Compose a pipeline

Pick the domains you are responsible for. Every control the graph holds for them is placed into the lifecycle phase where it belongs, with the frameworks it evidences and the attacks it stops.

Domains

Maturity ceiling

Controls carry the maturity level a program needs to run them. Raising the ceiling adds depth and volume; level 3 is a realistic target for most teams.

15 controls7 of 8 lifecycle phases · level 3 and below

GOVDecide

SUPAdmit

DEVAuthor

DELProduce

VERProve

OPSRun

OBSWatch

Attacks

none modeled

2 open

9 open

none modeled

1 open

1 held

11 open

none modeled

GOV Governance and assurance: The stream that decides what blocks, and proves it blocked.
SUP Open source and third-party supply: Everything you did not write, arriving faster than you can review it.
DEV Design and development: Where the cost of a fix is lowest and the attention is shortest.
DEL Build and delivery: The machine that makes the thing, and the largest single target in the chain.
VER Testing and validation: The stream that finds out whether any of the others worked.
OPS Runtime and platform: The last place to stop something, and the most expensive.
OBS Detection and continuous observation: The only stream whose answer changes while nothing else does.

The figure is how many controls the field places in that cell and the wash behind it is how much of the cell you have decided — 19 targeted, 0 ignored, 314 still open, of 333. A ring means the cell is closed. Your 15 controls account for 19 of those, because a control that belongs at build and again at deploy is two decisions about where it runs rather than one. Ignoring a control counts as decided and leaves the denominator, so coverage measures what you said you would do rather than everything that exists.

The dashed rules are the two boundaries every pipeline has, whatever its platform: intake at build and release at release. Both default open — nothing is refused unless something was configured to refuse it.

The columns are drawn as a row here and as a loop elsewhere, and the same eight phases are the eight color groups a player walks around the DevSecOpoly board, in these same colors. The shape is a convenience. What is real is that each phase is a set of activities, and an activity is only worth doing because it enables a capability.

15 capabilities appear 19 times, because a control can belong at more than one point in the lifecycle. Digest verification, for instance, is enforced at build and checked again at deploy — the same capability doing a different job.

Framework coverage

What this selection alone would let you evidence.

CI/CD Top 10
8 of 10
OWASP Top 10 CI/CD Security Risks
CICD-SEC-1 · CICD-SEC-10 · CICD-SEC-2 · CICD-SEC-3 · CICD-SEC-6 · CICD-SEC-7 · CICD-SEC-8 · CICD-SEC-9
S2C2F
6 of 25
OpenSSF Secure Supply Chain Consumption Framework (S2C2F)
AUD-2 · ENF-1 · ENF-2 · ING-2 · ING-3 · UPD-3
SLSA 1.2
5 of 16
Supply-chain Levels for Software Artifacts (SLSA) 1.2
Build L2 — Hosted build platform · Source L2 — Continuous immutable history · Source L2 — Source provenance attestations · Source L3 — Enforced technical controls · Source L4 — Two-party review
SSDF 1.1
5 of 42
NIST Secure Software Development Framework 1.1 (SP 800-218)
PS.1.1 · PS.2.1 · PS.3.1 · PW.4.1 · PW.7.1
Scorecard
4 of 20
OpenSSF Scorecard Checks
Branch-Protection · Code-Review · Security-Policy · Webhooks

Coverage by phase

Plan
Not modeled
No attack techniques are modeled against this phase yet. That is a gap in our model, not evidence the phase is safe.
Code
2 countered · 2 open of 4
Build
2 countered · 9 open of 11
Release
3 countered · 1 open of 4
Deploy
1 countered · 0 open of 1
Operate
2 countered · 11 open of 13
Monitor
Not modeled
No attack techniques are modeled against this phase yet. That is a gap in our model, not evidence the phase is safe.

What this selection leaves open

Trusted Supplier Compromise
Open12 real incidents
Common · Operate
Nothing in this pipeline counters it. The graph knows 5 capabilities that would: Commercial Software Binary Composition Analysis, Continuous Vendor Risk Monitoring, Nth-Party Dependency Mapping, SaaS & CI/CD Integration Governance, and others.
Maintainer Account Takeover
Countered10 real incidents
Common · Release
Countered by Developer & Maintainer MFA Enforcement, Trusted Publishing.
Stolen Publishing Token
Countered9 real incidents
Common · Release
Countered by Trusted Publishing.
Artifact Tampering After Build
Countered7 real incidents
Common · Release
Countered by Immutable Artifact Versioning.
CI Runner Secret Exfiltration
Open5 real incidents
Common · Build
Nothing in this pipeline counters it. The graph knows 4 capabilities that would: Build Egress Control & Network Monitoring, Pipeline Permission Minimization, Pipeline Runtime Anomaly Detection, Secrets Detection in CI Logs & Artifacts.
Exploitation of Known Vulnerable Component
Open5 real incidents
Very Common · Operate
Nothing in this pipeline counters it. The graph knows 7 capabilities that would: Container Image Vulnerability Scanning, Coverage-Guided Fuzzing, Minimal Hardened Base Images, Risk-Based Vulnerability Prioritization, and others.
Leaked Secret Abuse
Open5 real incidents
Very Common · Operate
Nothing in this pipeline counters it. The graph knows 5 capabilities that would: Dynamic Short-Lived Credentials, Leaked Credential Validation & Revocation, Secret Push Protection, Secrets Detection in Source Code, and others.
Malicious Install-Time Script
Open5 real incidents
Very Common · Build
Nothing in this pipeline counters it. The graph knows 3 capabilities that would: Install Script & Package Behavior Analysis, Install Script Execution Restriction, Malicious Package Detection.
Abandoned Package or Domain Takeover
Open2 real incidents
Common · Release
Nothing in this pipeline counters it. The graph knows 2 capabilities that would: Maintainer & Publisher Risk Analysis, Open Source Project Health Scoring.
Adversary-in-the-Middle MFA Phishing
Countered2 real incidents
Very Common · Operate
Countered by Developer & Maintainer MFA Enforcement.
Build Cache Poisoning
Open2 real incidents
Emerging · Build
Nothing in this pipeline counters it. The graph knows 2 capabilities that would: Build Cache Poisoning Prevention, Untrusted Workflow Trigger Isolation.
Dependency Confusion
Countered2 real incidents
Common · Build
Countered by Namespace & Package Name Reservation, Private Registry Proxy & Curation.

21 further techniques with no documented incidents

Not in this comparison

Does not apply to this kind of pipeline: stages A composed pipeline has no authored stages; its capabilities are grouped by lifecycle phase.; gaps Gap analysis compares a stage's capabilities against the products that stage uses, and only a client pipeline records products in use. A composed pipeline models the design, not an estate.

How this was produced

Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 374 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.

Compose a pipeline

Domains

Maturity ceiling

Plan

Code

Build

Release

Deploy

Operate

Monitor

Framework coverage

CI/CD Top 10

S2C2F

SLSA 1.2

SSDF 1.1

Scorecard

Coverage by phase

Plan

Code

Build

Release

Deploy

Operate

Monitor

What this selection leaves open

Trusted Supplier Compromise

Maintainer Account Takeover

Stolen Publishing Token

Artifact Tampering After Build

CI Runner Secret Exfiltration

Exploitation of Known Vulnerable Component

Leaked Secret Abuse

Malicious Install-Time Script

Abandoned Package or Domain Takeover

Adversary-in-the-Middle MFA Phishing

Build Cache Poisoning

Dependency Confusion