Compose a pipeline
Pick the domains you are responsible for. Every control the graph holds for them is placed into the lifecycle phase where it belongs, with the frameworks it evidences and the attacks it stops.
Domains
- Static Code Analysis20
- Dependency Management24
- Container Security24
- Exposure & Vulnerability Management×
- Endpoint Protection6
- Secrets & Identity Security24
- Build Integrity & Cryptographic Trust19
- CI/CD Pipeline Security10
- Runtime Application Validation25
- Runtime & Kubernetes Protection24
- AI Model & Agent Security16
- Identity & Access Management16
- Cloud Security Posture14
- Package Registry & Provenance Security13
- API Security12
- Detection & Response×
- SBOM & Component Visibility12
- Vendor Governance12
- Infrastructure-as-Code Security11
- Developer Security & Secure Coding10
- Secure Design & Threat Modeling10
- Governance, Risk & Compliance8
- Source Control Security8
- Data Protection×
- Email & Collaboration Security1
Maturity ceiling
Controls carry the maturity level a program needs to run them. Raising the ceiling adds depth and volume; level 3 is a realistic target for most teams.
- GOV Governance and assurance
- The stream that decides what blocks, and proves it blocked.
- SUP Open source and third-party supply
- Everything you did not write, arriving faster than you can review it.
- DEV Design and development
- Where the cost of a fix is lowest and the attention is shortest.
- DEL Build and delivery
- The machine that makes the thing, and the largest single target in the chain.
- VER Testing and validation
- The stream that finds out whether any of the others worked.
- OPS Runtime and platform
- The last place to stop something, and the most expensive.
- OBS Detection and continuous observation
- The only stream whose answer changes while nothing else does.
The figure is how many controls the field places in that cell and the wash behind it is how much of the cell you have decided — 36 targeted, 0 ignored, 297 still open, of 333. A ring means the cell is closed. Your 32 controls account for 36 of those, because a control that belongs at build and again at deploy is two decisions about where it runs rather than one. Ignoring a control counts as decided and leaves the denominator, so coverage measures what you said you would do rather than everything that exists.
The dashed rules are the two boundaries every pipeline has, whatever its platform: intake at build and release at release. Both default open — nothing is refused unless something was configured to refuse it.
The columns are drawn as a row here and as a loop elsewhere, and the same eight phases are the eight color groups a player walks around the DevSecOpoly board, in these same colors. The shape is a convenience. What is real is that each phase is a set of activities, and an activity is only worth doing because it enables a capability.
32 capabilities appear 36 times, because a control can belong at more than one point in the lifecycle. Digest verification, for instance, is enforced at build and checked again at deploy — the same capability doing a different job.
- 01
Plan
3 capabilities
- Security Champions ProgramDR · level 2 · 5 controlsNo product
- Tabletop Exercise ProgramDR · level 3 · 5 controlsNo product
- Business Context & Asset Criticality ScoringEVM · level 3 · 3 controlsList only1 scored of 3
- 02
Code
1 capability
- 04
Test
1 capability
- 07
Operate
10 capabilities
- Data Discovery & ClassificationDATA · level 2 · 3 controlsList only2 products
- Data Loss PreventionDATA · level 3 · counters 2 · 4 controlsOne product1 product
- Sensitivity Labeling & EncryptionDATA · level 2 · 4 controlsOne product1 product
- Incident Response Playbook ManagementDR · level 2 · 7 controlsNo product
- Real-time Threat DetectionDR · level 3 · counters 6 · 5 controlsCompare2 scored of 5
- Regulatory Incident & Vulnerability ReportingDR · level 3 · 5 controlsNo product
- Security Log Collection & RetentionDR · level 1 · table stakes · 8 controlsList only6 products
- Supply Chain Incident ResponseDR · level 3 · counters 4 · 6 controlsOne product1 product
- Tabletop Exercise ProgramDR · level 3 · 5 controlsNo product
- Asset Discovery & InventoryEVM · level 1 · table stakes · 5 controlsList only1 scored of 7
- 08
Monitor
21 capabilities
- Automated Investigation & ResponseDR · level 4 · counters 2 · 3 controlsCompare2 scored of 4
- Detection Engineering as CodeDR · level 4 · 2 controlsList only5 products
- Engineering Platform Audit Log MonitoringDR · level 3 · counters 5 · 7 controlsList only6 products
- Extended Detection & Response CorrelationDR · level 3 · counters 3 · 2 controlsList only1 scored of 2
- Managed Detection & ResponseDR · level 3 · 3 controlsList only2 products
- Real-time Threat DetectionDR · level 3 · counters 6 · 5 controlsCompare2 scored of 5
- Security Information & Event ManagementDR · level 2 · 5 controlsList only7 products
- Security Orchestration & Automated ResponseDR · level 3 · 3 controlsList only1 scored of 5
- Threat HuntingDR · level 4 · counters 3 · 2 controlsCompare2 scored of 10
- Threat Intelligence IntegrationDR · level 3 · 2 controlsList only2 products
- User & Entity Behavior AnalyticsDR · level 4 · counters 2 · 2 controlsList only3 products
- Application Security Posture ManagementEVM · level 3 · 5 controlsCompare2 scored of 8
- Automated Ticketing & Remediation WorkflowEVM · level 2 · 3 controlsCompare2 scored of 8
- Contextual Remediation GuidanceEVM · level 3 · 2 controlsCompare3 scored of 5
- Cross-Tool Finding CorrelationEVM · level 4 · 2 controlsCompare2 scored of 2
- Finding Ownership RoutingEVM · level 3 · 2 controlsCompare2 scored of 5
- Fix ValidationEVM · level 3 · 3 controlsList only1 scored of 5
- Risk-Based Vulnerability PrioritizationEVM · level 3 · counters 1 · 6 controlsCompare3 scored of 11
- Vulnerability Aggregation & DeduplicationEVM · level 2 · 3 controlsCompare3 scored of 11
- Vulnerability Root Cause AnalysisEVM · level 4 · 4 controlsNo product
- Vulnerability SLA TrackingEVM · level 2 · 4 controlsList only1 scored of 6
Framework coverage
What this selection alone would let you evidence.
