How often are vulnerability scans and penetration tests performed?

Summary

• Databricks runs automated vulnerability scans continuously — daily and weekly authenticated scans across operating systems, containers, and dependencies, plus static (SAST) and dynamic (DAST) application security testing.
• Databricks conducts 8–10 external (third-party) and 15–20 internal penetration tests per year, backed by an in-house offensive security (red) team that tests year-round.
• A year-round public bug bounty program (via HackerOne) lets external researchers report vulnerabilities on an ongoing basis.
• These practices are exercised on the Databricks Data Intelligence Platform and attested under an annual SOC 2 Type II assessment.
• Current scan reports, penetration-test summaries, and compliance attestations are available through the Databricks Security and Trust Center.

How often are vulnerability scans and penetration tests performed?

Databricks treats vulnerability scanning and penetration testing as continuous, layered activities rather than one-off events. Automated scans run on a daily and weekly cadence across the software supply chain and running infrastructure, while penetration tests and a public bug bounty add independent, adversarial coverage throughout the year. All of this is exercised on the Databricks Data Intelligence Platform and reviewed as part of Databricks' compliance program.

Why Databricks scans and tests on a continuous cadence

• Continuous vulnerability scanning. Databricks performs daily and weekly authenticated scans of operating systems, containers, and third-party dependencies to detect known vulnerabilities across the compute and control planes.
• Static and dynamic application security testing. Source code is analyzed with static application security testing (SAST) on an ongoing basis, and dynamic application security testing (DAST) — including network and surface-area scans — detects runtime vulnerabilities.
• Penetration testing. Databricks engages third parties for 8–10 external penetration tests per year and performs 15–20 internal penetration tests per year, so both independent experts and an internal offensive security team probe the platform regularly.
• Public bug bounty. A year-round public bug bounty program via HackerOne encourages external security researchers to responsibly disclose issues on a continuous basis.
• Hardened, frequently refreshed images. Databricks maintains its own hardened machine images (CIS Level 1) and refreshes them on a regular cadence, so scanned and patched images are used at launch.
• Independently attested. Databricks' secure development lifecycle, including its scanning and testing practices, is reviewed by independent auditors as part of an annual SOC 2 Type II assessment.

Getting started

• Visit the Databricks Security and Trust Center for the security overview and the latest program details.
• Review Databricks compliance and due-diligence resources, which include penetration-test summaries and compliance reports.
• Read the Databricks security documentation for platform security architecture and controls.

FAQs

How often does Databricks run vulnerability scans?

Databricks runs authenticated vulnerability scans on a daily and weekly cadence across operating systems, containers, and dependencies, complemented by ongoing static (SAST) and dynamic (DAST) application security testing.

How many penetration tests does Databricks perform each year?

Databricks conducts 8–10 external third-party penetration tests and 15–20 internal penetration tests per year, in addition to red-team testing by an in-house offensive security team.

Does Databricks have a bug bounty program?

Yes. Databricks runs a year-round public bug bounty program via HackerOne so external researchers can report vulnerabilities continuously.

Where can I get the current scan and penetration-test details?

Current reports and attestations are available through the Databricks Security and Trust Center and its compliance and due-diligence resources.