Roll out in waves, not all at once. Start with report only scans on your most important services, baseline the findings that already exist, fix or accept them deliberately, and only then turn on blocking gates for new problems. Expand wave by wave, so teams never face hundreds of alerts on day one.
Why waves
Switching scanning on for hundreds of repositories at once produces thousands of findings, most of them old. Teams stop reading, and the program gets a bad name before it starts. A staged plan keeps each team's first experience small and useful.
The waves
| Wave | Who | Mode |
|---|---|---|
| 0 | A pilot of three or four willing teams | Report only, collect feedback |
| 1 | Tier 1 services | Report only, then gate on new critical issues |
| 2 | Tier 2 services | Report only, gate later |
| 3 | The rest, including libraries | Scheduled scans, light gates |
Choose wave 0 teams who will tell you honestly what is annoying. Fix those issues before wave 1.
Per wave steps
- Confirm each repo has an owner and a tier.
- Connect the repo and run a first scan in report only mode.
- Create a baseline: findings present now are marked as existing.
- Share a short summary with the owner. Top five items, not five hundred.
- After two weeks, turn on a gate that blocks only new findings above your chosen severity.
- Review exceptions weekly during the wave.
The baseline is the key trick. It separates "debt we are working down" from "new risk we will not accept", and it lets the gate be strict without being unfair.
Make onboarding cheap
Use a template for the pipeline step, so adding a repo is a one line change. Provide a self service page where a team can request an exception with an expiry. Keep a rollout channel where people can ask questions and see the status.
Track the rollout
- Repos connected and scanning, as a share of the inventory.
- Repos with a first scan in the last cycle.
- Open baseline findings and their trend.
- Gate failures on new findings, and how many were fixed within a day.
If gate failures climb and fix times do not, the gate is too noisy. Tune before expanding.
Quick check
Should the first scan block builds?
No. Use report only first, set a baseline, and gate on new findings after a short settling period.
How long should each wave take?
Long enough to fix the issues the previous wave surfaced, often a few weeks. Let the data, not the calendar, decide.
Safeguard offers policies, gates and guardrails alongside SBOM and dependency scanning, and a free scan is a gentle first step.
Last reviewed: 19 October 2026.
