The Real Cost of SLSA Adoption — Eighteen Months From Level 2 to Level 3

The SLSA (Supply-chain Levels for Software Artifacts) guide draws Level 1 → 4 as a clean step ladder. In practice it isn't. Levels 1–2 are nearly free; Level 3 is where the real cost lives.

This post is the measured time, money, and political cost of going from Level 2 to Level 3 over 18 months.

SLSA Level 2 — almost free

Level 2 requires:

• Builds run on a hosted build service (GitHub Actions, GitLab CI, etc.)
• Signed provenance — which source produced this build
• Tamper-resistant source (git)

Most modern CI satisfies this by default. Our work — 3 days. Cost 0.

SLSA Level 3 — eighteen months

Level 3 requires:

• Isolated build environment — build machines fully isolated between builds
• Non-falsifiable provenance — provenance signed by the build system, not tamperable from inside the build
• Parameterless — builds deterministic without external parameters

These three look like small changes. They aren't — they require a full re-look at existing build infrastructure.

Time allocation across 18 months

Work                                       | Duration   | Labor cost
───────────────────────────────────────────┼────────────┼────────────
Build worker → *immutable images*          | 6 weeks    | $24,000
Reproducibility validation (parameterless) | 8 weeks    | $32,000
Provenance signing infra (sigstore)        | 4 weeks    | $16,000
Per-build-step isolation validation        | 4 weeks    | $16,000
Existing tooling Level-3 fitness review    | 6 weeks    | $24,000
Certification documents + external audit   | 4 weeks    | $16,000
───────────────────────────────────────────┼────────────┼────────────
Total                                       | 32 weeks   | $128,000

32 weeks = 8 months of focused work. Why 18 calendar months — competing priorities. Focused work was 8; calendar time was 18.

Political cost

Off the cost ledger, the political cost was substantial.

• Existing build tooling didn't fit Level 3 — 4 quarterly meetings to decide on tool changes.
• Some builds get a Level 3 exemption — required company-wide alignment.
• Who is responsible when provenance verification fails — security vs engineering vs SRE — six months of debate.

Not in the cost table. But the real meaning of those 18 months.

Was Level 3 worth it?

Direct incidents Level 3 has prevented to date — 0. Indirect effects:

• New public / financial customer meetings — Level 3 is an entry qualification. Without it, PoCs don't even start.
• Security team's quarterly audit time dropped from 6 hours to 1 (provenance answers automatically).
• The probability of a supply-chain incident itself is hard to measure — insurance value.

Aggregate — 18 months + $128,000 + political cost "worth it" is conditional.

SLSA Level 4 — a no for us

Level 4 = Level 3 + two-person review + hermetic builds for all dependencies. Additional cost similar in scale to Level 3. We made an explicit decision to not pursue Level 4. Reasons:

• None of our customers require Level 4
• The felt ROI of Level 3 is already conditional; Level 4 is more ambiguous
• Level 4 requires changes across the entire dependency ecosystem — not in our control

The $128,000 takeaway

For security and DevOps leads weighing SLSA adoption, the decision comes down to one question — Is Level 2 enough, or do we go to Level 3? The cost table above (32 weeks, $128,000, plus the political cost that never makes the ledger) is the raw material for that call. Going to Level 3 without a customer demanding it is almost always regretted.