Notifications
Clear all
Topic starter
20/08/2026 5:45 pm
TL;DR: Application security in DevOps now sits at the intersection of speed, secrets hygiene, and access control, with Cycode citing a cyber attack every 39 seconds, 82% of organisations hit by cloud misconfigurations, and 30% of 2025 breaches involving third parties. The security model has shifted from late-stage review to continuous governance across code, dependencies, infrastructure, and runtime.
NHIMG editorial — based on content published by Cycode: Application Security Best Practices To Secure Your DevOps Pipeline
By the numbers:
- On average, there is a cyber attack every 39 seconds against organizations.
- The average cost of data breaches in 2025 dropped to $4.44 million.
- 82% of organizations have experienced security incidents resulting from cloud misconfigurations.
Questions worth separating out
Q: How should security teams govern credentials used by CI/CD pipelines?
A: Security teams should treat CI/CD credentials as production-grade machine identities and apply least privilege, short lifetimes, and continuous monitoring.
Q: Why do exposed pipeline secrets create such fast compromise risk?
A: Because attackers do not need to break the application when a reusable credential already grants entry.
Q: What do teams get wrong about secret scanning in CI pipelines?
A: They often assume detection is enough, when the real problem is that a valid token can be used before the alert is triaged.
Practitioner guidance
- Inventory pipeline identities and secrets Map every CI/CD service account, token, certificate, and environment secret to an owner, purpose, expiry, and revocation path.
- Separate build, test, and deploy privileges Assign distinct non-human identities to each pipeline stage and remove cross-stage access where it is not required.
- Move secrets out of source and into runtime controls Prevent credentials from being committed to version control, inject secrets at runtime, and rotate them immediately after any exposure.
What's in the full article
Cycode's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance for embedding SAST, SCA, and container scanning into CI/CD gates.
- Implementation examples for secrets rotation, runtime injection, and version-control prevention controls.
- Expanded discussion of IaC scanning and policy controls for cloud provisioning drift.
- Workflow-oriented examples of how automated remediation and developer feedback are chained into delivery pipelines.
👉 Read Cycode's application security guidance for securing DevOps pipelines →
DevOps pipeline secrets exposure: what IAM teams need to know?
Explore further
20/08/2026 6:28 pm
Pipeline security is now an NHI governance problem, not just an AppSec problem. Modern DevOps environments concentrate authority in service accounts, deployment tokens, and automation identities that can outlive any single code change. That means the real question is not whether code is scanned, but whether the pipeline itself is governed as a privileged identity estate. Practitioners should manage pipeline credentials with the same discipline they apply to other non-human identities.
A question worth separating out:
Q: What should teams do when a CI/CD credential is exposed?
A: Revoke the token, validate the affected pipeline and artifact chain, and confirm whether the credential was used for deployment or build access. Then rotate any related secrets, review recent pipeline changes, and verify that protected environments and approvals still block unauthorized release activity.
👉 Read our full editorial: DevOps pipeline security needs stronger secrets and access controls
