Software understanding is the analysis and interpretation of software systems' behavior, structure, and functionality, particularly when dealing with incomplete documentation or source code. The field encompasses technical practices such as reverse engineering, code analysis, and formal verification to ensure software functions securely and reliably.
Definition and scope Software understanding involves examining software systems to verify their functionality, safety, and security across various operational conditions. This includes both static analysis of code and dynamic observation of runtime behavior. The practice has become increasingly important as software systems have grown more complex and interconnected, often incorporating third-party components and open-source libraries that organizations did not develop internally.
History
Early development (1960s–1980s) The need for systematic software understanding emerged during the "software crisis" of the 1960s–1980s, when the complexity of software systems began to outpace developers' ability to maintain and verify them reliably. Notable incidents during this period highlighted the importance of thorough software analysis:
The Therac-25 radiation therapy accidents in the 1980s, caused by software bugs that escaped traditional testing methods, resulted in fatal radiation overdoses. In response, software engineering practices evolved to emphasize program comprehension and maintainability through structured programming, code inspections, and early formal verification methods.
Modern challenges (1990s–present) The widespread adoption of open-source components, complex software supply chains, and rapid deployment cycles have created new challenges for software understanding. Organizations often run software they did not develop, making it difficult to fully comprehend system behavior.
The software understanding gap The "software understanding gap" refers to the growing disparity between society's reliance on complex software and the capacity to analyze and verify that software's behavior. The 2025 Closing the Software Understanding Gap report urged coordinated national action, including the creation of a cross-agency executive council and increased accountability for secure-by-design software. The report also called for the introduction of technical innovations, such as artificial intelligence, to develop reliable and affordable capabilities for analyzing software at scale. Undersecretary of Defense for Research and Engineering Emil Michael highlighted this report in comments to the DARPA Resilient Software Systems Colloquium in June 2025. In addition to government-led efforts, the topic of software understanding has also gained attention in the research community. In 2025, the Software Understanding and Reverse Engineering (SURE) Workshop will be held to bring together academics and practitioners working on technical challenges in program analysis, formal verification, and reverse engineering.
Contributing factors Several factors contribute to this gap:
Underinvestment in analysis tools: Decades of prioritizing rapid software development over comprehensive analysis capabilities have created a backlog of software that cannot be thoroughly understood with current tools. Overreliance on testing: Organizations often rely on functional testing and vendor attestations rather than deep code analysis, which may miss hidden vulnerabilities or malicious functionality. Scalability limitations: Current program analysis tools face limits in scale and precision when applied to modern software systems, which can have astronomically large numbers of possible execution states. Rapid evolution: Continuous software updates make it difficult for understanding efforts to keep pace with changes. Mindset: Not fully understanding software is seen as inevitable; a norm, perhaps as a matter of science stemming from the halting problem; or economics because it's infeasible to address.
Government initiatives
United States efforts In March 2023, a "Software Understanding for National Security" (SUNS) workshop was held in Arlington, Virginia, bringing together experts from 18 government agencies to assess the state of software understanding capabilities. In January 2025, four U.S. agencies (CISA, NSA, DARPA, and OUSD (R&E)) released a joint report titled "Closing the Software Understanding Gap," describing software understanding as a national security priority and calling for coordinated government action. The report proposed several approaches:
Promoting secure-by-design practices and independent third-party attestation Implementing policy and procurement changes to require higher software transparency standards Investing in technical innovation and R&D for automated analysis tools Building workforce capabilities and cross-sector collaboration In 2025, a National Academies consensus study on cyber hard problems emphasized the need for software understanding.
Methods and techniques Methods for gaining understanding can be seen on a spectrum of how much the participation of the creator is important. This list is sorted by increasing dependence on their participation.
Dynamic analysis
Dynamic analysis observes software behavior during execution in controlled environments. Techniques include sandboxing, fuzz testing, and runtime monitoring. This approach can reveal emergent behaviors but only covers the specific execution paths tested.
Reverse engineering
Reverse engineering analyzes compiled software without access to source code, using tools like disassemblers and decompilers. This is essential for analyzing malware, legacy systems, and third-party software.
AI-assisted analysis Machine learning and artificial intelligence are increasingly applied to software understanding tasks, including pattern recognition, vulnerability prediction, and automated code summarization.
Static analysis
Static analysis examines code without executing it, using automated tools to identify potential vulnerabilities, coding errors, or suspicious patterns. While comprehensive in scope, static analysis can produce false positives and may struggle with complex program interactions.
Threat modeling
… excerpt ends here. Continue reading the full article.
