What is Cognitive Behavioural Therapy? A Brief Introduction for Software Developers

The face of a bumble bee

Approximately a quarter of a century ago I was in a car with several friends driving around Cornwall, England, one of my favourite parts of the world. It was a beautiful, sunny day and the windows were down, and just as we came to a halt at a set of traffic lights, a bumble bee flew in through the passenger window.

According to the statistics published by the UK’s Department for Transport in 2011, there were 1,901 deaths on the roads of the United Kingdom. In comparison, the Independent Reviewer of Terrorism Legislation's annual report from 2011, bee and wasp stings account for approximately the same number of deaths in the UK as terrorism, around 5 per year (apologies, no more political stuff, I promise).

With blatant disregard for these statistics that wouldn’t be published for more than a decade later, my good friend in the driving seat, a 6’4 physically healthy rugby player who, to the best of my knowledge, is not allergic to bee stings, shifted the car into reverse and launched us all, including the innocent bee, backwards away from the traffic lights.

Fortunately nobody was injured (or even stung) and we all found it, including the driver, hilarious. But why would someone behave in such an irrational manner? I’ll get to that, but first, allow me a few tangents.

Any generalist software developer who has been around for more than a couple of years has probably created some kind of rules engine. A rules engine is a piece of software that can process inputs against a dynamic set of rules, loaded at runtime from an external source, to produce actions or outputs. There are a (small) handful of good reasons you might use one in your software, including:

  • The rules change frequently and updating the external rules is significantly safer or less costly than republishing the binary

  • You want the details of the rules and how they are being applied to your data to be available to your whole team or to your clients (and everybody knows that anything other than “living documentation” is almost never correct)

  • You want the non-technical members of your team or your clients to be able to modify the rules safely and whenever they want to without requiring you to write any code

  • You have a large number of clients who all need slightly different rules to be applied

There are also a handful of bad, sometimes cynical reasons you may use a rules engine in your software, including:

  • You already have a rules engine and you might as well reuse it for something different, right?

  • It’s an immensely satisfying programming challenge

  • There’s nothing like over-engineered complexity for your software developer job security, amirite!?

Rules engines are both terrible and tremendous things. Tremendous when they allow you to see exactly how a complex set of rules is applied to data even when it changes regularly, and terrible when they create an untestable vastness of technical debt that slows down production and fails to provide the main advantages of the rules engine in the first place. The best way to encourage tremendous, is to apply the KISS principle (keep it simple, stupid), and make your rules engine as simple as possible (avoiding looping and branching is a good start). 

Our humongous brain (by most Earthly creature’s standards) is a wonderful tool that enables us to communicate in metaphor, sarcasm and cockney rhyming slang. It allows us to construct houses, planes, rules engines and even vapid, meandering blog posts. The neocortex, the smartest piece of grey matter we have, gives us the ability to reason and rationalise the world, way deeper than the other creatures of this planet. Unfortunately, this deep neocortex analysis takes time, too much time to avoid the rock that’s currently on a collision course with your head. 

When you are in charge of a large, high-traffic computer system that’s live 24/7, it’s generally not a good thing to arrive at work in the morning, make a coffee, then drink that coffee while you take a look at the previous 24 hours of metrics, only then to discover that your whole business has been offline for most of the night. You need an alert system with its own set of rules to put you on high alert at the earliest possible time. Being automatically woken up when there’s an issue can cut short your downtime significantly, but an even better approach would be to install automated systems capable of taking steps to repair or bypass the trouble when it is detected. That way you can stroll in in the morning, make a coffee, then drink that coffee while you take a look how your system kept itself alive in the night and then, instead of writing an email explaining why revenue is down, you have more time to increase the stability of the system so there are less issues in the first place. 

It’s the same for the brain. We cannot always afford to wait for the full executive analysis from our higher functioning brain for every signal we receive, sometimes we just have to make a call. More primitive systems receive the same inputs in parallel and, upon pattern matching a danger, are capable of initiating an action way before our “conscious mind” has had time to yawn, stretch, and begin making sense of the input. One simple rules engine in our brain is known as the amygdala and its chief responsibility is to be on the alert for any reasons to freeze on the spot, get ready to rumble, or run like hell. 

