GitProtect’s DevOps Threat Unwrapped Report 2026, published this week, delivers a sobering set of findings for teams that manage source code and CI/CD infrastructure. The report documents how Git hosting platforms and developer toolchains moved from incidental targets to primary attack vectors over the past 12 months.
Among the key findings: espionage-motivated breaches increased 163% year-over-year and now represent 17% of all incidents, suggesting that nation-state and organised criminal groups have identified developer infrastructure as a high-value entry point into organisations. Third-party involvement in breaches has doubled to 30% of all incidents, with attackers increasingly compromising tools, extensions, and integrations rather than targeting organisations directly.
The integration of AI into DevOps platforms creates an expanded attack surface that the report flags as a priority concern. Emerging threat classes include malicious prompt injections into AI coding assistants, remote code execution triggered through AI-assisted code suggestions, and credential leaks via compromised marketplace extensions. These vectors are harder to detect with traditional security tooling because the attack surface is embedded in the development workflow itself.
On the infrastructure side, CI/CD pipelines remain a high-value target. The report notes that pipelines are often configured with overly broad credential scopes, insufficient secret rotation practices, and inadequate isolation between build environments. Even teams with strong application security practices frequently leave their build and deployment infrastructure under-hardened.
The headline recommendation is to treat your DevOps platform as a critical security boundary, not just a productivity tool. That means regular audits of pipeline credentials, extension provenance checks, secret scanning in repositories, and clear policies for AI tool usage within the development environment. If you want help reviewing your DevOps security posture against the findings in this report, contact Excello Digital and we will carry out a focused assessment.