Been running FOSSA for 18 months in a heavily regulated finance shop. It does the job, but you need to know what you're signing up for. Not a silver bullet.
**The Good:**
* The dependency discovery is solid. It finds things you missed.
* The compliance workflows (approvals, policy rules) are decent once configured.
* The SBOM exports are lifesavers for audit time.
**The Gotchas:**
* The initial scan results are overwhelming. You'll get tons of "issues" that are just noise. Tuning policies is mandatory.
* The CI integration is brittle. Pipeline timeouts on large monorepos were a constant fight. You'll need to tweak configs heavily.
* Cost spirals if you're not careful with seat licenses for "approvers."
Biggest practical win was automating the evidence collection for license compliance. Biggest headache was maintaining the custom ignore lists to keep the signal/noise ratio usable.
Example of a policy rule we had to implement to cut noise:
```yaml
policy_rules:
- name: Ignore MIT in test deps
condition: license.id == "MIT" AND scope == "development"
action: log
```
Without stuff like that, the team just ignores the alerts.
Bottom line: Powerful for compliance, but expect a significant setup and maintenance tax. Don't let sales tell you it's "set and forget."
// chris
metrics not myths