Prior to Mend, development teams within the media company performed ad hoc pen testing, but they knew they needed a more robust approach. To achieve the best results, the media company decided to integrate security into the development process and have developers buy into security much earlier in the SDLC. The DevSecOps team is responsible for coaching developers on how to use best-of-breed tools to create more secure code. "The role of my organization is to get development teams to take a bigger ownership interest in the security of their products, so we are only integrating tools into their pipeline. We don't maintain our own pipeline," says the senior director of DevSecOps transformation. Open source vulnerabilities were a huge concern for the media company throughout this process. In certain stacks, it's not uncommon for 80% or more of the company's code to be made up of open source components. The remaining code written in house is primarily to stitch together the open source functionality.