Trusted Resellers and CI/CD Accounts Become the New Entry Points

Resellers, developer accounts, and CI/CD pipelines are becoming high-impact entry points for attackers, exposing secrets and expanding blast radius across cloud and software supply chains.

Updated

What is this trend?

Attackers are increasingly entering through trusted resellers, maintainer accounts, and CI/CD systems to steal secrets and move into core infrastructure, making inherited trust a primary cyber risk.

  • Trusted partners are becoming the easiest path into high-value environments.
  • Compromised CI/CD accounts can expose cloud, code, and AI secrets at scale.
  • Reseller and backup-channel abuse can bypass perimeter defenses entirely.
  • Least privilege, secret hygiene, and workflow hardening are now critical controls.

What’s the latest?

A Ledger supply-chain breach and a GitHub CI/CD abuse campaign show how the next layer of exposure is now sitting inside trusted channels.

AI speeds intrusion cycles, revocation becomes the test, and Microsoft-native SecOps takes over

How it developed

  1. Autonomous Control Planes, Continuous Dependency Control, and Pre-Scoped Compliance Environments
    • Third-Party Risk Shifts to Continuous Dependency Control

  2. Agent Identity Governance Becomes the New Control Plane, Securing Credentials, Permissions, and Audit Trails
    • Third-Party Dependency Risk

Go deeper

Curated long-form picks on this trend — podcasts, videos, and analysis, by vantage.

Stay ahead in Cyber Security

Get the weekly brief in your inbox — the developments, what they mean by vantage, and what to do next.