A pen tester on my train ride to Boston called my scanner setup 'a smoke alarm with no battery'

Karen West · 2026-10-24T12:35:04.631998+00:00

I sat next to a guy doing a contract pen test last month on the Acela and he glanced at my laptop screen, which had three vulnerability scanners running at once. He asked if I actually read the output or just liked the colors, then said most teams install a scanner and call it security, like a smoke alarm with no battery in it. That stung because I had 2,400 open findings in my queue and honestly could not name the top 10 by risk. I spent the next weekend cutting the list down to 60 things that actually matter and turned off two of the scanners. Curious how others here deal with finding overload, do you tune the rules or just triage harder?

SMM Buzz

Loading…

A pen tester on my train ride to Boston called my scanner setup 'a smoke alarm with no battery' | Appsec Tools - SMM Buzz