Blogs
Thought leadership from Merito practitioners covering secure software delivery, DevOps culture, and emerging tooling trends. Actionable insights you can put to work immediately.
Explore BlogsResource Hub
Explore curated expertise from our team. Blog insights, customer success stories, and practical guidance for building secure, high-performing software delivery organizations.
Thought leadership from Merito practitioners covering secure software delivery, DevOps culture, and emerging tooling trends. Actionable insights you can put to work immediately.
Explore BlogsReal-world transformations that showcase how we partner with teams to modernize pipelines, strengthen application security, and ship with confidence across regulated industries.
Explore Case StudiesTrack platform enhancements, release notes, and rollout guidance from Merito across the tools and ecosystems enterprise teams rely on.
Explore Product Release UpdatesWatch concise briefings, walkthroughs, and expert explainers covering software delivery strategy, platform operations, and modernization priorities.
Explore VideosRegister for live Merito webinars on software quality, test automation, and application security, bring your questions, and watch recordings of past sessions on demand.
Explore EventsGrab guides, checklists, and reference PDFs from the Merito team to put enterprise software delivery, security, and modernization guidance to work.
Explore PDF DownloadsCurated picks from our team—explore thought leadership and transformation stories that showcase how Merito accelerates secure software delivery.

This blog shows how CVE‑2025‑31324 became a SAP NetWeaver business risk due to exposed services, weak controls, and missing negative tests. Discover how SAP automation with Merito MAPS reduces outage risk.

Navigating the End of Life for Jira Data Center with Atlassian phasing out Jira Data Center, many organizations are facing a critical crossroads. In this video, Adam Sandman (CEO of Inflectra) and Louis Tadman (CTO of Merito) discuss the official roadmap, the challenges of forced cloud migrations, and why SpiraPlan is the premier on-premise and self-hosted alternative.
Find the stories, guides, and insights that match your initiatives. Filter by resource type or search by topic to surface the most relevant content.

This case study covers how Merito upgraded a large regulated electric utility's OpenText ALM Octane platform from 16.1.100 to 25.1 LTP in one approved production change window, after earlier attempts had stalled. It details the three release hops, the Elasticsearch 7.16 to 8.11 and JDK 11 to JDK 21 moves, the move to Windows Server 2022, the rehearsal on a full production replica, and the Merito upgrade toolkit, with 222 million records migrated, no data loss and no rollback.

Anthropic Claude September 2026 adds Claude 5.5 models, plugin publishing, conversation-based Cowork work, and artifact creation. It also introduces Salesforce in Claude beta and Enterprise smart reports beta, with plan-specific availability.

Sonatype IQ Server 208.1 strengthens certificate trust protections after the eMudhra certificate authority compromise. It updates UI and backend container images to remove affected root certificates and block connections that rely on compromised certificate chains.

Release Radar Episode 05 reviews 10 enterprise software releases published between September 23 and October 6, 2026, from Checkmarx, Panaya, Perforce, Semgrep, TestRail and Tricentis. The thread running through the batch is labels on blank results: Semgrep Guardian reports whether it ran, Checkmarx One 3.66 reports SCA reachability in 5 statuses, Tricentis SeaLights lists covered SAP objects next to uncovered ones, BlazeMeter 3.6 shows a banner on paused notifications, and TestRail 10.8.1 fixes attachments wrongly reported as orphaned.

A Tosca Cloud migration moves SAP test automation from Tosca Commander on company servers to the Tricentis-hosted SaaS version of Tosca. Teams can upgrade on-prem to Tosca 26.1 in about 10 to 14 weeks or migrate to Tosca Cloud in about 12 to 22 weeks. A phased plan triages the test library, runs DEX and Elastic Execution Grid in hybrid, assigns ownership, and connects results to release gates. Merito delivers this work as a Tricentis Certified Solution Partner.
.png&w=2560&q=75)
Semgrep October 2026 adds Semgrep Guardian support for Codex and extends controls for AI providers and Agentic Workflows. It also improves GitHub integration reliability, exposes Autofix results in the findings API, and fixes scan, secrets, and workflow execution issues.

