OWASP publishes first Top 10 CI/CD Security Risks framework for engineering teams

The OWASP Top 10 CI/CD Security Risks is the first industry-wide attempt to catalogue and rank the most critical threats to build and deployment pipelines. Unlike generic application security lists, this framework focuses specifically on the unique attack surface created by CI/CD automation, third-party integrations, and Infrastructure-as-Code practices. The risks cover everything from insecure secrets management to dependency confusion and pipeline poisoning, reflecting the diverse ways attackers now target software delivery systems.

Each risk in the list follows a consistent structure that engineers can immediately operationalise. The definition provides a clear scope, while the description explains the adversary’s motivation and technical context. The impact section quantifies potential damage, from credential theft to supply-chain compromise. Most valuable are the recommendations, which offer specific controls and configuration changes rather than vague advice. This structure allows teams to quickly assess their exposure and implement fixes without extensive research.

The framework’s real-world grounding is one of its strongest features. Every risk includes references to actual breaches, such as the SolarWinds compromise, Codecov breach, and PHP backdoor incident. These examples demonstrate that the risks are not theoretical but actively exploited at scale. The list also accounts for modern engineering practices, including the heavy reliance on third-party dependencies and cloud-based CI/CD services, which have expanded the attack surface beyond traditional perimeter defences.

For engineering teams, the main cost of adopting this framework is the time required to audit existing pipelines against the ten risks. The recommendations often require changes to access controls, secrets management, and dependency resolution processes, which may slow down deployments temporarily. Some risks, like insecure system configuration, may require architectural changes that are difficult to implement in legacy pipelines. The framework also stops short of providing automated tooling, leaving teams to manually map their environments to the risks.

The OWASP list is particularly valuable because it bridges the gap between security and engineering teams. By providing a shared vocabulary and prioritised risks, it reduces friction in discussions about pipeline security. However, the framework’s effectiveness depends on organisations actually implementing the recommendations. Many of the risks, such as insufficient pipeline-based access controls, require cultural changes in how teams manage permissions and secrets, which may face resistance in fast-moving engineering organisations.