Compose a pipeline
Pick the domains you are responsible for. Every control the graph holds for them is placed into the lifecycle phase where it belongs, with the frameworks it evidences and the attacks it stops.
Domains
- Static Code Analysis20
- Dependency Management×
- Container Security24
- Exposure & Vulnerability Management15
- Endpoint Protection6
- Secrets & Identity Security24
- Build Integrity & Cryptographic Trust×
- CI/CD Pipeline Security10
- Runtime Application Validation25
- Runtime & Kubernetes Protection24
- AI Model & Agent Security16
- Identity & Access Management16
- Cloud Security Posture14
- Package Registry & Provenance Security13
- API Security12
- Detection & Response12
- SBOM & Component Visibility12
- Vendor Governance12
- Infrastructure-as-Code Security11
- Developer Security & Secure Coding10
- Secure Design & Threat Modeling10
- Governance, Risk & Compliance8
- Source Control Security8
- Data Protection×
- Email & Collaboration Security1
Maturity ceiling
Controls carry the maturity level a program needs to run them. Raising the ceiling adds depth and volume; level 3 is a realistic target for most teams.
- GOV Governance and assurance
- The stream that decides what blocks, and proves it blocked.
- SUP Open source and third-party supply
- Everything you did not write, arriving faster than you can review it.
- DEV Design and development
- Where the cost of a fix is lowest and the attention is shortest.
- DEL Build and delivery
- The machine that makes the thing, and the largest single target in the chain.
- VER Testing and validation
- The stream that finds out whether any of the others worked.
- OPS Runtime and platform
- The last place to stop something, and the most expensive.
- OBS Detection and continuous observation
- The only stream whose answer changes while nothing else does.
The figure is how many controls the field places in that cell and the wash behind it is how much of the cell you have decided — 55 targeted, 0 ignored, 278 still open, of 333. A ring means the cell is closed. Your 34 controls account for 55 of those, because a control that belongs at build and again at deploy is two decisions about where it runs rather than one. Ignoring a control counts as decided and leaves the denominator, so coverage measures what you said you would do rather than everything that exists.
The dashed rules are the two boundaries every pipeline has, whatever its platform: intake at build and release at release. Both default open — nothing is refused unless something was configured to refuse it.
The columns are drawn as a row here and as a loop elsewhere, and the same eight phases are the eight color groups a player walks around the DevSecOpoly board, in these same colors. The shape is a convenience. What is real is that each phase is a set of activities, and an activity is only worth doing because it enables a capability.
34 capabilities appear 55 times, because a control can belong at more than one point in the lifecycle. Digest verification, for instance, is enforced at build and checked again at deploy — the same capability doing a different job.
- 01
Plan
2 capabilities
- 02
Code
11 capabilities
- Automated Dependency UpdatesDEPS · level 2 · 8 controlsList only1 scored of 3
- Dependency Pinning & Lockfile Integrity VerificationDEPS · level 2 · counters 2 · 4 controlsNo product
- Hallucinated Package DetectionDEPS · level 3 · counters 2 · 3 controlsOne product1 scored of 1
- Install Script Execution RestrictionDEPS · level 3 · counters 3 · 3 controlsNo product
- Malicious Package DetectionDEPS · level 2 · counters 6 · 8 controlsCompare3 scored of 14
- Minimum Release Age EnforcementDEPS · level 3 · counters 3 · 2 controlsList only1 scored of 5
- Open Source License ComplianceDEPS · level 1 · table stakes · 2 controlsCompare3 scored of 12
