01 · The challenge
Testing that keeps up
Point-in-time pentesting could not match a fast-paced development environment built on many open source packages and dependencies.
Case Study How Spectro Cloud Aligns Continuous Pentesting with Continuous Deployment
Spectro Cloud needed security testing that could keep pace with rapid software releases. Through Synack365, rotating cohorts of vetted researchers continuously tested its critical assets, helping the team understand vulnerabilities, address root causes, and release software with confidence.
50+ researchers Per Synack365 cohort
Continuous testing Aligned with continuous deployment
Up-to-date reporting For customer due diligence
Pentesting at the speed of the SDLC
Spectro Cloud serves highly regulated industries, so its security testing has to move as fast as its releases.
02 · The approach
Continuous PTaaS
Synack365 continuously tests Spectro Cloud’s most critical assets, combing through software releases with rotating cohorts of vetted researchers.
03 · The outcome
Release fast, with confidence
Real-time understanding of weaknesses, root-cause insights and up-to-date reports for customers and auditors.
Security built in from the startup days
Spectro Cloud was created to serve highly regulated industries like government, healthcare and telecommunications. From its days as a startup, it took its security and compliance responsibilities seriously, in both product security and company operations.
Joi Frederick, Spectro Cloud’s Security, Privacy and Compliance Manager, set out to increase the frequency and coverage of testing to get a real-time understanding of the environment and its potential weaknesses.
Her team has achieved SOC 2 Type 2 attestation and ISO 27001 certification. At the time of the case study, the team was also pursuing FedRAMP Moderate Authorized status. It was natural to look at every avenue to address vulnerabilities, and that is what led them to Synack.
Continuous testing aligns with our continuous deployment goals for our flagship solutions, the Palette Enterprise and Palette VerteX platforms.
Continuous offensive testing that keeps pace with development
Synack’s Penetration Testing as a Service routes every finding and analysis through a single platform, from attack surface discovery to patch verification.
Synack365 researcher cohorts
Synack’s highest testing tier rotates through cohorts of 50+ unique, vetted security researchers to bring diverse perspectives and expertise.
Continuous release testing
Researchers comb through software releases for security vulnerabilities, keeping testing in step with continuous deployment.
Find root causes and address third-party risk
Palette brings together many open source packages and dependencies, so the program looks for root causes of software flaws and helps mitigate third-party risk.
Reports for customer due diligence
When customers ask about Spectro Cloud’s security posture, for example in an RFP, the platform makes it easy to scope custom, up-to-date reports.
“Synack’s pentesting program gives our team the best chance to fix vulnerabilities before real-world attackers can exploit them. That’s good for my peace of mind, but more importantly, our customers benefit when ethical hackers have spent hundreds of hours testing Spectro Cloud’s products.”
Being able to release software products fast, with confidence that we have caught vulnerabilities, that we’re tackling them, that’s really important for maintaining trust while also keeping up the pace of innovation for our customers.
Joi Frederick
Security, Privacy and Compliance Manager, Spectro Cloud
What Spectro Cloud achieved
Testing aligned with deployment
Continuous pentesting now matches the continuous deployment of the Palette Enterprise and Palette VerteX platforms.
Diverse researcher expertise
Synack365 cohorts of 50+ unique researchers bring perspectives a single pentest team cannot.
Ready answers for customers
Custom reports with up-to-date, comprehensive data support customer due diligence and RFPs.
Visibility across third-party code
Pentesting helps identify root causes of software flaws across open source packages, libraries and dependencies.
The next phase
The next phase identified in the case study included deeper infrastructure testing, supported by insights into vulnerability trends, average remediation times, and other actionable data.
Questions about the Spectro Cloud case study
Who is Spectro Cloud?
Spectro Cloud delivers simplicity and control to organizations running Kubernetes at any scale. Its Palette platform helps businesses deploy, manage and scale Kubernetes clusters from edge to data center to cloud.
Which Synack solution does Spectro Cloud use?
Synack Penetration Testing as a Service on Synack365, Synack’s highest testing tier, which rotates through cohorts of 50+ unique security researchers.
Why did Spectro Cloud need continuous pentesting?
Its fast-paced development environment and reliance on open source packages and dependencies meant point-in-time testing could not give a real-time view of vulnerabilities.
How does Synack help with compliance and customer requests?
The Synack Platform makes it easy to scope custom reports with up-to-date data when customers ask about Spectro Cloud’s security posture, for example during an RFP.
What next phase did the case study identify?
The next phase identified in the case study included deeper infrastructure testing, supported by insights into vulnerability trends, average remediation times, and other actionable data.
Get the Spectro Cloud case study
Read the full four-page story of how a Kubernetes management leader aligned continuous pentesting with continuous deployment.
Case Study · IT services and training How FDM Group Turned Pentest Findings Into Fixes Read the FDM Group story → 
Case Study · Travel technology How Sabre Builds Human-Led API Security Testing into Its Development Cycle Read the Sabre story → 
Case Study · Oil and gas How NOV Found Exploitable Vulnerabilities It Could Act On Read the NOV story →