The more extensive software becomes in terms of its range of functions, the more its program code often grows along with it. If program code is not structured using appropriate safeguards and not based on a suitable software architecture, it is usually very difficult to maintain. Vulnerabilities can then only be addressed with difficulty and obsolete program parts can only be replaced with a great deal of effort if, for example, the protection needs of the processed data change and thereby affect the security requirements of the software in question.

Software design errors not only complicate the maintenance of software; they can also lead to vulnerabilities and threats. If program code is not structured in a meaningful way and the software architecture is not documented comprehensibly, it is very difficult to identify conceptual errors in software tests. As a result, vulnerabilities can exist at almost any level of the software.

In practice, software design errors often have historical roots. For example, legacy systems may be used for tasks and environments for which they were not initially conceived. During the development of very old applications, aspects such as maintainability and modifiability may not have been considered as they would be in line with the current state of the art.