The Security Program Carta Built for the Modern Era
Highlights
Modern threats outpaced legacy approaches
Annual pentests and bug bounty programs delivered diminishing returns, prompting Carta to seek a continuous solution
Autonomous testing uncovered high-impact risks early
During a prelaunch assessment of Carta's MCP server, RunSybil surfaced two chained high-severity vulnerabilities that traditional tools missed
Accelerated risk visibility for M&As
RunSybil enabled Carta to complete a fast, thorough security review of an M&A target mid-acquisition, surfacing actionable findings within minutes and now serving as a core part of Carta's evaluation process
Carta is the ERP platform for Private Capital, trusted by companies worldwide to manage equity and ownership. To protect the $5 trillion in equity it manages, Carta had already invested in a comprehensive security program, including a growing application security team, SAST, SCA, secrets scanning, CSPM, and bug bounties.
But because AI reshapes how fast code ships and arms attackers with new ways to find vulnerabilities, Carta's security team wanted continuous testing of its applications to match the pace at which its developers ship code. They also needed a solution that identifies novel vulnerabilities beyond the reach of pattern-based tools and gives Carta's application security team clear visibility into what to test next.
“The real shift left is in findings becoming detection patterns powering the appsec flywheel where we push less vulnerabilities and we build confidence as there is continuous and deeper coverage of our attack surface”
Brad Freer, Senior Security Engineer, Carta
Outgrowing bug bounty and annual pentests
As the security landscape evolved, Carta’s bug bounty and annual pentesting programs began to yield diminishing returns.
Carta's challenges with bug bounty
Bug bounty researchers resurfaced the same vulnerability patterns. Many findings had steps that were hard to reproduce.
Severity disputes, triage failures, and management overhead required more bandwidth from Carta's security team than the findings justified
Carta was allocating a significant portion of its security budget without uncovering emerging threats
Carta's challenges with annual pentests
Carta spent significant time onboarding a traditional pentesting firm, but the findings rarely justified the effort
Coverage tended to be shallow against complex systems like Carta's authorization architecture
Business context and exploitability patterns didn't carry over from year to year
Carta prioritizes continuous testing in its security program
Moving beyond annual pentests and traditional bug bounty programs, Carta adopted RunSybil, a continuous autonomous security solution, as a key addition to its security program.
RunSybil's first engagement was a time-sensitive M&A review, where it surfaced exploitable vulnerabilities far faster than Carta's traditional methods could, enabling Carta to remediate them during the M&A process. Today, RunSybil is an integral part of Carta’s evaluation process.
For internal applications, Carta shifted focus from accumulating bug reports to validating and prioritizing the issues that matter most. With continuous testing, new code will be assessed as soon as it’s shipped, ensuring vulnerabilities are addressed quickly rather than waiting for the next scheduled review.
“The bug bounty has lost its charm. They're using the same tools to scan us externally as we're using internally. But it's more than that: they're finding the same patterns on repeat, farming bounties instead of the novel vulns, like XSS-to-RCE chains, that used to make this worth it.”
Vamsi NC, AppSec Lead, Carta
With RunSybil, Carta now has:
|
|
Looking ahead, Carta is integrating Sybil’s findings into custom agentic scanning rules by codifying every discovered pattern and ensuring its security stack evolves alongside emerging threats. Alongside, implementing continuous testing for internal applications.
Coverage for unknown patterns
To gain visibility into unknown vulnerability patterns—especially those beyond the scope of static analysis and internal rules—Carta prioritized coverage for their MCP server early in its development.
During the initial MCP engagement identified two chained high-severity vulnerabilities, both of which were remediated.
|
CVSS 8.1 SQL Validation Sybil identified a bypass in Carta's SQL validation layer. What made this finding possible wasn't a scanner. A tool like SQLMap has no awareness of how Snowflake's SQL dialect works in context. Sybil understood the integration, reasoned about the code structure the way a human code reviewer would, and built a working payload to demonstrate the bypass. |
CVSS 8.8 Administrative Function Execution via SQL Validator Bypass Sybil chained these two findings to extract live AWS credentials, map internal network topology, and enumerate service account identifiers in a test environment. The chained impact mapped to remote code execution risk. |
