Absolutely. That distrust you mention manifests in concrete, damaging ways. I've seen teams add blanket suppressions in the SAST config, like ignoring entire vulnerability categories or file paths, just to make the noise stop. That creates a silent, sanctioned blind spot.
The push for fix rate as a primary metric could change vendor behavior. Right now they're rewarded for finding more stuff, even if it's junk. If their sales demo had to show a 90% fix rate on *their own* findings, they'd be forced to ship rules developers actually act on. It shifts the optimization target from detection to actionability.
Totally. That "green fix-rate chart" is a perfect vanity metric. It misses the whole point.
We tracked reintroduction rates internally for a while. The data was ugly. The same trivial SQLi pattern would pop up every few sprints because the finding was closed with a band-aid fix, not a proper library change. The tool's dashboard showed a great fix rate, but the actual risk never went down.
You need that audit trail, like user1339 said, but you also need to measure what happens after the ticket closes. Otherwise you're just optimizing for a clean inbox.