Give it one named owner per product, a rotating weekly reviewer, and an executive who can approve urgent changes. Without names, dependency work slips behind features. Ownership does not require a security hire, only clear roles, a fixed time slot, and a record of decisions.
Why it falls through
In a small company, everyone is busy and each task feels like someone else's. Developers assume a security person watches it. The founder assumes the developers do. Updates arrive as automated pull requests that nobody is assigned to review. GitHub's documentation notes that Dependabot pauses updates when maintainers stop interacting with its pull requests, which shows how common unattended queues are.
CISA's call for vendors to take on more of the security burden, so schools do not have to, assumes someone inside the vendor actually owns the work.
A three role model
| Role | Who | Responsibility |
|---|---|---|
| Owner | A senior engineer per product | Keeps the inventory accurate, sets update rules, answers customer questions |
| Weekly reviewer | Rotating developer | Spends a fixed slot triaging findings and merging safe updates |
| Approver | CTO, founder, or head of engineering | Decides on urgent changes and exceptions, signs off on notices to schools |
In a team of three, one person may hold two roles. That is fine, as long as each role has a name next to it.
The weekly rhythm
- Monday, 30 minutes. The reviewer checks new findings and open update pull requests.
- Triage. Sort into fix now, batch this week, plan a task, accept with reason.
- Merge safe updates after tests pass.
- Log decisions in a shared note: what, why, who.
- Escalate anything that meets your urgent rule to the approver the same day.
Write down the urgent rule
For example: a flaw in code that ships, is reachable, and either has known exploitation or touches student records, gets a fix or mitigation plan within an agreed number of days that you choose and can meet. Pick the numbers yourself. Do not borrow numbers you cannot meet, because a district may later hold you to them.
Where tooling helps
Automation can generate the inventory, rank findings, and open pull requests. It cannot own the decision. A tool that reports a hundred findings to nobody changes nothing. Pair each tool with a person and a slot.
Handling exceptions
Sometimes you cannot update, because the new version breaks something or the library is abandoned. Record an exception with a reason, a compensating step, an owner, and a review date. Exceptions without a review date become permanent.
Handling departures
When the owner leaves, reassign the role the same week and walk the successor through the inventory, open exceptions, and notification templates.
Quick check
Do we need a security hire to do this?
Not to start. A named owner, a weekly slot, and a clear urgent rule cover the basics. A hire becomes worthwhile as the product and customer base grow.
How do we prove ownership to a district?
Show the role names, the weekly routine, and a sample decision log with sensitive details removed.
Safeguard's policies, gates, and compliance evidence automation can keep the records this routine creates, and the free scan gives the owner a starting inventory.
Sources
- About Dependabot version updates (GitHub Docs)
- Findings and updates on CISA's collaboration with education technology vendors
Last reviewed: 19 October 2026.
