Join our Newsletter — 33% off our NHI Course
Cyber Security

dbt

← Back to Glossary
By NHI Mgmt Group Updated October 29, 2026 Domain: Cyber Security

dbt is a data transformation tool used in analytics engineering to build, test and document SQL-based data models inside a warehouse. It organises transformation logic into modular models, with dependency tracking, tests and version-controlled code for repeatable pipelines.

What dbt does in a modern analytics stack

dbt is best understood as the transformation layer between raw warehouse data and analysis-ready models. It lets teams express business logic in SQL, break that logic into reusable models, and manage dependencies so transformations run in a predictable order.

That design matters because analytics engineering is not just about writing queries, it is about making data logic maintainable. dbt turns transformation work into code that can be versioned, reviewed, tested and documented like other software assets, which reduces the drift that often appears when analysts maintain one-off SQL in notebooks or dashboards.

How dbt structures transformation work

The core dbt workflow centres on models, tests and dependency management. Models are usually SQL files that describe how one table or view should be built from upstream inputs. dbt then resolves those relationships, generates execution order and materialises the output in the warehouse.

This structure is useful because it separates business logic from ad hoc query execution. Instead of repeatedly copy-pasting SQL, teams define one source of truth for each transformation step. That makes changes easier to review and helps preserve consistency across downstream reporting, metric layers and data products.

Testing, documentation and repeatability

dbt is also a quality-control tool, not just a modelling tool. Built-in tests let teams check assumptions such as uniqueness, non-null values and referential integrity, while documentation makes models easier to understand, trace and onboard.

Repeatability is one of dbt’s most important advantages. Because models live in version-controlled code, the transformation pipeline can be reproduced, compared across environments and audited over time. That makes dbt especially valuable in organisations that need disciplined change management around data logic, not just faster SQL authoring.

Where dbt fits, and where it stops

dbt sits inside the warehouse-centric analytics stack, so it is strongest when the problem is transformation, lineage and modelling. It does not replace the warehouse, ingestion layer, orchestration platform or business intelligence tool, it coordinates the logic that connects them.

That boundary is important for practitioners. dbt improves the reliability of transformation code, but it still depends on sound upstream data contracts, appropriate warehouse permissions and sensible deployment discipline. Teams get the most value when dbt is treated as part of a governed analytics engineering workflow rather than as a standalone query runner.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP SAMM, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

FrameworkControl / ReferenceRelevance
OWASP SAMMSoftware Assurance Maturity Modeldbt is a code-based transformation practice that benefits from mature build, review and testing discipline.
Recommendation — Apply SAMM practices to standardise review, testing and change control for dbt transformation code.
NIST SP 800-53 Rev 5CM-2 — Baseline Configurationdbt pipelines rely on controlled, repeatable model definitions and deployment settings.
AU-2 — Audit Eventsdbt’s run history and test outcomes support auditable transformation activity and traceability.
Recommendation — Baseline dbt project and warehouse settings so transformation behaviour stays consistent across environments. Log dbt runs and test results so changes to warehouse models are traceable and reviewable.
CIS Controls v8CIS-16 — Application Software Securitydbt is software that defines production data logic and should be developed and reviewed securely.
Recommendation — Treat dbt project changes as software changes and review them before promoting to production.
ISO/IEC 27001:2022A.8.9 — Configuration managementdbt model files and environment settings are configuration assets that need controlled change.
Recommendation — Control dbt project and deployment configuration through approved change management.

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org