The ability to distinguish between high-risk public-facing workloads and isolated internal systems allowed for a strategic response during time-sensitive security events. As a major player in the European retail sector, Coop Group oversees a massive digital footprint that supports over 100,000 employees and millions of customers across several countries. Managing such a sprawling network, which includes supermarkets, specialized retail outlets, and international subsidiaries, presented a unique challenge for the information security team. Under the leadership of CISO Dominik Bachofner, the organization embarked on a digital transformation that prioritized agility and efficiency. However, as the company migrated heavily to the Google Cloud Platform, they encountered significant hurdles in visibility and risk management. Traditional security tools struggled to keep pace with the scale of their operations, leading to fragmented monitoring and a reliance on manual coding to generate executive reports. This gap between operational needs and technical capabilities necessitated a shift toward a more modern, context-aware security strategy.
Transforming Data into Actionable Context
Mastering the Security Graph and Contextual Risk
The introduction of graph-based technology fundamentally altered how the security department viewed their multi-cloud environment. Rather than treating every individual telemetry flag as an isolated incident, the platform mapped the relationships between different cloud assets, identities, and vulnerabilities. This context-aware approach enabled the team to visualize the potential blast radius of any given threat across their entire hybrid infrastructure. By understanding how different components interacted, the security professionals moved away from reactive troubleshooting to a more sophisticated model of risk assessment. This transition was particularly vital as the organization adopted hundreds of containers and Kubernetes clusters across both on-premise and cloud-based locations. The ability to see everything through a single pane of glass provided the necessary clarity to manage a complex portfolio without the need for additional headcount or specialized software agents on every virtual machine.
Identifying Toxic Combinations for Prioritization
This unified visibility paved the way for identifying what are known as toxic combinations, which represent the intersection of several critical risk factors. For example, the security team could now pinpoint a specific workload that was not only exposed to the public internet but also possessed unpatched vulnerabilities and excessive identity and access management permissions. Identifying these specific intersections allowed the team to prioritize their efforts on the attack paths that posed the highest threat to business continuity. This focus on high-impact risks transformed the way the engineering teams operated, as they no longer felt overwhelmed by a sea of generic red flags. Instead, they could concentrate on the handful of architectural flaws that actually mattered, effectively shutting down the most dangerous avenues for potential breaches. This method of prioritization became a cornerstone of the company’s ability to maintain high levels of security while simultaneously accelerating their digital innovation.
Resolving Alert Fatigue from Fragmented Monitoring
Before the implementation of a unified platform, the security team struggled with an overwhelming volume of alerts that often exceeded 11,000 individual notifications. This state of alert fatigue made it nearly impossible to distinguish between a minor misconfiguration and a catastrophic security hole. The reliance on native tools from cloud service providers meant that the department was flooded with raw data that lacked the necessary business context. Sifting through this noise consumed thousands of hours of manual labor, as developers often had to write custom scripts just to extract meaningful metrics for leadership. The sheer volume of telemetry data created a situation where the security dashboard was described as being lit up like a Christmas tree, providing little actionable insight. This operational tax hindered the company’s ability to react quickly to emerging threats and placed a heavy burden on the engineering teams, who were forced to juggle remediation tasks with their primary development responsibilities.
Implementing Agentless Visibility for Google Cloud
To solve the problem of fragmentation, the organization looked for a solution that offered deep support for the Google Cloud Platform, as many existing vendors prioritized other service providers. The choice of an agentless architecture proved to be a turning point, as it allowed for immediate discovery of all cloud assets without requiring intrusive software installations. This approach provided 100 percent visibility into the hybrid cloud estate, including transient workloads that often escaped traditional scanning methods. By moving away from manual reporting and toward automated discovery, the team regained control over their digital infrastructure. The integration of security checks directly into the continuous integration and continuous deployment pipelines ensured that vulnerabilities were caught early in the development lifecycle. This shift-left strategy reduced the overall cost of security and fostered a culture where safety and speed were no longer viewed as conflicting goals, but rather as complementary elements of a successful digital strategy.
AI-Driven Remediation and Strategic Governance
Enforcing Least Privilege with Wiz Green AI
The deployment of specialized artificial intelligence agents introduced a new level of efficiency to the remediation process. Specifically, the Wiz Green agent played a pivotal role in enforcing the principle of least privilege across the entire cloud environment. When the system detected an asset with excessive permissions, it did not merely issue a warning; it provided a detailed technical blueprint for the engineers to follow. This blueprint included exact package upgrades and specific identity and access management configuration changes required to secure the workload. By providing these ready-to-use solutions, the platform eliminated much of the guesswork that typically plagues cloud security operations. Engineers could implement the necessary changes with confidence, knowing that the recommendations were based on a thorough analysis of the specific technical context. This proactive approach significantly reduced the time between threat detection and resolution, ensuring that critical vulnerabilities were addressed before they could be exploited.
Streamlining Workflows with Mika AI and Jira
Building on this automated foundation, the integration of Mika AI further streamlined the communication between security and engineering departments. By connecting the security platform directly with project management tools like Jira, the organization created a seamless workflow for threat remediation. When a high-priority risk was identified, the AI generated a concise, contextual summary of the issue and automatically opened a ticket for the relevant development team. These tickets included deep links to the specific cloud assets involved, providing engineers with all the information they needed to resolve the bug without requiring them to become cybersecurity experts. This automation minimized developer friction and ensured that security tasks were integrated into the standard engineering workflow. The result was a more collaborative environment where different business units could work together to maintain the organization’s security posture. This level of integration allowed the company to scale its security efforts alongside its rapid digital growth without sacrificing quality.
Managing Zero-Day Threats with Rapid Response
The true effectiveness of this context-aware strategy was demonstrated during a significant zero-day vulnerability event that occurred in late 2025. While many large enterprises spent weeks trying to determine which of their systems were affected, the organization used its unified platform to query their entire multi-cloud estate instantly. This immediate visibility allowed them to distinguish between public-facing workloads that required urgent attention and isolated internal systems that posed a lower risk. Within just 24 hours, the security and engineering teams successfully patched every critical public-facing application across their infrastructure. Remarkably, this rapid response was achieved without any disruption to the company’s retail operations or customer services. The ability to act so decisively during a high-pressure situation proved that the investment in a unified, agentless security platform was well-justified. It solidified the organization’s reputation for operational excellence and demonstrated that a proactive approach to cloud security can protect the brand.
Establishing Long-Term Governance and Future Goals
The successful elimination of critical risks led the organization to establish a permanent Google Cloud Competence Center to maintain these high standards. This centralized hub ensured that developers, architects, and security professionals shared responsibility for the cloud environment through a unified governance framework. Looking ahead, the leadership prioritized the expansion of unified vulnerability management to include all on-premise Kubernetes clusters under a single management pane. They also planned to implement automated prevention rules to block malicious software from entering the supply chain before deployment. These next steps were designed to further shrink the attack surface and ensure that security remained a proactive business enabler. By aligning technical hierarchies with specific business units, the group finalized a strategy that balanced rapid innovation with robust protection. This commitment to continuous improvement signaled a move toward a fully automated security ecosystem where risks were mitigated before they could even emerge.
