Just built a simple dashboard comparing scan times across our project portfolio.

Spun up a dashboard for scan times. It's predictably grim.

Our "simple" monorepo with 15 microservices? SAST takes 47 minutes. The SCA tool adds another 22. That's over an hour of CI time just for security theater before a single test runs. All to find the same dozen low-severity npm library flags we ignore anyway.

Here's the config that supposedly "optimizes" it. The tool vendor's recommendation.
```yaml
scan:
mode: deep
fail-on: all
monorepo: true
skip-dirs: node_modules, .git
```
Deep mode. On every commit. For a frontend change.

The ROI is negative. Most teams would be better off with `npm audit` in a pre-commit hook and calling it a day.