Compliance-Based Scanning & The Never-Ending Backlog

For the security team at Demandbase, legacy scanning looked more like a box-ticking exercise than a proactive defense. While they used Veracode to meet SOC2 and ISO requirements, the platform suffered from a 95-99% false positive rate.

Noisy tools led to inaction. The security team lacked confidence in the results, so they couldn't justify blocking builds. Developers didn't trust results either, making them unlikely to understand or improve the security of their own coding practices.

With trust lacking in security findings, the backlog grew over time instead of shrinking.

We had a scanner, but we weren't doing enough about it. Our CSO realized that if we didn't stop the bleeding, we simply couldn't catch up.

ASPM-Driven Prioritization & Policy Control

Demandbase needed a way to move beyond AppSec scanning tools and toward a proactive, defensible ASPM strategy. To make the leap, they evaluated several options, including GitLab Ultimate, but found that the bundled tools and policies lacked the granularity required for their security program. They chose the Boost Security ASPM Platform because it provided the "intelligence layer" needed to prioritize risk in a smart, tailored way.

Key Boost capabilities that made the decision easy:

The "Living Rollout" & Developer Experience

Transitioning security at Demandbase involved scaling across2,000 repositories and 500 developers. Yang implemented a "living rollout" strategy designed to minimize friction while maximizing impact.

The PR-First Workflow.The "defining factor" for success, in Yang's estimation, was Boost's inline PR comments. By delivering straightforward, actionable feedback directly in GitLab, security became part of the developer's existing discussion instead of an external hurdle imposed in a separate workflow.

The comments don't have a lot of fluff. The content itself is actionable and easy to find.

Phased Migration.Yang's team ran Boost in "silent mode" for several weeks to gather data and tune policies. This allowed them to understand (and educate developers about) what would have been blocked before actually enforcing the guardrail. This transparency transformed the relationship between security and engineering, allowing devs to stop feeling like security was "breaking things" and instead building loops that improved quality and security.

10x Posture Improvement & "Healthy Repos"

One year after migrating to Boost, the security program at Demandbase has shifted from reactive compliance-based maintenance to automated security oversight.

ASPM: Strategy Beyond the Scan

Scanners can find bugs. ASPM Platforms can govern development. For Demandbase, shifting to an ASPM meant being able to implement security controls at scale.