Revolut Enhances Compliance and Security with Aikido Technology
Revolut's adoption of Aikido's technology marks a pivotal shift in tackling the flood of security findings, empowering its extensive development team to prioritize actionable vulnerabilities effectively.
Key Facts
- Revolut's switch to Aikido maintained continuous SCA coverage, crucial for regulatory compliance.
- Aikido's reachability analysis prioritized 10,000 issues, enhancing developer focus on critical vulnerabilities.
- Direct Slack support led to same-day fixes, boosting operational efficiency and developer satisfaction.
- Replacing in-house DAST with Aikido reduced maintenance overhead, improving resource allocation for security.
- Future plans for runtime protection indicate a strategic shift towards proactive security measures against zero-days.
Summary
Summary
Revolut, a global fintech company, faced an overwhelming volume of security findings from its software composition analysis (SCA) tool, making it difficult to prioritize vulnerabilities. By switching to Aikido, they implemented reachability analysis that filtered out noise and highlighted critical issues. This transition resulted in improved accuracy and streamlined workflows for their development teams.
Background
Revolut, founded in 2015 and headquartered in London, operates in 40 countries and employs over 2,500 developers. Before deploying Aikido, the company relied on an existing SCA tool that generated an excessive number of findings, complicating their ability to secure customer data effectively.
Challenge
The primary challenge was managing the flood of findings produced by SCA, which had become unmanageable due to the increasing number of vulnerabilities being identified, particularly in open-source libraries. The security team struggled to differentiate between exploitable vulnerabilities and irrelevant noise, leading to inefficiencies in their workflow.
Solution
Revolut transitioned to Aikido, focusing on its reachability analysis feature, which allowed the team to identify vulnerabilities that directly impacted their transitive libraries. This implementation involved a full vendor switch, requiring the rebuilding of in-house automations and ensuring continuous scanning coverage without gaps. Developers received clear, prioritized tickets linked to relevant findings, streamlining their workflow.
Results
The migration to Aikido maintained uninterrupted scanning coverage, ensuring no lapse in vulnerability detection. The accuracy of Aikido's findings was rated higher than the previous tool during the proof of concept. Developers reported positive feedback on the clarity of the tickets they received, which included direct links to necessary updates and relevant CVE information.
Key Insights
Effective vulnerability management requires tools that can filter out noise and highlight critical issues. A collaborative relationship with vendors can enhance support and responsiveness. Streamlining workflows for developers by providing clear, actionable tasks can significantly improve efficiency and focus on fixing vulnerabilities.
Customer Testimonial
"They are helping us protect our code and our data, and helping us mature the tool based on what we're seeing and what we think would work. That is the best point for me." — Arsalan Ghazi, Head of Application Security at Revolut.
Entities Mentioned
Companies
Products
Technologies
People
Key Concepts
Definitions
- Software Composition Analysis (SCA)
- A process that identifies open source components in software and assesses their security vulnerabilities.
- Reachability Analysis
- A technique used to identify which vulnerabilities in transitive libraries are actually exploitable.
- Dynamic Application Security Testing (DAST)
- A security testing methodology that analyzes an application while it is running to identify vulnerabilities.
- Audit Trail
- A record that provides evidence of the sequence of activities that have affected a specific operation or event.
- Vendor Migration
- The process of transitioning from one service provider to another, often involving significant changes to systems and processes.
Use Cases
- →Narrowing down findings from SCA to prioritize critical vulnerabilities.
- →Maintaining a continuous audit trail during vendor migration.
- →Providing developers with targeted tickets for vulnerability fixes.
- →Using AI for enhanced vulnerability detection in open source.
- →Implementing runtime protection to safeguard against zero-day vulnerabilities.
- →Trialing device protection to mitigate supply-chain risks.
Frequently Asked Questions
What is the main challenge Revolut faces with SCA?
The main challenge is managing the overwhelming volume of findings generated by SCA tools, making it difficult to identify which vulnerabilities are truly critical.
Why did Revolut choose Aikido over previous tools?
Revolut chose Aikido for its superior accuracy in identifying relevant vulnerabilities and its effective reachability analysis that helps prioritize issues.
How does Revolut manage developer workload regarding vulnerabilities?
Revolut streamlines the process by assigning developers a single ticket that contains all necessary information, allowing them to focus on fixing rather than sorting through numerous findings.
What role does AI play in Revolut's security strategy?
AI enhances the detection of vulnerabilities in open source components, helping to surface more issues that traditional methods might miss.
What future plans does Revolut have for its security tools?
Revolut plans to implement runtime protection, trial device protection, and explore AI pentesting to further enhance their security posture.