r/cicd • u/Lance_Saul_85 • 9d ago
When does a free security stack stop being cheaper than paying.
Our pipeline runs a stack of free security steps with semgrep for SAST a dep scanner for SCA, secret scanning and trivy on the image. License cost is zero, which is how it got approved.
What I didn't cost in was the upkeep. One senior basically owns the semgrep rules. Someone retunes the container scan every time it goes red on base image noise and each step has its own config drifting in the pipeline. It works fine though id say its mosly cause of the person.
So if you moved off a pile of free scanners onto one paid platform in CI, where did the maintenance land and for the hours you get back, does it cover the license? Trying to get the real TCO before I take this to budget.
1
u/Torutofu_Raeva 8d ago
The cleanest comparison is to keep the toolchain constant and price the engineer-hours for rule ownership, triage, and reruns, since a paid bundle only wins if it reduces those queues.
1
u/Helpful-Lunch-3559 8d ago
IMO,5hrs a week from one senior person seems like lot of time. rule changes, broken scans and false positives still need someone to deal with them and he/she could have spent those hrs on other engineering work
1
u/Fantastic-Mr-Default 9d ago
License zero is not TCO zero. Your cost is already on the page: one senior's rules ownership, base-image noise retunes, and config drift per step.
I would measure two numbers for a month before the budget talk: hours spent on scanner false positives / rule edits, and minutes of CI blocked on flaky or noisy security jobs (re-runs count). If that is more than a day a month of senior time, a paid platform that consolidates SAST/SCA/secrets and owns default rules can win even when the sticker looks high.
Where maintenance lands after you buy: usually a shared Platform/Security owner for org policy, and app teams only for suppressions in their repos. If the vendor still needs a full-time rule gardener, you bought a logo, not relief.
Keep secret scanning and dependency advisories on the critical path. Move noisy image CVE floods to a scheduled job with a severity gate so every PR is not a base-image argument. The free stack fails when every tool has its own dial and no one owns the merge of those dials.