TLDR Tech / InfoSec
Remediation at Scale: What High-Performing AppSec Teams Do Differently
Semgrep analyzed anonymized SAST and SCA remediation data from 400+ organizations across 50,000+ repositories, finding that top-performing teams achieve 2.4x higher SAST and 3.3x higher SCA fix rates than peers, with PR-stage detection driving 9x faster Mean Time To Recovery (MTTR) than findings caught in full scans. Authentication and cryptographic failures show the widest performance gaps between leaders and the field, and findings older than 90 days rarely resolve through normal workflow. Prioritize blocking rules at PR review, enable SCA reachability analysis, and triage authentication/crypto findings before the 90-day threshold. The full benchmark data is available as a PDF linked on the page.
Read the full story