Open the ignore file of any security tool that has been in a codebase for two years.

You will find entries nobody can explain. A rule id with no comment. A path that no longer exists.

A wildcard somebody added during an incident. Possibly a whole control switched off, dated by

git blame to a Friday.

None of that happened because the team was careless. It happened because the tool offered exactly

one way to deal with a finding it could not fix today, and that way was to make it disappear.

Accepting risk is not the problem

Every security program accepts risk. A vulnerability with no patch, a rule that is wrong about your

code, a finding in a test fixture that is supposed to look like a secret. Refusing to accept any

risk means never shipping, so the question was never whether. Only whether it is written down.

The problem is the shape of the mechanism.…