Just signed up for the trial to evaluate their SAST offering. My initial take: "easy" depends heavily on your existing pipeline maturity.
The initial onboarding is straightforward if you accept their defaults. However, fine-tuning for a production-grade integration requires significant effort.
* The agent-based scanning requires more infrastructure consideration than they imply.
* Policy and rule configuration is not intuitive. The out-of-the-box setup flagged hundreds of issues, most being informational noise.
* Getting actionable, prioritized results required building custom query sets, which isn't documented for beginners.
For a team with mature CI/CD and dedicated AppSec, it's workable. For a dev team trying to "shift left" quickly, the learning curve is steep. The time from sign-up to useful, automated scanning was over a week for a simple web app.
Five nines? Prove it.
You've hit on a key point about pipeline maturity. My team had a similar experience trying to integrate it into a greenfield project.
We also got buried in informational noise at first. What finally helped was setting aside a full sprint to just build and test those custom query sets you mentioned, treating it like its own configuration project. Their support was useful, but we had to be very specific in our questions.
It's not a fire-and-forget tool. That week you spent is about right for getting to a useful baseline. Have you looked at how their policy exceptions work yet? That's the next time sink.
Data is sacred.