1. A computer-implemented method for assessing risk of a software program and software updates to a program to prioritize verification resources, comprising: receiving software code for a software product for a testing assessment; analyzing the code according to a risk assessment criteria, the risk assessment criteria includes risk assessment factors; selecting the risk assessment factors from a group consisting of: a complexity of change; a previous history of change; a functional area of code and its quality history; and a quality of the coder; evaluating an additional risk assessment factor of the risk assessment factors, the additional risk assessment factor includes determining when the software code includes a link directed to external software with respect to the software code, the external software including a daemon in a common operating system for running the software code and the external software, or a piece of external software running remotely, the piece of external software being run remotely and including one or more endpoints; determining when a change occurs to the link or external software; weighting the risk assessment factors for the code as part of the criteria, wherein the link or the external software of the additional risk assessment factor is considered an increased risk, and the endpoints being assigned respective sub-weights in the weighting of the risk assessment factors; determining a risk assessment score of the code based on the criteria, before running the testing assessment of the software code; and allocating testing resources for the testing assessment of the software code in response to the risk assessment score.