Security policy, as code.
Write your security bar once, and every scan, team and pipeline follows it.
policy.yamlOrganizationEnforced
- BlockCritical SAST findings
- BlockSQL injection on a protected branch
- WarnCVSS 7.0 and above
- ExcludedLegacy reports, accepted risk
Written once. Enforced at every merge.
policy.yamlevaluated on every scan
name: Block Critical Vulnerabilitiesscope: ORGANIZATIONpriority: 50enabled: truerules: - name: Block Critical SAST Findings action: block criteria: - scanner_type eq SAST - severity eq CRITICALSet the rules once, inherited everywhere.
Your organization's baseline reaches every team and project. A project can tighten it, never loosen it.
AcmeOrganization
Block Critical Vulnerabilitiesseverity eq CRITICAL → block- PaymentsTeaminherited
payments-apiinheritedcheckout-webinherited+ severity eq HIGH → blockstricter, never looser
- PlatformTeaminherited
infrainheriteddocs-siteinherited
Start with one repository.
Connect GitHub, GitLab, Bitbucket or Azure DevOps, pick a repository, and the first scan starts.
In detail
What a rule can say
Write the rule. Block the merge. Log the exception.
10 rule types, 8 operators, AND / OR logic. From a raw CVSS threshold to a specific CWE on a protected branch.
policy.yamlOrganizationEnforced
- BlockCritical SAST findingsscanner_type eq SASTAND severity eq CRITICAL
- BlockSQL injection on a protected branchCWE-89AND main
- WarnCVSS 7.0 and aboveCVSS 4.0
- ExcludedLegacy reports, accepted risklegacy/reports/**2026-12-31
10 rule types, 8 operators, AND / OR logic. From a raw CVSS threshold to a specific CWE on a protected branch.
Policy management, in short
What is security policy as code?
Your security requirements live as version-controlled YAML next to your code. CybeDefend evaluates the current policy against every scan across SAST, SCA, secrets, container, IaC and CI/CD, so the rules travel with the repo.
What is the difference between block and warn?
Block stops the pipeline and records the violation. Warn logs it and lets the pipeline continue, which is the safe way to roll out a new rule before you enforce it.
How does the organization, team and project hierarchy work?
Policies cascade top down. The organization sets a baseline that teams and projects inherit and can only make stricter, so a company mandate is never silently overridden.
Does policy evaluation slow down my pipeline?
No. Policies are evaluated asynchronously with a configurable timeout, so scans and deployments never wait on the gate.
Can I make an exception for a file or an accepted risk?
Yes. Each policy supports scoped glob-pattern exclusions with optional expiry dates, and you can mark a finding as accepted risk with a justification. Both leave an audit trail.