AI test case generation in tools like TestRail, qTest, and Xray makes cases nearly free to produce, so suites grow faster than teams can review, run, or maintain them. The fix is a scenario gate: define risk-based test scenarios first, have an accountable owner approve them, and generate cases only inside approved scenarios with a per-scenario cap and deduplication. Every case then traces to a requirement and a risk, which gives leaders real release evidence and shows which manual cases deserve automation first.
Sonatype Nexus Repository 97 adds the Pro+ edition, which evaluates requested components against Sonatype intelligence and organizational policies before intake. The release also improves cross-format service-account authentication, chained proxy behavior, Nexus One search, proxy health coverage, and Swift Firewall protection.

SAP test libraries go brittle as transports, support packages, S/4HANA programs, and Fiori updates change the system, and go stale as tests drift from the live business process. Merito pairs Tricentis Tosca and SAP Enterprise Continuous Testing with Claude and context engineering. Claude reads process context from SAP Signavio, change context from transports and Tricentis LiveCompare, test context through the Tosca MCP Server, and run context from results, so the framework hydrates test cases, retires stale tests, runs root cause analysis, and proposes Module repairs for human approval.

Perforce BlazeMeter 4.1 enables JMeter teams to check, automate, and load test MCP servers over STDIO, SSE, and Streamable HTTP. It also adds reduced Taurus Cloud image choices and addresses three identified high-severity vulnerability entries in Taurus Cloud 2.4.538-reduced.
Perforce Perfecto 26.10 introduces a unified AI Command, user-level AI access controls, and certificate selection for AI Scriptless desktop web sessions. It also adds Espresso support for Android Appium testing, expands iOS and browser coverage, and sets Appium 3.6.0 to become the default on January 3, 2027.

OpenText SDP 26.4 introduces semantic search for defects, enhanced dashboard and filtering controls, and richer application-module reporting. It also releases the MCP server, adds Harness CI runtime parameters, and expands APIs for similarity, tenant activity, and BDD workflows.

Release Radar Episode 04 reviews 8 enterprise software releases published between September 5 and September 22, 2026, from Inflectra, OpenText, Panaya, Perforce, Sonatype and TestRail, plus a first look at Checkmarx Fusion ahead of general availability. The thread running through the batch is stops in front of the save: Panaya blocks AI code corrections that touch 90% of the source and checks for newer script versions on save, BlazeMeter splits test data across engines, and TestRail centralizes token revocation, while Sonatype lets one user enable AI Developer for a whole organization.
Black Duck Detect 12.1.0 adds support for OpenJDK 25 and updated versions of pip, Pipenv, Setuptools, uv, Poetry, and Go. It also improves dependency visibility and corrects scan failures or inaccurate BOM results across several ecosystem detectors.
TestRail 10.9.1032 broadens API support for automation, reruns, incremental synchronization, and current test-state reporting. It also adds configurable inactive-user deactivation, improves large-instance query performance, and resolves 44 defects.
This video demonstrates a two-way integration between Azure DevOps and Tricentis qTest built on qTest Pulse. Azure DevOps service hooks send work item created, updated and deleted events to Pulse, which keeps the matching qTest requirement current. A defect submitted from a failed test run in qTest is created in Azure DevOps as a bug with a qTest tag and a link back, and changes made to that bug in Azure DevOps update the qTest defect. The demo also shows Slack notifications sent by Pulse and test case generation with qTest Copilot.

Enterprise test management software should be evaluated against real workflows, not generic feature lists. Use weighted requirements and a proof of concept to validate structure, integrations, reporting, scalability, migration, and total cost before making a selection.

The Merito UFT Phoenix customer brief is a two-page overview of how Merito moves OpenText UFT One test suites from VBScript to Python. It explains why VBScript deprecation and Python support in OpenText Functional Testing make the move timely, what UFT Phoenix does, and how Merito runs the migration with your team from a read-only assessment through rollout.

Merito has achieved the Select partner tier in the Claude Partner Network Services Track. The Claude Partner Network is how Anthropic works with the firms that put Claude into production for customers. Merito delivers Anthropic Claude strategy, rollout and operations services across AI Rollout and Activation, Agentic Build, and Managed AI Operations.

