Skip to content
RockPointCyber
← All pipelines

AI Application and Agent Delivery

Any CI/CD5 stages · 17 controls

What this design covers, and what it leaves

The same field every pipeline is drawn on. A reference design is a position taken on it, so the cells it does not fill are as much a part of the position as the ones it does — this one is deliberately deep in some streams and silent in others.

01Plan
02Code
03Build
04Test
05Release
06Deploy
07Operate
08Monitor
GOVDecide
11Governance and assurance at Plan: 0 targeted, 0 ignored, 11 still open of 11
Governance and assurance at Code: nothing, by the nature of the work
2Governance and assurance at Build: 0 targeted, 0 ignored, 2 still open of 2
Governance and assurance at Test: nothing, by the nature of the work
2Governance and assurance at Release: 0 targeted, 0 ignored, 2 still open of 2
1Governance and assurance at Deploy: 0 targeted, 0 ignored, 1 still open of 1
5Governance and assurance at Operate: 0 targeted, 0 ignored, 5 still open of 5
4Governance and assurance at Monitor: 0 targeted, 0 ignored, 4 still open of 4
SUPAdmit
4Open source and third-party supply at Plan: 1 targeted, 0 ignored, 3 still open of 4
11Open source and third-party supply at Code: 2 targeted, 0 ignored, 9 still open of 11
20Open source and third-party supply at Build: 5 targeted, 0 ignored, 15 still open of 20
2Open source and third-party supply at Test: 2 targeted, 0 ignored, 0 still open of 2
6Open source and third-party supply at Release: 1 targeted, 0 ignored, 5 still open of 6
1Open source and third-party supply at Deploy: 1 targeted, 0 ignored, 0 still open of 1
10Open source and third-party supply at Operate: 6 targeted, 0 ignored, 4 still open of 10
8Open source and third-party supply at Monitor: 1 targeted, 0 ignored, 7 still open of 8
DEVAuthor
8Design and development at Plan: 0 targeted, 0 ignored, 8 still open of 8
22Design and development at Code: 2 targeted, 0 ignored, 20 still open of 22
5Design and development at Build: 1 targeted, 0 ignored, 4 still open of 5
3Design and development at Test: 0 targeted, 0 ignored, 3 still open of 3
2Design and development at Release: 0 targeted, 0 ignored, 2 still open of 2
Design and development at Deploy: nothing, by the nature of the work
4Design and development at Operate: 0 targeted, 0 ignored, 4 still open of 4
3Design and development at Monitor: 0 targeted, 0 ignored, 3 still open of 3
DELProduce
2Build and delivery at Plan: 0 targeted, 0 ignored, 2 still open of 2
10Build and delivery at Code: 0 targeted, 0 ignored, 10 still open of 10
39Build and delivery at Build: 1 targeted, 0 ignored, 38 still open of 39
1Build and delivery at Test: 0 targeted, 0 ignored, 1 still open of 1
18Build and delivery at Release: 0 targeted, 0 ignored, 18 still open of 18
13Build and delivery at Deploy: 1 targeted, 0 ignored, 12 still open of 13
13Build and delivery at Operate: 0 targeted, 0 ignored, 13 still open of 13
4Build and delivery at Monitor: 0 targeted, 0 ignored, 4 still open of 4
VERProve
1Testing and validation at Plan: 0 targeted, 0 ignored, 1 still open of 1
2Testing and validation at Code: 0 targeted, 0 ignored, 2 still open of 2
Testing and validation at Build: nothing, by the nature of the work
10Testing and validation at Test: 0 targeted, 0 ignored, 10 still open of 10
Testing and validation at Release: nothing, by the nature of the work
1Testing and validation at Deploy: 1 targeted, 0 ignored, 0 still open of 1
9Testing and validation at Operate: 1 targeted, 0 ignored, 8 still open of 9
Testing and validation at Monitor: nothing, by the nature of the work
OPSRun
Runtime and platform at Plan: nothing, by the nature of the work
Runtime and platform at Code: nothing, by the nature of the work
1Runtime and platform at Build: 0 targeted, 0 ignored, 1 still open of 1
Runtime and platform at Test: nothing, by the nature of the work
Runtime and platform at Release: nothing, by the nature of the work
5Runtime and platform at Deploy: 0 targeted, 0 ignored, 5 still open of 5
35Runtime and platform at Operate: 0 targeted, 0 ignored, 35 still open of 35
2Runtime and platform at Monitor: 0 targeted, 0 ignored, 2 still open of 2
OBSWatch
3Detection and continuous observation at Plan: 0 targeted, 0 ignored, 3 still open of 3
1Detection and continuous observation at Code: 0 targeted, 0 ignored, 1 still open of 1
Detection and continuous observation at Build: nothing, by the nature of the work
1Detection and continuous observation at Test: 0 targeted, 0 ignored, 1 still open of 1
Detection and continuous observation at Release: nothing, by the nature of the work
Detection and continuous observation at Deploy: nothing, by the nature of the work
7Detection and continuous observation at Operate: 0 targeted, 0 ignored, 7 still open of 7
21Detection and continuous observation at Monitor: 0 targeted, 0 ignored, 21 still open of 21
Attacks
none modeled
none modeled
8 open
none modeled
none modeled
1 open
7 open
none modeled
GOV Governance and assurance
The stream that decides what blocks, and proves it blocked.
SUP Open source and third-party supply
Everything you did not write, arriving faster than you can review it.
DEV Design and development
Where the cost of a fix is lowest and the attention is shortest.
DEL Build and delivery
The machine that makes the thing, and the largest single target in the chain.
VER Testing and validation
The stream that finds out whether any of the others worked.
OPS Runtime and platform
The last place to stop something, and the most expensive.
OBS Detection and continuous observation
The only stream whose answer changes while nothing else does.

