A good enablement session for a new security tool runs about 45 minutes and shows the real workflow: where a finding appears, how to read it, how to fix or suppress it with a reason, and where to ask for help. Use the team's own repository, not slides, and leave time for questions.
Goal
Developers should leave able to handle their first finding without opening a ticket. Anything beyond that can live in a short guide.
Agenda
| Minutes | Topic |
|---|---|
| 5 | Why the change and what stays the same |
| 10 | Live demo: a pull request with a finding, from comment to fix |
| 10 | Reading a finding: severity, evidence, fix version, reachability if shown |
| 5 | Suppressing correctly: reason, owner and expiry |
| 5 | What blocks a merge and what only warns |
| 10 | Questions on their own repository |
Prepare the demo
Use a real repository from the team, with a seeded finding that has an available fix. Rehearse once. A demo that breaks in front of the team costs more trust than no demo.
Teach the decision, not the buttons
The interface will change. What lasts is how to judge a finding: is the vulnerable code reachable, is a fix available, what is the exposure. Our posts on reachability analysis and triaging a scanner backlog can help.
Leave behind a one page guide
Include: where results appear, how to suppress, who to contact, what the gate does. Link it from the pull request template. Our new developer tooling checklist is a model.
Follow up
Check in after the first week. See which questions came up and fix the guide. See also telling developers a scanner is changing.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the fix flow and use it as the walk through for your demo section.
Office hours after the session
Offer two short open slots in the first two weeks. Developers often hold questions until they hit a real finding. Keep notes of what is asked and fold the answers into the guide. After a few weeks the questions usually repeat, which is the signal that the guide is complete enough.
Quick check
Should attendance be mandatory?
Make it easy to attend and record it for those who cannot. Mandatory sessions that nobody wants breed resentment.
Do we need a session for every team?
Run one per wave or per group of teams that share a pipeline, and offer office hours for the rest.
Safeguard covers SBOM and dependency scanning, reachability analysis, policies and gates, and compliance evidence automation. You can try a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
