2026 DevOps Security Insights: What Matters Most for CISOs

Rich threat landscape, agentic AI, vulnerabilities, third-party DevOps platforms… Securing a software supply chain is a multidimensional and complex undertaking, so it is easy to lose track.

At GitProtect, we’ve gone the extra mile to make this effort easier for you. We collected stats, trends, and real-life incident cases into the “2026 DevOps Threats Unwrapped Report” to give you one source of truth about the current state of popular DevOps platforms’ security.

Below, you can find six key security insights from the report. Follow them to plan an efficient DevSecOps strategy and minimize risks for your software development organization.

#1 Development Data Isn’t Safe in the Cloud by Default

Year-over-year analyses show a sharp increase in critical and major incidents from 48 in 2024 to 156 in 2025 across popular Git hosting platforms. We recorded these just by referring to the official status pages of GitHub, GitLab, Azure DevOps, Bitbucket, and Jira.

Why does it impact your strategy? The short answer is: You should put limited trust in DevOps platform providers. Keeping your organization’s data in a large Git hosting cloud isn’t a way to protect it for several reasons:

• Limited cloud provider’s liability—your cloud provider limits their liability by following the shared responsibility model. In short, they take care of the infrastructure, but you are responsible for your data (code, metadata, LFS). Consequently, when something happens to your data, you can’t expect to get help in most cases.
• Cloud vulnerability—Git hosting platforms (just like any infrastructure) are vulnerable to all sorts of threats: from human and AI errors (e.g., accidental deletions), phishing, ransomware, to the provider’s configuration errors.
• No backup by default—if the provider isn’t responsible for your data, it is reasonable to deploy a backup solution. By default, native backup isn’t turned on, leaving your data completely exposed. What’s more, buying a backup add-on from the cloud provider is usually suboptimal due to limited retention, non-flexible restore, and lack of isolation from production. To be protected, you need a third-party professional backup solution with advanced features like data encryption, immutability, and replication to multiple storage locations.

#2 Don’t Trust SLA: The High Availability Myth

We’ve calculated that all the DevOps cloud incidents totalled up to more than 9k hours of disruptions in 2025. This translates into significant operational friction, whether through total outages, missing functionalities, or prolonged load times.

When thinking about your security strategy and keeping code in the cloud, always strive to build data sovereignty. In other words, keep regularly created backup copies of your production data in a competitive cloud or, even better, locally.

In fact, a robust backup solution can effectively serve a dual purpose: a) effectively protect your code and b) enable easy migration to the self-managed version of your Git hosting platform or a competitive one, if need be (e.g., a prolonged outage). This way, you can always resume operations and avoid the dire consequences of outages. According to Information Technology Intelligence Consulting, the cost of hourly downtime was more than $300,000 for 90% of mid-size and large firms already in 2024.

#3 Ensure Quick Turnaround of Vulnerability Fixes

Modern Git hosting platforms are more and more complex. This complexity increase correlates with the growing number of vulnerabilities. In 2025, major DevOps platforms patched a total of 236 of them. 59% of the patched vulnerabilities were of critical and high severity. It means they had the potential to cause serious damage, such as giving access to sensitive data or escalating privileges. What’s more, the trend was up, with a 30% increase in the second half of the year.

With the volume of serious vulnerabilities steadily rising, following security bulletins to quickly update local tools syncing with the Git hosting cloud is vital. The other pillar is (again) backup. If an attacker exploits a zero-day flaw in the cloud or your DevOps platform provider fails to fix a bug promptly, backup may be your last resort.

#4 The High Cost of Security Misconfigurations

In addition to exploiting vulnerabilities, attackers increasingly target DevOps cloud misconfigurations in the areas of identity, trust, and access. Real-life examples? Risky triggers with access to repo secrets, highly privileged tokens, secrets kept in a Terraform repo, and so on.

The strategic approach to this problem should be based on:

• Using short-lived & non-static credentials like ephemeral tokens.
• Storing all the secrets in a dedicated vault and injecting them when needed, instead of keeping them as part of a container image or repository.
• Following the rule of least privilege when configuring each access scope.
• Granting just-in-time (temporary) administrative rights for a one-off activity that requires them to be completed.
• Implementing an ASPM solution to centralize security insights.

#5 The Urgent Need to Harness Agentic AI

Each DevOps platform now brings its own AI agent to the table, promising time gains, lower spending, and more agility. While few think about AI-induced risks, our research identified 68 AI-related issues across Git version control platforms in 2025. Their impact and type varied and included vulnerabilities enabling prompt injections, remote code execution, private data exfiltration, and more. What’s also interesting is that their number grew each quarter, starting from 10 in Q1 and ending with 20 in Q4.

Harnessing AI agents has become an important aspect of security strategy. While highly efficient at executing tasks at scale, they can just as easily accelerate security risks. In fact, they have one serious drawback: they can be manipulated into obediently executing malicious commands in your DevOps pipeline. If you’ve integrated AI agents into your workflow, consider these to keep control:

• Make sure AI agents’ read/write permissions and access rights are limited. Never grant blanket administrative rights. Conduct a granular analysis of repository criticality, permissions hierarchy, possible attack paths, and consequences. That way, you’ll be able to come up with finely-grained scopes.
• Restrict third-party integrations (extensions, MCP servers) for AI agents and always sandbox-test the allowed ones. Prevent users from exploring integrations in open-source repos that promise a lot but may be a trap. Nowadays, even official marketplace extension releases can be infected. That’s why pre-production testing is vital to preventing catastrophic pipeline compromises.
• Follow the human-in-the-loop approach. Don’t automate pull requests’ finalization. Production code with maliciously introduced flaws or made-up dependency names is not only an easy target but also a great way to wreak havoc on a large scale.

Remember that you should map the same rules to local machines of developers, where the IDE heavily integrates with agentic AI, too.

#6 Trust Abuse: Supply Chain Attacks

The agentic AI ecosystem is particularly vulnerable to supply chain attacks. However, this threat is also becoming highly popular beyond the AI sphere, with GhostAction and Shai-Hulud as notable examples from 2025. Attackers use trusted sources, such as official repos (e.g., on GitHub) and marketplaces, to distribute malicious packages.

For your security strategy, this means a great focus on:

• Establishing procedures and sandbox spaces for verifying all third-party code, PoCs, and tools before integrating them into your production environment.
• Monitoring dependencies in the code before it reaches production.
• Hardening local and cloud workflows across the pipeline through enforcing short-lived/ephemeral tokens, so that malicious actors cannot exploit them after a compromise.
• In general, taking care of the highest level of cybersecurity hygiene in the area of identity with short-lived credentials, FIDO key-based MFA, etc. This prevents malicious actors from gaining an initial foothold for their campaigns.

Key DevSecOps Strategy Areas in 2026

Effective protection of code, IP, and sensitive data in DevOps shouldn’t be based on reactive and random actions. To be successful, your security strategy in 2026 needs to be laser-focused on the following aspects:

• Data sovereignty and independence from a provider
• Hardening the areas of identity, permissions, trust, and access—for human, AI, and service account (machine) identities
• Restricted and controlled use of integrations (extensions, add-ons, MCP servers)
• Non-native, professional DevOps backup for swift data recovery and migration (if needed)

About the Author

Daria Kulikova is Partnership & Project Marketing Manager at GitProtect. With years of background in DevOps security, data protection, and compliance frameworks, she tries to translate complex cybersecurity concepts into actionable insights for tech professionals and decision-makers. Passionate about secure software development and resilient infrastructure, she actively contributes to security education through reports, dedicated blog posts, and articles.

Daria can be reached online at her LinkedIn profile.