Topic starter
20/08/2026 5:22 pm
TL;DR: Runtime controls are being used to detect supply chain abuse, anomalous workflow behaviour, and AI-assisted pipeline risks, according to StepSecurity. The strategic issue is not just visibility, but whether identity, privilege, and execution controls can keep pace with increasingly trusted build systems, as Harden-Runner now protects more than 8,000 repositories and monitors over 8 million CI/CD jobs weekly.
Editorial analysis by NHI Mgmt Group, based on content published by StepSecurity: “8,000 Strong: Harden-Runner's Growing Impact on CI/CD Security”.
By the numbers:
- StepSecurity says Harden-Runner now protects more than 8,000 open-source repositories.
Key questions
Q: What breaks when CI/CD pipelines are monitored only at configuration time?
A: Configuration-only monitoring misses the actual execution path, which is where secrets are read, commands are launched, and network traffic is generated.
Q: Why do CI/CD secrets create more risk than many teams expect?
A: CI/CD secrets often have broad blast radius because they can authenticate to source control, cloud platforms, package registries, and deployment systems.
Q: What are the signs that a pipeline workload has been tampered with?
A: Look for network calls to unfamiliar domains, process launches that do not match the job's normal profile, sudden reads of environment secrets, and tag or version changes that happen too quickly to reflect normal release discipline.
Practitioner guidance
- Instrument CI/CD jobs with runtime behaviour monitoring Track process execution, file access, network calls, and secret reads inside build jobs so deviations from normal workflow behaviour are visible in real time.
- Classify build runners as privileged non-human identities Assign ownership, scope, and review requirements to runners, actions, and bot tokens so their permissions are managed as part of identity governance.
- Alert on unusual secret access from trusted workflows Detect when a job touches credentials, environment variables, or service endpoints it has never used before, especially during package install or release steps.
Bottom line: CI/CD pipelines have become privileged execution environments, so runtime monitoring is now part of supply chain defence rather than an optional visibility feature.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:12 pm
CI/CD runtime monitoring is now a governance control, not a developer convenience. The article shows that build systems have become privileged execution environments with secrets, tokens, and release authority attached. That makes runtime observation a control-layer issue, not just an operational enhancement. For identity teams, the key shift is recognising runners and workflow identities as governed actors whose actions must be continuously verified.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should security teams govern AI agent spend in CI/CD pipelines?
A: They should treat spend governance as a request-level control problem, not a billing review problem. The gateway should tag every call with owner metadata, track cumulative cost by repo and team, and enforce thresholds with clear alert and fail-closed behaviour. That makes cost overruns actionable and ties accountability to the workload that caused them.
👉 Read our full editorial: CI/CD runtime monitoring is becoming essential for supply chain defense