Yes, within limits. OWASP SAMM lists helping to verify and prioritize security defects among a champion's activities, because the champion knows the team's code and exposure. Champions should recommend and route, while the owning developer fixes and the security group handles disputes and high severity cases.
Why champions are suited
A central team sees a finding without context. A champion knows whether the service is internet facing, whether the flagged code path is used, and who owns the file. That knowledge removes much of the noise. SAMM Stream B level 1 says champions help verify and prioritize security defects.
What triage means here
Triage is a quick decision on each new finding: is it real, how urgent, who fixes it. It is not the fix. It is also not an exception approval, which should sit with someone who can accept risk.
A simple routine
- Weekly, open the team's new findings.
- Mark each: real, false positive, needs more information, or not applicable with a reason.
- For real findings, check whether the vulnerable code or package is reachable in your service and whether it is exposed to untrusted input.
- Set urgency: fix now, fix this sprint, schedule, or accept with sign off.
- Create a ticket with the owner and a due date, and write one line of why.
- Escalate to the security group anything that looks critical or that you are unsure of.
Who decides what
| Decision | Champion | Developer | Security group |
|---|---|---|---|
| Is it a real finding | Recommends | Confirms | Resolves disputes |
| Urgency within policy | Sets | Agrees | Sets policy |
| Fix | Advises | Owns | Reviews high severity |
| False positive tuning | Proposes | Approves rule changes | |
| Risk acceptance | Prepares record | Approves, or an accountable owner does |
For deeper discussion see who should triage SAST findings.
Keep it fair
Do not let triage become a way to quietly close findings. Require a written reason for every false positive, review a sample monthly, and keep an audit trail. Without that, champions will be accused of hiding issues, and sometimes rightly.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how many alerts drop in priority once you ask whether the vulnerable code is reachable.
Where Safeguard fits
Safeguard offers reachability analysis and vulnerability scanning, so findings can be sorted by whether the vulnerable code is reached. A free scan shows how that looks on your own project.
Quick check
Can a champion close a finding as a false positive alone?
For simple cases with a written reason, yes, and a monthly sample review. For anything disputed or severe, involve the security group.
How much time does triage take?
It depends on volume. Start with 45 minutes a week and adjust.
Sources
Last reviewed: 19 October 2026.
