Buildkite

Buildkite, the CI/CD orchestration platform, needed cloud security findings its small team could trust. With Plerion, they fix repeat issues once at the source, and Pleri checks whether a vulnerability can actually be exploited before anyone spends time on it. Engineers now ask Pleri what's going on instead of investigating by hand.

Challenge

Buildkite runs a large, fast-moving cloud estate with a small team securing it. The cloud estate was the most significant piece of infrastructure they have, but there was no single place they could go to answer the questions “Is our AWS Environment vulnerable?”; “What is the level of exposure our AWS environment has to external risks?”; “What do we need to take action on in our Infrastructure most importantly?”. They didn't want more alerts. They didn’t want spreadsheets with findings that didn’t provide context. They wanted to trust that anything flagged needed attention.

Most of the noise came from repetition. Many services share a common foundation, so one underlying issue can appear dozens of times, and the findings that matter get buried.

"We have a lot of priorities this year. As much as I want to get as much value out of Plerion and Pleri as we can, I also want that time spent to be valuable, and not sifting." - Robert Mitchell

Solution

Buildkite connected its whole cloud environment to Plerion and spent the first weeks tuning it with Plerion's Customer Success team. They agreed on two rules:

• Fix repeat issues once, at their shared source, instead of chasing every instance.
• Treat exemptions as temporary, reviewed decisions, not a way to hide problems.

"I want to do a bunch of intensive systeming up front over the next couple of weeks, to get us much more in the position of: when Pleri is telling me something, there's a pretty good chance I need to worry about it." - Robert Mitchell

The team then put Pleri, Plerion's AI cloud security engineer, to work. Pleri investigates findings, plans fixes, and raises remediation tickets directly in Buildkite's issue tracker. The team used Pleri's memory to teach Buildkite's conventions. They also turned on Pleri's vulnerability analyst, which checks whether a vulnerability can actually be exploited in Buildkite's environment. The platform team had been discussing that exact problem the week before the feature launched.

"You're tackling what is the holy grail of vulnerability management... I think it's going to make a huge difference to us and to pretty much every other customer that you've got." - Robert Mitchell

Key benefits

• Alerts worth reading: When Pleri flags something, it usually needs action, so the team spends its time fixing problems instead of sorting through noise.
• Remediation in the tools engineers already use: Work arrives in their existing tracker, formatted the way they expect, so nobody has to rewrite or reroute it.
• Effort focused on real risk: Engineers spend their time on vulnerabilities that can actually be exploited in Buildkite's environment, not on every CVE in a scan.
• A direct line to the product team: Buildkite's feedback goes to Plerion's product team and onto the roadmap.

Results

• Adopted across engineering: Buildkite introduced Plerion at a company-wide security presentation and opened access to all engineers. "We've made a decision that, broadly speaking, anyone from engineering can get access.” Pleri was made available to all Engineering staff, not just Security, so that all engineers were empowered to ask any question about the cloud estate
• Faster investigations: When AWS assets are involved, engineers now just ask Pleri what's going on instead of piecing it together by hand. "It has achieved the goals that we expected it to." - Robert Mitchell
• Wider coverage because people chose it: Without being asked, developers exploring findings added more of Buildkite's infrastructure code to Plerion's code scanning.
• Integration shipped in eight days: Eight days after Buildkite first asked Pleri to raise a ticket in their tracker, a native integration shipped, and they used it the same day.

Want to learn more? Book a demo and see what it’s like to have real help, not just another dashboard.