Module S08 — SDLC Gate Harnesses

SDLC Gate Harnesses

Control plane shift, multi-scanner orchestration, trend analysis and risk scoring, vulnerability triage at scale.

minutes

artifacts

sub-sections

The control plane shift from review-time checks to creation-time guardrails. Multi-scanner orchestration that runs SAST, SCA, secrets, and IaC in parallel, aggregates and deduplicates, and gates the pipeline. Trend analysis that tracks whether the codebase is getting safer. Vulnerability triage at scale using CVE, EPSS, and CISA KEV.

Key Claims

Load-Bearing Claims

The control plane shifts from review-time to creation-time. AI coding agents create code in seconds; review-time checks that surface findings days later are structurally too slow. The gate must move to the creation side.

Multi-scanner orchestration normalizes and deduplicates across scanners. Siloed scanners erode trust; the orchestrator presents one unified finding list from SAST, SCA, secrets, and IaC.

EPSS and CISA KEV invert CVSS-only prioritization. A CVSS 9.8 with EPSS 0.01 is less urgent than a CVSS 7.5 with EPSS 0.8. Probability of exploitation, not just impact, drives priority.

Per-author attribution is for coaching, not punishment. Misuse as a performance metric destroys the psychological safety that makes the gate effective.

After This Module

Articulate the control plane shift from review-time checks to creation-time guardrails, and design a hard-gate vs soft-gate decision matrix per scan type.

Orchestrate multiple scanners (SAST, SCA, secrets, IaC) in parallel, aggregate and deduplicate results, and perform LLM-driven cross-scanner triage under a token budget.

Build a trend and risk-scoring system that tracks finding counts over build history, attributes debt per author, and produces a single risk score that gates PR approval.

Implement vulnerability triage at scale: ingest CVE feeds, match against dependency manifests, score exploitability with EPSS, and prioritize with CISA KEV.

Artifacts

Teaching Document

~4,500 words; 4 sub-sections — control plane shift, multi-scanner orchestration, trend + risk, vuln triage

READ

Diagrams

5 diagrams — gate harness n8n, control plane shift, hard/soft gate matrix, risk score + trend, CVE triage pipeline

READ

Slide Deck

reveal.js slide deck, dark theme, design-system teal

READ

Teaching Script

Verbatim teaching transcript, [SLIDE N] cues