Topic starter
09/07/2026 1:40 pm
TL;DR: Attackers are increasingly reaching production through upstream dependencies, CI/CD pipelines, and compromised credentials, with compromises propagating automatically across many organisations and exploiting secret leakage in minutes, according to Orca Security. The practical shift is clear: pipeline security now depends on continuous iteration, identity control, and machine-speed response, not periodic review.
Editorial analysis by NHI Mgmt Group, based on content published by Orca Security: “Webinar Recap: Beyond the Perimeter: Mastering 3rd Party & Software Risk”.
Key questions
Q: What breaks when CI/CD pipelines are treated as non-production systems?
A: Teams miss that pipelines can authenticate, sign, deploy, and propagate trust into production.
Q: Why do CI/CD systems increase the impact of compromised credentials?
A: CI/CD systems often hold powerful secrets that can unlock source code, deployment pipelines, cloud environments, and internal services.
Q: What signs show that pipeline identity controls are failing?
A: Look for shared service roles, long-lived tokens, secrets stored outside a managed vault, and runner behaviour that does not match the declared build task.
Practitioner guidance
- Define the pipeline as production perimeter Map repositories, build runners, actions, package sources, and deployment jobs into one governed trust boundary with named owners.
- Inventory and scope every CI/CD credential Catalogue tokens, auth keys, service roles, and machine identities, then record which systems each can reach and whether the scope is still necessary.
- Shorten credential lifetime and narrow blast radius Replace broad, persistent pipeline access with task-scoped permissions and remove any shared role pattern that can reach thousands of workloads.
Bottom line: The article frames upstream delivery systems as an enterprise trust boundary because attackers can reach production by compromising dependencies, runners, and automation credentials.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 1:43 pm
Upstream CI/CD risk is now a trust-governance problem, not just a tooling problem. Once the delivery pipeline becomes part of the production perimeter, security teams have to govern what enters the build path, who can alter it, and how quickly trust can be withdrawn. The old split between software supply chain risk and identity governance no longer holds. Practitioners should model the pipeline as an access system with its own policy and blast-radius controls.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should security teams prioritise pipeline identity controls over more vulnerability scanning?
A: They should treat them as complementary, but pipeline identity controls usually deliver faster risk reduction because many recent compromises succeed through legitimate credentials rather than pure software flaws. Scanning still matters, but it does not stop an attacker who already has a valid token or service role.
👉 Read our full editorial: Upstream CI/CD risk is now the real perimeter for enterprises