In quarter two, a security program should turn the quarter one inventory into routine work: dependency scanning on every pull request, a merge gate that starts in report mode, a fix queue with named owners, and a short weekly review. The goal is a steady loop, not a clean dashboard.
What changes from quarter one
Quarter one produced lists and a baseline. Quarter two connects those lists to the way engineers already work, which is pull requests and CI. A control that lives outside that path gets skipped under deadline pressure.
The change is also about volume. Once scanning is on, findings arrive. A team of 30 engineers and a team of 150 engineers both feel this, just at different scales. Plan for the queue before turning the scanner on.
The quarter two deliverables
- Dependency scanning in CI on the repositories marked customer facing in the inventory. Start there, not everywhere.
- A pull request gate in report mode. It comments and records, but does not block. Blocking comes later.
- A fix queue. Every finding gets an owner team and a status. Unowned findings are the main source of backlog rot.
- A weekly review. Thirty minutes, one agenda: new critical items, items past their target date, items needing a decision.
- An exceptions note. A short written way to accept a risk, with an owner and an expiry date.
Report mode first, then block
Switching on a blocking gate on day one usually ends with developers asking for it to be turned off. Run in report mode for a few weeks, see which rules are noisy, tune them, then pick one narrow rule to enforce, such as a known exploited vulnerability in a package that is actually loaded by the service.
CISA's Known Exploited Vulnerabilities catalog is a reasonable first enforcement candidate, because its entries have evidence of active exploitation and a clear remediation action, such as a vendor update. CISA recommends organizations use the catalog as an input to their vulnerability management prioritization.
Try it yourself
This demo shows a pull request gate evaluating a change. Click through the checks and look at which result would block a merge and which would just warn. That split is what report mode versus enforce mode controls.
Click through it at your own pace, or open it full screen.
Staffing the loop
At the smaller end, the named owner runs the weekly review and engineering managers assign fixes. Closer to 200 engineers, a platform or security engineer usually owns the scanner configuration, while teams own their fixes. Either way, the review meeting is the heartbeat. If it stops, the program stops.
Signs quarter two worked
- New repositories get scanning without a ticket.
- Every open finding has an owner.
- The gate has been in report mode long enough to tune, and one rule is ready to enforce.
- People can say what the exception process is.
Safeguard offers dependency scanning, policies and gates, and reachability analysis, which helps separate packages that are present from packages that are actually called. Autonomous remediation with fix PRs exists too, but it is off by default and every category starts on Manual, so you decide when to turn any of it on.
Quick check
Should the gate block merges in quarter two?
Start in report mode. Move one narrow rule to blocking once you have seen how it behaves on real pull requests.
Do we scan every repository right away?
No. Begin with customer facing services from your inventory and expand as the fix routine proves it can keep up.
Sources
Last reviewed: 19 October 2026.
