Replace a security tool by running the new one beside the old one for at least one full release cycle, comparing what each finds, moving gates only after the results match your expectations, and switching off the old tool after an agreed overlap. The risk is not the new tool. It is the gap between the two.
Step 1: map what the old tool does
List everything the current tool does, including the quiet jobs. Scanning is obvious. Less obvious: a gate in a pipeline, a ticket integration, a compliance report an auditor expects, an alert that pages someone, a suppression list. Anything not on your list will vanish at cutover.
Step 2: choose the overlap
Run both on the same repositories for at least one release cycle and ideally across a patch cycle. Shorter overlaps miss the events that matter, such as a new advisory published mid-cycle.
Step 3: compare findings
Take a sample and classify each difference:
- Found by both: good, note any differences in severity.
- Found only by the old tool: is it real? If so, the new tool has a gap you need to understand.
- Found only by the new tool: is it real? If so, you may have been blind before.
Count confirmed findings, not raw totals. See measuring false positives in a pilot.
Step 4: carry over decisions
Export accepted risks, suppressions and exceptions from the old tool, with reasons and expiry dates. Re-enter them, or review whether they still apply. Do not carry blanket suppressions across without looking.
Step 5: move gates last
Keep the old tool as the enforcing gate. Run the new tool as advisory first, so builds do not fail on unknown results. Switch enforcement once the team accepts the new output. A gate that blocks merges for reasons nobody trusts will be bypassed.
Step 6: export and retain evidence
Before cancelling, export history your auditors may ask for: findings history, remediation dates, reports. Check whether your evidence retention rule needs it.
Step 7: switch off and revoke
Remove integrations, rotate tokens, ask for data deletion, and update your inventory. Put the old contract's notice date in your calendar so it does not renew by accident.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
How long should the overlap last?
At least one release cycle, and long enough to include a new advisory landing mid-cycle. Two to four weeks is a common minimum, depending on your cadence.
Should both tools block merges during the overlap?
No. Keep the old tool as the gate and run the new one in advisory mode until you trust its output.
Last reviewed: 19 October 2026.
