Retrospective: 2 Years of DevSecOps at Stripe – Reducing Vulnerabilities by 70%

Two years ago, Stripe’s security team was drowning: 1,200 open vulnerability tickets, 42% of production deployments blocked by manual security reviews, and a mean time to remediate (MTTR) for critical CVEs of 14 days. Today, that’s 360 open tickets, 6% deployment block rate, and 4.2-day MTTR — a 70%