A leader in Salesforce development, Copado diligently meets SLAs

Copado, headquartered in Chicago, Illinois, is an enterprise software company providing a comprehensive end-to-end DevOps platform that streamlines application coding, testing, and deployment for the Salesforce cloud. Its platform, Copado Org Intelligence™, maps every dependency, relationship, and hidden risk to give organizations the ability to deploy new code with confidence and speed. Copado operates globally in North America, Europe, and Japan, with a workforce of 490 people.

Security Applications Lead Engineer Robert Roldan Notario is responsible for driving the strategy and implementation of security controls across the software development lifecycle, ensuring applications are secure from design to deployment. Part of that responsibility includes ensuring that Copado meets its service level agreements (SLAs) to customers.

The software company wanted to maintain a rigorous security posture while managing rapid growth

Copado operates a sophisticated, multi-cloud environment spanning AWS and GCP, designed to meet the highest industry standards. Having already achieved FedRAMP Moderate Authorization to Operate (ATO) by meeting the security benchmarks required for government work, the team had established a robust security foundation. However, as the organization scaled, the challenge shifted from establishing security to optimizing operational efficiency. The legacy security stack, while effective at identifying risks, consisted of siloed point solutions. As the environment grew, these tools generated thousands of alerts daily. While these reflected a high-coverage security net, the volume of data created “noise” that made it labor-intensive to isolate the most critical risks. The goal wasn’t to find security—it was to streamline it.

As Copado embraced AI-driven development, the sheer speed of code generation introduced a new scale of vulnerabilities. Even with an ATO in place, the security team found themselves spending excessive time manually correlating data across environments, including AWS and GCP GovCloud.

Prioritization was often driven by the volume of findings rather than a unified, context-aware risk score. To maintain their commitment to customer SLAs and regulatory frameworks, Copado sought a way to move beyond manual tracking. They needed a “single pane of glass” to transform their existing high-security standards into a proactive, automated, and sustainable risk-management engine.

Teams can identify, contextualize, and own security risks using one source of truth with Armis from ServiceNow

To build upon their its FedRAMP-certified foundation, Copado implemented Armis from ServiceNow, securing attack surfaces with AI-powered asset intelligence. Rather than just adding another layer of software, the company used this as an opportunity to push security ownership back to the squads, making high standard risk management part of our daily workflow.

Central to this strategy was the appointment of Security Champions within Copado’s engineering squads. By assigning clear ownership and accountability, Copado shifted security “left,” ensuring that risk management became a core part of the development lifecycle rather than a final hurdle. Notario’s vision was clear: “We moved from fragmented, cloud-specific views to a unified, 360-degree visibility of our entire application estate, including our most sensitive GovCloud environments.”

The deployment followed a structured, departmental rollout across Copado’s five core groups. A critical phase of the implementation focused on intelligent noise reduction. By leveraging Armis to automatically filter false positives—specifically for internal or deprecated tools—Copado cut alert noise by up to 70% and restored the engineering team’s trust in security data. This allowed developers to focus exclusively on high-impact, verified risks, significantly improving the Mean Time to Remediation (MTTR).

Today, Armis acts as the “source of truth” for Copado’s application code and enables proactive SLA governance. Security leaders now distribute high-fidelity reports directly to Security Champions, fostering a culture of continuous risk management and compliance enforcement.

To ensure the long-term success of this ecosystem, Copado has dedicated two specialized team members to lead the Armis integration, working in close partnership with the Armis team to continually refine its security posture. 

The company moved from manual tracking to automated, risk-based prioritization

By implementing Armis as a unified orchestration layer, Copado has transformed its FedRAMP-certified foundation into a high-velocity security engine. The most significant outcome has been the shift from manual oversight to automated, context aware governance, allowing the team to maintain its rigorous security posture at the speed of modern DevOps.

The transition to a Continuous Threat Exposure Management (CTEM) lifecycle yielded immediate, record-breaking results. By automating the prioritization of high-fidelity risks, Copado achieved:

• 40,000% increase in remediation throughput: The team cleared a significant volume of vulnerabilities in just the first month.
• Rapid MTTR: Average remediation time dropped to just seven days, comfortably exceeding customer and regulatory SLAs.
• Elimination of manual toil: The security team reclaimed hundreds of hours previously spent on manual spreadsheet reconciliation, pivoting that energy toward strategic architecture and framework design.

Copado now proactively manages security across an evolving threat landscape, even supporting AI initiatives at scale

The visibility provided by Armis enabled a strategic shift toward a Platform Security strategy. By hardening Infrastructure-as-Code (IaC), security policies are now embedded directly into the CI/CD pipeline. This “secure-by-design” approach ensures that misconfigurations in storage (such as unencrypted buckets) or sensitive credential exposures are identified and blocked before they ever reach production.

With a “single pane of glass” view across AWS and GCP GovCloud, the “fire-drill” culture has been replaced by a proactive, data-driven program. “Armis’s ability to categorize risk across cloud, code, and host surfaces in one view was a major shift,” Notario explained. “By providing the high-fidelity value that siloed tools lacked, Armis has become our primary platform for orchestration.”

Today, Copado’s security department is viewed not as a bottleneck, but as a business accelerator. Leadership now has the real-time metrics and confidence needed to scale new AI initiatives and cloud expansions, knowing their security posture is both elite and infinitely scalable.