Software First Companies Trust Cycode
See how our customers leverage the Cycode platform to build and deliver secure applications.
Uphold Builds a Comprehensive Application Security Program with Cycode
About Uphold
Uphold, a leading digital finance platform, set out to centralize and modernize its application security operations to keep pace with its fast-scaling engineering organization. With hundreds of repositories, diverse tech stacks, and continuous delivery pipelines, the security team aimed to unify fragmented data. By partnering with Cycode, Uphold established a single source of truth for application security, combining visibility, automation, and developer enablement into one cohesive ecosystem. The platform unifies SAST, SCA, and Secrets scanning with pipeline visibility, deployment mapping, and API-based orchestration, giving AppSec and engineering teams complete end-to-end oversight.
| Key Outcomes | ||
|---|---|---|
| 100% SAST, SCA, Secrets, and CI/CD security coverage across repositories in 1.5 days with automated repository ownership and team mapping | Zero exposed secrets post-onboarding with complete supply chain visibility and governance, as well as an integrated developer experience | Increased operational efficiency and established KPIs, training metrics, and maturity reporting across teams, leading to executive alignment and continued investment |
The Challenge
Before adopting Cycode, Uphold’s AppSec team faced growing complexity in managing visibility and governance across its rapidly expanding software ecosystem.While multiple tools provided scanning capabilities, insights were fragmented, requiring the team to maintain custom scripts over SCM APIs to correlate repositories, dependencies, and contributors. This manual approach limited scalability and created operational overhead away from strategic security work.
The lack of centralized orchestration also made it difficult to:
- Generate and maintain SBOMs across the entire codebase.
- Track vulnerabilities and risks from code to deployment.
- Automate ownership mapping and assign accountability to teams.
- Measure and report maturity using standardized KPIs.
The Solution
Uphold approached the evolution of its Application Security program with a structured and data-driven mindset. The team developed a success matrix to evaluate potential platforms across key technical and operational dimensions from visibility and developer experience to automation, integration, and governance.
The objective was to identify a partner capable of centralizing visibility, automating risk management, and embedding AppSec directly into developer workflows, while providing the flexibility and extensibility needed to scale with Uphold’s engineering organization.
After evaluating multiple solutions, Cycode emerged as the platform best aligned with Uphold’s requirements. Its unified architecture, deep integrations, and developer-first design addressed every key area of the success matrix:
- Scan Coverage: Comprehensive coverage across SAST, SCA, Secrets, and IaC to detect vulnerabilities and exposures throughout the codebase, dependencies, and pipelines.
- Unified Visibility: Centralized view of all findings, combining data from native scanners and external tools.
- Ease of Implementation: Full production rollout in under two days, significantly faster than traditional multi-tool setups, with immediate visibility into nearly 1,000 repositories.
- Developer-First Experience: IDE plugins, PR quality gates, and contextual feedback integrated directly into developer workflows to encourage proactive remediation.
- Immediate Value: Instant detection of exposed credentials and high-risk issues during onboarding, delivering quick, tangible risk reduction.
- Integration Depth: Broad, native integrations with ticketing platforms, SCM, CI/CD, and existing security tools, consolidating data and workflows into a single orchestration layer.
- Automated Data Correlation: Continuous retrieval of repository, dependency, and pipeline data via APIs, removing reliance on custom scripts.
- Repository Ownership Mapping: Automated attribution of repositories and projects to responsible engineering teams, enabling accountability and team-based reporting.
- Team-Level KPI Tracking: Automated dashboards measuring MTTR, SLA compliance, vulnerability backlog, and training participation, supporting maturity benchmarking.
- Dashboard and Reporting Flexibility: Customizable views for engineering leads and AppSec stakeholders, ensuring actionable insights at every level.
- Supply Chain Visibility & Governance: Automated SBOM generation and dependency mapping to provide traceability from code to deployment.
- Security Tool Reinforcement: Strengthened existing AppSec investments by integrating and orchestrating external scanners under a single governance model.
The Results
Within months of implementation, Uphold achieved significant, measurable results that validated the choice of Cycode. The platform is the foundation of their application security program, providing the visibility and control they previously lacked.
- Rapid Time to Value: From evaluation to full production, the rollout was completed in under one month, with Cycode scanning nearly 1,000 repositories in just 1.5 days and delivering immediate visibility across all AppSec domains.
- Automation and Operational Efficiency: Automated ticket creation and contextual prioritization reduced manual workload and mean time to remediation (MTTR), allowing the AppSec team to focus on governance and proactive risk reduction.
- Integrated Ownership and Reporting: Ease to automate repository ownership mapping and team-level dashboards provided built-in accountability and regular performance reporting without manual data correlation.
- Enhanced Developer Engagement: IDE integrations, PR feedback, and contextual insights enabled developers to remediate vulnerabilities directly within their workflows, fostering collaboration between security and engineering.
- < strong>Maturity and KPI Tracking: Dashboards and reports track SLA compliance, remediation trends, backlog reduction, and training metrics, supporting data-driven maturity assessments for each engineering team.
- Governance and Supply Chain Control: End-to-end visibility across the software supply chain, including automated SBOM generation and dependency mapping, strengthened compliance and release governance.
- Executive Alignment and Continued Investment: Demonstrated improvements in visibility, automation, and cross-team engagement led to greater executive support and increased AppSec investment.
- Strong Customer Success Alignment: Uphold found Cycode’s Support and Customer Success teams highly responsive and aligned, with weekly syncs and a structured feature request process that ensures continuous value realization and platform optimization.
Uphold and Cycode continue to strengthen their partnership through close collaboration on roadmap alignment, feature feedback, and continuous improvement.
See how Cycode can improve your Application Security Posture and Developer Experience. Learn more at www.Cycode.com
