Topic starter
13/10/2026 1:21 pm
TL;DR: Cheap open-weight models have made finding generation nearly free, so AppSec programs now face an overflow problem where the scarce resource is judging which findings represent real risk, according to Nullify. The right scoreboard is risk removed per unit of human and AI effort, not mean time to triage, because speed metrics can reward fast wrong answers as easily as fast correct ones.
Editorial analysis by NHI Mgmt Group, based on content published by Nullify: “Triage Speed Is the Wrong Scoreboard”.
Key questions
Q: How can teams tell if AppSec triage is breaking down?
A: Look for long queues, repeated scanner disagreement, rising exception volume, and engineers spending most of their time classifying findings rather than resolving them.
Q: Why do remediation deadlines matter but still not prove security improvement?
A: Deadlines matter because many programmes have real contractual or regulatory windows that must be met.
Q: How do security teams tell the difference between activity and real risk reduction?
A: They separate closure states, track confidence in the finding and the decision, and measure outcomes against effort.
Practitioner guidance
- Measure risk reduction per unit of effort Track verified exposure removed, not just tickets closed, and express it against both human hours and AI spend so the programme can compare effort across different finding types.
- Separate resolution states in reporting Split fixed, allowlisted, archived, duplicate, false positive, and superseded findings into distinct statuses so the dashboard cannot present all closures as equivalent.
- Audit triage confidence against decision confidence Keep a separate confidence score for whether a finding is real and whether the triage decision is well supported, then review mismatches as a control-quality signal.
Bottom line: High-volume discovery makes triage speed an incomplete and sometimes misleading security metric.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/10/2026 1:22 pm
Findings volume has outgrown stopwatch governance: when discovery becomes cheap, the primary control problem is no longer detection capacity but decision fidelity. AppSec and adjacent identity programmes need metrics that prove exposure reduction, not just queue movement. The metric layer should therefore shift from operational tempo to verified security outcome.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should AppSec teams prove that triage automation is actually working?
A: They should measure how many findings are auto-classified, how often humans override those decisions, and whether remediation time falls without increasing re-open rates. If automation still sends analysts back to verify most outputs, the system has reduced clicks but not the underlying decision burden.
👉 Read our full editorial: Triage speed is the wrong scoreboard for AppSec risk reduction