Signals to the amygdala come from all our senses but can also come from other parts of the brain too. For example, the amygdala might not raise the alarm about an intruder entering your house if this is the usual time that your partner returns from work, but it takes a neocortex to realise that your partner is actually away on business and to override the false-negative. There are many complex feedback loops between the amygdala and neocortex, and many stress responses may in fact originate elsewhere in the brain, but the amygdala is basically the thing that sends the order to evacuate your digestive system, make your palms sweaty, dilate your pupils, alter your body temperature, add embarrassing sweat marks to the armpits of your favourite shirt, etc. All this gets you ready to deal with whatever threat it is that has been detected.

When the threat is imminent and real, your stress rules engine, the amygdala is your greatest ally. But when the threat is not actually a threat, when you have a rule that pattern matches and produces an unwanted stress or fear response, and this happens frequently enough to have a debilitating effect on your quality of life, you need to modify the rules in your rules engine. This is where Cognitive Behavioural Therapy comes in.

Cognitive Behavioural Therapy (CBT) is based on the principle that situations (inputs) don’t cause behaviours, moods or physical sensations (outputs), it is how we interpret (process) them that does. It gives us a toolset to change how we process these inputs to produce better outputs. 

In CBT, Automatic Thoughts are how we describe these interpretations of the situations we encounter and CBT is mostly interested in the Negative Automatic Thoughts, known as NATs, that produce distorted interpretations that are called Cognitive Distortions. One flavour of Cognitive Distortion is the “Mental Filter” which means you discard certain evidence when you make an evaluation. For example, in your annual review you may get a critical piece of feedback from an anonymous member of the team who dislikes working with you, and you are convinced that it must be true, you are completely unlikable, while ignoring all the other positive feedback you received from the rest of the team. This interpretation might bring about feelings of low self-esteem, make you dizzy with anxiety and make you isolate yourself from the team. CBT would encourage you to identify and challenge these NATs, test any assumptions you have and gradually make your automatic thoughts more balanced.

A list of types of Cognitive Distortions can be found below. By reacting to a situation in one or more of these ways you can contribute to negative moods like sadness, fear, anger, shame or guilt.

List of Cognitive Distortions

Cognitive Distortion



All or Nothing thinking

You think in extremes instead of shades of grey

The build system detects a bug in your code:

“I am a complete failure”

Mental Filter

You cherry pick only the evidence to reach the negative or positive conclusion you expect

Your code review goes great except for one small part needing attention:

“What’s wrong with me? I really suck at coding”

Discounting the Facts

You reject certain evidence to reach the negative or positive conclusion you expect

A teammate compliments you on your hackathon presentation: 

“They are only saying that to be nice”


You make assumptions as to what someone else is thinking or feeling

Someone looks at you from across the office:

“Oh no, what have I broken?”


You predict the future without sufficient evidence to do so

You are about to go into a sprint retrospective meeting:

“They will blame me for all the issues we had”


You interpret events disproportionately making everything a potential catastrophe

You are about to deploy a new build:

“This deployment is bound to go bad and then I’m sure to get fired”

Emotional Reasoning

You use the way you feel, to make judgements about the way things are

You are about to run a script to fix some data: 

"I’m feeling panicky, therefore this script must be flawed and we better not run it"

Should Statements

You apply the words “should”, “ought” or “must” to yourself or someone else

You are thinking about how to solve a difficult issue: 

“I should have solved this by now”

The solution is not to simply flip these thoughts to positive - “I am the worlds greatest!”. This is just as much an unhealthy distortion. Sometimes bad things happen and sometimes you fail. This is very human. The negative thoughts you have often will have some truth to them and it is your job to discover this truth and remove the distortion. Given the thought “This deployment is bound to go bad and then I’m sure to get fired”, you can ask yourself how many of your recent deployments have gone bad, and how many deployments in general go bad. You can ask if there is any specific evidence that this deployment will go bad or is it just a gut feeling. Most importantly you would want to inspect the suggestion that a bad deployment will lead to your termination and how likely this really is. If it really is likely and someone was fired only last week for a bad deployment, what then? How will life look in a few years? The bottom line is that this original thought will produce stress, stress that is designed to save your life by allowing you to react more quickly, by deactivating non-critical systems in your body, by increasing your heart rate and blood pressure, and even by sharpening your vision. Basically your CPU is temporarily overclocked! This isn’t terribly comfortable and it isn’t good for your long term health. The original thought must be examined and modified to become a more balanced, evidenced based thought, and this process must be repeated again and again until your automatic thoughts are automatically balanced.

