SAST tools are useless if you never fix the backlog they hand you

Our team turned on a scanner 8 months ago and it dumped 1,400 findings on day one, and now nobody looks at the dashboard at all. The tool didn't fail, we did, because we never set a rule for what gets fixed in a sprint versus what gets marked as accepted risk. How do you all keep a scan backlog from just becoming wallpaper?

0 comments

Log in to join the discussion

Log In

0 Comments

No comments yet

Be the first to share your thoughts on this discussion.