Periodic Table
The software supply chain, laid out so position means something.
Twenty-five domains, 236 controls, laid out in the order the chain runs. Open one to see its controls arranged by the program maturity each demands, how much of the modeled threat it closes, and who actually sells it.
Table
← All 25 domains
08CI/CD Pipeline Security
11 of 14 shown
Could an attacker who controls a pull request, a third-party action or a mutable tag run code in our pipeline with access to secrets or publishing rights?
Attacks counteredlow to high
- Counters none2
- Counters 1–25
- Counters 3–54
- Counters 6+0
Level 2
4 here
Level 3
7 here
- Bec78Build Egress Control & Network Monitoring3 attacks countered
- Ccs79CI/CD Security Posture Management0 attacks countered
- Dep80Deployment Environment Protection2 attacks countered
- Eib81Ephemeral Isolated Build Runners3 attacks countered
- Sgo82Security Gate Orchestration0 attacks countered
- Uwt83Untrusted Workflow Trigger Isolation3 attacks countered
- Wcr84Workflow Change Review Enforcement2 attacks countered
How this was produced
Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 396 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.