I prefer a "quarantine" approach testing giant ugly legacy code bases. You isolate as much of the code as possible behind a well-understood and relatively stab

I prefer a "quarantine" approach testing giant ugly legacy code bases. You isolate as much of the code as possible behind a well-understood and relatively stable interface. Sometimes that's an API boundary unlikely to change, where you standup a test instance of the app and database. Then begin testing there. Standup a version of the app, test it end-to-end, require all tests to pass before releases. When you fix a bug, ensure a test in this suite comes with it. Then with that secure perimeter in place, you can (if you so choose / need to) move in to the buggiest parts of the code to refactor and introduce better unit testing.