What nearly 4,000 software quality and security professionals say about AI in QA, QA and security convergence, and the teams, tools, and KPIs behind release quality.

This video explains the AI capabilities shipping in Tricentis Tosca 26.1, including AI chat in Tosca Commander, manual to automation, requirement to automation, and self-healing scripts, and walks through the two upgrade paths, an on-prem upgrade with cloud-delivered AI or a full Tosca Cloud migration, with realistic timelines for each.
Release Radar Episode 3 covers 9 enterprise software releases from August 26 to September 4 across Checkmarx, Microsoft, OpenText, Perforce, Sonatype, TestRail and Tricentis.

Checkmarx Fusion is a hybrid vulnerability detection layer in Checkmarx One that combines deterministic, rules-based SAST with a language-agnostic AI engine and curated frontier AI models, reconciled into a single result set. Checkmarx reports an F1 score of 0.741, versus roughly 0.20 for legacy rule-based SAST, and describes the approach as producing consistent results across scans while extending coverage to vulnerabilities with no existing rule or CVE.

This case study covers how Merito validated a $50M SAP deployment for go live in approximately three weeks, with no existing performance baseline. It details the load, stress and spike testing strategy, a mid engagement tool pivot to OpenText LoadRunner Enterprise, and how the team solved SAP session token and licensing issues under a fixed deadline.

This is the downloadable PDF version of Merito's case study on validating a $50M SAP deployment for go live in three weeks. It covers the load, stress and spike testing strategy, the mid engagement pivot to OpenText LoadRunner Enterprise, and how the team solved SAP session token, tool memory and vendor licensing issues under a fixed deadline.

The Spira Product Migration Tool is designed to move complete products between separate instances of SpiraTest, SpiraTeam, and SpiraPlan, including product artifacts and their surrounding configuration. For enterprises, this supports controlled ALM migration during mergers, divestitures, consulting handoffs, and infrastructure consolidation. Merito can help organizations plan migration governance, validate outcomes, and accelerate adoption of Inflectra solutions.

This video demonstrates the Merito Automation Accelerator for Workday, a library of reusable Tricentis Tosca modules and test step blocks. It runs a live create expense report test in a Workday tenant, explains how blocks such as proxy as a user and global search are nested inside other blocks, and runs a demo test library showing date fields, search results and selection by radio button and by index.

AppSec vendors have converged on exploitability-scored triage, autofix pull requests, coding-agent integration, and grounded output, making those four things table stakes, not differentiators. Real competitive separation over the next 12 months will happen in four unsolved areas: continuous re-testing after a fix ships, AI-BOM, mobile AppSec keeping pace with embedded AI, and agent guardrails that enforce policy at the execution harness, not just the agent's decisions.

Tricentis qTest Pulse ships with a qTest license, but the JavaScript, webhook design, and field mapping that make it work against a specific tech stack do not. Merito builds and runs that layer, connecting qTest to ServiceNow, Jira, Azure DevOps, Slack, and Microsoft Teams so defect status, user provisioning, notifications, and executive reporting all run without anyone re-keying data by hand.

The Merito Federal DevSecOps Capability Statement is a free, ungated PDF on how Merito Solutions supports DevSecOps, application security, and secure software delivery for federal and defense customers. It lists CAGE 9KX50, UEI ZNJ8RTVRRDH3, NAICS 541519, 541511, 541512, CMMC Level 1 certification, DoD ESI BPA participation, and GSA Schedule access through partners MFGS and Carahsoft. Capability areas span DevSecOps strategy, SAST, DAST, SCA and container security, secure CI/CD engineering, toolchain optimization, and Merito Signature Support. Government contact is govbids@merito.com.

Release Radar Episode 02 reviews 13 enterprise software releases published between August 4 and August 21, 2026, from Black Duck, Checkmarx, Microsoft, Perforce, Semgrep, Sonatype, TestRail and Tricentis. The thread running through the batch is dated enforcement: four vendors set firm deadlines in the same month, including Semgrep sunsetting its current Policies experience on November 1 and Black Duck removing Java 8 from Detect for EU Cyber Resilience Act alignment.

