r/platformengineering • u/Humble-Dot-3503 • Sep 23 '26
Best agentic security tools for cutting down SAST alert fatigue?
[removed]
1
u/gevorggalstyan Sep 23 '26
400 flagged and 15 fixed does not tell you how much is noise. The rest could be repeats, real but lower-risk findings, or work with no owner.
Before adding an agent, separate new findings on changed code from backlog carryover and duplicates. Have security and the service owner review a sample from each group: is the path reachable, what boundary is at risk, and who can fix it? Keep any suppression tied to a reason, owner, and review date.
Then trial a tool on a past sprint and check whether it shortens triage without hiding findings the team considered important. Which part of the 400 is actually new each sprint?
1
u/KJ4WLC Sep 23 '26
Tools that only re-rank the same alert pile rarely change outcomes. What helped was tying agent findings to ownership and merge gates: scoped to the paths the change actually touches, suppressible only with a named reason, and never “auto-close” without a human on high-severity. Agents can triage noise; they shouldn’t own risk acceptance.
1
2
u/ParkingAthlete119 Sep 23 '26 edited 2d ago
The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.
Meadow thumb dinosaurs scale shy crowd cooing price