A CI/CD Pipeline (Continuous Integration and Continuous Delivery or Deployment) is an automated workflow that builds, tests, and releases software changes quickly and consistently.
Continuous integration merges and tests code changes frequently so problems surface early, while continuous delivery or deployment automates the packaging and release of that code. Security teams embed checks directly into these stages, including static analysis, dependency and secret scanning, and artifact signing, so weaknesses are caught before code ever reaches production. In practice a single commit might trigger the build, run automated tests and a vulnerability scan, and have a failing check block the merge automatically. Here is the part people underestimate: the pipeline itself is a high-value target. Its credentials and broad access mean that whoever compromises the build system can push malicious code straight into production, as several real supply chain attacks have shown. So securing the pipeline, its secrets, and its access controls matters just as much as scanning the application that flows through it.
How is a CI/CD pipeline tested on the CISSP?
CI/CD pipelines relate to Domain 8, Software Development Security, which is 10% of the exam. Focus on how security integrates into automated build and release workflows.