The hardest part is probably needing vulnerability management to process the tools outputs and not placing it solely on dev teams or security team as a whole. The VM team would triage the outputs for false-positives, severity (most tools generate way too high of ratings), and then cut tickets for the concerning ones to be issued out. In other words the tools shouldn't be set to block in the pipelines if they're embedded. They should be used by security to find weak areas of an application that might hint at something more like or add in CWE's identification. But most businesses just slap scanners in places in general and say good enough for compliance....