> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/cicd-risks.md).

# CI/CD Risks

The CI/CD Risk scanner safeguards your software supply chain by identifying insecure configurations in the pipelines, workflows, and version control settings that build and deliver your software.

CI/CD pipeline risks are a set of predefined rules that identify pipeline vulnerabilities. Scans analyze both code and configurations of integrated VCS and CI/CD systems and pipelines, as well as their inter-connectivity, to detect these risks. The risks are classified based on security categories including attack vectors, misconfigurations, and bad practices found throughout your CI/CD pipelines.

## Workflow

Use the child pages for each stage of the workflow:

* [Understand the CI/CD Risks table](/application-security/software-supply-chain-security/risk-and-remediation/cicd-risks/understand-the-ci-cd-risks-table.md)
* [Investigate, prioritize, and remediate CI/CD risk issues](/application-security/software-supply-chain-security/risk-and-remediation/cicd-risks/investigate-prioritize-and-remediate-ci-cd-risk-issues.md)
* [VCS and CI/CD pipeline risk findings](/application-security/software-supply-chain-security/risk-and-remediation/cicd-risks/vcs-and-cicd-pipeline-risk-findings.md)

## Core achievements and use cases

* **Securing the delivery infrastructure**: Secure the delivery infrastructure: Detect insecure configurations in pipelines, workflows, and VCS settings to extend security coverage to the systems that build and promote code
* **Remediate pipeline risks**: Pinpoint the exact configuration file, the owning team, and the specific change required to fix the risk without manually reverse-engineering the CI/CD setup
* **Reducing noise.** Evidence text is generated as either general (platform-neutral) or specific (platform-specific and parameterized), which ensures the evidence reflects the actual VCS platform (GitHub, GitLab, Bitbucket, Azure DevOps) and CI/CD system (Jenkins, CircleCI) where the risk was detected, rather than a generic description that a practitioner must translate before acting
* **Standardize risk reporting**: Map pipeline vulnerabilities directly to recognized industry frameworks (OWASP Top 10 CI/CD, CIS Benchmarks) for standardized audits
* **Prevent security regressions**: Apply automated security policies to CI/CD workflows to stop previously remediated misconfigurations from being reintroduced

### Prerequisites

| Prerequisite        | Description                                                                                                                                                    |
| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| License             | An active Cortex Cloud license with Application Security entitlements                                                                                          |
| RBAC role           | The AppSec Practitioner or AppSec Manager role. The DevSecOps and Developer roles can view CI/CD risk evidence but cannot modify detection rule configurations |
| VCS integration     | At least one VCS data source (GitHub, GitLab, Bitbucket, or Azure DevOps) onboarded to Cortex Cloud                                                            |
| CI/CD risk scanning | CI/CD risk scanning enabled for the onboarded data source                                                                                                      |
| Completed scan      | At least one completed scan that includes CI/CD risk scanning results                                                                                          |

{% hint style="info" %}

### Note

Cortex Cloud Application Security CI/CD pipeline scans create a comprehensive inventory of all CI/CD pipelines in your environment. For more information refer to [CI/CD pipeline as an asset](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-pipeline-as-an-asset.md).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/cicd-risks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.