Security teams have invested heavily in securing the code that developers write. But threat actors have moved upstream. CI/CD pipelines run with elevated privileges by design, holding cloud credentials, registry tokens, SSH keys, and production secrets. They pull in third-party code at runtime and execute automatically, at scale, on every push and every pull request. Compromise the pipeline, and you don’t just get code, you get the keys to everything it touches.
The industry has done a good job modeling these threats, with OWASP’s Top 10 CI/CD Risks representing a strong example. But little has been done to turn those recommendations into simple, effective controls that security teams can actually trust. Wiz changes that today.
A Pattern of Pipeline Attacks: The Incidents That Got Us Here
Supply chain attacks targeting CI/CD infrastructure are not hypothetical, they’re a repeating pattern. In the span of less than two years, we’ve seen several notable supply chain attacks exploiting different pipeline weaknesses.
The common theme in all of these incidents is that the pipeline itself was invisible from a security standpoint. No one could see which workflows had dangerous trigger configurations, which jobs ran with excessive permissions, or which third-party actions had been silently tampered with.
The New Frontier: AI Agents in Your Pipelines
AI coding agents are moving into the build pipeline. Where developers once ran static scripts and predefined jobs, they are now deploying autonomous agents that are capable of reading context, making decisions, writing and committing code, and executing shell commands directly inside their CI workflows. GitHub Actions is one of the most common places this is happening today, but the pattern extends to any CI platform where an agent can be handed a job token and told to run.
The convenience is real, but so is the risk. These agents operate with the CI job's elevated privileges, like cloud credentials, repository write access, and OIDC tokens scoped to production. And unlike a script, an agent can be influenced by its inputs. An external contributor submits a pull request or issue comment containing a malicious prompt, and the agent executes arbitrary commands using the CI system's credentials. The threat actor never touches the workflow YAML, the build log looks normal, but the damage is done.
This is prompt injection, and it's a fundamentally different threat model than the pipeline misconfigurations security teams are used to reasoning about.
Wiz now detects risks and misconfigurations related to the use of AI agents in CI. These target the specific configurations that make prompt injection viable, such as the permissions granted to agents, the triggers they respond to, and the conditions under which they run.
These findings surface within the CI/CD Security category alongside other pipeline risks, giving security teams a unified view of both traditional misconfigurations and risky combinations.
CI/CD Pipelines Are Now a First-Class Security Surface in Wiz
Wiz Code now models, analyzes, and inventories your CI/CD pipelines. Security visibility has traditionally stopped at the code layer, scanning what developers write, but remaining blind to the system that tests and builds that code. Wiz now extends that visibility further, from the repositories and the code within them to the build infrastructure itself. Here's how it works in practice.
Seeing the Pipeline the Way Threat Actors Do
The foundation of everything is modeling. Wiz now parses your GitHub Actions workflow YAML files and models workflows, jobs, runners, and their relationships as objects on the Wiz Security Graph. This means your pipelines are no longer a black box. They're connected, queryable assets with context about what triggers them, what they can access, and where they sit in your broader environment.
But modeling structure is only part of the picture. Wiz also maps pipeline dependencies to the underlying technologies behind them, so a workflow referencing google-github-actions/run-gemini-cli doesn't show up as an opaque action name, it shows up as Gemini. That's the difference between knowing your pipeline's shape and understanding its true attack surface.
From that foundation, Wiz surfaces the risks that matter. Dangerous triggers like pull_request_target, the exact misconfiguration class that enabled both Shai Hulud and Trivy, are flagged automatically via CCRs. Risky inputs, potential secret leaks within pipeline definitions, and insecure workflow configurations all surface as findings within the Wiz platform.
Permissions: The Blast Radius Problem
One of the most persistent CI/CD risks is also one of the least visible – pipelines running with far more access than they need. A workflow triggered by an external pull request with write access to repository contents isn't just a misconfiguration, it's a privilege escalation waiting to happen.
Wiz now analyzes the permissions declared in your GitHub Actions YAML files and automatically generates issues for risky or excessive configurations. Security teams get a clear view of which pipelines are overprivileged and can remediate before that access becomes an attack path.
From Audit Logs to Actionable Context
Knowing a pipeline is misconfigured is one thing. Understanding what's happening inside it in real time is another. Wiz now associates GitHub Actions audit log events directly with the workflow and job objects they relate to, not just at the repository level. An unexpected trigger, a permission change, or an unusual runtime execution are all examples of what is now traceable back to the specific pipeline context where it happened, with the full Wiz Security Graph behind it to connect the dots.
Your Pipeline Dependencies Have a Supply Chain Too
Software Composition Analysis is a well-understood practice that helps teams inventory open source dependencies, track vulnerabilities, and act when something is compromised. But that analysis has traditionally stopped at the application layer. Your CI pipeline has dependencies too, and they carry the same risks.
Every third-party action your workflows pull from the GitHub Marketplace is an external component you are implicitly trusting to execute inside your build environment, with your credentials, on your infrastructure. A trusted action can be compromised and silently redirected to malicious code without changing a single line in your workflow file. The Trivy incident was exactly this – not a code vulnerability, but a dependency problem in the pipeline layer.
Wiz extends composition analysis into CI, giving you a CI-BOM, representing a bill of materials for your build infrastructure. Every action in use across your organization is inventoried, along with its license and its associated workflows and jobs. When a specific action version is compromised, you immediately know your blast radius. And because Wiz maps actions to the underlying technologies behind them, you're not looking at a raw list of action references, you're looking at what those actions actually are and do.
Managing Risk Across Your Entire CI/CD Estate
Understanding one pipeline is a graph problem. Understanding five thousand is an inventory problem, and that's where most teams are today.
Wiz is shipping a dedicated CI Pipelines Inventory page that brings all of your workflows together in one place, alongside their security findings, risk levels, active status, and pipeline metadata. Security teams can finally understand which pipelines are exposed, which ones haven't been touched in months but still hold production credentials, and which ones need attention right now.
Think of it as the CI/CD equivalent of what Wiz already does for cloud infrastructure. The same posture-level visibility, applied to your build environment.
How These Capabilities Come Together: A Lesson from the Trivy Incident
The Trivy supply chain attack did not hinge on a single issue, it was the result of multiple gaps aligning over time. A risky trigger, excessive permissions, and a compromised dependency each played a role. What made the difference was the lack of a clear, unified view of what was actually running across CI.
This is where CI Pipelines Inventory becomes foundational. It provides a living map of workflows, jobs, runners, actions, repositories, and triggers, creating a source of truth for the CI environment itself. With that visibility, teams can understand not just individual risks, but how they connect.
In the Trivy case, a workflow using pull_request_target had access to sensitive secrets and remained in place for months. At the same time, write permissions enabled escalation from initial access to full pipeline control. On top of that, trusted third party action tags introduced dependency risk across downstream pipelines. Each of these signals was visible, but not connected.
In Wiz, the CI Inventory powers that connection. The dangerous trigger, the overprivileged workflow, and the compromised dependency are correlated into a single Issue on the Security Graph. Instead of separate findings, teams see one prioritized risk with full context and a clear path to remediation.
This is what a graph based approach enables. When you understand what is running, and how it is connected, you can catch risk earlier and focus on what actually matters.
The Pipeline Is Part of Your Security Program Now
Wiz Code was built on the belief that securing software means securing the entire lifecycle, not just the code itself, but every process involved in building and delivering it. CI/CD pipelines are where code, credentials, third-party dependencies, and cloud access all converge. For too long, that convergence has been invisible to security teams. Wiz is here to change that.
Request a demo to see how Wiz gives teams complete software supply chain visibility.
