Jubilant Foodworks: Serving Millions, Securing Every Click
Jubilant Foodworks is one of India’s largest quick-service restaurant companies and the master franchisee for Domino’s, Dunkin’, Popeyes, and Hong’s Kitchen, operating more than 2,500 stores globally. With 95% of its applications running on AWS, the company’s cloud infrastructure underpins every order, delivery, and customer touchpoint across its portfolio.
As the cloud footprint grew, the security team led by Gaurav Mehta, who oversees cloud security, cybersecurity, SOC operations, and MSSP management, found itself flying blind. Native tools couldn’t keep pace with the scale or risk exposure of a cloud-first enterprise.
The Challenge: Visibility Gaps in a Cloud-First Enterprise
Jubilant Foodworks started with native AWS tools, which served their purpose in the early stages of cloud adoption. But as the environment grew in scale and complexity, the team found themselves outgrowing what those tools could offer. Each service required its own navigation, there was no single pane of glass, and gaps in coverage meant misconfigurations, exposed assets, and identity risks could go undetected.
The team had limited visibility into which workloads were internet-exposed, whether buckets had been inadvertently made public, or where overpermissive IAM roles and exposed API keys created silent risk. Without real-time alerting, if an infrastructure change created a new exposure, the team wouldn’t know until they happened to check.
Why Orca: A Deliberate, Criteria-Driven Evaluation
Gaurav’s team ran a structured evaluation against defined success criteria. Two vendors made it to a head-to-head comparison. Orca won on the merits.
The four non-negotiable requirements:
- Agentless scanning: The team needed a solution that didn’t require deploying agents across the environment. Orca’s SideScanning technology, which creates read-only snapshots without touching workloads, was a primary differentiator.
- Attack path visibility: Understanding how vulnerabilities could be chained together to reach critical assets was essential, not just isolated findings.
- Workload visibility: A consolidated view of all cloud assets, their configurations, and their risk exposure in one place.
- Shift-left / code-to-cloud security: The ability to surface security issues earlier in the development pipeline, before they reached production.
Orca met all four. Initial concerns from the infrastructure team about sharing cloud access details with a third party were addressed directly, Orca walked the team through data encryption, tokenization, and SOC 2 compliance. Once connected, onboarding was frictionless. In under 24 hours, real-time data on vulnerabilities, workloads, and misconfigurations was fully populated across the environment.
The Impact: From Reactive Chaos to Risk-Driven Clarity
Measurable Security Improvements
Vulnerabilities have been significantly reduced and misconfigurations have declined as the team shifted from unstructured, team-by-team remediation to a unified, risk-prioritized approach. Mean time to detect (MTTD) for cloud assets improved from 10 days to 7, and mean time to respond (MTTR) dropped from 72 hours to 50.
From Reactive to Proactive
Vulnerability remediation used to be a reactive battle fought differently by each team. Now Jubilant Foodworks runs a formal vulnerability management program that distributes prioritized findings, by OS and application, to the right owners in DevOps, Security, and Infrastructure. A key part of that shift is how Orca reframes prioritization: a vulnerability with a CVSS score of 9.3 on an isolated, non-internet-facing asset may be less urgent than one scoring 7.0 on a server with direct internet exposure. Orca surfaces that context automatically. “Earlier, our approach was largely reactive,” Gaurav says. “We have now transitioned to a more proactive and forward-looking security strategy.”
Rapid Incident Response
When a supply-chain vulnerability incident exposed compromised NPM libraries across the industry, Jubilant Foodworks used Orca to immediately determine whether any affected libraries were present in their environment, answering a critical question in minutes rather than days. Today, Orca is fully embedded in day-to-day operations: alerts flow into the SIEM for centralized monitoring, real-time notifications fire on high-priority events like any server becoming internet-exposed, and shift-left capabilities give developers visibility into IaC findings before changes reach production.
Executive Visibility and Compliance
Orca’s CISO and CIO dashboards transformed how the security team communicates with leadership. Monthly governance meetings with the CIO, CTO, and CSO now run on Orca-sourced risk scores, giving leadership a clear picture of posture without requiring them to parse technical detail. As a retail operator, PCI compliance is foundational. Jubilant Foodworks uses Orca’s PCI framework alongside CIS and NIST benchmarks to track scores against targets continuously, turning compliance into an ongoing program rather than a periodic audit.
Looking Ahead: Four Years In, Still Accelerating
Gaurav has been an Orca customer for four years, witnessing the platform evolve from CSPM to a mature CNAPP with attack path analysis, shift-left, and now AI Security Posture Management (AI-SPM).
AI-SPM is where he’s focused next. As Jubilant Foodworks integrates AI-driven approaches into its security operations, shifting from reactive response to proactive anomaly detection, securing AI infrastructure is the next frontier. Orca is the platform he’s counting on to get there.
The transformation at Jubilant Foodworks, from fragmented native tools to a unified, risk-driven platform, comes down to a principle Gaurav has applied across every initiative: security isn’t about managing tools. It’s about aligning with the business. Orca made that alignment possible.
Chat with an Orca Expert