Passport to resilience

Who is this travel group?

A leading European travel group moves millions of travelers a year, operates across seven countries through a portfolio of companies, and employs around 3,000 people. Its technology estate carries the whole customer journey: booking systems at the front end, and behind them the operational coordination that gets travelers to their destination and looks after them along the way.

Security sits at the intersection of two business imperatives. Continuity: an outage or attack could stop bookings, disrupt fulfillment and destination logistics, or leave travelers without timely information and support. Trust: the group handles sensitive personal data, including names, passports, dates of birth, and booking records. Five frameworks and regulations shape the program: CIS, PCI DSS, ISO 27001, NIS2, and GDPR. GDPR is particularly demanding in a sector that has to exchange customer data with partners in third countries.

Leadership's direction to the six-person security team is straightforward: make the company as secure as possible without preventing the business from operating.

“Protecting that data and keeping the travel operation available are inseparable from protecting the business.”

Team Lead IT Security

What did life look like before Mondoo?

The old process was a chain of separate tools and manual follow-up. A weekly Tenable Nessus scan produced a PDF. Someone reviewed it, translated findings into tickets, chased the owners, and eventually ran another scan to see whether anything had changed. Credentialed remote scanning also meant provisioning and safeguarding a high-privilege account on every box in the estate.

Two problems compounded each other. Latency: because the scan ran weekly, a vulnerability could exist for up to seven days before anything found it, and a critical finding then took another one to three business days to remediate. Coverage: the gaps were most acute on the business-critical AIX systems, where a deep review could occupy external specialists for days per sample and the native CIS scanner offered no useful remediation guidance. The team leaned on samples and expert judgment rather than continuously verified evidence.

“It was also harder to give leadership a current risk picture, because the report might already be outdated by the time it was read.”

Team Lead IT Security

What triggered the change?

There was no breach and no failed audit. Three things converged instead: a newly established cross-functional security team, a mandate to raise the security level across teams that had previously worked separately, and the decision to adopt CIS as the group's practical standard. That last decision was pivotal, and it needed a route that did not depend on manual collection and samples. Without a scalable platform, the choice was to accept incomplete fleet coverage or add an estimated four people.

“Mondoo did not create the CIS goal. It made that goal operationally achievable.”

Team Lead IT Security

Why did the group choose Mondoo?

Mondoo runs agent-based assessment across the hybrid estate: on-premises Linux, Windows, and AIX, plus multiple AWS accounts. It keeps vulnerability and compliance in one place instead of splitting them across tools and workflows.

Open source at the core.

The cnspec scanning component is open source, which means the team can inspect and understand what actually runs in their environment, and so can the wider community. Open documentation also let them evaluate deployment and product quality before committing, without a sales gate.

A deployment that feels native.

Mondoo installs through standard package managers such as apt and dnf, so rollout felt native to the group's Linux environment rather than bolted on. Compared with remote scanners, the agent also provides a more current view without distributing a high-value credentialed account across the estate.

One platform, both use cases.

Vulnerability and compliance assessment sit on the same underlying data, which as coverage expanded began to support reporting, asset insight, and new automation too.

A vendor the team could reach.

The commercial comparison mattered, but the relationship weighed just as heavily. The team could talk directly to knowledgeable engineers and to Mondoo's leadership, raise feature requests, and be heard.

“We could speak directly with knowledgeable people and raise feature requests, and feel heard rather than feel like one customer among tens of thousands.”

Team Lead IT Security

How does the team answer the CVE question now?

With the previous scanner, answering "are we affected?" meant finding the right plugin, configuring targets and credentials, running the scan, waiting, exporting results, then repeating all of it after patching to prove the fix had landed. With Mondoo the current estate-wide result is already in the tenant: the team filters it, assigns owners, and creates tickets directly from the platform. AIX system owners use the same data to raise hardening and compliance scores. MQL query speed and the sheer amount of operational work that now happens in one place were both positive surprises.

How did the evaluation and rollout go?

The team assessed Rapid7, Tenable Nessus, and Qualys, alongside agent-based alternatives, against broad ecosystem and AIX coverage, CIS capability, a lightweight deployment model, current evidence, useful remediation information, transparency, and cost. The security team lead and the head of IT decided together that an agent was the right model, while recognizing that every agent must itself be evaluated as part of the attack surface.

A carefully prepared proof of concept did the rest: Mondoo asked what the team needed to see, ran concrete working sessions of an hour to ninety minutes, and demonstrated those workflows successfully, so production onboarding matched the expectations the POC had set. Getting systems in was unusually painless. Spaces, Mondoo's per-team workspaces, gave each team the right installation command and placed assets in the right context automatically. The hardest part was organizational: defining what 100% coverage means when you cannot be certain the CMDB contains every asset.

“Mondoo made deployment easy, but it also exposed the importance of knowing the estate you are trying to cover.”

Team Lead IT Security

What would the team tell a peer?

• Start with a goal, not a tool.
• Expect deployment to expose weaknesses in your CMDB. That is useful information, not a setback.
• Use risk and compliance scores to build momentum in the first weeks, when teams see their own improvements immediately.
• Take your time with hardening. Driving a score above 90% without understanding the operational impact can leave a system secure on paper and unavailable in practice.
• Use exceptions properly: documented, time-bounded, and reviewable.

On getting organizational buy-in

Leadership trust was already earned. The team framed Mondoo as the means to reach the CIS and wider security goals on time and at reasonable cost, and chose a three-year horizon deliberately, wanting enough runway to deploy the platform properly and grow with it.

“The business case was not a one-year feature checklist. It was sustainable coverage and operating leverage for the security program.”

Team Lead IT Security

What is the honest reading of the results?

The honest reading of the data matters as much as the headline. The evidence now rests on current technical proof rather than self-reported spreadsheets, which gives both the security and GRC teams more confidence in the conclusions. Remediation is not yet a clean apples-to-apples comparison. Critical MTTR stood at approximately eight days from CVE publication to remediation. The historical process combined a weekly scan with one to three business days of fixing, so the same critical finding took roughly eight to ten days to close. That assumed the scan surfaced it at all. The structural improvement is the removal of the seven-day blind window, and the remediation trend is expected to follow as the program matures.

Mondoo is also becoming a source of record for a more reliable software and security CMDB, and stakeholders now pull the reporting they need directly instead of asking for another scan report that may already be out of date. What the team values most is harder to put in a table. They have confident visibility across almost the entire IT landscape, on premises and in the cloud, current enough to act on, and when a finding appears they can see the technical basis for it instead of inferring it from a stale report or a self-attestation.

The estate grew.The response got faster.The workload did not.