Revolut

Revolut context

Revolut: scale, speed and regulatory pressure

Revolut is scaling as a global financial platform while moving deeper into licensed banking. The security challenge is to keep software delivery fast while proving stronger control over third-party code.

Why it matters here

At Revolut's scale, open-source governance is not a hygiene topic. It touches customer trust, banking regulation, developer velocity, audit evidence and operational resilience.

Why now?

AI coding acceleration
UK banking licence
DORA and growing regulatory scrutiny
Global engineering and customer scale

Proof point / angle

Frame: scale + banking licence + fast product expansion = higher bar for OSS control.

Source: Revolut 2025 annual results and UK Bank launch announcement

Discovery recap

What I heard today

Everything I am going to show maps back to one of these three challenges.

Unknown threats

You need to identify malicious packages and suspicious behaviour beyond known CVEs.

Prioritise what matters

Your team needs less noise and clearer focus on the findings that deserve action.

Shift left without friction

You want to stop risky dependencies earlier in the developer workflow without slowing delivery.

Combined impact

AppSec teamsMore blind spots, investigation noise and late-stage remediation work.

BusinessGreater security and regulatory exposure, with slower engineering delivery.

Software Composition Analysis

Build a trusted inventory of every dependency

Socket SCA gives a clear view of direct and transitive dependencies, known vulnerabilities, package risk and policy exposure across selected repos and workflows.

Why Revolut should care

In a large engineering organisation, a single application can pull hundreds or thousands of packages. AI-assisted coding can increase dependency exploration and make it harder to track what entered the codebase and why.

Value drivers

Create a reliable inventory of OSS risk across critical services
Understand direct vs. transitive exposure
Give AppSec, engineering and compliance the same source of truth

Proof point / angle

Useful benchmark: 84% of developers use or plan to use AI tools, increasing the need for governance around generated code and suggested packages.

Source: Stack Overflow Developer Survey 2025

Malicious package detection

Detect malicious packages before they become CVEs

Socket looks at what packages can do - network access, filesystem access, install scripts, obfuscation and other behaviours - instead of waiting for a CVE to be published.

Why Revolut should care

Malicious packages target developers directly. As AI coding assistants suggest packages and snippets at speed, Revolut needs a control layer that understands suspicious package behaviour before it reaches the build or production path.

Value drivers

Reduce exposure to zero-day supply chain attacks
Detect risky behaviour that CVE-only tools miss
Give developers a clear reason when a package is blocked or flagged

Proof point / angle

Socket uses 70+ behavioural signals and is designed to detect malicious packages within minutes of release.

Source: Socket Technical Brief

Reachability

Prioritise the findings that actually matter

Reachability analysis checks whether the vulnerable function is called by the application, helping separate theoretical exposure from practical risk.

Why Revolut should care

The issue is not finding more alerts. The issue is knowing which alerts deserve engineering time. This matters even more when AI-generated code increases code volume and dependency churn.

Value drivers

Cut alert fatigue and focus remediation
Improve AppSec-to-engineering credibility
Prioritise based on exploitability, not only CVSS or package presence

Proof point / angle

Socket brief: false-positive reduction of 35-90% and customer noise reduction of 80-90%.

Source: Socket Technical Brief

Socket Firewall

Control packages at the point of installation

Socket Firewall checks direct and transitive dependencies before install on developer machines and in CI/CD, then blocks, warns or monitors based on policy.

Why Revolut should care

A lot of OSS risk enters before a pull request is merged. AI tools make it easier for developers to add unfamiliar dependencies quickly, so install-time control becomes a practical security boundary.

Value drivers

Block malicious packages before they execute locally or in CI
Govern npm, PyPI and other package manager activity
Stop risky packages before developers waste time on them

Proof point / angle

AI risk angle: Stack Overflow reports 46% of developers do not trust AI accuracy, yet adoption keeps rising.

Source: Stack Overflow Developer Survey 2025

Certified Patches

Fix critical exposure without risky broad upgrades

Certified Patches apply focused fixes to vulnerable code paths, avoiding a full dependency upgrade when that would introduce too much change or delay.

Why Revolut should care

For banking-grade systems, remediation needs to be fast but controlled. A broad package upgrade can trigger regression testing, transitive changes and release friction when the urgent need is to close a specific exposure.

Value drivers

Shorten time to remediation for priority issues
Reduce regression risk from broad upstream changes
Give engineering a safer interim path while planning the long-term upgrade

Proof point / angle

CISA has observed that among known exploited vulnerabilities, 42% were used on disclosure day, 50% within two days and 75% within 28 days.

Source: CISA 2021 analysis cited in Wired, 2026

Threat Feed

Make supply chain threats visible in SecOps

Socket Threat Feed sends real-time supply chain intelligence into SIEM, SOAR and custom workflows so malicious package events are triaged where the SOC already operates.

Why Revolut should care

If open-source threats stay inside a separate AppSec tool, response can be slow. Revolut should be able to correlate package threats with identity, endpoint, CI/CD and production signals.

Value drivers

Route OSS threat alerts into existing SOC workflows
Speed triage with context on package behaviour
Support repeatable response playbooks for supply chain events

Proof point / angle

Operational principle: move from dashboard-only visibility to event-driven response inside SIEM/SOAR.

Source: Socket Technical Brief

SBOM & license governance

Turn dependency control into audit evidence

Socket automates SBOM generation, tracks licenses across the dependency tree and enforces package policies with block, warn or monitor actions.

Why Revolut should care

A regulated fintech needs to show what software components are used, which licenses apply and how exceptions are governed. AI-assisted development makes that evidence trail more important, not less.

Value drivers

Generate SBOM and package governance reporting
Detect license exposure earlier in development
Support security, legal and compliance with one dependency view

Proof point / angle

Socket brief: license detection across 800+ license types, with configurable enforcement policies.

Source: Socket Technical Brief

Closing

Validate better signal—without slowing developers

Before we discuss next steps, does this sound like a fair summary of what I heard today?

What I heard

AI is accelerating development faster than AppSec can keep pace.
Your team needs fewer, much more actionable findings—not more noise.
Supply chain risk is moving beyond CVEs and needs to be caught earlier in the developer workflow.

The goal isn't to prove that Socket finds more alerts. It's to help your team focus on the alerts that actually matter—without slowing developers down.

Short technical validation

Identify risks current tooling is not surfacing
Significantly reduce AppSec investigation noise
Shift controls earlier without slowing engineering

Success & process

Prove those outcomes on one or two representative repositories, then decide together whether it makes sense to move forward.

Who else should join the validation?

Formal pilot or iterative evaluation?