- Open Source Project Health ScoringDEPS · level 2 · counters 1 · 4 controlsList only1 scored of 4
- Private Fix Backporting & Upstream ContributionDEPS · level 5 · 2 controlsCompare2 scored of 5
- Software Composition AnalysisDEPS · level 1 · table stakes · counters 2 · 15 controlsCompare7 scored of 23
- Typosquatting DetectionDEPS · level 2 · counters 2 · 3 controlsList only1 scored of 3
- 03
Build
23 capabilities
- Dependency Confusion PreventionDEPS · level 2 · counters 1 · 4 controlsList only3 products
- Dependency Curation & AllowlistingDEPS · level 3 · counters 3 · 4 controlsList only1 scored of 5
- Dependency Pinning & Lockfile Integrity VerificationDEPS · level 2 · counters 2 · 4 controlsNo product
- End-of-Life Component DetectionDEPS · level 2 · 3 controlsOne product1 product
- Install Script & Package Behavior AnalysisDEPS · level 3 · counters 3 · 3 controlsList only1 scored of 2
- Install Script Execution RestrictionDEPS · level 3 · counters 3 · 3 controlsNo product
- Maintainer & Publisher Risk AnalysisDEPS · level 3 · counters 3 · 2 controlsList only1 scored of 2
- Malicious Package DetectionDEPS · level 2 · counters 6 · 8 controlsCompare3 scored of 14
- Minimum Release Age EnforcementDEPS · level 3 · counters 3 · 2 controlsList only1 scored of 5
- Reachability AnalysisDEPS · level 3 · 3 controlsCompare4 scored of 8
- Rebuilt-from-Source Dependency ProvisioningDEPS · level 5 · counters 4 · 4 controlsCompare2 scored of 6
- Software Composition AnalysisDEPS · level 1 · table stakes · counters 2 · 15 controlsCompare7 scored of 23
- Transitive Dependency ResolutionDEPS · level 2 · 3 controlsCompare2 scored of 4
- Artifact Chain-of-Custody TracingBUILD · level 4 · 3 controlsList only4 products
- Artifact Digest Integrity VerificationBUILD · level 2 · counters 2 · 3 controlsNo product
- Artifact SigningBUILD · level 2 · counters 3 · 6 controlsCompare3 scored of 11
- Build Provenance AttestationBUILD · level 3 · counters 4 · 7 controlsCompare3 scored of 15
- Code Signing Key ManagementBUILD · level 3 · counters 1 · 3 controlsList only8 products
- Hermetic Build EnforcementBUILD · level 5 · counters 2 · 2 controlsList only2 products
- Keyless Signing with Transparency LogBUILD · level 3 · counters 2 · 3 controlsList only1 scored of 8
- Reproducible Build VerificationBUILD · level 5 · counters 2 · 2 controlsList only5 products
- Signature VerificationBUILD · level 3 · counters 4 · 6 controlsList only1 scored of 5
- Supply Chain Layout VerificationBUILD · level 5 · counters 3 · 2 controlsOne product1 product
- 05
Release
9 capabilities
- Open Source License ComplianceDEPS · level 1 · table stakes · 2 controlsCompare3 scored of 12
- Artifact Chain-of-Custody TracingBUILD · level 4 · 3 controlsList only4 products
- Artifact SigningBUILD · level 2 · counters 3 · 6 controlsCompare3 scored of 11
- Attestation Policy EvaluationBUILD · level 4 · counters 2 · 3 controlsList only6 products
- Binary-to-Source VerificationBUILD · level 5 · counters 3 · 3 controlsList only2 products
- Code Signing Key ManagementBUILD · level 3 · counters 1 · 3 controlsList only8 products
- Keyless Signing with Transparency LogBUILD · level 3 · counters 2 · 3 controlsList only1 scored of 8
- Reproducible Build VerificationBUILD · level 5 · counters 2 · 2 controlsList only5 products
- Supply Chain Layout VerificationBUILD · level 5 · counters 3 · 2 controlsOne product1 product
- 06
Deploy
4 capabilities
- Artifact Chain-of-Custody TracingBUILD · level 4 · 3 controlsList only4 products
- Artifact Digest Integrity VerificationBUILD · level 2 · counters 2 · 3 controlsNo product
- Attestation Policy EvaluationBUILD · level 4 · counters 2 · 3 controlsList only6 products
- Signature VerificationBUILD · level 3 · counters 4 · 6 controlsList only1 scored of 5
- 07
Operate
3 capabilities
- 08
Monitor
3 capabilities
Framework coverage
What this selection alone would let you evidence.
