CyberForge Blog — DevSecOps & CI/CD Hardening https://cyberforge.agency/en/blog CI/CD pipeline security, DORA and NIS2 regulations, DevSecOps tools — written for CTOs and engineers. en Wed, 25 Mar 2026 15:05:30 GMT https://cyberforge.agency/og-image.png CyberForge https://cyberforge.agency/en/ Policy-as-Code — when security policy exists only on paper https://cyberforge.agency/en/posts/policy-as-code-opa https://cyberforge.agency/en/posts/policy-as-code-opa Most organizations have security policies. Few have mechanisms that actually enforce them. The difference becomes apparent during an incident. Wed, 18 Mar 2026 00:00:00 GMT Tools kontakt@cyberforge.agency (Szymon Mytych) Zero Trust in the context of DevSecOps — a principle you cannot ignore https://cyberforge.agency/en/posts/zero-trust-in-devsecops https://cyberforge.agency/en/posts/zero-trust-in-devsecops Zero Trust is a security architecture based on the assumption that no user, system or network should be trusted by default. Tue, 17 Mar 2026 00:00:00 GMT Fundamentals kontakt@cyberforge.agency (Szymon Mytych) Why DevSecOps slows down teams — and when it doesn't have to https://cyberforge.agency/en/posts/devsecops-without-slowing-teams https://cyberforge.agency/en/posts/devsecops-without-slowing-teams Most negative experiences with implementing security in pipelines stem from implementation errors, not from the DevSecOps idea itself. Mon, 16 Mar 2026 00:00:00 GMT Practice kontakt@cyberforge.agency (Szymon Mytych) Enterprise client security questionnaire — what they check and how to prepare https://cyberforge.agency/en/posts/enterprise-security-questionnaire https://cyberforge.agency/en/posts/enterprise-security-questionnaire VRA blocks the contract. Analysts look for answer consistency, knowledge of your environment and evidence — not declarations. Sun, 15 Mar 2026 00:00:00 GMT Business kontakt@cyberforge.agency (Michał Jaśniewski) Long-lived tokens in CI/CD — why they are a problem nobody sees https://cyberforge.agency/en/posts/oidc-replacing-tokens https://cyberforge.agency/en/posts/oidc-replacing-tokens Static API keys and cloud access tokens in pipelines are one of the most common attack vectors. The problem is structural. Sat, 14 Mar 2026 00:00:00 GMT Security kontakt@cyberforge.agency (Szymon Mytych) Cost of data breaches and CI/CD incidents — what the data says https://cyberforge.agency/en/posts/cost-of-data-breaches-cicd https://cyberforge.agency/en/posts/cost-of-data-breaches-cicd IBM, Verizon, GitGuardian — what the data says about security incident costs and why companies selling to Enterprise pay double. Fri, 13 Mar 2026 00:00:00 GMT Business kontakt@cyberforge.agency (Michał Jaśniewski) GitHub Actions — 10 configuration mistakes I see in every audit https://cyberforge.agency/en/posts/github-actions-configuration-mistakes https://cyberforge.agency/en/posts/github-actions-configuration-mistakes GITHUB_TOKEN with write on everything, actions without SHA pinning, secrets in logs — 10 mistakes that co-occur and reinforce each other. Thu, 12 Mar 2026 00:00:00 GMT Practice kontakt@cyberforge.agency (Szymon Mytych) Evidence Pack — What It Is and Why Your Auditor Wants One https://cyberforge.agency/en/posts/evidence-pack-what-it-is https://cyberforge.agency/en/posts/evidence-pack-what-it-is An Evidence Pack is the technical documentation that proves your pipeline security controls actually work — not just that you claim they do. Wed, 11 Mar 2026 00:00:00 GMT Fundamentals kontakt@cyberforge.agency (Michał Jaśniewski) SBOM — why the software bill of materials is becoming a market requirement https://cyberforge.agency/en/posts/sbom-what-it-is https://cyberforge.agency/en/posts/sbom-what-it-is Software Bill of Materials describes what software is built from. Regulations and Enterprise requirements mean its absence blocks sales. Tue, 10 Mar 2026 00:00:00 GMT Tools kontakt@cyberforge.agency (Szymon Mytych) SOC 2 Type II and Your CI/CD Pipeline — What Auditors Actually Verify https://cyberforge.agency/en/posts/soc2-pipeline-requirements https://cyberforge.agency/en/posts/soc2-pipeline-requirements SOC 2 auditors increasingly examine CI/CD pipelines. Here's what they look for and how to prepare. Mon, 09 Mar 2026 00:00:00 GMT Regulations kontakt@cyberforge.agency (Michał Jaśniewski) Secret leaks in CI/CD pipelines — scale of the problem and mechanisms https://cyberforge.agency/en/posts/secret-leaks-github-actions https://cyberforge.agency/en/posts/secret-leaks-github-actions Secrets in pipelines leak regularly — often not through attacks but through configuration errors that exist for years. Sun, 08 Mar 2026 00:00:00 GMT Security kontakt@cyberforge.agency (Szymon Mytych) Vendor Risk Assessment — What Enterprise Buyers Actually Evaluate https://cyberforge.agency/en/posts/vendor-risk-assessment-guide https://cyberforge.agency/en/posts/vendor-risk-assessment-guide VRA questionnaires are getting longer and more technical. Here's what security analysts look for and how to respond effectively. Sat, 07 Mar 2026 00:00:00 GMT Business kontakt@cyberforge.agency (Michał Jaśniewski) Artifact integrity in DevOps — the gap most organizations ignore https://cyberforge.agency/en/posts/artifact-signing-cosign https://cyberforge.agency/en/posts/artifact-signing-cosign Between build and production deployment an artifact can be replaced. Without integrity verification — there is no way to detect it. Fri, 06 Mar 2026 00:00:00 GMT Security kontakt@cyberforge.agency (Szymon Mytych) NIS2 and the software supply chain — new obligations for technology companies https://cyberforge.agency/en/posts/nis2-supply-chain-security https://cyberforge.agency/en/posts/nis2-supply-chain-security NIS2 requires auditing software suppliers. If you deliver software to entities covered by the directive — you must prove supply chain security. Thu, 05 Mar 2026 00:00:00 GMT Regulations kontakt@cyberforge.agency (Michał Jaśniewski) DORA and CI/CD Pipeline Security — What the Regulation Actually Requires https://cyberforge.agency/en/posts/dora-pipeline-requirements https://cyberforge.agency/en/posts/dora-pipeline-requirements DORA requires ICT security controls including CI/CD systems. If you sell software to financial institutions — your pipeline is in scope. Wed, 04 Mar 2026 00:00:00 GMT Regulations kontakt@cyberforge.agency (Michał Jaśniewski) CI/CD Hardening — What It Is and Why Companies Ignore It https://cyberforge.agency/en/posts/hardening-cicd-what-it-is https://cyberforge.agency/en/posts/hardening-cicd-what-it-is Your CI/CD pipeline holds production keys — but it's secured like a dev tool. What is hardening and why do companies ignore it? Tue, 03 Mar 2026 00:00:00 GMT Fundamentals kontakt@cyberforge.agency (Szymon Mytych)