Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Source code management (SCM) and CI/CD pipelines have become the industry standard for automating software delivery. But from the time a code change enters your SCM until it’s deployed, it’s susceptible to changes and reconfigurations that can go so far as to modify the pipeline itself. If you’re not proactively securing your CI/CD system, attackers can use it to grant themselves permissions, access secrets, and ship malicious code.

In Part 1 of this series, we discussed the CI/CD security boundary, mapped out potential attack vectors with a CI/CD threat matrix, and introduced a simple threat model focused on ideating detection workflows. In this post, we’ll apply these principles to a real-world source code management (SCM) tool example that every developer is familiar with: GitHub. In addition to threat modeling, we’ll also be taking a closer look at historical attacks on GitHub and GitHub Actions ecosystems.

AI-assisted development helps teams write code faster, but that speed comes with added security risk. As agents generate more code, they can introduce vulnerabilities, insecure dependencies, or exposed secrets, often before a human reviewer ever sees the change. Security teams are left reviewing more code with the same resources, which makes it harder to catch issues early.

Security teams face a threat landscape shaped by AI-driven attacks and identity misuse. Adversaries increasingly rely on compromised identities to blend in as legitimate users, making attacks harder to detect and slower to contain. On average, organizations take 241 days to identify and contain a breach.1 While threats have evolved, legacy SIEMs have not kept pace.

Proactively addressing risks in technical environments is a constant challenge. Many teams wait until it’s too late and key application functionality is disrupted or sensitive data is exposed. However, understanding risk severity in context can be difficult, especially in distributed systems where related issues and impacts may not be immediately obvious.

For many organizations, ServiceNow operates as the system of record for governance, auditability, and compliance. But when incidents occur, engineers often need to consult external tools to identify and resolve the root cause. When investigations are siloed from the system of record, engineers must return to ServiceNow to manually update work notes, incident statuses, and mandatory resolution fields before closing tickets.

Organizations adopt multi-cloud architectures for many reasons, including compliance requirements, business strategy, and resiliency. Regardless of the cloud provider, the security challenges remain the same: Identify the most critical risks, prioritize them with business context, and remediate them before they are exploited by a bad actor.

Amazon Machine Images (AMIs) are templates for launching and scaling Amazon Elastic Compute Cloud (EC2) instances. Because Amazon EC2 AMIs are reused across environments and automation pipelines, decisions about how you build, source, manage, and share them directly affect your cloud attack surface.

Security teams are responsible for finding and remediating vulnerable dependencies within applications that are built from large ecosystems of frameworks, SDKs, and utilities. What makes this task especially challenging is that these dependencies can pull in dozens or even hundreds of transitive dependencies through complex dependency chains. Even when scanners identify what’s vulnerable, teams still often lack the information they need about the dependency chain to safely address the issue.

Security teams are frequently asked to provide clear, time-bounded evidence of their organization’s security posture. Whether the request comes from external auditors validating SOC 2, ISO 27001, PCI DSS, or internal governance reviews, they typically require collecting vulnerability data from multiple tools, reconciling resource lists, and manually generating spreadsheets for auditors. This process is slow, error-prone, and difficult to repeat consistently.