That goal of never debugging in production is understandable. But some companies have that software that falls in to the shit-in-shit-out category of software.

That goal of never debugging in production is understandable. But some companies have that software that falls in to the shit-in-shit-out category of software. By that, I mean software that does basically no input validation and consistency checks. The business never wants to think through all the cases, they are just willing to specify the minimum of requirements for the easy cases. In such an environment you have no chance without looking at the real pile of s.., hmm data. Obviously such companies should have an empty intersection with ISO27001-regulated once.