Validate and roll out

Validate through Pilot phase on 10-20 machines

Before broad rollout, deploy to 10 to 20 closely monitored machines and confirm all of the following:

• ggshield installs successfully.
• ggshield --version works.
• ggshield plugin list shows machine_scan for the scan user.
• The scheduled job runs without user interaction.
• ggshield machine report exits successfully.
• Scan duration is acceptable.
• Users do not report noticeable performance issues.
• The SAT does not appear in logs, command lines, or output.

If you are deploying honeytoken protection, also confirm:

• ggshield honeytoken plant --list-targets resolves the expected target on a test machine.
• ggshield honeytoken plant exits successfully and is idempotent, so a second run reports no new placement.
• The developer's existing AWS profiles are untouched after planting.

Only continue to percentage-based rollout after this first group is healthy.

Confirm visibility in the Endpoints dashboard

In your GitGuardian dashboard, open Endpoint protection > Endpoints and verify the pilot machines appear as expected:

• The machines table lists each pilot endpoint with a latest endpoint scan time, not Never scanned.
• Fleet coverage KPIs reflect the pilot group, so the Endpoints scan percentage rises after scans run.
• Opening a machine shows Local scanning with severity counts and a ggshield scanner version on the latest scan.
• The Discovered secrets table loads for machines where the scan found credentials. An empty table is acceptable on a clean test machine.
• If you deployed honeytoken protection, the pilot machines show as Protected, and the Honeytoken protection card on a machine reports a recent latest sync.
• Optional: if AI Agents is enabled on your workspace, the tab loads without error for a scanned machine.

For the CLI and MDM checks above, see Deploy ggshield at scale with a service account token. For how to read each view, see Monitor coverage.

Roll out at scale

Here is the suggested rollout path:

10-20 monitored machines → 1% → 10% → 25% → 50% → 100%
             |             |     |      |       |
             +-------------+-----+------+-------+-- pause / rollback gates

We recommend the following approaches for a successful scaled rollout:

• Split waves by region, timezone, business unit, OS, or device type.
• Spread first scans across hours or days, not minutes.
• Use package caching or internal distribution for very large fleets.
• Monitor errors and endpoint impact before each increase.
• Keep rollback simple: disable the scheduled scan first, then remove components if required. For honeytokens, disable the plant job and run a ggshield honeytoken plant --remove-only pass to clear what is already on disk.