Loading…
18
A security engineer at a Denver meetup said our SAST tool was just generating noise, and it made me rethink how we triage
Last Thursday I went to a small appsec meetup in Denver and got stuck talking to a security engineer named Priya who works at a fintech company. She asked what SAST tool we run and when I named it she just laughed and said hers flags around 400 findings a week and her team only fixes maybe 15 of them. That number hit me because I manage a crew and I keep seeing our scanner dump hundreds of alerts while devs just close them without reading. So this week I started tagging each finding as real, false positive, or maybe, and after 60 alerts we found only 3 that mattered. Anyone else tracking their false positive rate like this? Curious what number made you change your process.
1 comments
Log in to join the discussion
Log In1 Comment
jessica_ross381mo ago
I used to just mute those alerts, but 3 out of 60 real is eye opening.
4