# Common Pitfalls and Trade-offs — DevSecOps

Source: https://www.skillbyai.com/en/devsecops/dso-pitfalls

> Recognise alert fatigue, tool sprawl, slow gates and checkbox compliance, and choose pragmatic fixes.

## Where DevSecOps programmes go wrong

The most common failure is **alert fatigue**: ten scanners dumping thousands of unprioritised findings into a dashboard nobody reads. Developers learn to ignore them, and the one real issue drowns. Fix it by deduplicating, tuning rules, gating only on high-confidence and high-impact findings, and sending results where developers already work, inside the pull request. The second is **slow pipelines**: if security adds twenty minutes to every build, people find ways around it, so parallelise jobs, scan diffs and move heavy scans to scheduled runs. Third, **tool sprawl** without ownership: every tool needs a person who tunes it and someone who fixes what it finds. Fourth, **checkbox compliance**: passing an audit does not mean you are secure. Finally, beware of **blocking everything**. A gate with no exception process gets disabled during the first urgent release; a documented, time-limited exception keeps the gate alive.

## The car alarm nobody hears

A car alarm that goes off every time a bike passes teaches the whole street to ignore car alarms. Noisy security tools do the same to developers.

## Measure outcomes

Useful metrics: time to remediate critical findings, percentage of services on the paved-road pipeline, secrets caught before push versus after. 'Number of findings' alone rewards noisy tools.

**Quiz:** A team ignores security scan results because there are thousands of low-value findings. What is the best first step?

- [x] Tune and prioritise the rules so only high-confidence, high-impact findings block or alert
- [ ] Add two more scanners for coverage
- [ ] Make every finding block the build
- [ ] Turn off all scanning

*Answer:* Tune and prioritise the rules so only high-confidence, high-impact findings block or alert. Reducing noise restores trust in the signal; more tools or blanket blocking worsen fatigue.