Building Kitsune: Spotify’s path to automated vulnerability management
Spotify’s Security Tribe began developing its vulnerability management platform (VMP) in Q2 2020. The goal was straightforward: reduce security risk efficiently and at scale. While the company embeds security features into its Golden Path developer workflow to prevent vulnerabilities upfront, issues still surface, and handling them consistently requires a solid operational framework.
From manual notification to automated lifecycle
The standard workflow for a reported vulnerability follows a clear pattern: a detection service, or reactive control (RC), flags the issue; the security team locates the asset owner; the owner is notified with remediation steps; and the owner is then responsible for applying the fix. This repetitive pattern is a prime candidate for automation.
Initially, Spotify automated this process using its Comet notification system. Peripheral systems fed vulnerability data from reactive controls into Comet, which handled email notifications to asset owners. Owners could click a “Resolve” button to mark issues as fixed. This covered basic automation, but the team saw room for improvement.
Reevaluating the vulnerability lifecycle led to several key design decisions. The team defined more granular states for each vulnerability than Comet offered, and they wanted to surface assigned vulnerabilities directly within Backstage so teams could prioritize fixes during sprint planning. They also required a relational data structure for deeper analysis — something beyond Comet’s event-based format.
These requirements drove the creation of Kitsune, Spotify’s dedicated vulnerability management platform. Built as a backend API service, Kitsune acts as the single source of truth for vulnerability data, paired with a Backstage UI plugin for user interaction.
Decoupling with mediators
Kitsune initially ingested data from two reactive controls, including the HackerOne bug bounty program, but the design goal was broader coverage. To keep systems decoupled, Kitsune handles only general business logic, while a separate mediator layer processes RC-specific logic and translates data into a compatible format. This clean separation enabled straightforward integration with additional reactive controls, and more are planned.
Not all vulnerabilities come from automated detectors — some are reported manually by employees. To cover this, Kitsune supports CSV uploads for manually reported issues.
Metrics-driven security
Sample dashboard view. Figures above are for illustrative purposes only.
Metrics were a core requirement from the start. Kitsune’s relational data model makes it possible to generate insights showing each org unit’s current risk posture and historical resolution performance. Teams view these metrics via the Security Hub plugin on Backstage. Quarterly reports based on this data are also sent to upper management to inform strategy.
Current status and direction
The platform remains in active evolution roughly 18 months after development began. The focus is on enabling Spotify to take calculated risks by engaging engineers efficiently and scalably, ensuring security work integrates smoothly into regular development cycles.
