Running open source scanners usually costs a small amount of setup time and a steady, easy to underestimate amount of upkeep. The scanners are free. The hours go to pipelines, data updates, triage, exceptions and reporting. Estimate those four buckets for your team before you decide.
Where the hours go
Setup. Wiring a scanner into CI for one repository takes an afternoon. Wiring it into forty repositories with different build systems takes weeks, because each one has its own quirks.
Upkeep. Scanners release new versions, rule formats change, vulnerability data sources move or add limits. For example, the OWASP Dependency-Check README says users are highly encouraged to get an NVD API key and that updates are extremely slow without one, and it notes that shared keys in CI can hit rate limit errors, so you need a caching plan.
Triage. Every finding needs a human decision: fix, defer, or dismiss with a reason. This bucket grows with the number of repositories, not with the number of scanners.
Reporting. Someone has to turn raw output into numbers a manager, customer or auditor can read.
A worksheet you can fill in
| Bucket | Question to answer | Your number |
|---|---|---|
| Setup | Repositories times hours to onboard one | |
| Upkeep | Hours per month to update tools, data and pipelines | |
| Triage | Findings per month times minutes per decision | |
| Reporting | Hours per month producing reports and evidence | |
| Cover | Hours per month when the owner is away |
Multiply the monthly hours by twelve and by a loaded hourly cost for your engineers. Compare the total with a quote, and be fair about the other side: a platform also needs onboarding and tuning time.
The cost people forget
Context switching. A scanner that fails at 4 pm blocks someone who did not write it. The person who owns the scanner stack is pulled away from product work in small, frequent interruptions that never show up on a timesheet.
When the numbers favour open source
If you have a handful of repositories, one main ecosystem, and an engineer who enjoys the work, the total can be small. That is a legitimate outcome. The comparison just tips when repositories, teams or audit demands grow faster than the hours you can spare.
Where a platform fits
A platform moves upkeep, data freshness and reporting to the vendor and leaves triage with you. It does not remove triage, and it is worth asking in any trial how it reduces the number of decisions, not just how many findings it shows.
Safeguard covers this ground with SBOM and dependency scanning, reachability analysis, policies and gates, and compliance evidence automation. Autonomous fix PRs are off by default, with every category set to Manual. You can try a free scan at gold.safeguard.sh/scan.
A quick sanity check
Ask the engineer who would own the stack to log their time for one month on anything scanner related: fixing a failed job, answering a developer, updating a tool, building a report. Most people are surprised by the total. Use that log, not a guess, as the upkeep line in the worksheet. Repeat it after a quarter, because the first month usually includes setup work that fades while triage keeps growing.
Quick check
Are open source scanners free?
The software is. Pipelines, upkeep, triage and reporting still cost engineer time, so estimate those hours.
Which bucket grows fastest?
Triage, because it scales with the number of repositories and findings rather than with the number of tools.
Sources
Last reviewed: 19 October 2026.
