After the scan, you still have to decide which findings matter, assign an owner, track fixes, handle exceptions and produce evidence. Open source scanners focus on detection. The workflow around it is usually your job, built from tickets, spreadsheets and conventions.
Detection is only the first step
A scan produces a list. A security program needs outcomes: fewer exploitable flaws, faster fixes, and a record that shows both. The distance between the list and the outcome is what this post calls the triage gap.
None of this is a criticism of free tools. They are designed to find things, and many do it well. The gap is a planning issue: someone has to cover it.
The seven jobs after a scan
| Job | Question it answers | Typical DIY approach |
|---|---|---|
| Deduplicate | Is this one flaw or twenty? | Scripts or manual review |
| Prioritise | Which matter in our context? | Severity score plus judgement |
| Assign | Who owns the fix? | Ticket by hand |
| Track | Is it fixed, by when? | Spreadsheet or tracker |
| Except | Is it accepted, who approved? | Ignore files |
| Verify | Did the fix work? | Rescan |
| Report | What can we show an auditor? | Manual export |
Each of these is small. Together, on a team with dozens of repositories, they become a part time job.
Where the time goes
Prioritising consumes the most. A severity score tells you how bad a flaw could be in general, not whether your code calls the vulnerable function. Our post on how scanners and pen testers decide a flaw is exploitable covers the difference. Reachability analysis narrows the list by checking whether the vulnerable code path is used.
Exceptions come next. Without a shared record, the same finding gets debated again each quarter.
Try it yourself
Open the reachability demo and compare the list before and after the filter. Look at how many findings drop out and what evidence supports each decision.
Click through it at your own pace, or open it full screen.
Budget the gap honestly
- For one month, log the time spent on the seven jobs above.
- Note who does them and whether it is their main role.
- Count findings older than your own target.
- Use the result in your decision about tooling. Our memo template in moving to a platform shows where it fits.
Cover it with process first
You can close much of the gap without buying anything: a shared tracker, one exceptions file with owners and expiry dates, a weekly triage hour and a monthly report. If it still overwhelms the team, that is a measured reason to look at a platform. Safeguard provides reachability analysis, policies and gates, and autonomous remediation with fix pull requests, which is off by default with every category set to manual.
Quick check
Do paid tools remove the triage gap?
They can reduce it with prioritisation and workflow, but someone still owns decisions. Ask what a tool automates and what it leaves to you.
What is the quickest improvement for a small team?
A single exceptions file with owners and expiry dates, plus a fixed weekly triage slot.
Last reviewed: 19 October 2026.
