Cybersecurity teams are under mounting pressure to remediate vulnerabilities quickly, while engineering teams must keep delivering the reliable digital services customers expect. That makes security tooling a customer experience decision as much as a technical one.
The challenge for CX tech buyers is choosing technologies that reduce the number of issues engineers need to manage, without slowing product delivery or creating new operational burdens.
The rising volume of vulnerabilities makes this increasingly urgent, Dan Conn, Staff Platform Engineer at Trustpilot, told CX Today.
“We’re finding that just as many vulnerabilities in recent years are found than the 10 previous years or five previous years. That’s quite a remarkable uptick. It’s something that we’re all going to struggle with going forward.”
While AI can help security researchers find vulnerabilities, it may also speed up the discovery of flaws that attackers can exploit. Conn pointed to a recent example in which AI, working alongside a researcher, identified an exploit affecting multiple software versions.
A security approach built around ever-growing queues of alerts will not scale. Instead, the first buying priority should be better prioritization, acknowledging that a high Common Vulnerability Scoring System (CVSS) score does not automatically mean a flaw poses the highest risk to customers or the business.
“In particular, just relying on CVSS scoring, that can be quite problematic,” Conn said. “A lot of the base scores don’t take into account the temporal environment scores that you meant to add anyway.”
At Trustpilot, teams use a combination of signals, including CVSS severity, Exploit Prediction Scoring System (EPSS) exploitability data and whether a vulnerability can genuinely affect their own environment, Conn said. They also consider customer exposure.
“The main overriding factors are, is it on the perimeter? Is it something that a customer can touch? That would be the first thing to get sorted.”
For CX tech buyers, that means asking potential vendors whether they can help teams rank risks by real-world exploitability, internet exposure, affected services and customer impact. While tools that simply generate an inventory of vulnerabilities can create more triage work, more useful platforms help teams identify the issues that could interrupt a customer journey, expose customer data or affect service trust.
Trustpilot is a customer of software supply chain security company Chainguard, using its hardened container images as part of this effort. The relationship illustrates the shift in security buying from tools that report a problem to products that remove a common source of risk before it reaches developers and production systems.
Conn describes Trustpilot’s approach as “start left,” building on the established principle of shifting security earlier in the software-development lifecycle. But the aim is not simply to give developers more security tasks.
“More from a security side standpoint of ‘start left,’ this is like ‘secure by default,’” Conn said.