Confluence+8 Mixed

Operator Insights

What are business and product leaders learning from rolling Confluence out across their teams?

5 accounts: 1 failure, incident or rollback, 1 left it or turned it down, 2 adopted it and 1 reported by others

Failures, incidents and rollbacks1

Mark WaiteJenkins maintainer, with R. Tyler CroyJenkins project
Open-source project. Self-hosted Confluence wiki, read-only since October 2019. Disclosed September 4, 2021.
Jenkins Blog, published Sep 4, 2021Read the write-up (opens Jenkins Blog in a new tab)
Observation
Attackers used a Confluence flaw to plant a crypto miner on the Jenkins project's wiki, and the project shut the wiki down for good.
Takeaway
Patch or retire self-managed Confluence servers on Atlassian's schedule; a read-only wiki left online was enough to compromise Jenkins' infrastructure.
What happened
Attackers used Confluence CVE-2021-26084 to install what the Jenkins team believes was a Monero miner in the container running its deprecated, self-hosted Confluence wiki. The infrastructure team took the service offline permanently, rotated privileged credentials, reset accounts in its shared identity system and paused releases while it checked the scope.
“At this time, the Jenkins infrastructure team has permanently disabled the Confluence service, rotated privileged credentials, and taken proactive measures to further reduce the scope of access across our infrastructure.”
Jenkins infrastructure team
- Public engineering write-up
- Investigated by the project's infrastructure team
Deployment details
Open-source project. Self-hosted Confluence wiki, read-only since October 2019. Disclosed September 4, 2021.
- Public engineering write-up
- Investigated by the project's infrastructure team
Team
Jenkins infrastructure team
Duration
Wiki read-only from October 2019; breach disclosed September 4, 2021
Workload
Self-hosted project wiki
Product version
Confluence Server, self-managed

Left it or turned it down1

Karim DasoukiHead of IS&T GovernanceParloa
Organization-wide. Conversational AI company. Account published May 23, 2025 on Notion's site.
Notion customer stories, published May 23, 2025Read the write-up (opens Notion customer stories in a new tab)
Observation
Parloa left Confluence and Coda for Notion and Notion AI and reports halving its tool costs.
Takeaway
If teams already live in another workspace, price the consolidation honestly; Parloa left Confluence to cut tools.
What happened
Parloa dropped a fragmented set of tools including Confluence and Coda and moved to Notion and Notion AI, reporting a 50% cut in tool costs and less complexity. The account is Notion's customer story and does not separate the effect of leaving Confluence from the wider consolidation.
“By replacing a fragmented system of Coda, Confluence, and other tools with Notion and Notion AI, Parloa cut costs by 50% and reduced tool complexity.”
Karim Dasouki
- Vendor customer story (Notion's)
- Cost cut reported on a competitor's site
Deployment details
Organization-wide. Conversational AI company. Account published May 23, 2025 on Notion's site.
- Vendor customer story (Notion's)
- Cost cut reported on a competitor's site
Team
Company-wide
Workload
Documentation and knowledge search
Product version
Confluence, replaced by Notion with Notion AI
Measurement
Tool cost reduction (50%)

Adopted it2

Ryan BoydVP of ITSpotOn
Sales support. A Slack channel for sales questions. Reported May 2026.
Atlassian blog, published May 6, 2026Read the write-up (opens Atlassian blog in a new tab)
Observation
At SpotOn, a Rovo agent in Slack took over nearly all sales support questions.
Takeaway
Start an agent on one busy channel with a clear deflection metric, so the result is measured before the agent spreads.
What happened
SpotOn built a sales support Rovo agent in Slack, tailored to the questions in its sales support channel. According to Boyd, Rovo answered 95% of questions in the channel, and the clean deflection rate rose from 40% to 53%, which Boyd describes as measurable impact.
- Vendor customer story
- Answer and deflection rates reported
Deployment details
Sales support. A Slack channel for sales questions. Reported May 2026.
- Vendor customer story
- Answer and deflection rates reported
Team
SpotOn, as described by its VP of IT
Workload
Sales support questions in a Slack channel
Product version
Rovo agent in Slack
Measurement
Share of questions answered, clean deflection rate before and after

Teach for AllMay 6, 2026Atlassian blogAt Teach for All, a Rovo agent drafts weekly reports most of the way from Jira and Google Sheets.
Tapiwa SamkangeDirector, Digital TransformationTeach for All
Digital transformation team. Weekly reporting. Reported May 2026.
Atlassian blog, published May 6, 2026Read the write-up (opens Atlassian blog in a new tab)
Observation
At Teach for All, a Rovo agent drafts weekly reports most of the way from Jira and Google Sheets.
Takeaway
Point agents at recurring reports with known sources, and plan for a person to finish the last third of each one.
What happened
Samkange built a Digital Transformation Update Agent in Rovo that generates weekly reports from Jira and the team's Google Sheets. The agent gets about 60 to 70% of the way, and Samkange refines the rest, crediting the structure it provides.
Vendor customer story
Share of report drafted reported
Deployment details
Digital transformation team. Weekly reporting. Reported May 2026.
Vendor customer story
Share of report drafted reported
Team
Teach for All digital transformation
Workload
Weekly digital transformation updates
Product version
Rovo agent built in Rovo Studio, reading Jira and Google Sheets
Measurement
Share of each report drafted by the agent, about 60 to 70%

Reported by others1

Swati KhandelwalAug 8, 2026The Hacker NewsVaronis and PromptArmor each made Rovo send Confluence and Jira data a user could reach to an attacker's server.
Swati KhandelwalJournalist, The Hacker News, reporting on Varonis Threat Labs and PromptArmor researchThe Hacker News
Security research. Rovo in Confluence and Jira Cloud. Reported August 8, 2026.
Its own announcement, published Aug 8, 2026Read the report (opens the announcement in a new tab)
Observation
Varonis and PromptArmor each made Rovo send Confluence and Jira data a user could reach to an attacker's server.
Takeaway
Treat Rovo as able to reach everything a user can open, and limit agent actions on pages from outside the company until Atlassian closes the injection path.
What happened
Varonis found a link flaw it calls RovoBlast that let Rovo leak Jira and Confluence data a signed-in user could open; Atlassian fixed it server-side on July 8, 2026. PromptArmor showed a content-borne prompt injection that still worked on August 5, 2026 with Rovo's web search switched off.
“Varonis calls the flaw RovoBlast and says it disclosed the issue through Bugcrowd. The Bugcrowd record shows Atlassian fixed it server-side on July 8, 2026, and the reporter validated the fix.”
Swati Khandelwal
Second-hand news report (The Hacker News)
Reported by The Hacker News
Deployment details
Security research. Rovo in Confluence and Jira Cloud. Reported August 8, 2026.
Second-hand news report (The Hacker News)
Reported by The Hacker News
Team
Security researchers
Duration
Fixed July 8, 2026 for one flaw; the other open at August 5, 2026
Workload
Rovo over Confluence and Jira content
Product version
Rovo in Confluence Cloud

Failures, incidents and rollbacks1

Attackers used a Confluence flaw to plant a crypto miner on the Jenkins project's wiki, and the project shut the wiki down for good.

Left it or turned it down1

Parloa left Confluence and Coda for Notion and Notion AI and reports halving its tool costs.

Adopted it2

At SpotOn, a Rovo agent in Slack took over nearly all sales support questions.

At Teach for All, a Rovo agent drafts weekly reports most of the way from Jira and Google Sheets.

Reported by others1

Varonis and PromptArmor each made Rovo send Confluence and Jira data a user could reach to an attacker's server.