01 · The challenge
Static reports, no action
Traditional consulting firms ran scans that duplicated in-house tools and delivered 50+ page reports without actionable results.
Case Study How Domino’s Builds Security Testing into Fast-Moving Software Releases
Domino’s needed security testing that could keep pace with software releases every two weeks or less. Synack combined vetted security researchers with a platform for real-time testing visibility, actionable findings, and patch verification, helping security and development teams address vulnerabilities before applications reached production.
Pre-release testing For applications that impact the business
On-demand pentests Two-week engagements with start-and-stop control
Real-time visibility Into testing activity and findings
Security that keeps pace with delivery
For Domino’s, security is product quality, and it has to move as fast as the engineering teams do.
02 · The approach
Human-led testing on a platform
The vetted Synack Red Team tests Domino’s web and mobile apps, and the Synack Platform helps triage, prioritize, patch and manage every finding.
03 · The outcome
Fewer vulnerabilities over time
Regular testing before new software reaches production helped Domino’s find fewer vulnerabilities over time, strengthen developer ownership, and assess deployment readiness.
Why security is part of the recipe
Domino’s spearheaded a new age of digital ordering, from mobile apps and social channels to pizza tracking and driver technology. With an average of 2 million orders a day in the US, an unchecked vulnerability can trigger costly business downtime.
Its agile engineering teams roll out code across one or all of their geographies at least every two weeks. To sustain that pace, security has to be part of the product development cycle itself.
Domino’s had tried traditional security consulting firms, but none offered the dynamism it needed. Their scanning duplicated what Domino’s already had in-house, and the 50+ page reports that followed did not provide actionable results. The security team turned to Synack’s human-powered testing for dynamic security for dynamic problems.
Until Synack, I had not seen a major change in security testing.
Expert-led testing with visibility and control
Domino’s tests a broad range of assets, from iOS and Android apps to its Customer Care and PeopleSoft web applications, combining a highly skilled research team with the Synack Platform.
Vetted Synack Red Team
Only the top 10% of applicants are accepted. Virtual desktop infrastructure and a VPN gateway track all testing activity, so Domino’s knows who is testing and what they did.
Two-week pentests on demand
Domino’s buys bundles of two-week pentests and runs them before new software reaches production, with the control to start and stop testing at its discretion.
Coverage Analytics
Security and development teams see researcher hits, attack traffic and resulting vulnerabilities in real time, evidence of true negatives rather than a consultant’s word.
Attacker Resistance Score
A realistic metric for how hardened each asset is, used to measure readiness for deployment and to prioritize security resources.
“Synack is our last chance to find something before we move it to the Internet.”
Developers who own their code
Knowing their work will be tested by a third party changed how Domino’s developers and security team work together, with more ownership of the code and a greater inclination to fix things.
Our policy is if an app is going to impact the business before it goes live, it must be Synacked.
Developers now measure the time it takes Synack to find vulnerabilities in their code.
There are comforts with Synack. I know I’m not taking unnecessary risks.
It’s like a safe. You test a safe to know how resistant it is to a break-in. That’s what the Attacker Resistance Score gives me. It tells me how hardened my digital assets are against attack.
Domino’s CISO
What Domino’s achieved
Fewer vulnerabilities over time
Regular testing before each release means Domino’s finds fewer vulnerabilities in its assets.
Findings developers can act on
Detailed reporting shows how each vulnerability was found, and patch verification helps engineering turn findings into fixed bugs.
Testing at the speed of release
Synack deploys quickly across a varied scope of assets, with a critical volume of skilled researchers and transparent testing in the platform.
Control over every test
Domino’s can swiftly test any asset and stop testing at its discretion.
Risk metrics leadership can use
The Attacker Resistance Score gives security engineers, product owners and leadership a shared view of security performance for each asset and the whole company.
Questions about the Domino’s case study
Who is Domino’s?
Domino’s grew from a single pizza restaurant in 1960 into the recognized world leader in pizza delivery. It processes an average of 2 million orders a day in the US across web, mobile and social ordering channels.
Which Synack solutions does Domino’s use?
Domino’s uses Synack’s Pentesting as a Service, with the Synack Red Team testing its assets and the Synack Platform used to triage, prioritize, patch and manage findings, including Coverage Analytics and the Attacker Resistance Score.
What does Domino’s test with Synack?
A broad range of assets, including its iOS and Android apps, Customer Care web application and PeopleSoft web application.
How often does Domino’s run pentests?
Domino’s buys bundles of two-week pentests and runs them before new software goes into production. Any app that will impact the business must be tested before it goes live.
What is the Attacker Resistance Score?
A Synack metric that shows how hardened an asset is against attack. Domino’s uses it to measure security risk and deployment readiness, prioritize resources and share security performance with leadership and product owners.
Get the Domino’s case study
Read the full three-page story of how Domino’s made security testing part of an agile development cycle that ships code every two weeks.
Case Study · IT services and training How FDM Group Turned Pentest Findings Into Fixes Read the FDM Group story → 
Case Study · Travel technology How Sabre Builds Human-Led API Security Testing into Its Development Cycle Read the Sabre story → 
Case Study · Oil and gas How NOV Found Exploitable Vulnerabilities It Could Act On Read the NOV story →