In the first 30 days of an AppSec program, do four things: inventory repositories and applications, run one baseline scan, name an owner for each system, and agree what "urgent" means. Do not tune rules or block builds yet. The aim is an honest picture of where you stand.
Week 1: inventory
List every repository, deployed application, and the team that owns it. Include forgotten services, internal tools and scripts that deploy to production. Ask three sources: source control, the cloud account and the people. They will disagree, and the differences are your first findings.
Record for each system: owner, language, where it runs, whether it is internet facing, and whether it handles sensitive data.
Week 2: baseline scan
Run dependency scanning and secrets scanning across everything. Add static analysis for the most critical applications. Do not try to fix anything yet. Save the results and the date. This baseline is how you will show progress later.
Week 3: ownership and triage
For each critical finding, find a human to own it. Group findings by system and send each owner a short list, not an export of ten thousand rows. Agree on a simple definition of urgent, for example a known exploited issue in an internet facing system. Use a published signal, such as CISA's Known Exploited Vulnerabilities catalog, as one input.
Week 4: first fixes and a plan
Fix the few things that are both severe and easy. Leaked credentials come first because rotation is quick. Then write a one page plan for days 31 to 90. See also what to do after tool selection.
30 day checklist
| Done | Item |
|---|---|
| Yes or no | Inventory with owners |
| Yes or no | Baseline scan stored with a date |
| Yes or no | Leaked secrets rotated |
| Yes or no | Definition of urgent agreed |
| Yes or no | Plan for days 31 to 90 shared |
Common traps
- Turning on blocking gates in week two. You will lose developer goodwill.
- Presenting raw totals to executives. A large number with no context creates panic or shrugs.
- Scanning only the apps you already worry about.
Try it yourself
Click through it at your own pace, or open it full screen.
See how a repository becomes a list of components. That is your week one and two output.
Quick check
Should we fix everything the baseline finds?
No. Fix the severe and reachable items first, record the rest with owners and dates, and revisit them in the next phase.
What if the inventory is incomplete after 30 days?
That is normal. Mark it as a known gap and add a monthly check, since discovery is continuing work.
Safeguard does asset discovery and SBOM and dependency scanning, which cover the first two weeks. Try the free scan on one repository to see a baseline.
Sources
- CISA Known Exploited Vulnerabilities Catalog (cisa.gov). Referred to as an input, not quoted.
Last reviewed: 19 October 2026.
