AI
The Single Source of Truth Problem
AppSec teams often inherit scope they don’t fully understand, and tool vendors push teams toward logging into dozens of separate consoles. Most organizations end up stitching data together in spreadsheets. That patchwork makes it impossible to answer basic questions: what has been tested, what needs fixing, and who is responsible. DefectDojo was built to replace that setup with one place to normalize scanner outputs, remove duplicates, and serve different views to different stakeholders.
Engagements and the 180-Parser Architecture
DefectDojo organizes work through “engagements,” a structure that combines results from multiple scanners into one reporting output. Run four tools against a repo and the engagement shows one net finding list, not four separate reports. The platform ships over 180 parsers for scanner output formats, plus CSV and JSON for custom data. Features include customizable deduplication, false positive tracking, tagging, customer reporting, a capacity calendar, and historical assessment records. A SaaS version called DefectDojo Pro funds the core maintainers.
Why a Vulnerability Buffer Beats Direct Jira Pipelines
The AppSec pipeline model covers intake, triage, test, and deliver. DefectDojo sits between the test stage and developers as a deliberate buffer. Instead of piping every scanner finding directly into Jira, teams use DefectDojo to mark false positives, deduplicate, and group related findings first. One practical example: a library with seven CVEs needs one Jira ticket, not seven. Teams new to SAST can import only criticals and highs to start, then add lower severities as capacity grows.
840% More Assessments With a Smaller Team
One organization using DefectDojo ran 44 security assessments per year when they started. Two years later, they ran 414. The team shrank by 5.5 people over that same period, an 840% efficiency gain with fewer staff. A separate example from a developer named Aron: 15 repos, 5,100 automated pipeline runs over four months, over 25,000 container executions. Both outcomes came from removing the manual work of reconciling scanner outputs and tracking findings across spreadsheets.
Dropping MySQL, Hardening Tests, and the Path to 3.0
The July release dropped MySQL and RabbitMQ support, leaving PostgreSQL and Redis as the only backends. The team now only accepts features that ship with automated test coverage and is rewriting the UI test framework. A beta UI is available to Pro customers. One customer running 26,000 re-imports per day triggered a significant internal performance overhaul. The team targets a 3.0 release but is working through internal cleanup first: the notification framework and re-import pipeline need updates before new capabilities land.
Q&A
Can DefectDojo ingest threat model outputs? A Threat Modeler parser was recently added; custom threat modeling findings can also be imported via CSV. ▶ Watch (17:54)
When multiple scanners push data in, how do you avoid being overwhelmed? DefectDojo deduplicates findings automatically, closes findings absent from the latest re-import, and lets teams filter by severity before importing into their real product structure. ▶ Watch (19:09)
What finding statuses does DefectDojo support beyond open and closed? Active, active-plus-verified (human-confirmed), mitigated, closed, and risk-accepted are all supported, with optional SLA targets tracked at the product level. ▶ Watch (21:19)
How does ASVS benchmarking work inside DefectDojo? Enable it, select one of three ASVS levels, check the controls you have in place, and the product page shows your percentage toward 100% compliance. ▶ Watch (22:09)
Notable Quotes
using Excel it’s disgusting and it Matt Tesauro · ▶ Watch (3:06)
exactly why we created defect Dojo was Matt Tesauro · ▶ Watch (3:29)
that honestly I would not suggest you do Matt Tesauro · ▶ Watch (26:21)
Key Takeaways
- DefectDojo centralizes findings from over 180 scanners, replacing spreadsheets and fragmented vendor consoles.
- Placing a vulnerability buffer before Jira reduces noise; one library update becomes one ticket, not seven.
- One deployment grew from 44 to 414 assessments per year over two years while the team shrank by 5.5 people.
About the Speaker(s)
Matt Tesauro specializes in building security programs, using automation to increase team output, and training security professionals at all experience levels. When not writing automation code in Go, he promotes DevSecOps adoption broadly. He is the CTO and co-founder of DefectDojo Inc., the core maintainer of the open source project, and a board member at OWASP.