- 01Six pipeline controls catch most issues: SAST (curated rules), SCA (vulns + license), secret scan (pre-commit + history), IaC scan (Terraform / Helm / K8s), container scan (base + deps + build config), DAST against ephemeral preview envs.
- 02False-positive rate is the single largest determinant of engineer respect. Tune aggressively per codebase, suppress in version control (not in the tool UI), and require security-team review for any global suppression.
- 03Performance budget: full pipeline ≤ +30% over your existing CI budget. Above that, engineers route around — skipping CI, batching changes, gaming PR cadence.
- 04Cache aggressively, parallelize ruthlessly, and run heavy DAST asynchronously against preview environments rather than blocking PRs. Async DAST with a 24h SLA catches more than blocking DAST with a 5-minute timeout.
After a decade of 'shift left,' the controls that actually catch issues in modern pipelines are well known. The challenge is configuring them so engineers do not route around them.
The six pipeline controls
- 01SAST — static analysis with rule sets curated for your language stack
- 02SCA — software composition analysis with vulnerability and license views
- 03Secret scanning — pre-commit and pre-push, plus repository history
- 04IaC scanning — Terraform, Helm, Kubernetes manifests
- 05Container scanning — base image, dependencies, build-time configuration
- 06DAST — running against ephemeral preview environments
False-positive economics
The single largest determinant of whether engineers respect the pipeline is the false-positive rate. Every false positive is a tax on engineering trust. Tune aggressively for your codebase, suppress with version control (not in the tool's UI), and require a security-team review for any global suppression.
Performance budget
The full pipeline should not exceed your existing CI budget by more than 30%. Anything more and engineers will start gaming it (skipping CI, batching changes, etc.). Cache aggressively, parallelize ruthlessly, and run heavy DAST asynchronously against preview environments rather than blocking PRs.