Our Automatic Thoughts originate from our Core Beliefs. These are deeply held beliefs about ourselves, the people around us, and the world in general. It is more difficult in CBT to modify dysfunctional Core Beliefs than challenging the Automatic Thoughts they produce, but the more prolonged positive effects brought about make this worthwhile. Identifying NATs, working down to the Core Beliefs that they originate from, and then attempting to replace these with more balanced, evidence based beliefs is the essence of CBT. In our Mental Filter example, there may be an underlying Core Belief of “I am unlikable” responsible for this thought. We can now see that in this case the mental filter is an example of confirmation bias where only the feedback that agrees with the Core Belief is taken seriously.

It is CBT’s job to uncover dysfunctional rules in all our rules engines and replace them with more balanced rules that lead to better moods and behaviours and enable a better quality of life. How this is done can depend on which rules engine the rule resides in. For the vastly complex but rational neocortex rules engine it’s possible to reason with it by questioning in a structured way (known as socratic questioning), examining evidence that confirms or disconfirms a belief, tracking metrics and making and testing predictions.

For irrational rules that reside in the more simple amygdala rules engine, which cannot be reasoned with in the same way, this approach is less effective. Instead you need to “test in production”, recreate the inputs that generate the unwanted output under controlled conditions, and incrementally prove to the amygdala rules engine that the situation isn’t such a danger. This approach is known as exposure therapy and, though it is unavoidably stressful, it can be remarkably successful.

So, to summarise, the brain is an array of rules engines running in parallel and rarely subject to conscious inspection. Some rules engines, like the amygdala, the stress rules engine (and the fascinating insula, the disgust rules engine), have very simplistic rule sets allowing them to react quickly enough to save your life but can only be modified directly by actual experience. Other rules engines go deeper and, as a result, work a bit slower, but allow for much more nuanced conclusions as well as rules that can be reasoned with and modified a little more easily using CBT techniques.

Now, back to the bumble bee. Somewhere in my friend’s stress rules engine there lives a rule that pattern-matches large flying insects and generates an irrational panic response. It may have been added to the rules list many years ago after he was stung, saw the distress in someone else who had been stung, saw the distress of someone else who already feared these little creatures, or even simply heard a compelling story about someone being stung. However it got there, it produces unnecessary and potentially dangerous reactions that are woefully disproportionate to the threat posed by the insect.

So it looks like the most effective way my friend can overcome his fear and rewrite this rule is by a carefully planned series of exposure tests that gradually increase in magnitude. He might start by looking at pictures (like the one at the top of this post) and recording his stress level, then repeating this exercise until his resulting stress level is lessened, and then moving on to video, and then perhaps to a real bee in a jar, and beyond. Or he might just decide to keep his vehicle windows closed on warm sunny days.

I’ll leave you with an extreme example of how amazingly well exposure therapy can work:  Snake Phobia Behavioral (Exposure) Therapy

I’ve really only given a brief overview of CBT in this post. For a much deeper dive into CBT I can recommend any one of the following books: 

  • Cognitive Behavior Therapy: Basics and Beyond, by Judith S. Beck; 

  • Mind Over Mood: Change How You Feel by Changing the Way You Think, by Dennis Greenberger and Christine A. Padesky; 

  • Feeling Good: The New Mood Therapy, by David D Burns;

  • Rewire Your Anxious Brain: How to Use the Neuroscience of Fear to End Anxiety, Panic, and Worry, by Catherine M. Pittman and Elizabeth M. Karle;

And, as always, this blog post is not a substitute to professional therapy. If you are struggling with anxiety, go and talk to someone, it's nothing to be ashamed about. A therapist specialising in Cognitive Behaviour Therapy can change your life.