Has anyone had any trouble managing noise in appsec scanners (think Snyk, OWASP ZAP, Bridgecrew, TFSec, Claire, and all the other SAST/DAST/SCA tools) in a modern DevOps environment? E.g. too many alerts, too hard to prioritize alerts, irrelevant alerts to the business, too hard to properly define policies for what scanners run where and when, etc? I’ve gotten the sense that a lot of cloud sec teams feel stuck figuring out how to get developers to actually fix appsec issues, and engineers/DevOps will often ignore the scan results sent over JIRA or in pull requests because there are too many. How do people solve this?
