# Overview Parent epic for SPM's centralized, secure-by-default enablement of GitLab security scanners at scale. This epic exists to track what we are doing and why — not detailed implementation. It connects the [SPM Vision](https://docs.google.com/document/d/1g_ZqRVxpqjC59uo5Ed2Rd7lHsnKuz3lEPy_Wl-Kjwpc) to concrete product and engineering work needed for large Ultimate customers to adopt security safely and consistently. --- ## Problem Statement Large Ultimate customers need to enable and operate security scanners across thousands of projects and groups without fragile, project-by-project CI changes. Today: * Enablement is manual and risky — customers fear pipeline breakage, cost surprises, and behavior changes when turning on scanners at scale. * No clear control point — security and platform owners lack a centralized place to define and manage "how security is enabled" across their portfolio. * Limited visibility and attribution — we cannot easily see: * Where security is enabled by default vs. ad hoc. * How quickly customers reach first meaningful security value. * How centralized enablement influences multi-scanner adoption. --- ## Strategic Direction At a high level, this epic drives SPM to: ### Make centralized enablement the default entry point for security * Security should be enabled and managed through SPM-owned surfaces, not scattered CI configuration. * Security owners define how scanners are rolled out across groups and organizations from a single place. ### Ensure enablement is safe and predictable at enterprise scale * Provide guardrails that limit blast radius, protect performance, and keep costs predictable when rolling out to 10K–50K+ projects. * Make changes reviewable and explainable so security and platform teams are confident enabling security broadly. ### Provide clear, shared understanding of "what is enabled where, and why" Give project, group, and org stakeholders a consistent, trustworthy view of: * Which scanners are enabled. * Why they are running (e.g., a specific SPM configuration or policy). * How this relates to overall security posture. ### Measure adoption and value from centralized enablement * Attribute scanner adoption to SPM-driven defaults vs. manual CI configuration. * Track time-to-first meaningful security signal for large accounts. * Tie results to SPM's FY27 Security-by-Default goals and multi-scanner coverage targets. ### Naming change Please note the name for this feature has changed from `Centralized Security Scanner Enablement` to `Scanner Enablement Wizard`. --- ## Ownership * PM: @m-omokoh * PD: @mfangman * EM: @or-gal