ASVS 5.0
3 of 17
OWASP Application Security Verification Standard (ASVS) 5.0.0
V11 · V14 · V15
CI/CD Top 10
3 of 10
OWASP Top 10 CI/CD Security Risks
CICD-SEC-3 · CICD-SEC-5 · CICD-SEC-9
S2C2F
19 of 25
OpenSSF Secure Supply Chain Consumption Framework (S2C2F)
AUD-1 · AUD-3 · ENF-1 · ENF-2 · FIX-1 · ING-3 · ING-4 · INV-1 · REB-1 · REB-2 · REB-3 · SCA-1 · +7 more
SLSA 1.2
7 of 16
Supply-chain Levels for Software Artifacts (SLSA) 1.2
Build L1 — Provenance generated and distributed · Build L2 — Consumer validates provenance · Build L2 — Signed provenance · Build L3 — Run isolation · Build L3 — Signing secrets isolated · Source L3 — Enforced technical controls · Verification — Verification Summary Attestation
SSDF 1.1
9 of 42
NIST Secure Software Development Framework 1.1 (SP 800-218)
PS.1.1 · PS.2.1 · PW.4.1 · PW.6.1 · RV.1.1 · RV.2.1 · PS.3.2 · RV.2.2 · PW.4.4
Scorecard
7 of 20
OpenSSF Scorecard Checks
Contributors · Dependency-Update-Tool · License · Maintained · Pinned-Dependencies · Signed-Releases · Vulnerabilities
Coverage by phase
Plan
Not modeledNo attack techniques are modeled against this phase yet. That is a gap in our model, not evidence the phase is safe.
Code
2 countered · 2 open of 4
Build
3 countered · 8 open of 11
Release
4 countered · 0 open of 4
Deploy
1 countered · 0 open of 1
Operate
1 countered · 12 open of 13
Monitor
Not modeledNo attack techniques are modeled against this phase yet. That is a gap in our model, not evidence the phase is safe.
What this selection leaves open
Trusted Supplier Compromise
Open12 real incidentsCommon · Operate
Nothing in this pipeline counters it. The graph knows 5 capabilities that would: Commercial Software Binary Composition Analysis, Continuous Vendor Risk Monitoring, Nth-Party Dependency Mapping, SaaS & CI/CD Integration Governance, and others.
Maintainer Account Takeover
Countered10 real incidentsCommon · Release
Countered by Maintainer & Publisher Risk Analysis, Malicious Package Detection, Minimum Release Age Enforcement.
Stolen Publishing Token
Countered9 real incidentsCommon · Release
Countered by Rebuilt-from-Source Dependency Provisioning.
Artifact Tampering After Build
Countered7 real incidentsCommon · Release
Countered by Artifact Digest Integrity Verification, Artifact Signing, Build Provenance Attestation, Dependency Pinning & Lockfile Integrity Verification, Keyless Signing with Transparency Log, Signature Verification.
CI Runner Secret Exfiltration
Open5 real incidentsCommon · Build
Nothing in this pipeline counters it. The graph knows 4 capabilities that would: Build Egress Control & Network Monitoring, Pipeline Permission Minimization, Pipeline Runtime Anomaly Detection, Secrets Detection in CI Logs & Artifacts.
Exploitation of Known Vulnerable Component
Countered5 real incidentsVery Common · Operate
Countered by Software Composition Analysis.
Leaked Secret Abuse
Open5 real incidentsVery Common · Operate
Nothing in this pipeline counters it. The graph knows 5 capabilities that would: Dynamic Short-Lived Credentials, Leaked Credential Validation & Revocation, Secret Push Protection, Secrets Detection in Source Code, and others.
Malicious Install-Time Script
Countered5 real incidentsVery Common · Build
Countered by Install Script & Package Behavior Analysis, Install Script Execution Restriction, Malicious Package Detection.
Abandoned Package or Domain Takeover
Countered2 real incidentsCommon · Release
Countered by Maintainer & Publisher Risk Analysis, Open Source Project Health Scoring.
Adversary-in-the-Middle MFA Phishing
Open2 real incidentsVery Common · Operate
Nothing in this pipeline counters it. The graph knows 3 capabilities that would: Developer & Maintainer MFA Enforcement, Multi-Factor Authentication, Phishing & Business Email Compromise Protection.
Build Cache Poisoning
Open2 real incidentsEmerging · Build
Nothing in this pipeline counters it. The graph knows 2 capabilities that would: Build Cache Poisoning Prevention, Untrusted Workflow Trigger Isolation.
Dependency Confusion
Countered2 real incidentsCommon · Build
Countered by Dependency Confusion Prevention, Dependency Curation & Allowlisting.
21 further techniques with no documented incidents
Not in this comparison
- Does not apply to this kind of pipeline
- stages A composed pipeline has no authored stages; its capabilities are grouped by lifecycle phase.
- gaps Gap analysis compares a stage's capabilities against the products that stage uses, and only a client pipeline records products in use. A composed pipeline models the design, not an estate.
How this was produced
Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 306 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.