[bacelyy]

You’re absolutely right — SMEs don’t need another wall of JSON masquerading as “security.” The value is in fast interpretation, not just detection. In practice we’ve found that the sweet spot is dual-mode output:

• Machine-readable (SARIF/JUnit/JSON) so CI/CD, GitHub Actions, and auditors can ingest it automatically. • Human-readable summaries that tell a non-security person what this means and what to do next in <10 seconds.

Pass/fail thresholds tied to control objectives help a lot because SMEs rarely know whether a warning is “fix tomorrow” or “fix this quarter.”