Context is everything

Who is the provider?

The provider offers cloud computing and managed services and has grown over the years, adding data and AI capabilities to its portfolio. Its customers trust it with their data, and that trust is the business.

Compliance is part of the culture. The provider has held ISO 27001 for many years, alongside SOC 2 Type 2 and a government-backed cybersecurity certification. As it builds its own AI capabilities, it is now working toward an AI governance standard.

Compliance also shapes how the provider buys technology. The provider rigorously audits every new supplier or tool to ensure the data going into it is controlled. Only tools that meet those guidelines and are fit for purpose make it through.

The provider's DevOps and automation team has a clear mandate: automate manual processes so people can focus on higher-value work.

“If someone's trusting you with their data, it makes sense that you don't let unauthorized people access it.”

Engineering Leader, DevOps and Automation

What was life like before Mondoo?

Before Mondoo, the honest answer to “how secure is this asset?” was often “we’re not sure.”

Scanning covered a limited set of systems. Development teams ran static analysis and dependency checks that blocked any push or deployment with a critical or high CVE. That protected the code, but beyond it, much of the work was manual. The security team worked through asset lists by hand, checking each system’s version and whether it had known vulnerabilities.

Audits added to the load. Collecting evidence meant logging into servers to pull configuration details and manually querying application databases. Preparing for a single audit could take several months.

The cost was time: time spent investigating issues, fixing them, and redoing work. For a team whose job is to automate away manual effort, that was the wrong direction.

Why does context matter so much?

The biggest gap in the provider’s previous tooling was context. Tools could flag a vulnerability, but not whether it actually mattered in the provider’s environment.

In one recent case, a critical CVE turned out, after investigation, not to affect the provider at all. The attack depended on a route that had already been closed off. Without context, every alert like that costs investigation time before anyone knows whether it is real.

That is where Mondoo made the difference.

Mondoo works across many asset types and shows which issues actually relate to the provider’s environment, so teams spend their time fixing what is real instead of chasing what isn’t.

“A lot of the tools before had no real context to them. That’s a big one.”

Engineering Leader, DevOps and Automation

How does Mondoo fit into the provider’s workflows?

Security built into the VM build pipeline.

The provider’s compliance requirements mandate that virtual machines are built from a secure template. Mondoo is now part of that process: Mondoo checks each template as it is built and passes the findings as evidence for the relevant control. Security validation happens automatically at build time instead of manually at audit time.

A dashboard that shows where to focus.

Instead of piecing together asset lists and version checks, teams can see in one place what needs attention. “It probably saves quite a few hours a day just being able to look at a dashboard and go, OK, that’s what we should focus on.”

Fixes, not just findings.

What surprised the team most was Mondoo’s remediation guidance. Instead of pointing out a problem and leaving engineers to research the answer, Mondoo provides a finished fix they can apply directly. “I’d never seen a tool do it. Mondoo was one of the first to give me a remediation fix, which was very helpful.”

Platform and security teams working together.

Platform teams manage their assets in Mondoo, and the security team uses its findings to flag CVEs that need attention. That fits the way the provider’s security team already works: advising and collaborating rather than issuing mandates.

How easy was it to get started?

The DevOps team’s first hands-on work with Mondoo came when they built an internal application around it alongside other context sources. Getting started was simple: install, run, and within about 10 to 20 minutes the asset appeared.

The learning curve was gentle. “It wasn’t too steep. Everything was pretty easy to find.”

Support has been just as smooth. The team describes it as “fantastic,” with colleagues who raise tickets getting answers fairly quickly.

What results has the provider achieved?

The provider adopted Mondoo in focused pockets rather than with a big-bang rollout, so the results are strongest where Mondoo is already in use. There, the gains are clear.

Audit preparation in weeks, not months.

Evidence collection is far less manual, and the process is more streamlined. “It will sometimes take several months to prep for an audit, whereas now it’s probably down to a month and a half.”

Hours back every day.

Clear prioritization means less time spent working out what to fix first.

A remediation benchmark.

Mean time to remediate currently sits at 7 to 10 days, giving the team a clear baseline to improve on as adoption grows.

Speed where it counts.

The most valuable outcome is speed: getting from an idea, or a discovered problem, to a result as quickly as possible. “Anything that can help speed up those specific junctures is a massive plus.”

The reason is rooted in how the team works: “A big part of Agile is iterating very quickly. I understand why you have to put certain gates in place, but they slow things down.”

What comes next?

The provider sees significant room to grow. The next step is extending Mondoo into more workflows across the business, particularly software development, infrastructure as code, and platform engineering.

“I can see it being one of the main tools that we get alerted by.”

Engineering Leader, DevOps and Automation

What would the provider tell a peer?

Start small, then grow.

“Start small and then grow outwards. When we first started using Mondoo, we had very specific use cases, and then expanded from there.” The same approach works for internal buy-in: begin in specific areas with specific use cases.

Jump in with both feet.

“Really get stuck into every little piece of how it works, because there’s a lot of really cool stuff in there.”

Know your environment.

“Understanding your environment is a big thing. You still need to know your stuff, remain technically capable, and keep your skills up to date.”

Would they recommend Mondoo to a peer? “Yes.”

“You guys have been fantastic. It’s been a joy working alongside you.”

Engineering Leader, DevOps and Automation