Case Study: Watershed

Like most modern software companies, Watershed relies heavily on open source packages. To ensure these packages are secure and up-to-date, Watershed has adopted a disciplined approach to detecting and remediating vulnerabilities.

However, their existing SCA tool generated a high volume of false alarms, overwhelming engineering teams with unnecessary tasks. In search of a more effective solution for vulnerability management, Watershed turned to Coana’s SCA with reachability analysis.

The Challenge: Noisy SCA Slowing Down Engineering Teams

Watershed's security team, led by Head of Security Jesse Kriss, faced challenges in managing vulnerabilities within their monorepo. Watershed's existing SCA tool tracked vulnerabilities, but it often took significant investment from the Security and Engineering teams to determine if they were actually susceptible to the exploit. Jesse explains:

"Our engineering team generally has a positive attitude towards security, but we were stuck doing reactive, time consuming upgrades that may or may not have even been necessary. The promise of knowing exactly which vulnerabilities actually mattered to us was extremely compelling. This is why we considered Coana."

‍

The Solution: Implementing SCA with Reachability Analysis

Coana provided a solution to the security team's needs: By implementing Coana’s SCA with reachability analysis, Watershed was able to remove false positives from their SCA results. The effect was immediate: A few days after implementing Coana, Watershed reduced the number of unresolved reachable vulnerabilities to 0.

This was achieved through two core features of Coana’s SCA:

1. Automated Triaging: Coana automated the triaging process, removing 85% of irrelevant alerts and significantly reducing the vulnerability workload for their engineering teams.
2. Contextual Information: Coana provided contextual information for the 15% of reachable vulnerabilities, making remediation easier for Watershed’s engineers.

As Jesse Kriss puts it,

“Now, only the most relevant 15% of vulnerabilities reach the engineering team, complete with contextual information and suggested fixes. At this volume, we can easily track and guide remediation without specialized tools or complex processes.”

‍

The Implementation: Zero-Configuration, Secure by Design

For Watershed, the implementation of Coana was straightforward and hassle-free. The tool was easily integrated into their CI pipeline using a GitHub Action, and the benefits of the reachability analysis were immediately apparent.

Additionally, since the analysis runs locally without sharing any source code, it ensured that there were no significant security concerns, making the implementation both secure and efficient.

The Impact: Enhanced Efficiency and Developer Satisfaction

By implementing Coana, Watershed experienced remarkable improvements in their vulnerability management process:

• 85% Reduction in Workload: With Coana's precise filtering, only 15% of vulnerabilities required attention from the security team, allowing engineers to focus on core development tasks.
• Improved Security Posture: The streamlined process ensured that all critical vulnerabilities were addressed promptly without overwhelming the team.

"Coana has changed our approach to open source vulnerability triaging and remediation” says Jesse Kriss. “The reduction in noise and the focus on critical issues have improved productivity, kept our third party security posture strong, and improved the relationship between Security and Engineering, because we’re only asking for work when it actually matters."

‍

About Watershed

Watershed is the enterprise sustainability platform used by companies like Airbnb, Carlyle Group, Everlane, YETI, and BBVA to reduce emissions, meet customer, investor, and regulatory requirements, and modernize their sustainability programs. Watershed has offices in San Francisco, New York, and London.

Ready to see how Coana can transform your vulnerability management process? Contact us for a demo and experience the benefits firsthand.