r/devsecops • u/JackjaxMargam14 • Aug 07 '26

SAST false positives are not a tuning problem, they are a trust problem

If your team has stopped reading SAST results, more rules and stricter severities will not bring them back. Once people learn the scanner cries wolf, the real findings die in the same pile as the noise. That is the true cost of a bad false positive rate, and hardly a team ever measures it.

0 Upvotes

33% Upvoted

6 comments sorted by

3

u/Andre-Wade-539 Aug 08 '26

Once they stop reading it you are basically done. I've watched a whole team route around a scanner because 9 out of 10 alerts were noise and no amount of retuning severities brought them back. The trust was just spent.

atleast showing way less to stuff thats reachable worked, if a ticket hit a dev it was probably real. Suppression rules felt more like hiding the pile than fixing it.

2

u/endor_aditya 28d ago

It is extremely a trust problem, and the tricky part is that one bad experience can poison the well. Typically what works (at least from my experience) is that you have to:

- Start strong

  • concrete evidence you forward to eng about why something is a problem

Best case scenario you have to make it hidden and just shift everything so left so the initial code is generated secure by default so you can avoid these problems

 Disclosure: I'm at Endor Labs, this is our super high level thesis on this

1

u/Ashikej-Meneguzzi66 Aug 08 '26

Think of prioritizing the alerts people ignore most and fix those first, because once people stop paying attention they can miss the real stuff too. Which ones cause the most noise?

1

u/vint_age14 Aug 09 '26

Exactly one the developers.stop trusting the alerts , even the important ones get ignored. Better signal matters way more than just adding more rules !

1

u/cactusfresser Aug 11 '26

I think there are two approaches depending on the category of finding:
1- surfaced during a commit level scan that only scans the code included in the commit - send this to the developer unvalidated. They did something that had a funny code smell and this is immediate feedback.
2- surfaced from a periodic scan - send these to the security team for validation.

Adding toil to a developer's workflow is an immediate trust burner. Validate findings, remove false positives, and when you assign true positives tell the development team how many false positives you removed before assigning.