Red Hat Blog: DevSecOps tools, culture and misconceptions: Advice from Red Hatters

I’ve seen organizations where developer productivity is measured by the number of lines of code they deliver, which is a terrible metric. Don’t measure your team on that, don’t measure them on the number of vulnerabilities that are found the first time you scan -- measure them on how quickly they can respond, or on the effectiveness of their tests, or whether they’re testing the right things.