New AppSec programs most often stall because of six myths: that a tool is a program, that more findings means more security, that blocking early is bold, that security alone owns risk, that training fixes everything and that maturity scores equal safety. Each has a simple correction.
Myth versus fact
| Myth | Fact |
|---|---|
| Buying a scanner starts a program | A program needs owners, rules and follow through |
| More findings mean better security | Findings measure visibility, not outcomes |
| Block builds from day one | Untuned blocking trains developers to bypass checks |
| Security owns the risk | Engineering owns the code and its risk |
| Training alone changes behavior | Easy defaults and guardrails matter more |
| A high maturity score means safe software | A score shows practice coverage, not absence of flaws |
What to do instead
Start with ownership. Name one program owner and assign each repository to a team. Without this, a tool just produces a list.
Count outcomes. Track the age of severe findings and the share fixed, not totals. See measuring AppSec program effectiveness.
Stage enforcement. Run in advisory mode, tune, then block newly introduced severe issues. Leave old debt on a schedule.
Share ownership. Publish who owns what. See who owns AppSec risk.
Make the safe path easy. Provide templates and defaults and let training explain why.
Treat models as mirrors. OWASP SAMM describes five business functions and fifteen practices to help organizations assess and improve. Use it to find weak areas, not to chase a number.
Other quiet causes
- The program owner is also fully booked with other work.
- Leadership attention fades after the kickoff.
- The first quarter produces a long report and no fixes.
- Exceptions pile up with no expiry.
A recovery plan for a stalled program
- Pause new tool purchases.
- List the current checks and who reads each one.
- Cut or fix the ones nobody reads.
- Pick two outcomes for the next quarter and ignore the rest.
- Ask leadership for one explicit decision.
Quick check
What is the most common reason programs fail?
Missing ownership. Findings reach nobody in particular, so nobody fixes them.
Is it a mistake to start with a maturity assessment?
Not a mistake, but do it quickly. Use it to pick priorities, then move on to action.
Try it yourself
Click through it at your own pace, or open it full screen.
See how separating reachable from unreachable findings turns an overwhelming list into a manageable one, which is the antidote to the second myth.
Safeguard provides reachability analysis, policies and gates, and monitoring for the mechanics. Owners and decisions still need your people. Try a free scan.
Sources
- OWASP SAMM model page. Paraphrased.
Last reviewed: 19 October 2026.
