Datadog CI/CD Threat Matrix: A MITRE Framework for Pipeline Security

CI/CD pipelines have become the most consequential security boundary in modern software delivery — and the most consistently overlooked. Datadog’s CI/CD Security Threat Matrix applies the MITRE ATT&CK framework specifically to pipeline attack pathways, producing a structured map of how attackers move from initial access through credential theft to shipping malicious code into production.

Context

The MITRE ATT&CK framework has been the reference model for enterprise security teams for years, but it covers the full attack surface — endpoints, networks, cloud environments, and everything in between. CI/CD pipelines have their own distinct attack surface: they hold secrets for every environment, have elevated permissions to deploy into production, and accept code changes from a broad contributor base. Generic threat frameworks don’t map cleanly to the specific ways pipelines are exploited.

Datadog’s matrix fills that gap, drawing from three existing sources — Microsoft’s DevOps threat matrix, OWASP’s top 10 CI/CD risks, and documented historical attacks — and structuring them into a CI/CD-specific taxonomy. The practical value is that platform and security teams can audit their pipeline configuration against a structured set of known attack patterns rather than reasoning from first principles.

The Detail

The matrix organizes threats across ten attack tactics mirroring the MITRE ATT&CK structure: Reconnaissance, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Lateral Movement, Exfiltration, and Impact. The mapping to CI/CD-specific techniques makes the abstract concrete. Reconnaissance in a CI/CD context means scanning public repositories for exposed configuration files. Initial Access means exploiting permissive pull request permissions that allow unreviewed code to trigger pipeline runs. Privilege Escalation means modifying pipeline configuration files to elevate the permissions under which subsequent steps execute.

The full attack chain Datadog documents as an example: an attacker scans public repositories, identifies a permissive PR configuration, submits a PR that modifies the pipeline, extracts environment credentials during the build, exfiltrates proprietary source code, and deploys cryptomining workloads into the build environment. Each step maps to a tactic in the matrix — which means each step has a corresponding detection or prevention control that platform teams can implement.

The intersection with the Datadog Code Security MCP is worth noting for teams already evaluating Datadog’s security toolchain. Code Security addresses vulnerabilities in what gets committed; the CI/CD threat matrix addresses vulnerabilities in the pipeline that builds and ships what gets committed. These are complementary security layers — both sit between developer intent and production deployment, but at different points in the delivery chain.

Detection mapping to Datadog’s products is specific: Cloud Security surfaces compromised credential usage, Cloud SIEM identifies anomalous pipeline behavior patterns, and the combination creates a detection surface that spans from the build environment through to cloud resource access. For teams standardized on Datadog for observability, extending that investment to pipeline security closes a gap that most existing monitoring configurations leave open.

Source: Datadog

Content created with AI assistance and reviewed for accuracy.