# Security Drone: scaling continuous security at Revolut.

DevFeed: [Security Drone: scaling continuous security at Revolut.](<https://devfeed.tech/articles/security-drone-scaling-continuous-security-at-revolut-26347.md>)

Original publisher: [Read original article](<https://medium.com/revolut/security-drone-scaling-continuous-security-at-revolut-862bcd55956e?source=rss----44c5ac415e14---4>)

Author: Krzysztof Pranczk

Published: 2023-01-03T09:24:53Z

Content type: tutorial

Language: en

Sources: [Revolut Engineering](<https://devfeed.tech/sources/revolut-engineering.md>)

Topics: [Application Security](<https://devfeed.tech/topics/application-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [sdlc](<https://devfeed.tech/topics/sdlc.md>), [Testing](<https://devfeed.tech/topics/testing.md>), [software-development](<https://devfeed.tech/topics/software-development.md>)

Tags: [application-security](<https://devfeed.tech/tags/application-security.md>), [article](<https://devfeed.tech/tags/article.md>), [automated](<https://devfeed.tech/tags/automated.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [development](<https://devfeed.tech/tags/development.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [fintech](<https://devfeed.tech/tags/fintech.md>), [pipelines](<https://devfeed.tech/tags/pipelines.md>), [security](<https://devfeed.tech/tags/security.md>), [software](<https://devfeed.tech/tags/software.md>), [software-development](<https://devfeed.tech/tags/software-development.md>), [testing](<https://devfeed.tech/tags/testing.md>)

## AI overview

Revolut describes Security Drone, an approach for scaling application security assurance in fast CI/CD environments. The article explains the limits of manual review and automated scanner triage as development activity and pipeline volume increase.

## Source excerpt

Security Drone: Scaling Continuous Security at RevolutIntro As we're continuously growing and extending our product offerings, we can face many technological challenges. These challenges are solved by our engineers and this results in many features, changes and updates being developed and successfully delivered to our customers. However, with the development of new features comes many security challenges that are faced by the internal Application Security Team. This lovely bunch is responsible for the security assurance of every new feature developed by our engineers. To provide the highest level of security assurance to our products, we've implemented a number of processes placed in different stages of the Software Development Life Cycle (SDLC), including automated scans in our CI/CD pipelines. However, it wouldn't be possible to efficiently triage every security finding produced by automated scanners. In July 2022, there were nearly 39,000 commits created by over 900 authors! To address this challenge, we developed Security Drone. In this article, we'd like to share with you our approach to provide the highest security assurance in fast CI/CD environments. Challenges faced by Revolut The classic approach to security testing requires the security teams to perform a manual review of any developed features, with the help of automated security scans. Traditionally, this work was executed on a risk and priority basis and that need was stretching the team beyond its capacity. Additionally, the team had to cope with the numerous CI pipelines across the company. This approach wasn't a viable solution in terms of scaling, quality and coverage. Some of you may have an idea of the security challenges faced in a fast CI/CD environment. If not, let us make a little recap of the challenges we've been facing: Software changes are constantly increasing New changes are integrated and deployed every day Engineers tend to prioritise the development of functionalities over security T