Customers
MarketAxess
MarketAxess Uses Cogent to Prioritize Vulnerabilities by Real-World Exploitability
A global electronic trading platform uses Cogent to determine which vulnerabilities give an attacker a real path to compromise, so its security and engineering teams can fix those first.
50%
of analyst time saved per week
1 day
head start over scanners on new vulns
6
security tools combined into one view
The Customer
Leading Electronic Trading Platform
MarketAxess, whose parent company operates the New York Stock Exchange, delivers a leading electronic trading platform for fixed-income markets. About 2,100 institutional investors and broker-dealers across more than 90 countries use the platform to trade corporate bonds, U.S. Treasuries, and other fixed-income instruments.
Its security team protects trading systems across on-premises data centers and cloud workloads. It works with dozens of application teams and the vulnerabilities it escalates need clear cases behind them.
The Challenge
“Critical” Doesn’t Always Mean Exploitable
MarketAxess already had broad vulnerability detection coverage across hosts, applications, code, endpoints, and network controls. The hard part was determining which of those findings an attacker could exploit in its environment.
A scanner’s severity score couldn’t tell the team whether an affected asset was internet-accessible, whether the vulnerable functionality was enabled, or whether an existing security control already blocked the exploit path.
Answering those questions required manual investigation across threat intelligence sources and network and endpoint tools. The context behind those answers was scattered across systems. Reporting relied on manual exports and spreadsheets. When the team couldn't quickly prove that a vulnerability was exploitable, the safest option was to patch it.
The Solution
Prioritizing by What an Attacker Can Exploit
MarketAxess connected Cogent to its vulnerability scanner, code scanning, endpoint detection, endpoint management, Jira, and firewall configuration. Cogent’s AI agents continuously combine those sources to understand each asset’s vulnerabilities, ownership, internet exposure, business context, and compensating controls.
The biggest difference came from bringing MarketAxess’s existing security controls into vulnerability prioritization. For network controls, Cogent maps firewall policy and intrusion-prevention signatures to each affected asset and determines whether an attacker has a reachable path to the vulnerability and whether a control on that path blocks the exploit.
Every determination comes with an evidence chain showing the policies, controls, and source configuration behind it.
Cogent also gave MarketAxess a way to respond to newly disclosed vulnerabilities before traditional scanner coverage was available. As new advisories are published, Cogent matches them against the software inventory built from MarketAxess’s connected tools. Cogent triaged new advisories against the MarketAxess environment within seconds to minutes of publication, around one day ahead of their scanners on average.
The Results
Evidence-Backed Remediation Priorities
Cogent’s analysis showed that most of the vulnerabilities MarketAxess’s scanners rated critical had no viable exploit path in its environment. Either an attacker could not reach them, or an existing security control blocked the exploit path.
That lets MarketAxess focus remediation on the vulnerabilities that are reachable and exploitable, and show application owners the evidence behind every decision. Cogent also uses Jira history to identify asset owners, which speeds the routing of remediation tasks to the right people.
Cogent automates the manual work of aggregating findings, investigating controls, and preparing vulnerabilities for application teams. That gives the vulnerability management team back approximately 50% of analyst time each week.
Reporting is moving out of spreadsheets. MarketAxess is building production dashboards that distinguish internet-facing from internal exposure. With Cogent, MarketAxess is moving from scanner-driven vulnerability management to exposure-driven remediation that points engineering effort at exploitable risks.
