This is the default text value
How Sallie Mae went from a ‘hell week’ of spreadsheets to exposure answers in minutes
Sallie Mae’s vulnerability management team works against strict remediation deadlines, and audit and compliance teams check whether each one is met. With tens of thousands of open vulnerabilities at any given time, and sometimes hundreds of thousands, the team needed a reliable way to identify which vulnerabilities posed real risk to the company. They also needed evidence to justify which vulnerabilities they fixed first and which they deferred, along with a way to keep pace with AI threats that now move faster than their monthly workflows. Zafran gave them all three.
Key Outcomes
96%
reduction in CVSS Criticals
23K
vulnerabilities identified for immediate mitigation using the millions of dollars in security controls already in place
Minutes
To answer “are we exposed?”
“With Zafran, we are providing real time information. We’re able to assess exposure before CVEs have even been defined.”
Chad Haselby, Director, Threat & Vulnerability Management, Sallie Mae
Intro
As a financial services company, Sallie Mae holds every vulnerability to a required remediation timeframe. The audit team tracks whether each one is met and reports the results to leadership. For years, the vulnerability management team had months to close a vulnerability after detection. As frontier AI models like Mythos sped up how quickly vulnerabilities are found and exploited, that window shrank, and the team needed a quicker way to decide what to fix first.
“Prior to Mythos and the more recent vulnerability speed and acceleration, we would have ninety days, a hundred and twenty days, a hundred and eighty days from the time something was detected until the time it was remediated. That just doesn’t work today.”
Steve Lodin, VP InfoSec, Sallie Mae
Ending “hell week”
Before Zafran, prioritization at Sallie Mae relied on scanner-generated CVSS and EPSS scores. But these scores had no way of knowing whether a vulnerable system sat behind layers of compensating controls, whether the asset was even reachable from the internet, or whether the relevant code was running at all. The team still had to make sense of that data.
Once a month, the vulnerability management team lost a full week to what they called “hell week.” It was a week of exporting reports from the scanning tool, building spreadsheets, and turning the data into pivot charts to show where the organization stood.
“Hell week was literally a week that we would spend generating reports out of our scanning tool. Getting all of this data, developing spreadsheets, trying to make sense of these spreadsheets by developing pivot charts. You dreaded that time every single month.”
Chad Haselby, Director, Threat & Vulnerability Management, Sallie Mae
After a week of building prioritized lists, the team took them to the IT remediation teams. By the time the list was ready, some vulnerabilities had already been fixed. For other vulnerabilities, IT questioned whether the fix was worth the effort. Neither side had a current view of exposure they both trusted, so every conversation started from scratch
Putting existing security controls to work
Sallie Mae wanted to prioritize vulnerabilities by what’s truly exploitable, which meant factoring in the security controls the company had already invested millions of dollars in. Most teams can confirm they have endpoint detection or a web application firewall in place. Far fewer can verify how each one is configured. Zafran checks those configurations device by device and adjusts the risk of every vulnerability based on the controls protecting it.
“Zafran checks that on an individual device basis and adjusts the risk for those vulnerabilities based on those security controls. It’s helped us build trust with those teams to where we aren’t really questioned anymore”
Steve Lodin, VP InfoSec, Sallie Mae
Zafran delivered Sallie Mae with live telemetry from EDR, WAF, and NGFW tools to show when defenses are already blocking exploit attempts. The team could deprioritize those findings with confidence and validate patch exceptions against real data. Focus sharpened on credible threats like zero-days and CISA KEVs, and the team had the foundation for a scalable, risk-based vulnerability management framework.
From days to minutes with Zafran AI
Early in the deployment, the team suspected a gap in their vulnerability discovery coverage. Working late one night, they asked Zafran AI in plain language to look into it. The AI searched across their connected scanners and security controls, correlated the findings with device-level configurations, and returned a detailed answer that included the full scope of what was in view.
“[Zafran AI] saved us probably hours of digging and then questioning ourselves, Okay, what didn’t we think of?”
Chad Haselby, Director, Threat & Vulnerability Management, Sallie Mae
Assessments that used to take days now take minutes. The team asks Zafran AI questions in plain language and gets answers grounded in their correlated asset and findings data, including a comparison of how quickly each scanner detects new vulnerabilities. When they want something to share, the AI agent builds the dashboard for them. Zafran was able to show the team where their scanners were falling behind and resolved their concern about a gap in discovery coverage almost instantly.
The Implementation
“If I could offer any advice to other companies in the financial sector, give Zafran a try. The time to deployment is very fast. And the results, I think they’ll find it very surprising.”
Chad Haselby, Director, Threat & Vulnerability Management, Sallie Mae
Discover how Zafran Security can streamline your vulnerability management processes.
Request a demo today and secure your organization’s digital infrastructure.
Request a demo today and secure your organization’s digital infrastructure.
Industry
Financial Services
Key Outcome
See Zafran in action
See Zafran in Action
Prioritize and fix what is truly exploitable using risk context from your existing security tools