Making security a business asset: How Atlan builds customer confidence with Wiz

Challenge:

• Increase visibility into the security of its cloud environments without having to piece together data across multiple solutions and dashboards.

• Scale the security program to detect vulnerabilities and toxic combinations of risk across its cloud environment.

• Establish a strong security foundation to continue building customer trust and confidence in the business.

Solution

• Wiz provides a single-pane of glass to see and understand Atlan’s cloud infrastructure, enabling engineers to easily identify and prioritize issues for remediation.

• The start-up is able to analyze its AWS environment with Wiz, enabling engineers to quickly identify and remediate risks seamlessly across the environment.

• Wiz helps Atlan ensure and maintain compliance requirements and supports the transition to a risk-based security approach.

Securing a fast-growing startup

With the aim of becoming a universal desktop icon to access data and a single hub for data teams to collaborate, Atlan has no shortage of ambition. The startup describes itself as an active metadata platform that aims to help users work with data in fields as diverse as cancer research and electronic vehicle development. 

To win and retain businesses, Atlan needs to keep its platform and data secure–and this responsibility falls to Kashfun Nazir, the first security engineer to join the organization and now is the Information Security Lead & Data Protection Officer. Nazir is responsible for developing a security roadmap and implementing Atlan’s security architecture. “Our strategy is initially defensive and involves building the security fundamentals, backed by an appropriate governance framework,” he explains. “This enables us to comply with the audits needed to build our customers’ confidence in our security and our business model.”

To manage costs while scaling to support growth, Atlan elected to run its workloads in Kubernetes containers on Amazon Web Services (AWS) as a stepping stone to a multi-cloud architecture. However, the native AWS security products and AWS Security Hub could not provide the ease of use and visibility required by the startup’s lean security team. Engineers needed to login to separate dashboards to view alerts and data, which made correlating information complex and time consuming. Nazir wanted a unified dashboard that provides a single pane of glass to see into Atlan’s cloud environment and easily identify problems. According to Nazir, this helps prevent “toxic combinations,” when multiple security issues are combined together and present considerable risk to the business.

Log4j vulnerability prompts search for an external tool

The emergence of a critical vulnerability in Log4j caused security teams around the world to scramble. Faced with a lack of immediate visibility through their existing AWS dashboards, Nazir set out to find an alternative solution that could identify and map out vulnerabilities like Log4j for quick remediation.

Wiz’s scalable and agentless platform stood out to Nazir, and when Wiz produced unexpected findings during the initial proof of concept, he and the team were sold. “That was one of the winning factors for Wiz–we thought we’d remediated all of the Log4j issues in our environment, based on what was visible to us,” says Nazir. “With Wiz, we found that wasn’t the case.”

That was one of the winning factors for Wiz–we thought we’d remediated all of the Log4j issues in our environment, based on what was visible to us. With Wiz, we found that wasn’t the case.

Kashfun Nazir

Information Security Lead & Data Protection Officer, Atlan 

Seamlessly deployed in an hour

Deploying Wiz proved to be a seamless experience: Atlan was able to link Wiz to its AWS Cloud accounts in minutes, and complete the total exercise in an hour. “The Wiz team worked very closely with our IT team to successfully deliver the project,” says Nazir. “The fact that the product was agentless was a pleasant surprise and streamlined the deployment–overall, that process was faster than the deployment of any of the other technology products and tools we use.” Adding Wiz also had no impact on Atlan’s business operations, resources, or workload performance. 

The fact that the product was agentless was a pleasant surprise and streamlined the deployment

Kashfun Nazir

Information Security Lead & Data Protection Officer, Atlan

The Security Graph delivers the greatest day-to-day benefit

For Atlan, the most useful feature of Wiz is the Security Graph, which provides detailed visualization of the components involved with any cloud risk, and the relationships between them. “The Wiz Security Graph provides a map of affected containers and also enables us to dive deep to obtain more details about that vulnerability,” explains Nazir. “And the graphs themselves are dynamic, so we can generate visuals from our own queries.” By identifying toxic combinations and critical risks across the Atlan environment at cloud speed, Wiz enables the business to control costs, optimize resource utilization, and prioritize remediation. Atlan estimates the savings derived from automation through Wiz as equivalent to the cost of three full-time team members.

Meanwhile, with clear, simple Wiz documentation and product webinars available on the web, Nazir can simply direct newly-recruited engineers to review them in order to greatly speed up their learning and onboarding process.

Wiz has also helped the business address a proliferation of zero day attacks and Nazir notes how quickly the product is updated with details of the latest threats and vulnerabilities. This enables Atlan to build trust with customers and prospects.

As we scale and gain more customers, we are confident that we can tell them we are aware of all known vulnerabilities, and that new vulnerabilities will be quickly visible to us too.

Kashfun Nazir

Information Security Lead & Data Protection Officer, Atlan

Adopting a proactive security stance

Compliance with CIS frameworks, as well as SOC 2 and HIPAA is key to Atlan’s strategy to win new customers, and Wiz plays a key role in ensuring the business achieves the required certifications and standards. “We’re using the Wiz compliance feature to check against relevant frameworks. It helped us confirm our status by detecting some outlying issues we had previously missed,” says Nazir.   

Wiz is continuously analyzing configurations and scanning for vulnerabilities across Atlan’s cloud environment to discover issues that present risks. As the data company continues to evolve its security posture, it will look to Wiz to keep its platform safe.

Atlan plans to evolve its use of Wiz from vulnerability management and issue tracking and identification, to broader risk reduction. The business also intends to use the platform to shift left and apply a unified security policy into their CI/CD pipeline in the coming months, as well as integrate Wiz with a SIEM tool to deliver increased visibility and alert capability.       

“Wiz is extremely user-friendly and a pleasant experience compared to other tools I’ve used,” concludes Nazir. “In a nutshell, Wiz is the ideal solution, not just for security practitioners, but for any engineers or users who do not necessarily have the skills or knowledge to go deep into the technical aspects of your environment.”