ASVS 5.0
3 of 17
OWASP Application Security Verification Standard (ASVS) 5.0.0
V11 · V14 · V16
CI/CD Top 10
1 of 10
OWASP Top 10 CI/CD Security Risks
CICD-SEC-10
S2C2F
1 of 25
OpenSSF Secure Supply Chain Consumption Framework (S2C2F)
INV-2
SSDF 1.1
8 of 42
NIST Secure Software Development Framework 1.1 (SP 800-218)
PO.4.1 · RV.2.1 · RV.3.1 · PO.4.2 · RV.2.2 · RV.3.2 · RV.3.3 · RV.3.4
Coverage by phase
Plan
Not modeledNo attack techniques are modeled against this phase yet. That is a gap in our model, not evidence the phase is safe.
Code
0 countered · 4 open of 4
Test
Not modeledNo attack techniques are modeled against this phase yet. That is a gap in our model, not evidence the phase is safe.
Operate
1 countered · 12 open of 13
Monitor
Not modeledNo attack techniques are modeled against this phase yet. That is a gap in our model, not evidence the phase is safe.
What this selection leaves open
Trusted Supplier Compromise
Open12 real incidentsCommon · Operate
Nothing in this pipeline counters it. The graph knows 5 capabilities that would: Commercial Software Binary Composition Analysis, Continuous Vendor Risk Monitoring, Nth-Party Dependency Mapping, SaaS & CI/CD Integration Governance, and others.
Exploitation of Known Vulnerable Component
Countered5 real incidentsVery Common · Operate
Countered by Risk-Based Vulnerability Prioritization.
Leaked Secret Abuse
Open5 real incidentsVery Common · Operate
Nothing in this pipeline counters it. The graph knows 5 capabilities that would: Dynamic Short-Lived Credentials, Leaked Credential Validation & Revocation, Secret Push Protection, Secrets Detection in Source Code, and others.
Adversary-in-the-Middle MFA Phishing
Open2 real incidentsVery Common · Operate
Nothing in this pipeline counters it. The graph knows 3 capabilities that would: Developer & Maintainer MFA Enforcement, Multi-Factor Authentication, Phishing & Business Email Compromise Protection.
Unauthorized Commit Injection
Open2 real incidentsCommon · Code
Nothing in this pipeline counters it. The graph knows 5 capabilities that would: Branch Protection & Ruleset Enforcement, Code Review Enforcement, Commit Signing & Verification, Unauthorized Code Change Detection, and others.
AI Agent Privilege Abuse
Open1 real incidentEmerging · Operate
Nothing in this pipeline counters it. The graph knows 3 capabilities that would: AI Agent & MCP Server Governance, AI Coding Assistant Security Guardrails, Non-Human Identity Discovery & Governance.
Cloud Misconfiguration Exploitation
Open1 real incidentVery Common · Operate
Nothing in this pipeline counters it. The graph knows 3 capabilities that would: Cloud Security Posture Management, IaC Misconfiguration Scanning, IaC Plan-Time Policy Evaluation.
Exposed Kubernetes Control Interface
Open1 real incidentCommon · Operate
Nothing in this pipeline counters it. The graph knows 2 capabilities that would: Kubernetes Manifest & Helm Chart Scanning, Kubernetes Security Posture Management.
Injection Exploitation
Open1 real incidentVery Common · Operate
Nothing in this pipeline counters it. The graph knows 6 capabilities that would: Dynamic Application Security Testing, Interactive Application Security Testing, Runtime Application Self-Protection, Static Application Security Testing, and others.
Broken Object Level Authorization Exploitation
OpenVery Common · Operate
Nothing in this pipeline counters it. The graph knows 3 capabilities that would: API Runtime Threat Protection, Authenticated DAST Scanning, Broken Object Level Authorization Testing.
Direct and Indirect Prompt Injection
OpenVery Common · Operate
Nothing in this pipeline counters it. The graph knows 1 capability that would: Prompt Injection Detection.
MCP Tool Poisoning
OpenEmerging · Operate
Nothing in this pipeline counters it. The graph knows 2 capabilities that would: AI Agent & MCP Server Governance, MCP Tool Poisoning Detection.
5 further techniques with no documented incidents
Not in this comparison
- Does not apply to this kind of pipeline
- stages A composed pipeline has no authored stages; its capabilities are grouped by lifecycle phase.
- gaps Gap analysis compares a stage's capabilities against the products that stage uses, and only a client pipeline records products in use. A composed pipeline models the design, not an estate.
How this was produced
Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 300 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.