Case Studies
What are you really protecting?
Securing your business is never just about defending digital systems. Breaches and disruptions put relationships and revenue at risk, along with the lives and livelihoods of people and their communities. The pressure on security teams is enormous.
But what if you’re defending a platform that’s fundamental to the success of thousands of small businesses? Suddenly, the possible consequences of a single breach multiply, impacting more businesses as well as the lives and livelihoods of the many people who depend on them.
The challenge: securing rapid platform growth with less worry
This was one of the missions that drew seasoned security architect Paul Intrarakha to ServiceTitan. The company, which provides digital business infrastructure to over 11,800 commercial and residential services companies, was growing quickly.
As more pros trusted their business to ServiceTitan’s continuously expanding platform, could security keep up? Paul and other team members knew they had to rethink how they secured and shipped new features, vulnerability detection and mitigation in particular.
They also knew they needed a strategy that let them effectively and efficiently defend a codebase that was growing in both size and complexity. Paul and other leaders were convinced status quo strategies couldn’t keep pace.
Evaluating the status quo
As Paul, Senior Principal, Application Security Architect, and others worked, important questions emerged. Was penetration testing enough? Is ServiceTitan too reliant on point-in-time pentests? Was there a more effective approach? And finally, could costs become more predictable as needs evolved?
Like many other software organizations, ServiceTitan relied heavily on external pen testing to assess vulnerabilities and other weaknesses, but Paul saw the scope and price were a constant concern, especially as the platform grew. “There is value in a pentest. Ideally you would want to do a pentest continuously but that's just not cost effective.”
There was also concern about how effective pen testing was in the face of rapidly evolving risks, especially across cloud and other third-party service providers. ServiceTitan realized they needed access to broader, deeper threat and vulnerability expertise. Our code base is constantly evolving and changing. We wanted to tap into the knowledge of the security community to help us identify these vulnerabilities that could potentially be popping up.” ServiceTitan knew this need for continuous “as a service” expertise was critical.
"You’re built to get more eyes on the platform. You also have a system in place to operationalize findings and integrate them into our workflows. It all goes into our ecosystem and starts generating results." - Paul Intrarakha, Senior Principal, Application Security Architect, ServiceTitan
Click to tweet
Appreciating the Inspectiv Difference
ServiceTitan already understood the value that crowdsourced software security can bring to the business—and the thousand of businesses it services. Paul also immediately realized the impact Inspectiv’s unique approach could potentially have on SericeTitan’s security readiness.
As Paul learned more about Inspectiv, one benefit jumped out quickly. “What caught my eye initially was the fixed cost model and the expectation that going in you know how much you’re going to spend.” That, combined with the ability to tap into a broader community of security researchers made ServiceTitan comfortable enough to get started.
Confidence as a service
That external expertise was important. As a business built around supporting service providers, ServiceTitan understands the power of continuous learning. But, when it comes to securing their technology, constant change makes it hard for internal teams to keep up. Inspectiv gives ServiceTitan access to a network of diverse security experts and researchers.
For Paul, this means expertise can keep pace with growth. What was attractive was this continuous evaluation of the platform. Our own codebase is constantly evolving and changing, and we wanted to tap into the knowledge of the security community to help us identify these new threats and models that are always popping up.
Per security best practice, the result is a layered framework that combines regular, focused penetration testing with continuous testing by the Inspectiv platform. Paul says it achieves a “nice balance”, where carefully scoped penetration tests are complemented by more broad, continuous coverage by Inspectiv-engaged experts.
Not just quicker insight, but faster action too
Beyond the upfront cost of vulnerability services, complexity and overload can also drive-up operational costs. Engineers with too little, or too much, information can’t be effective. But Paul also knew his team couldn’t scale to keep up support needs either, and they needed to empower engineers and product owners to act on their own.
When asked how Inspectiv specifically made his life easier, Paul had a fast answer. “I do less hand holding with software engineers and product owners, which saves me time to work on other things. I only participate when I need to.”
Luckily, Inspectiv’s information-dense approach, including easy-to-understand findings videos, make remediation easier for engineers. Paul and others get involved as required, but Inspectiv enables engineers and others to resolve most issues on their own. “With these videos, I don’t ever have to touch them.” Automation via other important tools like JIRA also saves everybody time.
Inspectiv: An ideal partner and platform
ServiceTitan was started by two founders who grew up watching their fathers’ own struggles and successes building a services business. The platform is designed to help small and growing providers level up their ability to serve customers with cutting edge digital tools and experiences. As with any service business, trust is critical—and so is value.
When asked about the value of the Inspectiv platform, Paul talked about the uniqueness of the business model and solution completeness. As ServiceTitan and its technology expand, Paul expects Inspectiv’s impact to grow as well. “You’re built to get more eyes on the platform. You also have a system in place to operationalize findings and integrate them into our workflows. It all goes into our ecosystem and starts generating results. So yeah, we can see that scaling with us.”
Share this post
Case Studies
