Cloud Platform
Platform
Solutions
Resources
Customers
Partners
Community
Support
Company
Login
Contact us
Try it
Asset Management
Vulnerability & Configuration Management
Risk Remediation
Threat Detection & Response
  • Overview

  • Platform Apps

  • Qualys Endpoint Security

    Advanced endpoint threat protection, improved threat context, and alert prioritization

  • Context XDR

    Extend detection and response beyond the endpoint to the enterprise

Compliance
Cloud Security
Cyber Risk Series | Cloud Security Edition | February 28 | Register Now

EPAM Systems Delivers a Secure Foundation for Cutting-Edge Digital Projects

Protecting over 50,000 hybrid and multi-cloud endpoints with highly accurate and automated vulnerability management capabilities

.

www.epam.com

INDUSTRY: Computer Services

BUSINESS: Headquartered in Newtown, Pennsylvania, EPAM Systems, Inc. specialises in product development, digital platform engineering, and digital design

SCOPE: International

SIZE: 38,000+ employees

BUSINESS CHALLENGE: To deliver cutting-edge digital products for its clients, EPAM Systems depends on a large and complex hybrid cloud infrastructure. How does the company protect more than 50,000 endpoints from cyber threats?.

SOLUTION:

  • Qualys Vulnerability Management
  • Qualys Continuous Monitoring
  • Qualys Container Security
  • Qualys Web Application Scanning
  • Qualys Policy Compliance
  • Qualys Threat Protection
  • Qualys Global AssetView

With operations in more than 35 countries, EPAM Systems, Inc. builds compelling digital products and experiences for some of the world’s leading enterprises—including more than 120 Fortune Global 2000 companies.

To shape outstanding solutions for its clients, EPAM Systems relies on a wide range of digital systems and platforms. In total, the company manages over 50,000 IP-connected endpoints, including more than 540 multi-cloud accounts and approximately 2,000 active containers.

Protecting Fast-Growing Environments

EPAM’s industry leading position and reputation is of utmost importance to the company, and information security is a top priority. To mitigate the potential financial, legal and reputational impacts of a breach, the company aims to ensure that its virtual machines, containers and multi-cloud environments are protected from cyber risks 24/7.

Miroslav Sklansky, Senior Director and Head of Information Security, EPAM Systems, explains, “In the past, one of our biggest vulnerability management challenges was balancing the requirement to regularly scan our production systems for threats with the risk of those scans causing performance issues. Our previous scanning technology was also prone to generating false positives, which reduced trust in our vulnerability management reports and made it difficult to prioritise remediation tasks effectively.”

Why EPAM chose Qualys:

  • Enables comprehensive vulnerability management capabilities for thousands of virtual machines, containers and public cloud accounts.
  • Allows effective prioritisation of threats, helping to remediate critical vulnerabilities rapidly.
  • Facilitates compliance with industry best practices for information security, strengthening EPAM’s reputation.

Targeting a Fresh Approach

To solve the challenges, EPAM Systems decided to look for a fresh approach. As well as reducing the time and manual effort required to perform scans, the company targeted a platform that would minimise the number of false positives and offer rapid, actionable insights into the most pressing cyber threats.

After reviewing solutions from several different vendors, EPAM Systems selected the Enterprise TruRisk Platform as its new vulnerability management solution. By installing Qualys Cloud Agents across its endpoints and deploying Qualys Vulnerability Management (VM), the company rapidly gained deep insight into its global inventory of IT assets and the potential risk exposure.

“Implementing and configuring the Qualys solution was extremely straightforward,” recalls Sklansky. “Not only was it simple to install the Qualys Cloud Agents throughout our environment, but the agents themselves are also very lightweight—eliminating the performance issues we had with our previous scanning technology. Without a doubt, Qualys offers the best agents I’ve ever used; they never cause us any trouble.”

Gaining Actionable Insights

Based on its positive experience with Qualys VM, EPAM Systems decided to augment its capabilities by adding Qualys Threat Protection (TP) and Continuous Monitoring (CM).

“With Qualys Threat Protection, we gain a ranked list of vulnerabilities based on their severity, combined with targeted recommendations on how to remediate them,” explains Sklansky. “Using Qualys Continuous Monitoring, we can monitor our external IP-connected systems and get alerts on network irregularities that might indicate an attack or a breach, all in real time.”

Extending Protection into the Cloud

As a digital innovator and early adopter of cloud and container technology, EPAM Systems is always looking for new ways to deliver client value. As these cloud environments continued to grow significantly year-on-year, EPAM Systems engaged Qualys to help reduce the cost and complexity of its security processes.

“Our cloud environment is extremely large, comprising around 240 AWS accounts, 120 Google Cloud accounts and 180 Azure accounts,” continues Sklansky. “To enhance security, we provision a new cloud environment for each new client project. A side-effect of this policy was that it took time and effort to verify that each environment was configured in line with our internal governance and compliance standards.”

Increasing Automation, Boosting Security

By combining Qualys Cloud View (CV) and Container Security (CS) with its custom-developed EPAM Cloud Orchestrator and EPAM Carrier tools, EPAM Systems has enabled a highly automated approach to protect its cloud and container environments.

“Using the EPAM Cloud Orchestrator and Qualys APIs, we deploy a connector instance to every new cloud account,” says Sklansky. “We then use EPAM Carrier to collect the relevant information on the asset and verify its compliance status using the Enterprise TruRisk Platform. If an action is required, the solution automatically creates a JIRA ticket for the remediation work, which we track to completion via a central dashboard.”

He adds, “We are currently in the process of rolling out a similar solution to help us to inventory and monitor the compliance status of our 2,000 active containers. Here also, we use EPAM Carrier in combination with the Qualys solution to collect information, detect configuration changes, and monitor compliance against our internal policies and best practices.”

“Qualys plays a key role in helping us to protect all our virtual machines, workstations and cloud services, and we look forward to working with Qualys to further strengthen our security posture.”
Miroslav Sklansky
Miroslav Sklansky

Senior Director and Head of Information Security, EPAM Systems, Inc.

Forging a Valuable Partnership

EPAM Systems knows that information security is an ongoing process, and the company continually strives to enhance its capabilities. The business has recently begun exploring Qualys Policy Compliance (PC) to help compare its compliance processes and standards against industry benchmarks, empowering its information security leaders to set and measure progress against concrete targets.

Looking further ahead, the company is interested in delivering information security services as a value-added offering to its clients. For example, EPAM Systems is investigating the possibility of providing Qualys Web Application Scanning (WAS) for its clients—helping them to ensure that their digital products and services are protected against security threats.

“Vulnerability management data is of limited use if you can’t quickly interpret it and take the appropriate actions,” concludes Sklansky. “ is one of our most valuable sources of vulnerability management data for exactly this reason: the solutions provide easy-to-digest insights into the type, severity and priority of information security threats across the business. Qualys plays a key role in helping us to protect all our virtual machines, workstations and cloud services, and we look forward to working with Qualys to further strengthen our security posture.”