Traditional vs AI-Secure CI/CD Pipeline

Cross-cutting security controls

These are not stages. They apply to every stage above, in both pipelines. If any one of them is weak, the stage-by-stage controls become much easier to defeat.

Identity and access management

Every human and every machine has its own identity, with the minimum permissions needed and multi-factor authentication for people.

AI adds: the agent is a separate identity, not a borrowed one.

Secrets management

Credentials live in a vault and are issued short-lived at the moment of use. Nothing long-lived is stored in code, configuration or a developer laptop.

AI adds: never in prompts, which are routinely logged.

Encryption in transit and at rest

Data is unreadable on the wire and unreadable on disk without the right key, so a stolen backup or an intercepted connection yields nothing useful.

AI adds: prompt logs and vector indexes are sensitive data stores too.

Audit logging and traceability

Who did what, when, from where — written somewhere the actor cannot edit, and kept long enough to investigate and to satisfy regulators.

AI adds: which model, which prompt version, which retrieved sources, which tool calls.

Network security and segmentation

Systems can only reach what they genuinely need to reach, so one compromised component does not open a path to everything else.

AI adds: restrict which external endpoints an agent may call at all.

Continuous monitoring and threat detection

Someone or something is watching, all the time, with alerts that reach an accountable human who knows what to do next.

AI adds: behavioural and quality monitoring, not just errors and availability.

What actually changes with AI

Everything in the traditional pipeline still applies. These are the additions — six shifts that account for almost all of the new risk.

✓

AI artifacts become first-classPrompts, models, agent configurations and knowledge bases are versioned, reviewed, signed and rolled back — because they determine behaviour as much as code does.

✓

New security testing disciplineAdversarial and behavioural testing sits alongside functional and penetration testing. Prompt injection, jailbreak, data leakage, tool abuse and excessive agency each need their own test cases.

✓

Provenance and integrity for models and dataYou must be able to state which model version, which dataset and which documents produced a given output — and prove none of them were tampered with.

✓

The agent is an identity, not a featureIt authenticates, it is authorised per tool and per end user, it has spend and turn limits, and it has a kill switch. Treat it like an employee with a very narrow job description.

✓

Runtime observability gains AI contextThe SIEM needs to see prompts, responses, tool calls, guardrail triggers and model versions. A successful attack often looks like a perfectly normal API call.

✓

Trust boundaries move inwardCode written inside your own organisation, by your own assistant, is now untrusted input. The reviewer, not the author, becomes the control point.

Plain-English glossary

Every term used above, in one line each.

CI/CD: Continuous integration / continuous delivery — the automated assembly line that takes code from a developer’s laptop to real users.
Pipeline: That assembly line itself: a defined sequence of automated steps every change must pass through.
Repository: The shared store holding all the code and its complete change history.
Pull request: A proposed change, submitted for review before it is allowed into the main codebase.
SAST: Static application security testing — reading the code for flaws without running it.
DAST: Dynamic testing — attacking a running copy of the application from the outside.
SCA: Software composition analysis — checking the open-source libraries you depend on for known vulnerabilities.
IaC: Infrastructure as code — describing servers, networks and permissions in files rather than clicking in a console.
SBOM: Software bill of materials — a machine-readable ingredients list of every component inside a release.
AI-BOM: The same idea extended to models, datasets, prompts and agent configurations.
Artifact: The finished, packaged output of a build — the thing that actually gets deployed.
Signing: Applying a cryptographic seal so any later tampering is detectable and the origin is provable.
Provenance: The documented history of where something came from and how it was produced.
SIEM: Security information and event management — the system that collects logs from everywhere and raises alerts.
RAG: Retrieval-augmented generation — giving the model relevant documents to read before it answers, so it works from your data rather than memory.
Prompt injection: Hiding instructions inside data the model reads, so it follows the attacker’s instructions instead of yours.
Jailbreak: Persuading a model to ignore its own safety instructions.
Excessive agency: Giving an agent more capability than its task requires, so any successful manipulation causes disproportionate damage.
Guardrails: Filters that screen what goes into and comes out of a model. Useful, but probabilistic — never the only control.
Agent: An AI system that does not just answer, but takes actions by calling tools on your behalf.
Least privilege: Granting exactly the access needed for the job and nothing more.
Blast radius: How much damage a single compromise can cause before something stops it.