Skip to content
RockPointCyber
← All pipelines

Compose a pipeline

Pick the domains you are responsible for. Every control the graph holds for them is placed into the lifecycle phase where it belongs, with the frameworks it evidences and the attacks it stops.

Domains

Maturity ceiling

Controls carry the maturity level a program needs to run them. Raising the ceiling adds depth and volume; level 3 is a realistic target for most teams.

2 controls1 of 8 lifecycle phases · level 1 and below
01Plan
02Code
03Build
04Test
05Release
06Deploy
07Operate
08Monitor
GOVDecide
11Governance and assurance at Plan: 0 targeted, 0 ignored, 11 still open of 11
Governance and assurance at Code: nothing, by the nature of the work
2Governance and assurance at Build: 0 targeted, 0 ignored, 2 still open of 2
Governance and assurance at Test: nothing, by the nature of the work
2Governance and assurance at Release: 0 targeted, 0 ignored, 2 still open of 2
1Governance and assurance at Deploy: 0 targeted, 0 ignored, 1 still open of 1
5Governance and assurance at Operate: 0 targeted, 0 ignored, 5 still open of 5
4Governance and assurance at Monitor: 0 targeted, 0 ignored, 4 still open of 4
SUPAdmit
4Open source and third-party supply at Plan: 0 targeted, 0 ignored, 4 still open of 4
11Open source and third-party supply at Code: 0 targeted, 0 ignored, 11 still open of 11
20Open source and third-party supply at Build: 0 targeted, 0 ignored, 20 still open of 20
2Open source and third-party supply at Test: 0 targeted, 0 ignored, 2 still open of 2
6Open source and third-party supply at Release: 0 targeted, 0 ignored, 6 still open of 6
1Open source and third-party supply at Deploy: 0 targeted, 0 ignored, 1 still open of 1
10Open source and third-party supply at Operate: 0 targeted, 0 ignored, 10 still open of 10
8Open source and third-party supply at Monitor: 0 targeted, 0 ignored, 8 still open of 8
DEVAuthor
8Design and development at Plan: 0 targeted, 0 ignored, 8 still open of 8
22Design and development at Code: 0 targeted, 0 ignored, 22 still open of 22
5Design and development at Build: 0 targeted, 0 ignored, 5 still open of 5
3Design and development at Test: 0 targeted, 0 ignored, 3 still open of 3
2Design and development at Release: 0 targeted, 0 ignored, 2 still open of 2
Design and development at Deploy: nothing, by the nature of the work
4Design and development at Operate: 0 targeted, 0 ignored, 4 still open of 4
3Design and development at Monitor: 0 targeted, 0 ignored, 3 still open of 3
DELProduce
2Build and delivery at Plan: 0 targeted, 0 ignored, 2 still open of 2
10Build and delivery at Code: 0 targeted, 0 ignored, 10 still open of 10
39Build and delivery at Build: 0 targeted, 0 ignored, 39 still open of 39
1Build and delivery at Test: 0 targeted, 0 ignored, 1 still open of 1
18Build and delivery at Release: 0 targeted, 0 ignored, 18 still open of 18
13Build and delivery at Deploy: 0 targeted, 0 ignored, 13 still open of 13
13Build and delivery at Operate: 0 targeted, 0 ignored, 13 still open of 13
4Build and delivery at Monitor: 0 targeted, 0 ignored, 4 still open of 4
VERProve
1Testing and validation at Plan: 0 targeted, 0 ignored, 1 still open of 1
2Testing and validation at Code: 0 targeted, 0 ignored, 2 still open of 2
Testing and validation at Build: nothing, by the nature of the work
10Testing and validation at Test: 0 targeted, 0 ignored, 10 still open of 10
Testing and validation at Release: nothing, by the nature of the work
1Testing and validation at Deploy: 0 targeted, 0 ignored, 1 still open of 1
9Testing and validation at Operate: 0 targeted, 0 ignored, 9 still open of 9
Testing and validation at Monitor: nothing, by the nature of the work
OPSRun
Runtime and platform at Plan: nothing, by the nature of the work
Runtime and platform at Code: nothing, by the nature of the work
1Runtime and platform at Build: 0 targeted, 0 ignored, 1 still open of 1
Runtime and platform at Test: nothing, by the nature of the work
Runtime and platform at Release: nothing, by the nature of the work
5Runtime and platform at Deploy: 0 targeted, 0 ignored, 5 still open of 5
35Runtime and platform at Operate: 2 targeted, 0 ignored, 33 still open of 35
2Runtime and platform at Monitor: 0 targeted, 0 ignored, 2 still open of 2
OBSWatch
3Detection and continuous observation at Plan: 0 targeted, 0 ignored, 3 still open of 3
1Detection and continuous observation at Code: 0 targeted, 0 ignored, 1 still open of 1
Detection and continuous observation at Build: nothing, by the nature of the work
1Detection and continuous observation at Test: 0 targeted, 0 ignored, 1 still open of 1
Detection and continuous observation at Release: nothing, by the nature of the work
Detection and continuous observation at Deploy: nothing, by the nature of the work
7Detection and continuous observation at Operate: 0 targeted, 0 ignored, 7 still open of 7
21Detection and continuous observation at Monitor: 0 targeted, 0 ignored, 21 still open of 21
Attacks
none modeled
none modeled
none modeled
none modeled
none modeled
none modeled
12 open
none modeled
GOV Governance and assurance
The stream that decides what blocks, and proves it blocked.
SUP Open source and third-party supply
Everything you did not write, arriving faster than you can review it.
DEV Design and development
Where the cost of a fix is lowest and the attention is shortest.
DEL Build and delivery
The machine that makes the thing, and the largest single target in the chain.
VER Testing and validation
The stream that finds out whether any of the others worked.
OPS Runtime and platform
The last place to stop something, and the most expensive.
OBS Detection and continuous observation
The only stream whose answer changes while nothing else does.

