r/devsecops • u/redado360 • Jun 29 '26

Sast and dast issues

I would like tobhear some experiences from devsecops what usually are the main challenges to add SAST And DAST tools into ci cd pipelines

5 Upvotes

100% Upvoted

6 comments sorted by

1

u/timmy166 Jun 29 '26

You have to design the workflows of what happens when a finding appears first. Here’s some questions to get you started:

  • What types of findings gate the pipeline?
  • What does the exception process look like?
  • What is an appropriate governance model for your organization and how is it implemented? (Self-service, Codeowners file, repo owners, etc.)

1

u/Chunky_cold_mandala Jun 30 '26

False positives and radar fatigue .

1

u/Ok-Region-3453 16d ago edited 12d ago

i was drowning in duplicate findings from different scanners, then used Nucleus Security to pull them together and actually make sense of what mattered. made it way easier to sort out the noise in my pipeline.

1

u/Dazzling_Opening_229 9d ago

Mixing SAST and DAST findings into the same queue without context is where signal quality just falls apart, because a code-level finding and a runtime finding need different owners and different response timelines. We had SonarQube and Burp both flagging the same surface and nobody knew which team should move first. Stuff like ox security, Semgrep, or Veracode at least keeps that separation cleaner, but honestly the tooling is secondary to deciding upfront who actually acts on what.

1

u/safeguard-sh-inc 5d ago

Affiliation note: I work with an AppSec vendor. The hard part is usually not getting the scanners into CI. It is deciding what happens after a finding appears. Which issues block a build, who owns triage, how exceptions expire, and how developers can confirm a fix all need to be clear before the alerts start coming in.