# Ensure Implement Automated Vulnerability Scanning in Build Pipelines

- Source: https://support.icompaas.com/support/solutions/articles/62000235016-ensure-implement-automated-vulnerability-scanning-in-build-pipelines
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**  
Level 1

**Description:**  
Build and deployment pipelines must include automated vulnerability scanning steps to identify security flaws in source code, dependencies, container images, and other build artifacts. This proactive approach helps detect and remediate vulnerabilities early in the development lifecycle before production deployment.

**Rationale:**  
Automated scanning in pipelines reduces the risk of deploying vulnerable software by providing continuous security assessment. It supports compliance with security standards, improves software quality, and enables rapid response to newly discovered threats.

**Impact:****Pros:**

-   Identifies vulnerabilities early, reducing remediation costs.  
      
    
-   Supports continuous security and compliance.  
      
    
-   Enhances overall software quality and security posture.  
      
    
-   Facilitates integration of security into DevOps (DevSecOps).  
      
    

**Cons:**

-   May increase build time and resource consumption.  
      
    
-   Requires configuration and maintenance of scanning tools.  
      
    

**Default value:**  
Many pipelines lack integrated automated vulnerability scanning by default.

**Audit:**  
Review pipeline configurations and logs for evidence of automated scanning. Verify that identified vulnerabilities are tracked and addressed.

**Remediation:**  
Integrate static application security testing (SAST), software composition analysis (SCA), and container scanning tools into pipelines. Define policies for vulnerability thresholds and remediation timelines. Educate development teams on security best practices.

**References:**

1.  OWASP DevSecOps Guidelines: [https://owasp.org/www-project-devsecops-guideline/](https://owasp.org/www-project-devsecops-guideline/)
    
2.  GitLab Security Scanning: [https://docs.gitlab.com/ee/user/application\_security/](https://docs.gitlab.com/ee/user/application_security/)
    
3.  CIS Controls v8, Control 6 - Maintenance, Monitoring, and Analysis of Audit Logs: [https://www.cisecurity.org/controls/maintenance-monitoring-and-analysis-of-audit-logs/](https://www.cisecurity.org/controls/maintenance-monitoring-and-analysis-of-audit-logs/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.