Inflectra's beta SpiraPlan Extension for XWiki embeds live SpiraPlan requirements, test cases, releases, and defect backlogs directly in XWiki pages. Enterprise teams can use it to keep project documentation connected to current quality management data and support a shared view of delivery status. Merito helps organizations assess fit, plan adoption, and align XWiki and SpiraPlan workflows with governance needs.

COCARP, a small team operating twelve production web properties, worked with Merito to build an agentic content operation on the Claude Developer Platform and Claude API. The pipeline routes work across Claude Opus, Sonnet, and Haiku by task complexity and applies a validator layer that tests every item for bias and quality before publication. It has run continuously since July 2026 at $235 per month, replacing a $60,000 per year full-time role.

Release Radar Episode 01 reviews 14 enterprise software releases published between July 17 and August 3, 2026, from Perforce, Panaya, Tricentis, Black Duck, Checkmarx, OpenText, Inflectra and TestRail. Two patterns run through the batch: vendors adding evidence trails that record what their AI features did, and seven separate vendors shipping MCP servers within a single quarter without coordinating.

This video demonstrates connecting Tosca Cloud, Jenkins, and Slack into one automated testing pipeline. Jenkins authenticates against Tosca Cloud, triggers a test playlist on a team agent, polls for completion, retrieves JUnit results, and posts a summary to Slack with pass and fail counts plus links back into both the Jenkins build and the Tosca Cloud run.
Inflectra partnered with Merito to deploy Anthropic Claude on Amazon Bedrock, accelerating AI-powered QA, test automation, compliance assurance and software development while reducing test-script creation time by up to 90%.

Workflow misconfigurations drove the largest software supply chain attacks of 2025 and 2026. This free PDF gives you a single prompt that turns Claude Code into a ranked GitHub Actions security audit of your repository.

See how UFT customers stand up OpenText DAST inside existing QA workflows, with authenticated scans anchored to real user journeys.

Perforce Continuous Testing delivers AI-powered web, mobile, API, and performance testing at scale, cutting test maintenance by 90% and regression cycles by 70%.

OCS previously relied on Selenium for their test automation needs but it was an open-source solution that required significant coding knowledge and was primarily limited to web-based testing. While powerful, it created a bottleneck by limiting automation to developers or team members with coding experience.

Stellantis is one of the world's leading automakers and mobility providers, known for its portfolio of iconic brands. With a strong focus on innovation, the company continuously works to improve vehicle quality, safety, and efficiency. To support these efforts, Stellantis relies on rigorous software testing and development processes to ensure its technology meets high industry standards.

When it comes to ensuring reliability and performance of critical systems, particularly with Electronic Health Records (EHR) platforms like Epic and integrations with their downstream applications, Healthcare IT teams face several unique challenges compared to other industries. One major healthcare provider was struggling with inefficient testing processes, zero automation, and a lack of structured reporting. Merito implemented a comprehensive test automation strategy to enhance testing efficiency and enable a Ready-Set-Go testing approach. This provided key stakeholders with an easy to use, collaborative environment, empowering doctors and nurses with limited IT knowledge, to participate in user acceptance testing (UAT). The initiative established clear communication channels, validation/reporting structures, and ultimately ensured higher quality releases which improved systems for patient care and safety.

Used by 60% of Fortune 500 companies, the Workday platform is a leader in enterprise cloud applications for managing finance, HR, and operations. As the backbone of critical enterprise workflows, organizations leveraging Workday require a comprehensive solution to streamline testing processes, which are often heavily manual and time-intensive. To address these challenges, Merito developed a powerful Automation Accelerator for the Workday Platform—a modular solution designed to automate and optimize the testing of Workday's platform and Workday Extend applications using Tricentis Tosca.

Merito partnered with Cencora to successfully migrate their enterprise testing operations from Zephyr Enterprise to Tricentis qTest. This strategic transition streamlined test management processes, improved traceability across the SDLC, and enabled greater collaboration and efficiency for Cencora’s QA teams at scale providing realization of return on investment rapidly.
Merito is an authorized reseller and services partner for the vendors below.