The product security team has seen significant benefits across both the security and engineering organizations since placing the Oligo platform at the core of its product security program. 

Alignment of Vulnerabilities to Real Risk

Oligo’s platform has fostered better collaboration and partnership between security and engineering teams, as Oligo makes it seamless to deliver trusted results to developers. Rather than simply flagging problems, the security organization can now show why a specific issue needs to be fixed, based on evidence of a library’s runtime execution. 

“Previously, more than half of our SCA findings were going out of SLA, and with Oligo, we’re down to a very small percentage . It’s an incredible testament to showcase that engineering really does care about vulnerabilities, as long as they know the problem is tied to real risk.” - Senior Staff Security Engineer, Financial Services Organization

Zero-Day Response 

Another aspect that has been critical for the company is Oligo’s unique ability to identify and respond against zero-day vulnerabilities. Previously, when a zero day was announced, they had to manually find impacted dependencies, figure out which ones were actually exploitable, and prioritize accordingly.

With Oligo, the security team can simply look up the vulnerability within their environment, show proof of exploitability for certain dependencies, and orchestrate remediation efforts. The removal of the manual processes required for prioritization has enabled the company to apply focus to urgent problems. On top of this, Oligo’s Application Detection and Response (ADR) capabilities allow the security team to continuously profile the behavior of application components to detect anomalies and respond to malicious actions, protecting the environment from vulnerabilities lacking a CVE identifier. 

“Oligo has given us peace of mind, allowing us to shift the internal security focus away from open-source software. If something does go wrong, we know that Oligo is going to catch the anomalous behavior and alert us to respond promptly.” - Senior Staff Security Engineer, Financial Services Organization

Ultrafast Deployment 

According to the organization, the Oligo deployment process was seamless and easy, leading to immediate value. Oligo was rolled out, and they achieved full coverage in its lower environment in a day, then moved it up to production after some testing. 

Engineering Efficiency, Cost Savings, and Smaller Attack Surface

Beyond the improved security posture, the benefits of Oligo even extend to driving cost savings for engineering. Due to Oligo’s ability to see which libraries are used in applications in production, the company was able to identify opportunities to remove unused libraries, leading to reduced artifact storage costs, transfer costs, and build time. This can significantly drive down the operational cost per pull request as the organization continues to scale and minimize the organization’s overall attack surface.

“What’s great about Oligo is that all of our expectations have been not just met, but blown out of the water when it comes to identifying what’s exploitable and executed in our environment.” - Senior Staff Security Engineer, Financial Services Organization