Challenge

• Gain visibility into the most critical risks in Copper’s production containerized environment

• Strengthen security profile with no disruption to operations or development

• Address vulnerabilities and drift before code goes into production

Solution:

• Secure containers from image scanning in the pipeline to vulnerability management in production using Wiz

• Deliver immediate visibility into production with Wiz’s agentless approach that scales without friction

• Extend security to the CI/CD pipeline by scanning container images with Wiz-CLI

Staying ahead of adversaries and threats

For Copper Technologies Ltd., its prominence in the digital asset and cryptocurrency market puts it squarely in the crosshairs of certain bad actors. “There are very few sectors where a single breach can destroy an entire company,” says Adam Schoeman, interim CISO at Copper. “Ours is one of them.” 

Founded in 2018, Copper launched ClearLoop, its cryptocurrency custody technology, to enable institutional investors to trade with crypto exchanges without needing to transfer digital assets onto an exchange before a trade. Copper’s award-winning custody application minimizes counterparty risks and reduces withdrawal time for its clients.

All of which requires Copper to be at the forefront of fintech cybersecurity. “The explosive growth of our platform combined with our role in this industry means that we’re a target and must remain vigilant about cybersecurity,” says Schoeman. “That’s why we created our own threat intelligence division and why we needed a way to improve our visibility into our production, cloud-native environment.” 

Copper’s platform is completely containerized and running on Amazon Web Services (AWS). “When I joined the company, we had no way to monitor our containers in real time for vulnerabilities,” says Schoeman. “We couldn’t efficiently identify and prioritize our most critical risks in the cloud and container environment.”

Reducing cloud risk with agentless visibility

When Schoeman discovered Wiz, a 100% agentless, graph-based cloud-native security solution, he knew he’d found the answer to Copper’s security challenges. “We needed a non-intrusive solution for our containerized production environment that didn’t require agents, wasn’t too noisy, and didn’t require real-time scanning,” says Schoeman. “Choosing Wiz was a no-brainer — no other tool comes even close.”

Choosing Wiz was a no-brainer — no other tool comes even close. I'm convinced that Wiz is the most friction-free way of running cloud security.

Adam Schoeman

interim CISO, Copper

Schoeman was impressed with how easy it was to deploy Wiz and start seeing results. “We installed Wiz in a matter of minutes and purchased it the same day,” he says. “I’m convinced that Wiz is the most friction-free way of running cloud security.”

Today Copper’s security team relies on Wiz for image scanning, visibility into containers running in production, vulnerability management, triage for threat context, and more. “Wiz gives us the complete telemetry, monitoring, and visibility we need for vulnerability management,” says Schoeman. “We’re using Wiz in pre-production as well to scan images to discover drift early in the pipeline.” Copper leverages Wiz to secure its containers in production, as well as extending that to the CI/CD pipeline by scanning container images with Wiz-CLI.

The security team makes extensive use of the Wiz Threat Center, particularly for context about new threats. “With one click, we can see which threats could impact our environment,” says Schoeman.

When Log4j came out, it took me 15 seconds using the Wiz Threat Center to confirm that our exposure was essentially zero.

Adam Schoeman

interim CISO, Copper

Delivering a high level of confidence

Copper’s team relies on Wiz and its Security Graph to surface and visualize real risks with actionable context. “With Wiz Security Graph, we can correlate vulnerabilities to see whether they are critical in our environment and identify fixes with big impacts,” says Schoeman.

At the same time, Wiz reduces alert noise and streamlines analysis to save the Copper security team time and effort. This gives Schoeman and his security team a high level of confidence in the security of their platform and helps them maintain a light touch to minimize any impact on development. “Wiz helps us explore and prioritize risks before we share them with developers,” says Schoeman.

Because it’s agentless and doesn’t require ongoing maintenance and troubleshooting of agents, Wiz helps Schoeman keep his team small and agile.

Even as we expand usage of Wiz to DevOps, it will be a force multiplier for our headcount. Wiz doesn’t require adding more resources to have a wider reach across our organization.

Adam Schoeman

interim CISO, Copper

It also keeps tool costs down as Copper’s security continues to mature and the team explores new use cases such as external discovery and scoping for penetration testing, Cloud Detection and Response (CDR), and threat modeling. “With Wiz as our single source of truth for production, we don’t need to double up on tools or run redundancies, like we do with other security solutions,” says Schoeman. “Nor do we need new tools for use cases beyond our original reason for choosing Wiz.”    

For Schoeman, working with Wiz has been an eye-opening experience. “Wiz has exceeded my expectations when we’ve requested help,” he says. “They are one of the rare vendors where I can say the relationship is really good and I speak with them regularly.”