Snowflake keeps critical IP safe without disrupting employee productivity

Snowflake needed to protect its critical IP without compromising the collaborative culture that made it successful, but traditional DLP and CASB tools fell short. ”We didn’t have a good story on the endpoint,” says Mario Duarte, VP of Security. ”I can see that you connected, I can see you downloaded something, but after that, I don’t know what you did with it.” After testing and rejecting rules-based tools that slowed down machines without delivering real visibility, Duarte turned to a forum of security peers for advice, and the response overwhelmingly pointed to Mimecast Incydr.

Since deploying it, Duarte’s team has used Incydr to correlate telemetry across SaaS applications and Snowflake’s own Data Cloud for a fuller picture of what’s happening across the environment. In one case, the team noticed an employee had updated their LinkedIn profile around the same time they uploaded source code to personal cloud storage, a common exfiltration warning sign. A quick conversation confirmed the upload was unintentional, and the code was removed. ”Without Incydr, we just wouldn’t have known,” Duarte says, calling it central to Snowflake’s security strategy going forward.