StepSecurity

StepSecurity’s cutting-edge security features are a core part of Mercari’s supply chain security strategy. Adding these isolation, monitoring and governance capabilities to our platform has enabled Mercari’s Security Engineering team to spend more time focusing on the areas that are truly unique to our enterprise

StepSecurity's cutting-edge security features are a core part of Mercari's supply chain security strategy

StepSecurity has excelled at filling gaps in GitHub's native security feature set. It has enabled us to convert a set of recommended practices into enforced controls, and to do so at enterprise scale

With the increase in supply chain attacks, StepSecurity gives us peace of mind that this behaviour will be caught and stopped

I genuinely don't worry about CI/CD the way I used to, because I know StepSecurity is watching it

StepSecurity gave us visibility into a part of the software delivery process that had previously been difficult to observe

It just works. We had no issues testing it, it worked as expected and covered the gaps we were most concerned about without the product trying to cover too many bases

It hasn’t significantly changed our workflow, and I think that’s a very cool outcome of this rollout. Besides waiting for the checks to finish, they don’t even notice it is there, which is a win for us, as we don’t want security to be significantly impactful on teams and their processes

Peace of mind. With the increase in supply chain attacks, StepSecurity gives us peace of mind that this behaviour will be caught and stopped

StepSecurity has excelled at filling gaps in GitHub's native security feature set. It has enabled us to convert a set of recommended practices into enforced controls, and to do so at enterprise scale

StepSecurity feels like the missing piece of GitHub itself. The depth of intelligence in StepSecurity’s governance platform gives a security engineer peace of mind in what is otherwise an unruly, hazardous environment

I am extremely impressed with the depth of StepSecurity’s solution. Every time I brought up a security concern about the GitHub actions ecosystem, they not only acknowledged it but also offered a mitigation

StepSecurity is critical for filling in the blanks with our GitHub security posture. They coverall the major shortcomings of the GitHub 3rd party actions ecosystem architecture in addition to many more security focused tools and features to make sure we’re secure

StepSecurity enables us to scale security enforcement across thousands of repositories by automatically generating consistent, policy-driven pull requests. This ensures a uniform security baseline without adding manual overhead

StepSecurity checks all of these boxes. It is fairly easy to roll out to organization wide through GUI and easy to maintain afterwards. The key thing that we were impressed with is the ability to investigate the process events to identify what process is triggering the events. Not only that, but we also liked their exceptions management capability to unblock developer in a matter of minutes when they get blocked by StepSecurity rules. I think these two capabilities distinguished them well from others

StepSecurity has become a vital part of Aquanow’s CI/CD security strategy. It provides real-time visibility into workflow execution, detects suspicious behavior, and enforces best practices—from secret management to outbound network control—making our pipelines significantly more secure and resilient

We were concerned about the lack of visibility into what our GitHub Actions were doing at runtime—particularly in terms of network activity and potential abuse

StepSecurity provided a level of runtime insight and control that we hadn’t seen elsewhere. Their focus on GitHub Actions security, especially around outbound network monitoring and enforcement, aligned well with our needs

StepSecurity has filled a critical gap in our CI/CD security stack. It gave us visibility into what our GitHub Actions runners are actually doing, not just what they’re configured to do. StepSecurity is now an integral part of how Neon secures its CI/CD pipelines