Open source scanners stop scaling when you can no longer measure coverage, when triage lags behind findings, when configuration drifts between repositories, when evidence requests take days, or when one person holds the knowledge. Any two of these together are a strong reason to review your approach.
Why use thresholds instead of a feeling
Teams usually switch because of a bad week, not a measured trend. A threshold turns a vague unease into something you can put in a ticket. These are not industry standards. Set the limits yourself, based on your own risk and capacity.
The five thresholds
| Threshold | How to measure | Warning sign |
|---|---|---|
| Coverage | Repositories scanned divided by repositories that exist | You cannot compute the denominator |
| Triage lag | Age of the oldest unreviewed finding | It keeps growing month over month |
| Configuration drift | Repositories with their own custom settings | Nobody knows what each one does |
| Evidence time | Hours to answer an audit or customer request | Days, with manual spreadsheet work |
| Key person risk | People who can fix the pipeline | One |
Coverage. If you cannot list every repository, you cannot say what share is scanned. Asset discovery is usually the first gap. Our post on measuring scanner coverage across repositories shows how to count.
Triage lag. Findings are not the problem. Unreviewed findings are. A growing queue means the volume exceeds the capacity of the people reading it, and adding more detection makes it worse.
Configuration drift. Each repository gets its own ignore file and its own tweaks. After a year no two behave alike, and a policy change means editing hundreds of files.
Evidence time. When a customer or auditor asks for your dependency inventory or remediation record, how long does it take? If the answer involves exporting from three tools and merging by hand, the cost shows up here.
Key person risk. If the engineer who set it all up leaves, can anyone else repair it? Our note on who maintains scanners when their owner leaves covers this.
How to score yourself
- Measure each threshold once, today, and write down the number.
- Decide a limit for each that you would not accept, and get agreement.
- Re-measure quarterly and chart the trend.
- If two or more breach their limits, open a formal review.
One breach can often be fixed with process: a coverage list, a cleanup sprint, a documented runbook. Several at once usually point to the model itself.
Try it yourself
Open the continuous monitoring demo and look at how coverage and open findings are shown together in one view. Think about which of the five numbers you could read off a screen like that today.
Click through it at your own pace, or open it full screen.
What to do next
If you are heading toward a platform, Safeguard offers asset discovery, SBOM and dependency scanning, policies and gates, and compliance evidence automation. You can run a free scan at https://gold.safeguard.sh/scan to get a baseline for the coverage and triage numbers above.
Quick check
Is one breached threshold enough to switch?
Usually not. Try a process fix first and re-measure.
Do these thresholds apply to a small team?
Yes, with different limits. A five person team may only need a repository list and a backup owner.
Last reviewed: 19 October 2026.
