Leadership asks whether mandatory SAST gates actually improve outcomes for city applications. What should AppSec measure?
Select an answer to reveal the explanation.
Short Explanation
A gate that nobody measures is just a speed bump with a fancy name. Track whether fewer nasty bugs slip into production after SAST becomes mandatory. If escaped defects do not drop, fix the gate—not the slide deck.
Full Explanation
Whether mandatory SAST gates improve outcomes should be judged by whether escaped production defects decline after enforcement—and related quality/security indicators such as critical findings blocked pre-prod, mean time to fix, and recurrence of the same weakness classes. Leadership funding AppSec needs outcome metrics tied to resident-facing risk, not activity theater. If gates are tuned and adopted, fewer injection and secret-exposure defects should reach city production; if not, the program needs rule quality, developer enablement, or process fixes.
Counting coffee meetings with vendors measures relationship activity, not defect escape reduction.
Marketing click-through rates on the IT newsletter measure communications engagement, not application security effectiveness.
How often developers disable laptop screen locks is an endpoint hygiene metric orthogonal to whether SAST gates stop bad code from shipping.
Exam caveat: effectiveness metrics must link control to outcome; vanity or unrelated metrics fail the exam's intent for security program measurement. Operational check: baseline escaped defect rates before gate enforcement, compare after a defined period for municipal apps, segment by severity, review false-positive burden so developers do not bypass gates, and report results to leadership in civic-service risk language.