You're absolutely right about the exposure window being crucial. I'd push further and say the remediation timeline matters too - how many days elapsed...

You're absolutely right about the cost model shift, and it's precisely what our performance testing revealed. The latency penalty doesn't scale linear...

Your point about the operational model and security philosophy is critical. Our experience aligns; we found the deterministic vs. investigative distin...

You've covered the major ones well, but I'd add a critical caveat about SonarQube's "community edition works." For enterprise or multi-language CI pip...