PepsiCo is a Fortune 50 company operating globally in food, beverage and agriculture. Defending it falls to the Cyber Fusion Center, a team tasked with global threat management and response for every cybersecurity threat PepsiCo faces, 24 hours a day, 365 days a year. The work is inherently hazardous: analysts visit live phishing sites, browse the dark web, and detonate malware on purpose. Doing that safely — and without anything tracing back to PepsiCo — is the job Kasm Workspaces now does.
A lab with one non-negotiable rule
The Cyber Fusion Center runs its own research lab, deliberately separated from PepsiCo’s corporate network. The lab operates on ten published principles — reproducibility, tested change windows, global parity, simplification, cost reduction, forward-looking design, automation, ease of use, and benefit of all — but one outranks the rest: non-attribution. Nothing in the lab may be attributable to PepsiCo, and no corporate data flows through it without explicit precautions.
Four groups depend on the lab day to day:
Incident Response accesses phishing sites, researches and launches malicious samples, and performs incident-related investigation.- Threat Intelligence browses the dark web, visits phishing infrastructure and conducts threat research.
- Malware Analysis executes samples to extract indicators of compromise — the most delicate workload to keep isolated.
- General users need a safe place to open a link or browse a site they wouldn’t trust on a corporate endpoint.
The breaking point: a price hike & a leak
Before Kasm, the team ran a patchwork: Silo (Authentic8) for isolated browsing, plus individually issued secondary laptops & analyst homelabs for anything Silo couldn’t handle. James Konderla, Threat Response Management Associate Principal, is blunt about it: the arrangement “was not sustainable or good in any sense especially the homelab components.”
Two things forced the issue. The first was a substantial increase in Silo’s pricing. The second was a run of failures on work the team cannot compromise on:
WHERE THE INCUMBENT FELL SHORT
- No real control over the platform, and little open documentation to work around gaps
- Repeated failures on large downloads — a routine need in dark web casework
- Inability to store case data in line with PepsiCo’s six-year evidence retention policy
- DNS and traceability leaks observed while executing phishing and malware samples, met with a “renew first, then we’ll troubleshoot” response
For a lab whose first principle is non-attribution, a traceability leak during sample detonation is not a bug. It is a direct threat to the mission. Combined with a renewal quote the team was no longer willing to pay, it sent them looking for something they could own.
Why Kasm: not how flexible it was, but how flexible it could be
The team evaluated standard virtualization and per-analyst dirty machines alongside the incumbent. Nothing met the full set of requirements — isolation, non-attribution, reliable large-file handling, retention under their own control, and a platform a two-person engineering team could actually run. Kasm Workspaces did. But what tipped the decision wasn’t the feature list.
“It wasn’t about how flexible Kasm was to meet our needs — it was how flexible it could be.”
After studying the documentation, Konderla and his colleague Bradley recognized that Kasm’s open documentation and active community meant they could build around any gap themselves — including creating entirely new workspaces. When the catalog lacked specific research tooling, they built it into a non-attributable workspace of their own rather than waiting on a vendor roadmap.
Momentum mattered too. The pair were about to purchase and stand up their own egress solution when Kasm announced its PureVPN integration. They scrapped the plan, bought the licenses, and report no regrets. “I have no doubt we can combine any new capabilities in our lab with Kasm,” Konderla says.
What they built: isolation, egress and a workspace of their own
Today the Cyber Fusion Center runs a self-hosted Kasm Workspaces deployment on its own isolated lab infrastructure, in a multi-server architecture. Every session is a disposable, containerized browser or full desktop. Phishing sites, dark web research and live malware execution never touch an analyst endpoint or the corporate network.
The right workspace for the job
- Default Kasm browser workspaces and Kasm’s official Tor workspace for general and dark web research
- VPN-enabled and Tor-enabled SquirrelWorks workspaces, built in-house, for incident response and threat intelligence
- A custom SquirrelWorks REMnux workspace for malware analysis
- RDP/VNC sessions into dirty-network hosts and forensics servers, launched side by side with other workspaces
Egress that honors non-attribution
Kasm’s PureVPN integration keeps investigative traffic off PepsiCo IP space. Asked how much managed egress has factored into operations, Konderla’s answer is one word: “Tremendously.” Given the lab’s non-attribution clause, he adds, “it is a must.”
A real build pipeline for custom workspaces
Custom workspaces aren’t one-off images. Every change runs through a documented pipeline: lint all images, build, vulnerability-scan the core image (a high or critical finding fails the build), publish scan and size reports to the registry, push to a container registry, and let Kasm pull the new image automatically. The result is that every capability the lab adds is reproducible and version-controlled — exactly what the lab’s principles demand.
Twenty-four hours from problem to shipped capability
Shortly after the move, the Cyber Threat Intelligence team tested its new dark web capability by pulling a large file tied to an active case. The download kept failing — not because of Kasm, but because the threat actor’s own infrastructure kept going up and down, a common pattern in criminal hosting.
Under the old model, that would have been a support ticket and a wait. Instead, Konderla modified the custom SquirrelWorks workspace, tested the change and deployed it to analysts within 24 hours. The team can now stop, pause and resume interrupted downloads over Tor directly inside the workspace.
“We now develop our own workspaces to meet our specific use cases, host our own isolated solution and eagerly follow Kasm’s patch and development notes to integrate them as a key feature in our lab’s use cases.”
Scaling on their own terms
The team started on a single server and, as session demand grew, re-deployed to a multi-server architecture themselves using Kasm’s public documentation. Analysts can now run several workspaces and a remote forensics session at once. Automated backups and snapshots — a lab standard — paid for themselves when the database VM was migrated during the redeployment.
Day-to-day operations have gotten easier too. Konderla credits Kasm’s diagnostics dashboard, introduced in a recent release, with making troubleshooting “much easier” and letting him hunt down and fix issues “incredibly quick” — meaningful for a platform run by two people.
Next on the roadmap: once PepsiCo provisions the lab’s AWS environment, the team plans to move the Kasm database to the cloud and enable multi-zone deployment, steering analysts to the closest connection point in line with the lab’s global parity principle. PepsiCo also plans to expand licenses at renewal as more users are brought into the lab, with Kasm positioned as a core offering of the Cyber Fusion Center.
Results
| Metric | Before | With | Impact |
|---|---|---|---|
 Research traffic attributable to PepsiCo | DNS and traceability leaks observed during sample execution | Isolated lab, managed VPN and Tor egress | Zero |
 Time to deliver a new analyst capability | Dependent on vendor roadmap and renewal | Modified, tested and deployed in-house | <24 hours |
 Concurrent sessions per analyst | Single workspace (single-server) | Multiple workspaces plus remote forensics sessions | Scale unlocked |
 Six-year evidence retention | Not supported by prior platform | Retained under the lab’s own control | Requirement met |
 Research platforms in use | Isolation service + secondary laptops + homelabs | One self-hosted Kasm deployment | 4 use cases → 1 platform |
Asked to name the single biggest difference Kasm has made, Konderla says it’s hard to pick one — because Kasm “consolidated and strengthened our capabilities at the same time.” His advice to a peer at another enterprise security team: “Kasm is customizable, resilient, you can host it yourself or in the cloud, and you can develop your own workspaces when they don’t have what you need in their store.”
