Industry: Internet Services & Media
Company: Yahoo
Location: New York
Product: Mend.io
HIGHLIGHTS:
- Rapid identification of libraries enables vulnerabilities to be addressed proactively before they become exploitable.
- Automated pull requests have transformed remediation by making it faster while minimizing disruption to development workflows.
- Mend.io provided exceptional on-site assistance throughout implementation, helping ensure a smooth deployment.
The Challenge
Managing the large-scale use of open source components efficiently while reducing the security risks associated with them was a significant challenge for Yahoo. According to Chris Madden, Distinguished Technical Security Engineer at Yahoo, the organization lacked a unified view and a single solution covering all open source software and the related risks across the company. As a result, Yahoo began looking for a more effective way to manage security incidents at scale.
Yahoo’s objective was to establish an enterprise-grade solution that included capabilities such as automated pull requests for remediation and comprehensive support for open source compliance. These enhancements were intended to simplify development processes and ensure consistent application of security policies. They would also help vulnerabilities be addressed proactively and more quickly.
The Solution
Yahoo selected Mend SCA as the solution. Mend.io’s capacity to operate at Yahoo’s enterprise scale and deliver a complete view of open source components and their associated risks played a key role in the decision. Yahoo subsequently integrated Mend.io into its GitHub Enterprise environment.
Madden explained that Yahoo’s software engineers viewed automated pull requests as a major improvement. The functionality can be tailored to the developer experience and allows remediation to happen quickly without interrupting development activities. He also highlighted the ability to identify libraries rapidly. This supports proactive action on vulnerabilities before they can become exploitable. Madden additionally praised Mend.io’s on-site assistance during the implementation process, describing the support as exceptional and emphasizing that deployment proceeded smoothly.
Yahoo software engineers regarded automated pull requests as a major improvement because the functionality can be customized around the developer experience and supports rapid remediation without disrupting development.
The Results
Mend.io has contributed to a significant transformation of Yahoo’s security approach. Madden explained that Mend SCA enables Yahoo to use open source software safely and securely. He also noted that SCA providers are often particularly strong either in compliance or in vulnerability management, while relatively few perform strongly in both areas. Mend.io is among the vendors that provide strength in both. The ability to resolve vulnerabilities rapidly across Yahoo’s entire software portfolio has substantially reduced the company’s risk.
Chris Madden, Distinguished Technical Security Engineer at Yahoo, noted that the number of Mend SCA-generated pull requests that were merged, compared with the cost of performing the same work manually, demonstrated considerable savings in developer time.
Madden also noted that Mend SCA helps Yahoo make more efficient use of its resources. This allows greater focus to be placed on growth, profitability, and innovation. He explained that comparing the number of Mend SCA-generated pull requests that were merged with the cost of having developers perform the same work manually demonstrates considerable savings in developer time.
About Yahoo
Yahoo is a global media and technology company with several thousand employees. The company manages a portfolio of iconic products and is highly active in open source projects.