The figure is how many controls the field places in that cell and the wash behind it is how much of the cell you have decided — 26 targeted, 0 ignored, 307 still open, of 333. A ring means the cell is closed. Your 17 controls account for 26 of those, because a control that belongs at build and again at deploy is two decisions about where it runs rather than one. Ignoring a control counts as decided and leaves the denominator, so coverage measures what you said you would do rather than everything that exists.

The dashed rules are the two boundaries every pipeline has, whatever its platform: intake at build and release at release. Both default open — nothing is refused unless something was configured to refuse it.

The columns are drawn as a row here and as a loop elsewhere, and the same eight phases are the eight color groups a player walks around the DevSecOpoly board, in these same colors. The shape is a convenience. What is real is that each phase is a set of activities, and an activity is only worth doing because it enables a capability.

Stages and gates

Each control is a link to the products that provide it, and each of those opens its full profile. Blocking gates fail the build; advisory, monitor and manual ones do not.

This is a reference design, so no products are assigned to its stages. Each control links to the products that provide it, and where two or more of those carry evaluation scores you can compare them head to head.

  1. 01

    Model and dataset intake

    03Build

    4 controls · 3 blocking

  2. 02

    Application build

    03Build

    4 controls · 3 blocking

  3. 03

    AI security evaluation

    04Test

    2 controls · 1 blocking

  4. 04

    Agent and tool governance

    06Deploy

    3 controls · 3 blocking

  5. 05

    AI runtime protection

    07Operate

    4 controls · 3 blocking

Framework coverage

Controls these capabilities let you evidence. Partial is the normal case; the remainder is the work.