The figure is how many controls the field places in that cell and the wash behind it is how much of the cell you have decided — 2 targeted, 0 ignored, 331 still open, of 333. A ring means the cell is closed. Your 2 controls account for 2 of those, because a control that belongs at build and again at deploy is two decisions about where it runs rather than one. Ignoring a control counts as decided and leaves the denominator, so coverage measures what you said you would do rather than everything that exists.

The dashed rules are the two boundaries every pipeline has, whatever its platform: intake at build and release at release. Both default open — nothing is refused unless something was configured to refuse it.

The columns are drawn as a row here and as a loop elsewhere, and the same eight phases are the eight color groups a player walks around the DevSecOpoly board, in these same colors. The shape is a convenience. What is real is that each phase is a set of activities, and an activity is only worth doing because it enables a capability.

  1. 07

    Operate

    2 capabilities

Framework coverage

What this selection alone would let you evidence.

  • ASVS 5.0

    2 of 17

    OWASP Application Security Verification Standard (ASVS) 5.0.0

    V6 · V10

  • CI/CD Top 10

    1 of 10

    OWASP Top 10 CI/CD Security Risks

    CICD-SEC-2

Coverage by phase

  • Operate

    1 countered · 12 open of 13

What this selection leaves open

  • Trusted Supplier Compromise

    Open12 real incidents

    Common · Operate

    Nothing in this pipeline counters it. The graph knows 5 capabilities that would: Commercial Software Binary Composition Analysis, Continuous Vendor Risk Monitoring, Nth-Party Dependency Mapping, SaaS & CI/CD Integration Governance, and others.

  • Exploitation of Known Vulnerable Component

    Open5 real incidents

    Very Common · Operate

    Nothing in this pipeline counters it. The graph knows 7 capabilities that would: Container Image Vulnerability Scanning, Coverage-Guided Fuzzing, Minimal Hardened Base Images, Risk-Based Vulnerability Prioritization, and others.

  • Leaked Secret Abuse

    Open5 real incidents

    Very Common · Operate

    Nothing in this pipeline counters it. The graph knows 5 capabilities that would: Dynamic Short-Lived Credentials, Leaked Credential Validation & Revocation, Secret Push Protection, Secrets Detection in Source Code, and others.

  • Adversary-in-the-Middle MFA Phishing

    Countered2 real incidents

    Very Common · Operate

    Countered by Multi-Factor Authentication.

  • AI Agent Privilege Abuse

    Open1 real incident

    Emerging · Operate

    Nothing in this pipeline counters it. The graph knows 3 capabilities that would: AI Agent & MCP Server Governance, AI Coding Assistant Security Guardrails, Non-Human Identity Discovery & Governance.

  • Cloud Misconfiguration Exploitation

    Open1 real incident

    Very Common · Operate

    Nothing in this pipeline counters it. The graph knows 3 capabilities that would: Cloud Security Posture Management, IaC Misconfiguration Scanning, IaC Plan-Time Policy Evaluation.

  • Exposed Kubernetes Control Interface

    Open1 real incident

    Common · Operate

    Nothing in this pipeline counters it. The graph knows 2 capabilities that would: Kubernetes Manifest & Helm Chart Scanning, Kubernetes Security Posture Management.

  • Injection Exploitation

    Open1 real incident

    Very Common · Operate

    Nothing in this pipeline counters it. The graph knows 6 capabilities that would: Dynamic Application Security Testing, Interactive Application Security Testing, Runtime Application Self-Protection, Static Application Security Testing, and others.

  • Broken Object Level Authorization Exploitation

    Open

    Very Common · Operate

    Nothing in this pipeline counters it. The graph knows 3 capabilities that would: API Runtime Threat Protection, Authenticated DAST Scanning, Broken Object Level Authorization Testing.

  • Direct and Indirect Prompt Injection

    Open

    Very Common · Operate

    Nothing in this pipeline counters it. The graph knows 1 capability that would: Prompt Injection Detection.

  • MCP Tool Poisoning

    Open

    Emerging · Operate

    Nothing in this pipeline counters it. The graph knows 2 capabilities that would: AI Agent & MCP Server Governance, MCP Tool Poisoning Detection.

  • Malicious or Compromised OAuth Integration

    Open

    Common · Operate

    Nothing in this pipeline counters it. The graph knows 3 capabilities that would: Non-Human Identity Discovery & Governance, Repository Access Governance, SaaS & CI/CD Integration Governance.

1 further technique with no documented incidents

Not in this comparison

Does not apply to this kind of pipeline
stages A composed pipeline has no authored stages; its capabilities are grouped by lifecycle phase.
gaps Gap analysis compares a stage's capabilities against the products that stage uses, and only a client pipeline records products in use. A composed pipeline models the design, not an estate.

How this was produced

Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 305 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.