What metrics tell you whether a DevSecOps program is actually working?
Quick Answer
Track mean time to remediate by severity, percentage of pipelines with security gates enforced (not just warning), escaped-defect rate, and false-positive rate that predicts whether developers will start ignoring the gate. The leading indicator is false-positive rate — if it climbs, developers start ignoring the gates and every other metric degrades.
Detailed Answer
Vanity metrics (number of findings, number of scans) prove activity, not security. Useful metrics measure outcomes and flow.
Track mean time to remediate by severity, percentage of pipelines with security gates enforced (not just warning), escaped-defect rate, and false-positive rate that predicts whether developers will start ignoring the gate. Mean time to remediate by severity shows whether findings actually get fixed or just pile up. Gate enforcement coverage shows how much of the estate is genuinely protected versus merely warned at. Escaped-defect rate — issues found in production that a gate should have caught — measures the program's real effectiveness.
The metric that predicts collapse is false-positive rate. Once it crosses the point where developers assume a red build is noise, they bypass the gate and every downstream number rots. Treat scanner precision as a first-class reliability metric, not an afterthought.
Code Example
# DevSecOps program metrics # MTTR by severity -> are findings actually fixed? # gate enforcement coverage -> % pipelines blocking vs warning # escaped-defect rate -> issues prod caught that a gate should have # false-positive rate -> LEADING indicator of gate abandonment
Interview Tip
Name false-positive rate as a leading indicator — it shows you understand adoption, not just scanning.