How Jellyvision scaled triage and remediation to machine speed

Jellyvision builds the software that guides employees through health insurance, retirement, and the benefits decisions most people dread. That work runs over sensitive data, under a real compliance burden. As development accelerated, Mehul Patel and his team needed their security program to scale with the codebase, not with headcount.

IndustryBenefits engagement software

Use caseContinuous, automated VulnOps

~205employees

~40developers

Millionsof employees served

Before Pixee

“We basically have development teams doing our remediation for us. I am still manually doing triaging.”

Mehul Patel Sr. Director of Security & Technical Operations, Jellyvision

The challenge

Mehul Patel and his team had built a split that worked: developers own remediation in their own services; security owns the call on which findings are real enough to fix. The model was sound. The volume broke it.

Scanners surfaced far more than the team could work, flagging without the context to tell a reachable risk from a dead one. Findings queued for a weekly manual pass, and the ones that mattered waited behind the ones that didn't. Auditors check the action taken on every finding, not just a cleared dashboard.

The solution

Pixee runs inside Jellyvision's own environment, wired to the scanners and pipeline already in place. Triage and remediation run as one continuous motion.

Triage: every finding leaves with a verdict

Real riskFalse positiveNot worth fixing

Findings

From the scanners already in place

Triage

Reachability verdict, reasoning attached

Remediate

Fixes in the team's conventions, pre-checked

Merge

Merge-ready PRs, the normal review

One continuous motion, inside the pipeline Jellyvision already ran

Pixee traces each finding's data path to confirm whether the vulnerable line is actually reachable, and attaches that reasoning to the verdict. Automatable fixes are written to Jellyvision's conventions and checked before a human sees them. Nothing is auto-committed, so the team's existing review gates stay in place.

The operating principle

Scale the model, not the manual work.

The outcome

The capacity math changed. Instead of hand-triaging the critical list once a week, the team works the full backlog, every severity, continuously, with the same headcount.

What that unlocked:

The full backlog in reach, with every severity worked continuously, not just the criticals
Findings that arrive already judged, reasoning and evidence attached, not as raw scanner output
Fixes that land as merge-ready pull requests in the developers' normal flow
An audit trail that is a byproduct of the work, because every verdict and fix records why

The team's hours moved off sorting noise and onto the judgment calls and real fixes only they can make.

Is this a real risk?If so, fix it.

Looking ahead

Continuous triage and remediation is now Jellyvision's default operating mode, and the same team keeps pace as the codebase grows.

“It's been impactful. We're keeping pace with triage and remediation now and sending PRs to the dev teams. We look forward to the next set of capabilities that are rolling out.”

Mehul Patel Sr. Director of Security & Technical Operations, Jellyvision

VulnOps for your codebase

See what machine-speed security looks like on your own repositories.

Pixee triages what your scanners already find, then opens merge-ready fixes inside your pipeline.

Get a demo How VulnOps works

Do Not Sell or Share My Personal Information