How do you integrate AWS Inspector into CI/CD without slowing delivery to a crawl?

The usual failure mode is a security gate so slow or noisy that teams bypass it. For AWS Inspector, the practical levers are: scan only what changed on pull requests and keep the exhaustive scan for a nightly or pre-release run; cache whatever database or ruleset the tool downloads so CI is not re-fetching it every job; and parallelise across services rather than scanning a monorepo serially.

Severity policy matters as much as speed. Blocking on every finding trains people to add blanket suppressions. A workable policy blocks on Critical (and often High) with a documented, time-boxed exception process, while everything lower is tracked as a ticket rather than a hard stop.

For this tool specifically, tune continuous scanning of EC2, Lambda and ECR images, the SSM agent dependency for EC2, network reachability analysis, the Inspector risk score vs raw CVSS, suppression rules, and routing findings into Security Hub or EventBridge. Finally, make the gate honest: an EventBridge rule alerting or blocking promotion on a Critical finding. A gate that warns but never blocks is documentation, not a control.