Engagement 10
Choke Point Sprint
Close one of the two boundaries, properly, in weeks — without touching the rest.
The situation
There are only two places where the whole pipeline narrows: what comes in, and what goes out. Every other stage can be hardened later without the rest of the estate noticing.
Teams rarely fail here for lack of ambition. They fail by attempting both boundaries across every repository at once, which takes a year and shows nothing in the first quarter. This closes one boundary on one subject, and measures it.
This is you if
- Container findings dominate the backlog and almost none of them are in code you wrote.
- You want a result you can show, on one image family or one package ecosystem, before committing further.
- Scanning harder has stopped producing improvement and you need a different lever.
How it runs
- Week 1
Choose the boundary and the subject
Intake or release, on one image family or one package ecosystem. Picking a narrow subject is what makes the before and after a measurement rather than an estimate.
- Weeks 2–5
Close it
For intake: hardened base images with automated migration and equivalence testing, or behavioral dependency analysis at the pull request. For release: signing, provenance, and the policy that verifies them at deployment.
- Weeks 5–6
Measure and hand over
The same counts taken before and after on the real subject, with the runbook for extending it to the next family without us.
What you are left holding
- One boundary closed: either what enters the build, or what leaves it
- Hardened base images with automated migration and equivalence testing, if that is the one
- Behavioral dependency analysis at the pull request and at install, if it is the other
- A measured before and after on a real image family or repository, not an estimate
What we need from you
- One image family or package ecosystem you are willing to change, and the team that owns it.
- A build you can run end to end outside production.
- Agreement on what gets measured before we start, so the after is comparable.
A fixed fee that assumes nothing about access is a guess. This is the list that keeps the price the price.
What this is not
- Not the whole estate. One boundary on one subject — extending it is work you can do without us, which is the point.
- Not a product sale. Where a product is the right lever we say so and name the alternatives, including those we have no relationship with.
What we can already show
On our own monorepo: 236 findings to 8, image size 1.01 GB to 642 MB, and 202 of the original findings had no upstream fix.
Why people call about this one
Nobody can defend the tool spend
Fifteen to thirty overlapping tools with tangled licensing, in a year when every line is being questioned. The easiest security sale in a flat budget is the one that removes spend.
On the SAST program we model, the license is 34% to 41% of what the tool actually costs
The shape of it
- Shape
- Four to six weeks on one choke point
- Usually funded by
- Engineering · CISO
- Often leads to
- Supply Chain Modernization