  • ASVS 5.0

    5 of 17

    OWASP Application Security Verification Standard (ASVS) 5.0.0

    V1 · V2 · V5 · V9 · V15

  • CI/CD Top 10

    3 of 10

    OWASP Top 10 CI/CD Security Risks

    CICD-SEC-2 · CICD-SEC-3 · CICD-SEC-6

  • S2C2F

    4 of 25

    OpenSSF Secure Supply Chain Consumption Framework (S2C2F)

    ING-3 · SCA-1 · SCA-2 · SCA-4

  • SSDF 1.1

    7 of 42

    NIST Secure Software Development Framework 1.1 (SP 800-218)

    PS.2.1 · PW.4.1 · PW.7.1 · RV.1.1 · PW.7.2 · RV.1.2 · PW.4.4

  • Scorecard

    2 of 20

    OpenSSF Scorecard Checks

    SAST · Vulnerabilities

Coverage by phase

  • Build

    3 countered · 8 open of 11

  • Test

    Not modeled

    No attack techniques are modeled against this phase yet. That is a gap in our model, not evidence the phase is safe.

  • Deploy

    0 countered · 1 open of 1

  • Operate

    6 countered · 7 open of 13

Attacks this pipeline faces

Techniques modeled against the phases this pipeline covers, ordered by how many documented real-world incidents used them.

  • Trusted Supplier Compromise

    Open12 real incidents

    Common · Operate

    Nothing in this pipeline counters it. The graph knows 5 capabilities that would: Commercial Software Binary Composition Analysis, Continuous Vendor Risk Monitoring, Nth-Party Dependency Mapping, SaaS & CI/CD Integration Governance, and others.

  • CI Runner Secret Exfiltration

    Open5 real incidents

    Common · Build

    Nothing in this pipeline counters it. The graph knows 4 capabilities that would: Build Egress Control & Network Monitoring, Pipeline Permission Minimization, Pipeline Runtime Anomaly Detection, Secrets Detection in CI Logs & Artifacts.

  • Exploitation of Known Vulnerable Component

    Countered5 real incidents

    Very Common · Operate

    Countered by Software Composition Analysis.

  • Leaked Secret Abuse

    Countered5 real incidents

    Very Common · Operate

    Countered by Workload Identity Federation.

  • Malicious Install-Time Script

    Countered5 real incidents

    Very Common · Build

    Countered by Malicious Package Detection.

  • Adversary-in-the-Middle MFA Phishing

    Open2 real incidents

    Very Common · Operate

    Nothing in this pipeline counters it. The graph knows 3 capabilities that would: Developer & Maintainer MFA Enforcement, Multi-Factor Authentication, Phishing & Business Email Compromise Protection.

  • Build Cache Poisoning

    Open2 real incidents

    Emerging · Build

    Nothing in this pipeline counters it. The graph knows 2 capabilities that would: Build Cache Poisoning Prevention, Untrusted Workflow Trigger Isolation.

  • Dependency Confusion

    Open2 real incidents

    Common · Build

    Nothing in this pipeline counters it. The graph knows 4 capabilities that would: Dependency Confusion Prevention, Dependency Curation & Allowlisting, Namespace & Package Name Reservation, Private Registry Proxy & Curation.

  • Mutable Tag Hijack of CI Actions and Images

    Open2 real incidents

    Common · Build

    Nothing in this pipeline counters it. The graph knows 7 capabilities that would: CI/CD Configuration Scanning, Curated Hardened Action Catalog, Image Digest Pinning Enforcement, Immutable Artifact Versioning, and others.

  • Pwn Request (Privileged Trigger Abuse)

    Open2 real incidents

    Common · Build

    Nothing in this pipeline counters it. The graph knows 1 capability that would: Untrusted Workflow Trigger Isolation.

  • Self-Propagating Package Worm

    Countered2 real incidents

    Emerging · Build

    Countered by Malicious Package Detection.

  • Workflow Script Injection

    Open2 real incidents

    Common · Build

    Nothing in this pipeline counters it. The graph knows 2 capabilities that would: CI/CD Configuration Scanning, Workflow Injection Detection.

13 further techniques with no documented incidents

Not in this comparison

Does not apply to this kind of pipeline
phases A reference pipeline has authored stages rather than a phase grouping.
gaps Gap analysis compares a stage's capabilities against the products that stage uses, and only a client pipeline records products in use. A reference pipeline models the design, not an estate.

How this was produced

Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 202 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.