Topic starter
24/06/2026 7:15 pm
TL;DR: Partial automation is leaving release integrity uneven, with DigiCert’s State of Software Supply Chain Security 2026 report finding only 13% fully automate code signing and only 13% fully automate security checks across all projects. When policy is manual at release velocity, attackers only need the easiest pipeline, not every pipeline.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “How to close the CI/CD enforcement gap before it ships”.
By the numbers:
- Only 13% fully automate code signing, according to DigiCert.
- Only 13% fully automate security checks across all projects, according to DigiCert.
- 71% of organizations say security checks are only partially automated or ad hoc, according to DigiCert.
Key questions
Q: What breaks when CI/CD access is not tightly governed?
A: Build and deployment systems become an easy path to bypass application defenses.
Q: Why does manual release enforcement increase supply chain risk?
A: Manual enforcement depends on timing, attention, and consistent human follow-through, all of which deteriorate when teams release quickly or operate across many pipelines.
Q: How do teams know whether release integrity controls are actually working?
A: They should look for consistent automated coverage across signing, security checks, SBOM generation, and image signing, not just policy documents.
Practitioner guidance
- Define mandatory pipeline-enforced controls Classify code signing, security checks, SBOM generation, and image signing as non-optional release gates rather than discretionary build steps.
- Make signing a hard release gate Require every releasable artifact to pass automated code signing before promotion, with no manual bypass path for routine delivery.
- Protect signing keys in managed systems Store signing material in HSMs or managed key services and restrict human access to the smallest possible operating set.
Bottom line: Partial automation is not a halfway point to maturity when release integrity depends on the same control behaving differently across pipelines.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:28 am
Release integrity now fails at the enforcement layer, not the policy layer: this article shows that many organisations already know what should happen, but their pipelines do not make it happen consistently. The governance problem is not a lack of standards. It is that integrity controls still rely on human execution in places where release velocity eliminates the chance for reliable manual enforcement. Practitioners should treat consistency as the real maturity test.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should security teams prioritise signing before other CI/CD improvements?
A: Yes, when release integrity is the immediate concern, signing is the best anchor control because it establishes provenance and creates a clear release gate. Other controls still matter, but signing gives the programme a point where trust can be proven rather than assumed. Without that gate, surrounding controls are harder to defend.
👉 Read our full editorial: Closing the CI/CD enforcement gap before release integrity breaks