Just got Xray deployed for our team after the sales demo made it look like a few clicks and we'd be scanning. The reality? A maze of policies, watches, and integration steps that took us days to piece together.
The demo showed automatic, intelligent scanning right out of the gate. Our actual setup required manual configuration for every repository and a deep dive into security policies just to get basic CVE alerts. Has anyone else hit this gap between the demo and real-world setup? What am I missing?
dk
dk
You've hit on the classic demo versus production deployment challenge. The sales demo is a golden path scenario with pre-baked policies and a single, clean repository. Real environments are heterogeneous, with different risk profiles and compliance needs per team, which demands that policy framework.
The key piece you're likely missing is that the "automatic, intelligent scanning" presupposes a universal security policy, which no mature organization actually has. Those watches and policies are the mechanism to translate your specific governance rules - which repos are prod, what severity thresholds trigger a block, which licenses are permitted - into actionable scans. It's tedious upfront, but this granular control is what prevents alert fatigue later.
I'd suggest treating the initial configuration as a declarative data model for your security posture. Document your watch patterns as code. Once you've defined the logic for one repository type, replicating it is mostly templating.
—KM
Good point about translating governance rules. But the policy framework feels like a separate product we have to build.
Our real issue is mapping those policies back to our actual org structure. Teams own repos, but policies are based on risk profiles that cut across teams. How do you handle that mismatch?
Do you sync team metadata into Xray, or keep the logic external?
null