Rebuilding Brindlewood Payments' static analysis programme as a triage funnel of eight bands, from 38,412 raw open findings through coverage, curated rules, measured precision, a baseline and gate, fast feedback and governed suppression down to 1,610, where a finding leaves only by a recorded decision; the incident that started it, a flaw reported 421 days earlier and never triaged; rules tiered as blocking, advisory or audit on Brindlewood's own triaged sample; and the outcomes reported to the board: a 4.1-minute pull-request scan, 86.4 per cent of new findings fixed before merge and an 11-day median fix for reachable highs.

CY-EXPERT-102Expert Level · DevSecOps

SAST Programme Optimisation

An expert-level course on taking a static analysis programme with a huge backlog that developers ignore and making it precise, fast, owned and trusted. Build the triage funnel - eight bands narrowing from the scanner's raw output, through coverage and scope, curated rules, measured precision, baseline and gate, fast feedback, and suppression and triage, to the true, reachable, owned findings that get fixed and reported - and assemble a programme standard and rule tuning register that someone else can re-perform.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Trace an escaped flaw to the finding that reported it, set out what SAST can and cannot see beside other tools, and anatomise a findings backlog.
Measure coverage against the repositories that exist, close language and pipeline gaps by exposure, and scope scanning to production code with receiving controls.
Curate a rule set with decision records, framework models and fixture-tested custom rules for the organisation's own patterns.
Measure precision per rule on a stratified, double-reviewed sample, tier rules by it, and measure recall against the organisation's own fixed defects.

Price:৳12,000