Revisit the decision once a year and whenever one of seven triggers occurs: repository growth, a new audit or buyer demand, a staffing change, a data freshness miss, a project health change, a missed incident, or a contract renewal. The review takes an hour if you keep evidence as you go.
Why the choice does not stay right
The right fit for a ten person team is often wrong for a hundred person team, and the reverse can also happen when a company shrinks or simplifies. Treat the decision as a position you hold with an expiry date, not a one time purchase.
The seven triggers
| Trigger | What changed | What to check |
|---|---|---|
| 1. Growth | Repository or team count rose sharply | Does ownership time still fit? |
| 2. Evidence demand | Buyers or auditors ask for reports | Can you produce evidence without heroics? |
| 3. Staffing | The scanner owner left or changed role | Is there a named owner and backup? |
| 4. Freshness miss | A real advisory was found late | Rerun the lag test and compare |
| 5. Project change | The open source project slowed, changed license or archived | Run the project health check |
| 6. Incident | A vulnerability reached production unnoticed | Was it a data, coverage or process gap? |
| 7. Renewal | A contract date is approaching | Do the numbers still support it? |
The one hour review
- Collect evidence (15 minutes). Pull the last quarter's freshness test, time log, support tickets or issue history, and list of exceptions.
- Check ownership (10 minutes). Confirm owner, backup and runbook exist.
- Check fit (15 minutes). Compare current repository counts, ecosystems and compliance asks with what the tool was chosen for. Our post on signs it is time to switch your scanner lists symptoms.
- Check exit readiness (10 minutes). Are triage decisions, baselines and rules stored in portable files? Is there a data export?
- Decide (10 minutes). Stay, adjust, or start a trial of an alternative. Write one paragraph with reasons and the date of the next review.
Keep a decision log
Store a short record in the repository: date, options considered, evidence, decision and next review. When leadership changes or an auditor asks why a tool was chosen, you can answer in a minute.
Avoid two failure modes
- Permanent trial. An experiment that never ends and never gets an owner.
- Permanent contract. A renewal that happens because nobody looked. Our post on renewal notice dates helps you diarise this one.
If you decide to look at managed options
Plan a comparison on your own repositories with agreed measures, and protect audit continuity during the change. Safeguard offers a free scan at gold.safeguard.sh/scan as a quick way to compare findings with what you have today.
Quick check
How often should we review the decision?
At least yearly, and sooner when a trigger such as team growth, an audit request or a missed advisory occurs.
Who should lead the review?
The scanner owner prepares the evidence and the engineering manager decides, with the security lead.
Last reviewed: 19 October 2026.
