Topic starter
20/08/2026 5:22 pm
TL;DR: More than 8,000 repositories are now protected and over 8 million CI/CD jobs are monitored weekly, StepSecurity reports, showing runtime controls in active use against supply chain abuse and anomalous workflow behaviour. CI/CD runners now need behavioural checks while jobs run, not just static review of workflow files.
Editorial analysis by NHI Mgmt Group, based on content published by StepSecurity: “8,000 Strong: Harden-Runner's Growing Impact on CI/CD Security”.
By the numbers:
- StepSecurity says Harden-Runner now protects more than 8,000 open-source repositories.
Key questions
Q: Why do CI/CD secrets create more risk than many teams expect?
A: CI/CD secrets often have broad blast radius because they can authenticate to source control, cloud platforms, package registries, and deployment systems.
Q: What are the signs that a pipeline workload has been tampered with?
A: Look for network calls to unfamiliar domains, process launches that do not match the job's normal profile, sudden reads of environment secrets, and tag or version changes that happen too quickly to reflect normal release discipline.
Q: What breaks when CI/CD pipelines are monitored only at configuration time?
A: Configuration-only monitoring misses the actual execution path, which is where secrets are read, commands are launched, and network traffic is generated.
Practitioner guidance
- Instrument CI/CD jobs with runtime behaviour monitoring Track process execution, file access, network calls, and secret reads inside build jobs so deviations from normal workflow behaviour are visible in real time.
- Classify build runners as privileged non-human identities Assign ownership, scope, and review requirements to runners, actions, and bot tokens so their permissions are managed as part of identity governance.
- Alert on unusual secret access from trusted workflows Detect when a job touches credentials, environment variables, or service endpoints it has never used before, especially during package install or release steps.
Bottom line: CI/CD pipelines have become privileged execution environments, so runtime monitoring is now part of supply chain defence rather than an optional visibility feature.
Glossary terms: Runtime Monitoring, CI/CD runner, Behavior Baseline, Supply Chain Defence
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
20/08/2026 6:12 pm
CI/CD runtime monitoring is now a governance control, not a developer convenience. The article shows that build systems have become privileged execution environments with secrets, tokens, and release authority attached. That makes runtime observation a control-layer issue, not just an operational enhancement. For identity teams, the key shift is recognising runners and workflow identities as governed actors whose actions must be continuously verified.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should security teams govern AI agent spend in CI/CD pipelines?
A: They should treat spend governance as a request-level control problem, not a billing review problem. The gateway should tag every call with owner metadata, track cumulative cost by repo and team, and enforce thresholds with clear alert and fail-closed behaviour. That makes cost overruns actionable and ties accountability to the workload that caused them.
👉 Read our full editorial: CI/CD runtime monitoring is becoming essential for supply chain defense