How Mixpanel scales attack surface management with a lean security team using Detectify

Mixpanel's results: Automated scoping, vendor visibility, high-signal findings, and low operational overhead

With Detectify, Mixpanel has:

• Automated attack surface scoping: A read-only DNS integration keeps scope current as infrastructure changes.
• Vendor visibility: New subdomains pointing to third-party services surface for review.
• An accurate technology footprint: Mixpanel can see the technologies and dependencies across its environment, including those its vendors use.
• Higher-signal findings: Scoping to Mixpanel-owned assets reduces false positives and triage time. Every alert includes remediation guidance.
• Fast onboarding: Full scanning was in place within 30 minutes.
• A tighter bug bounty scope: Detectify covers the findings an automated scanner would surface, so Mixpanel excludes them from its bug bounty program.

The challenge:

Mixpanel's cloud IP addresses change frequently, and the alternatives its security team evaluated needed near-daily manual updates to keep scanner targets current. Scanning was also split across engineering teams running separate tools.

The result:

A read-only DNS integration now keeps Mixpanel's scope current automatically. Surface Monitoring and Application Scanning findings flow into one vulnerability management platform, so a lean team spends its time on remediation instead of upkeep.

Keeping scope current across a dynamic cloud environment

When Scot Matson, Manager of Information Security at Mixpanel, took ownership of the application security program, individual engineering teams ran scanning on separate tools. His goal was a single DAST and attack surface management capability with one view across Mixpanel's external footprint.

Scot holds every tool to a clear standard: it has to earn its operational cost. For a lean team covering a large footprint, that means actionable findings and minimal care and feeding.

Scoping was the central problem. Mixpanel's cloud IP addresses change frequently, and the alternatives Scot evaluated required near-daily manual updates to keep scanner targets current.

Customers also share reports from third-party security rating services during vendor reviews. These reports frequently flag infrastructure outside Mixpanel's ownership, and each one requires investigation.

Lightweight security that runs in the background

Detectify met those requirements: a specialized platform that stays current through its community of security researchers and needs little ongoing tuning.

Onboarding took under 30 minutes. Detectify reads Mixpanel's DNS records through a read-only integration with its cloud provider. As DNS changes, Detectify discovers and scans new assets automatically, keeping scope current.

Visibility into vendor services and the full technology footprint

Continuous monitoring of DNS gives Mixpanel an outside-in baseline for its external infrastructure. When a new subdomain points to a third-party service, the security team sees it and confirms the service went through the right review. Vendor-hosted assets carry Mixpanel's brand and sit in the same footprint customers and rating services scan, so they get the same scrutiny as Mixpanel's own infrastructure.

Detectify also fingerprints the technologies running across Mixpanel's assets. The result is an accurate map of the environment and its dependencies, including technologies vendors use that the team had no prior record of. Scot previously relied on separate fingerprinting tools for this work.

High-signal findings and a lighter operational load

• Higher-signal findings: Scanning is scoped to Mixpanel's DNS, so findings focus on Mixpanel-owned assets. When a customer shares a third-party rating report, the team validates it against Detectify's inventory and resolves false positives quickly.
• Remediation guidance: Each finding includes remediation steps. The team treats them as a starting point and determines the right fix for Mixpanel's environment.
• A reliable daily signal: Detectify sends daily notifications on open findings. The team trusts the quality of the reporting, so high and critical findings prompt immediate investigation and everything else waits its turn.
• Dashboards built for how analysts work: The team can drill into a finding's details or switch context quickly and stay focused.
• Centralized vulnerability management: Detectify findings flow daily into Mixpanel's central vulnerability management platform alongside code scanning, cloud posture, and bug bounty findings. The team triages from a single view.
• Low operational overhead: Surface Monitoring handles dynamic scoping, and engineers focus on remediation and higher-impact work.
• A tighter bug bounty scope: With Detectify covering the automated baseline, Mixpanel scopes its bug bounty program to exclude findings a deterministic scanner would surface. Submissions concentrate on issues that require human insight.

A recommendation for lean security teams

For security leaders managing a growing cloud footprint with a lean team, Mixpanel's experience shows how automated attack surface management and continuous application scanning can scale with minimal upkeep and extend visibility to every service running under a company's domains.