Abstract
When systems fail at Netflix and in an environment this complex, they sometimes will, the instinctive response is to freeze deployments. Stop the bleeding,but blanket freezes carry their own hidden cost: delayed rollouts, missed business windows, and an illusion of safety that disappears the moment the freeze lifts and a backlog of pent-up changes floods production all at once.
The uncomfortable truth is that in a distributed system at Netflix's scale, not deploying is itself a risk. Bugs don't get fixed. Security patches wait. Rollback windows close. Blanket freezes optimize for one failure mode while creating several others.
In this session, Prachi Jain and Sandhya Narayan from Netflix Security Engineering will share how Netflix dismantled the one-size-fits-all freeze model and replaced it with service-aware risk controls, a framework that treats deployment risk as continuous and measurable, not binary. They'll walk through how Netflix:
Classifies services by criticality and blast radius
Feeds deployment confidence scores and test coverage into pipeline gates
Empowers domain teams to make informed deployment decisions in real time, even during major incidents and high-traffic launch events.
Attendees will see the technical machinery: CI/CD risk integration, controlled bypass mechanisms with full auditability, canary rollouts, regional staggering, and the feedback loops that make the system self-improving. The result is a model where resilience comes not from pausing change, but from understanding which changes are safe to make and when.
Key Takeaways:
Why deployment freezes are a resilience anti-pattern at distributed scale, and what to replace them with
How to build a service risk classification framework using deployment confidence, test coverage, and blast radius
Practical implementation: integrating risk profiles into CI/CD pipelines, canary deployments, and real-time monitoring
How to give domain teams deployment autonomy without sacrificing system reliability
