This case study describes how Crest Data leveraged AWS CloudOps best practices to design and implement a fully managed platform using Amazon ECS, AWS Lambda, Amazon SQS, Amazon DocumentDB, Amazon CloudWatch. This helped in optimized networking with Amazon ECR and VPC Endpoints enabling predictable operations, reduced costs, and faster remediation insights to support scalable DevSecOps adoption.

About the Customer

The customer is a leading cybersecurity solutions provider focused on delivering unified asset intelligence and cyber risk management. The organization enables real-time visibility and protection across complex and diverse technology environments, helping enterprises and public-sector organizations continuously identify, prioritize, and remediate security risks at scale. Through its core platform, the customer supports large, dynamic infrastructures by providing actionable insights that strengthen security posture across interconnected digital and operational ecosystems.

Customer Challenge

The customer needed to deliver a multi-tenant vulnerability scanning platform that could scale to thousands of repositories across multiple tenants while maintaining cost efficiency and operational resilience. The core challenge was to balance scalability, automation, and observability without increasing manual overhead for development teams.

Traditional vulnerability management approaches were either too slow, too costly, or lacked actionable insights, making it difficult for software companies to quickly respond to security issues. The customer required a solution that could run daily scans, centralize results, and provide AI-led code-level remediation suggestions that integrated directly into developer workflows.

If left unaddressed, these challenges would have led to security blind spots across customer repositories, significantly increasing the risk of breaches and compliance violations. Development teams would continue to spend excessive time manually triaging and fixing vulnerabilities, slowing release cycles and eroding customer trust.

Proposed Solution

Crest Data implemented a multi-tenant SaaS solution on AWS designed to run daily vulnerability scans across thousands of repositories while ensuring scalability and strong observability. The architecture followed AWS CloudOps best practices to balance automation, cost-efficiency and reliability.

The scanning workflow is orchestrated using Amazon EventBridge and AWS Lambda, which trigger the scans once a day. Each repository is scanned using multiple vulnerability scanning tools. The scans are executed in parallel, enabling the system to process large workloads quickly and efficiently.

All scan results are aggregated and stored in Amazon S3, providing durable and cost-effective storage. Each record is tagged with a tenant ID, ensuring logical isolation of data across customers. After results are available, the platform invokes an external AI model via secure API calls, which analyzes vulnerabilities and provides code-level remediation suggestions.

For observability, we integrated Amazon CloudWatch metrics, dashboards and alerts to track scanner performance and task health. In addition, Lambda-based cleaners were implemented to detect and terminate long-running ECS tasks, improving reliability and preventing resource waste.

Finally, to control networking costs, VPC endpoints were introduced for services like S3, reducing data transfer through NAT gateways. This optimization ensured both cost-efficiency and security while maintaining high system performance.