Notifications
Clear all
Topic starter
19/08/2026 3:47 pm
TL;DR: Datadog’s State of DevSecOps 2026 report reinforces that CI/CD pipelines and GitHub Actions remain heavily exposed to supply chain abuse, with StepSecurity arguing that unpinned actions, release-day dependencies, and runtime behaviour all widen the blast radius of compromised workflows. The governance gap is no longer visibility alone but control over what can execute, when it can execute, and what it can reach.
NHIMG editorial — based on content published by StepSecurity: Datadog's DevSecOps 2026 report validates what we've been building
By the numbers:
- Datadog found that 87% of organizations have at least one exploitable vulnerability, affecting 40% of all services.
- Only 4% pin the hash for all marketplace actions, while 71% never pin the hash for any of their actions.
- Datadog found that 1.6% of organizations using npm have used at least one malicious dependency in the past year.
Questions worth separating out
Q: What breaks when GitHub Actions are not pinned to immutable references?
A: When actions are not pinned, the code that runs in a trusted workflow can change after review, which destroys the assumption that approval equals execution safety.
Q: Why do CI/CD pipelines create non-human identity risk?
A: CI/CD pipelines create non-human identity risk because they authenticate to other systems, carry secrets, and perform privileged actions automatically.
Q: How do security teams know if dependency controls are actually working?
A: Look for whether build systems prevent unauthorised version drift, whether package provenance is checked before install, and whether secret-handling code is isolated from broad application reach.
Practitioner guidance
- Pin every marketplace action to an immutable reference Use full-length commit SHAs for all third-party GitHub Actions, then enforce that requirement with repository checks so tag drift cannot change execution after review.
- Add a release-day cooldown gate for dependencies Block newly published packages, images, or actions for a configurable waiting period so teams do not consume artefacts inside the attacker’s highest-risk exposure window.
- Treat workflow secrets as high-risk credentials Inventory which secrets, tokens, and signing keys are reachable from each workflow, then reduce scope so a compromised job cannot access more than it needs.
What's in the full article
StepSecurity's full blog covers the operational detail this post intentionally leaves for the source:
- How StepSecurity maps Datadog’s findings to specific GitHub Actions controls and pipeline protections.
- Step-by-step descriptions of runtime monitoring, action pinning, and compromised-package checks in build workflows.
- Operational examples of how release cooldowns and maintained actions are applied in real CI/CD environments.
- Product-specific guidance on extending protection to developer machines and AI-assisted coding tools.
👉 Read StepSecurity’s analysis of Datadog’s DevSecOps 2026 report and CI/CD risk →
CI/CD pipeline exposure and GitHub Actions risk: are controls keeping up?
Explore further
19/08/2026 4:23 pm
CI/CD pipelines are now non-human identity environments, not just automation layers. GitHub Actions, developer machines, and package pipelines all depend on delegated access, reusable secrets, and code execution rights. That makes them an NHI governance problem as much as a DevSecOps problem. The control question is who and what is allowed to act inside the delivery system, under which constraints, and with what blast radius. Practitioners should therefore treat workflow identities as governed assets, not background tooling.
A question worth separating out:
Q: Who is accountable when a compromised dependency exposes production secrets?
A: Accountability is shared across application, platform, and identity teams because the failure spans dependency control, secret exposure, and workload access governance. Security frameworks expect organisations to reduce attack surface, but the practical answer is to remove reusable secrets from places untrusted code can reach and to log every runtime credential handoff.
👉 Read our full editorial: CI/CD pipeline exposure in DevSecOps is still a governance gap
