A monthly drift review compares what runs in dev, staging, and production for each service, ranks differences by risk, and assigns owners. Thirty minutes is enough if you bring the data. Without data, the meeting turns into opinions and nothing changes.
Inputs to bring
- An export of installed packages or an SBOM from each environment, dated within the last week.
- The release identifier running in each environment.
- A list of emergency changes since the last review.
- Open advisories that touch your dependencies.
If you cannot produce these in advance, fix that first. See how to compare installed packages.
The agenda
| Minutes | Topic |
|---|---|
| 5 | Review last month's action items |
| 10 | Walk the differences, riskiest first |
| 5 | Emergency changes and whether each was reconciled |
| 5 | Base image and runtime versions |
| 5 | Assign owners and dates |
The checklist
- Is every environment running a known release identifier? An unknown one is the first finding.
- Are there packages present in one environment and missing in another?
- Do any differences involve a package with a known advisory?
- Did any hotfix skip the pipeline? Was it replayed?
- Do base images match by digest, or by tag only?
- Do language runtimes match across environments?
- Are lockfiles committed, and do CI installs fail when they are stale?
- Is any environment missing from the comparison, such as a disaster recovery region or a customer-facing sandbox?
Outputs to record
Keep a one page log: date, services reviewed, differences found, risk rating, owner, due date, outcome. After three months it shows whether drift is shrinking, and where it keeps coming from.
Keep the meeting small
Invite the service owners and one security representative. Skip anyone who will only listen. The meeting works when a person who can change the pipeline is in the room.
Signs the process is working
- The same difference does not appear two months in a row.
- Emergency changes get replayed within the agreed window.
- New environments are created from the same artifact definition as old ones.
- Questions like "which environments run this version?" are answered from data in minutes.
Prepare the data in advance
The meeting only works if the comparison already exists. Ask each service owner to run the export a day earlier and post the differences in a shared document. Anything marked as explained, such as a deliberate canary, can be skipped in the room. Focus the time on unexplained differences and on anything older than one review cycle.
If a service has no export at all, put it at the top of the next agenda as its own finding. A service nobody can describe is a bigger risk than a service with a known difference.
What Safeguard does here
Safeguard keeps dependency inventories and monitoring in one place, so the review inputs exist before the meeting. Try the free scan at gold.safeguard.sh/scan.
Quick check
Is monthly too slow?
For most teams it is a good start. Automate the comparison so critical advisories trigger a check immediately, between meetings.
Who runs it?
A rotating engineer or a platform owner. The key is that someone owns the action items.
Last reviewed: 19 October 2026.
