Most of OWASP's ten CI/CD risks feed supply chain attacks, but four map most directly to common entry points: identity and access management, dependency chain abuse, poisoned pipeline execution and credential hygiene. A small team should start there and treat the rest as follow-up work.
What the OWASP list is
The OWASP Top 10 CI/CD Security Risks is an OWASP lab project that identifies focus areas for securing a CI/CD environment. It was compiled from research on attack vectors and analysis of breaches and security flaws. The ten risks are:
- CICD-SEC-1: Insufficient Flow Control Mechanisms
- CICD-SEC-2: Inadequate Identity and Access Management
- CICD-SEC-3: Dependency Chain Abuse
- CICD-SEC-4: Poisoned Pipeline Execution (PPE)
- CICD-SEC-5: Insufficient PBAC (Pipeline-Based Access Controls)
- CICD-SEC-6: Insufficient Credential Hygiene
- CICD-SEC-7: Insecure System Configuration
- CICD-SEC-8: Ungoverned Usage of 3rd Party Services
- CICD-SEC-9: Improper Artifact Integrity Validation
- CICD-SEC-10: Insufficient Logging and Visibility
Only the titles were confirmed from the project overview page. For definitions, read the project pages themselves.
Mapping to entry points
This mapping is our reading of the titles, not OWASP's wording.
| Entry point | Closest OWASP risk titles |
|---|---|
| Credential theft | Insufficient Credential Hygiene; Inadequate Identity and Access Management |
| Maintainer takeover | Inadequate Identity and Access Management |
| CI abuse | Poisoned Pipeline Execution; Insufficient PBAC; Insecure System Configuration |
| Name tricks | Dependency Chain Abuse |
| Poisoned update | Dependency Chain Abuse; Improper Artifact Integrity Validation; Ungoverned Usage of 3rd Party Services |
| Weak review | Insufficient Flow Control Mechanisms |
| Slow detection | Insufficient Logging and Visibility |
The four to start with
- Identity and access: who and what can change code or release it.
- Credential hygiene: where secrets live, how long they last, who can read them.
- Dependency chain: what your builds fetch, and from where.
- Pipeline execution: whether untrusted input can influence what a job runs.
How to use the list in a review
Take an hour. For each of the ten, write one sentence about your current state and one about the next improvement. Mark gaps red, amber or green. Share the sheet with engineering leads and pick a few items for the quarter.
Why a list is not a plan
A risk list names problems. It does not set priorities for your organization. Pair it with your own scoring of exposure and blast radius, and review it as your pipeline changes. See which supply chain entry point to fix first for a simple scoring method.
Where Safeguard fits
Safeguard's compliance and evidence automation can help you map controls to frameworks, and its policies and gates can enforce some of the pipeline rules above. You can see framework mapping in the demo below.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how one control maps to several framework requirements.
Quick check
Is the OWASP CI/CD list a compliance standard?
No. It is a community research project that helps defenders find focus areas.
Do I need to address all ten?
Over time, yes in some form. Start with the ones that match your highest exposure.
Sources
Last reviewed: 19 October 2026.
