Slack’s Vulnerability Aggregator: manage vulnerabilities at scale
summary
Slack builds a central Vulnerability Aggregator that ingests findings from 15+ scanners, normalizes them into a data model (finding rule, finding, asset, finding group), applies configurable grouping rules and custom fields, looks up owners via Omni ownership and emits Jira/Slack via a notification service. Implementation is Python (FastAPI) with Postgres and GraphQL; it supports dedupe and auto-close tickets. Rollout begins after a multi-vendor POC; 3–4 tools are onboarded and the platform is actively working.
AI-written summary · about
chapters (16)
- 0:00Slack’s vulnerability management
- 2:26Vulnerability lifecycle at scale
- 5:59Scaling vulnerability challenges
- 9:08Old process limitations
- 11:15Ideal solution criteria
- 12:21Vendor limitations research
- 14:47Slack’s vulnerability aggregator
- 15:29Aggregator in the process
- 16:52Architecture and core components
- 17:54Data model and features
- 21:05Grouping rules
- 25:01Simple ingestion demo
- 26:25Multiple findings demo
- 27:27Automated closing demo
- 28:08Key takeaways
- 28:29Q&A
related talks
42mMoving Fast and Securing Things
28mSlack App Security: Securing Your Workspaces From a Bot Uprising
40mMaking Vulnerability Management Less Painful with OWASP DefectDojo
33mFrom Chaos to Calm: Vulnerability Management for a Dynamic, Sprawling Technology Estate
45mApplication security loves Agile
59mWho’s Vulnerability Is It Anyway? Harmonizing Stakeholder Roles in Vulnerability Management
43mBuilding a Secure DevOps Pipeline
26mBuilding Secure Cultures