If you run engineering for a booking, reservations, or operations platform in travel, transport, or logistics, you are managing a contradiction that got sharper in 2025. Your throughput is up. Your delivery stability is not necessarily following. The same tooling that lets a team ship more changes per week also surfaces every weakness in how those changes are tested, gated, and observed, and in tightly coupled travel stacks a single bad change does not degrade gracefully. It grounds the operation.
This is not a tooling problem to be bought away. It is a discipline problem in the software delivery lifecycle, and the data from the last twelve months is unusually clear about where the failures cluster. This piece walks through four concrete pressures, what the evidence says, and what disciplined teams actually do differently.
Key takeaways
- AI raises throughput but lowers delivery stability, so mature pipelines, automated testing and fast feedback loops have to come first.
- In tightly coupled travel stacks one dependency failure can halt operations, as the 2025 outages at American, United and Alaska Airlines showed.
- Decoupling, headroom for 5x to 10x traffic spikes and real-time health checks are the architectural answer.
- Buying a platform is not the win: it earns its budget only when it is run as a product.
- The EU's Digital Operational Resilience Act and sustained supply-chain attacks turn resilience testing, third-party governance and pipeline hardening into delivery constraints.
Faster delivery is exposing weak foundations, not fixing them
The 2025 DORA research, drawn from roughly 5,000 technology professionals, reports that 90% now use AI at work and over 80% see productivity gains. The uncomfortable finding sits next to it: AI has a positive relationship with throughput and product performance but a negative relationship with software delivery stability. DORA's framing is the part worth pinning to the wall: AI is an amplifier, not a fixer. Strong systems get stronger; weak systems become more visibly unstable.
The follow-up ROI analysis put a number on the downside. Across a 500-person model, change failure rate rose from 5% to 6% after AI adoption, and that single point translated to roughly $344,000 of downtime impact. The same analysis found productivity gains skew heavily toward simple greenfield work (35 to 40%) versus complex legacy code (around 10% or less), which is precisely the inverse of where most travel platforms spend their time.
The foundations come first
The implication for a director is direct: if your pipelines, automated test coverage, and feedback loops are not already mature, accelerating delivery will raise change-failure rate and rework before it raises anything you want.
Tightly coupled stacks turn one dependency failure into a ground stop
Travel and aviation platforms run interconnected systems, reservations, crew and aircraft scheduling, departure control, payments, and supplier APIs, where a failure deep in one dependency can halt operations even when aircraft and crews are ready. 2025 made the cost of that coupling impossible to ignore:
| Outage | What happened |
|---|---|
| American Airlines, June 27 | The outage hit 40% of its flights. |
| United, August 6 | A failure of Unimatic, which handles weight-and-balance calculations, caused 1,086 delays and 201 cancellations across its hubs. |
| Alaska Airlines, October 24 | The pattern repeated badly: the outage triggered a nationwide ground stop, 400-plus cancellations, and roughly 49,000 stranded passengers. It was its second fleet-grounding outage in four months. |
Legacy systems and tight coupling are cited repeatedly as root causes, not bad luck. The engineering response is architectural and unglamorous:
- Decouple the monolith so search, booking, payment, ticketing, and CRM run independently and a slow supplier degrades one surface instead of all of them.
- Design explicitly for 5x to 10x traffic spikes rather than average load.
- Treat real-time health checks as a first-class control, not an afterthought.
Reference architecture work in this space attributes meaningful gains to exactly these moves: decoupled services supporting more concurrent users at peak, and real-time health checks materially reducing peak-hour downtime.
Toil and a platform-adoption gap drain the capacity resilience needs
The capacity to build that decoupling and observability is the same capacity most travel orgs are quietly burning on undifferentiated work. Platform-engineering analyses in 2026 put developers at 30 to 40% of their time on infrastructure tasks unrelated to business logic, and roughly 40% on tool configuration and troubleshooting. Platform engineering is the prescribed remedy, and adoption is near-universal: DORA reports 90% of organizations have adopted at least one platform, with a high-quality internal developer platform correlating directly with unlocking AI value.
Adoption is not the same as value. Predictions for 2026 hold that around 80% of organizations will have platform teams while fewer than 30% see measurable developer-productivity gains, with many spending $500K to $2M per year on internal platforms their developers route around.
Procurement is not the win
The lesson for a director: a platform earns its budget only when it is run as a product, with real users, user-centric scope, and governance, rather than as a mandated layer.
DORA's decision to add a Rework Rate metric is a tell: AI-driven rework is now a measurable, named drain on capacity, and it competes head-on with the resilience work you actually want done.
Compliance and supply-chain security are now delivery constraints, not side quests
Two pressures have moved from governance slideware into the critical path of delivery. The first is regulatory. The EU's Digital Operational Resilience Act entered into application on 17 January 2025, with European Supervisory Authorities empowered to impose fines from that date.
What the Act mandates, and for whom
It mandates an ICT third-party risk-management strategy, a registry of all ICT contractual arrangements, mandatory contract provisions, and a digital-operational-resilience testing program that includes advanced, threat-led testing. It is scoped to financial entities, but travel platforms handling payments and their ICT vendors are increasingly pulled into the oversight of critical third-party providers and concentration risk.
For a Benelux or wider European travel team, that means resilience testing and third-party governance are becoming auditable obligations, not internal best practice.
The second pressure is the software supply chain underneath all of it. Sonatype's 2026 report logged 454,648 new malicious open-source packages in the past year, with the threat shifting from spam and stunts to sustained, often state-sponsored campaigns. Insecure CI/CD pipelines and lack of dependency visibility rank as top risks.
The August 2025 S1ngularity attack made it concrete: a vulnerable GitHub Actions workflow in the Nx repository was exploited to steal an npm publishing token. Against 9.8 trillion annual component downloads, a large share of vulnerable Maven Central and NuGet releases carried CVSS 9.0+ scores. For a high-availability platform, dependency governance, signed artifacts, and pipeline hardening are no longer hygiene items you defer. They are preconditions for resilient delivery.
What good looks like
The teams that hold up under peak load and audit pressure share a recognizable set of practices:
Closing the loop
None of the four pressures is solved by a product purchase. Each is a property of how a team designs, tests, ships, and governs change over time, which is to say each is an SDLC and platform-engineering discipline. The throughput is available to almost everyone now. What separates a platform that absorbs a peak from one that becomes the next ground-stop headline is whether the foundations underneath that throughput were built deliberately. That is the work, and it is the work worth investing in before the next peak season tests it for you.
Sources
- Announcing the 2025 DORA Report - Google Cloud Blog
- New DORA Report Claims Strong Engineering Foundations Drive AI Return on Investment - InfoQ
- IT outages are plaguing air travel. Here's what to know - CNN
- Alaska Airlines Devastated by Major IT Outage: Over Four Hundred Flights Canceled, 49,000 Passengers Stranded - Travel And Tour World
- The EU's Digital Operational Resilience Act Comes Into Effect - Ogletree Deakins
- 2026 State of the Software Supply Chain Report - Sonatype
