers working on real issues in repositories they knew well measured slower task completion when early-2025 AI tools were available.

    EVD-0013

  3. Local development gains meet system constraints

    DORA's research suggests AI acts as an amplifier of the wider engineering environment and that increased development velocity can interact with downstream delivery constraints.

    EVD-0009

The cited studies measure different outcomes and should not be presented as directly comparable effect sizes.

Explore the evidence tension

Standards and reference frameworks

Standards and government guidance are held in the same evidence register as research, so a standard can be mapped to framework domains and services in the same way. Lornets does not reproduce copyrighted standards material and is not certified by or affiliated with these organisations.

ISO/IEC 25040:2024

ISO / IEC, 2024

A current ISO SQuaRE standard covering the framework, concepts, requirements and process for evaluating ICT product, data and service quality.

Technical Standard

View Evidence Note

ISO/IEC 27001:2022

ISO / IEC, 2022 edition, with Amendment 1:2024 applicable, 2022

An international requirements standard for establishing, implementing, maintaining and continually improving an Information Security Management System.

Technical Standard

View Evidence Note

Browse the evidence

Records carry more than one topic where more than one applies. Nothing is forced into a single exclusive category.

Showing 24 of 24 records

Government Guidance

2026

Supplier Assurance Questions

UK National Cyber Security Centre

Supplier assurance can include governance, incident recovery, cloud configuration, privileged access, bespoke software security, data handling, testing and certification.

  • Enterprise Assurance
  • Security & Supply Chain
  • Reliability & Operations

Read Evidence Note

Practitioner Reference

2026

Software Due Diligence

Deloitte

Technical diligence can examine product capability, architecture, technology stack, technical debt, R&D organisation, open-source use, hosting, cloud, cybersecurity and scalability.

  • Fundraise & Technical Diligence
  • Architecture & Platform Transition
  • Software Quality & Maintainability

Read Evidence Note

Technical Standard

2022

ISO/IEC 27001:2022

ISO / IEC, 2022 edition, with Amendment 1:2024 applicable

ISO/IEC 27001 addresses organisational information-security management.

  • Enterprise Assurance
  • Security & Supply Chain

Read Evidence Note

Technical Standard

2023

ISO/IEC 25010:2023

ISO / IEC

The 2023 edition defines a product-quality model using nine quality characteristics.

  • Software Quality & Maintainability

Read Evidence Note

Technical Standard

2024

ISO/IEC 25040:2024

ISO / IEC

Software quality evaluation is a process rather than merely a list of product characteristics.

  • Software Quality & Maintainability
  • Enterprise Assurance

Read Evidence Note

Government Guidance

2022

NIST Secure Software Development Framework v1.1

National Institute of Standards and Technology, SP 800-218, SSDF v1.1

SSDF organises secure-development practices into a structured set of outcomes rather than prescribing one development methodology.

  • Security & Supply Chain
  • Software Quality & Maintainability

Current, revision underway

Read Evidence Note

How we select evidence

Lornets prioritises primary technical standards, government and institutional guidance, peer-reviewed research and transparent industry evidence. Vendor and practitioner research may be included where useful and is identified by evidence type.

Source findings, Lornets interpretation and material limitations are kept distinct. Where credible evidence points in different directions, those differences are made visible rather than forced into a single conclusion.

Sources are periodically rechecked because standards, software platforms and AI engineering practices continue to change.

How this evidence is used

Evidence informs the Lornets Production Assurance Methodology. It does not replace direct examination of a specific system: a conclusion about your software comes from your context, your evidence and structured senior engineering judgement.

Explore the Production Assurance MethodologyDiscuss Production Readiness