Yes, and you should. In report-only or shadow mode, a remediation tool lists the changes it would propose without opening them. Compare those proposals with what your team would do by hand, and turn on pull requests only for the categories where the two agree.
What shadow mode gives you
You learn the shape of the workload before it lands on reviewers: how many changes, in which repositories, in what categories. You also catch scope mistakes, such as a vendored directory the tool should skip or a repository that nobody maintains.
Terraform offers a familiar pattern. Its plan command proposes changes without making them so you can check the actions before applying, and a saved plan lets apply carry out exactly what was reviewed. The same two-step habit suits remediation: see first, then act.
How to run it
- Pick two or three repositories with different shapes, such as a service, a library and a frontend.
- Run the tool in report-only mode for two weeks.
- Each week, sample 20 proposals, or all of them if fewer.
- For each, record: would we have made this change, is the version right, is the description clear.
What to compare
| Question | Good sign | Warning sign |
|---|---|---|
| Does it propose the version you would pick? | Mostly yes | Frequent major bumps where a patch exists |
| Does it skip vendored or generated code? | Yes | It edits them |
| Are priorities sensible? | Exploited and reachable first | Alphabetical order |
| Is the volume manageable? | A few per week per repo | Dozens at once |
If the answers are good, move to pull requests on Manual approval. If they are not, tune the scope or ask the vendor why.
Where shadow mode stops
Report-only mode cannot tell you how your tests respond to the change. That needs real branches. Once you move on, start with one category and a few repositories, as in the 90 day rollout plan.
What to record from the trial
Keep a simple sheet with one row per proposal: repository, package, current and proposed version, change type, your verdict and the reason. After two weeks, count verdicts by change type. You will likely find that some types agree with your judgement nearly every time and others rarely do. That split tells you which categories to try first and which to keep on manual approval. Share the sheet with the vendor if you are evaluating one, since specific examples get better answers than general complaints.
Where Safeguard fits
Safeguard's autonomous remediation is off by default and every category starts on Manual, so you decide what runs. You can look at what it finds before connecting anything with a free scan.
Quick check
How long should shadow mode run?
Two weeks is usually enough to see patterns, longer if releases are infrequent.
Is shadow mode the same as a dry run?
Close. A dry run is a single preview. Shadow mode repeats it over time so you can watch the proposals change.
Sources
Last reviewed: 19 October 2026.
