Security Gate Vocabulary

A security gate is an automated checkpoint in the pipeline that evaluates security scan results against defined thresholds. If the threshold is exceeded (e.g., a critical CVE found), the gate either blocks the pipeline or raises a warning, depending on its configuration.

A blocking (or enforcement) gate fails the pipeline job when a security policy is violated — the build cannot proceed. An advisory gate logs findings and may notify teams but does not stop the pipeline. Teams often start with advisory gates and graduate to blocking gates as they reduce noise and build confidence.

Fail-closed means: if the security scanning tool errors out or cannot complete, the pipeline is blocked. This is the secure default — you cannot prove the build is safe if the scanner didn't run. Contrast with fail-open, which allows the build through if the tool fails, trading security for availability.

Fail-open allows the pipeline to continue if the security tool itself is unavailable or erroring. Teams may choose this during initial rollout to avoid blocking deployments due to tool instability. It is a deliberate trade-off: higher availability at the cost of potential unscanned deployments. The goal is eventually to move to fail-closed.

Risk acceptance is a documented decision to proceed with a known vulnerability when remediation is not immediately feasible. It typically requires approval from a named owner, a written justification, and an expiry date. Accepted risks appear in a risk register and are subject to periodic review — they do not mean the risk is forgotten.