How Citrix Reduced Cost Of Vulnerability Scanning By x10 Using Floating Licenses And Automation

Nessus, Qualys, Rapid7 licenses are expensive and pricing rages from $2.50/host/month up to $18/host/month.

Most organizations scan their infrastructure on a weekly basis. Single host scan lasts under an hour. The remaining 23 hours in the day that scanning license does absolutely nothing. This idling actually costs a lot of money and is not necessary.

At 15,000 hosts, Citrix was dropping close $40,000 for vulnerability scanning licenses alone. Using Cloudaware scanning automation, they reduced the cost of scanning licenses to $4,000 per month. How? Short answer is floating licenses but if you want the long answer, keep reading.

Step 1. Cloudaware SPOT CMDB

Citrix uses Cloudaware CMDB as its centralized system of record for all infrastructure: on-prem, AWS, Azure and GCE.

On top of all the Cloud integrations, Cloudaware CMDB also can pull down scanning data from Nessus, Rapid7 and Qualys. The CMDB not only maintains all the scan results but keeps record of the last scan date for each host. This is very important!

Step 2. Cloudaware Breeze Agent

Now if scanning agent is not going to be installed and registered on the host all the time, someone else has to install and register it on the continuous basis. Citrix used Cloudaware breeze agent which provides equivalent functionality to Puppet, Chef, Ansible and other DevOps technologies but in a more compact, mission driven configuration based on strictly curated Breeze Plugins.

Step 3. Floating Licenses

Well basically that’s it. Breeze agents run every 15 minute and reconciles with CMDB to see when was the last time a host was scanned. If scan date is more than 7 days, Breeze deploys and registers scanning agent. Once the scan is done, agent is uninstalled and unregistered from the host. This method of floating licenses reduced the number of liceses by a factor of 10 and consequently reduced the costs by a factor of 10 as well.

Side Benefits

One of the side benefits of maintaining scan data in the CMDB is we can measure things like scan coverage and average resolution time. More about this in separate blog post here.

Find out more about Cloudaware here.