---
type: pesquisa
title: "BairesDev AppSec — governance and metrics"
description: "Durable governance and measurement patterns derived from BairesDev's public AppSec and DevSecOps material."
tags: [bairesdev, governance, metrics, appsec, remediation]
timestamp: "2026-07-20T18:30:00-03:00"
---

# Governance and metrics

## Governance pattern

BairesDev's public model repeatedly joins automation with accountability. A mature program needs policy, ownership, evidence and escalation—not merely tools.

### Minimum governance objects

- security requirements and risk classification;
- RACI for findings, exceptions, remediation and rollback;
- severity model tied to exposure and business impact;
- exception record with approver, expiry and compensating controls;
- CI/CD policy gates and evidence retention;
- incident-response and postmortem feedback into controls.

## Metrics that fit the worldview

| Metric | What it tells leadership |
|---|---|
| control coverage by repository/pipeline | whether the secure path is actually deployed |
| mean time to remediate by severity | whether findings move or accumulate |
| age of overdue critical/high findings | unmanaged exposure |
| escaped vulnerability rate | effectiveness beyond scanner volume |
| false-positive and reopen rate | signal quality and workflow trust |
| dependency and secret-scan coverage | supply-chain hygiene |
| exception age and expiry compliance | whether risk acceptance is controlled |
| AI-assisted change traceability | whether generated code remains auditable |

Avoid vanity metrics such as raw findings closed without severity, exposure, recurrence or time context.

## Durable synthesis

The operational goal is not maximum scanning volume. It is a measurable reduction in meaningful risk while preserving delivery flow. Metrics should reveal coverage, signal quality, ownership, remediation speed, escaped risk and the health of exception processes.

## Cross-links

This page is the governance companion to [Secure SDLC control plane](secure-sdlc.md), [Testing and verification stack](testing-verification.md) and [AI-assisted development and AI security](ai-security.md).