ForEach-Object is a PowerShell cmdlet that processes items one at a time through the pipeline. It executes a script block for each incoming object, which makes it useful for transforming, filtering, or acting on streamed data without first storing every item in memory.
How ForEach-Object Works in a PowerShell Pipeline
ForEach-Object is a streaming cmdlet, so it handles each incoming object as soon as it reaches the pipeline instead of waiting for the full collection. That makes it a natural fit for line-by-line processing, object transformation, and per-item actions where memory efficiency and pipeline flow matter more than batch-style processing.
Because it operates on objects rather than raw text, the script block can use each item’s properties directly. In practice, that means the cmdlet is often used for selective formatting, calculated output, side effects such as logging or file writes, and other operations that depend on the current item rather than the whole dataset.
Pipeline Semantics and Script Block Execution
The cmdlet runs one script block for each object that arrives from upstream commands. Inside that block, the current pipeline object is available through the automatic $_ variable, which is why the construct is concise and expressive for item-wise logic.
PowerShell also distinguishes this pattern from the foreach language keyword, which iterates over an already materialised collection. ForEach-Object works within the pipeline itself, so it supports true streaming when the source command emits items progressively, such as from file reads, directory enumeration, or remote command output.
Where It Fits Best
This cmdlet is strongest when the task is naturally incremental: enriching each object with derived data, filtering by conditions that depend on each object’s properties, or triggering an action for each result as it arrives. That makes it useful in administrative automation, log processing, and data shaping tasks where a pipeline-friendly approach keeps scripts simple.
Its design also encourages composition with other PowerShell cmdlets. Upstream commands can select, sort, or fetch data, while ForEach-Object applies the per-item logic in the middle of the pipeline before the results continue downstream.
Performance, State, and Common Pitfalls
The main advantage is that it avoids forcing the entire input set into memory before work begins. The main trade-off is that any logic placed inside the script block runs once per object, so expensive operations can become slow when the input is large. If the work depends on shared state, that state must be managed carefully because the script block is evaluated repeatedly rather than all at once.
A common misunderstanding is expecting ForEach-Object to behave like a batch iterator over a fixed list. In reality, it is a pipeline operator, so ordering, object shape, and upstream/downstream behaviour all affect the outcome. That is why it is most predictable when each object can be handled independently.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8, NIST CSF 2.0 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | CM-8 — System Component Inventory | Streaming pipeline commands depend on knowing what components and scripts are in use. |
| Recommendation — Inventory PowerShell automation paths so you can govern script execution and data-handling exposure. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Per-item pipeline actions often generate or consume operational logs that need visibility and retention. |
| Recommendation — Log automation activity so each pipeline action can be reviewed and investigated when needed. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Command-line automation should be observable for unexpected or unsafe execution patterns. |
| Recommendation — Monitor automation execution for anomalous script behavior and unexpected command activity. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | The cmdlet is commonly used in scripting patterns where per-item processing and state handling affect robustness. |
| Recommendation — Use secure scripting patterns that keep per-item logic simple, predictable, and testable. | ||
| ISO/IEC 27001:2022 | A.8.9 — Configuration Management | PowerShell pipeline usage is part of operational configuration that should be controlled and reviewed. |
| Recommendation — Control script and automation changes so pipeline behavior stays intentional and approved. | ||
Related resources from NHI Mgmt Group
- What is the difference between ForEach and ForEach-Object in PowerShell automation?
- What is the difference between scope-based authorization and object-level authorization in MCP?
- What breaks when AI output is allowed to drive object deserialization?
- What breaks when asset systems record approval but not the approved object?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org