There is a need to reduce CI disruption from false positives. The security scan job can block CI runs on findings that are context-dependent and not actually exploitable in our environment. That creates noise and slows engineering velocity. We need better controls for more granular tuning and suppression to mark findings as accepted risk or not applicable with context, expiry, and audit trail. This will help compliance stay strong without repeatedly re-litigating the same issue. Prioritization would improve if findings were mapped to likelihood and impact and enriched with repository and runtime context. For example, it should only fail builds on truly high-confidence, high-severity issues.
