CMDashCybersecurity Maturity Dashboard

← All landscape areas

Application Security · Advanced

DevSecOps & Secrets Management

Secures CI/CD pipelines, IaC, and secrets.

10 options listedTypical cost: $15k-$100k/yrPROTECT (PR)

Overview

This area secures the build/release pipeline: IaC scanning, pipeline hardening, and centralized secrets/credential management. It prevents leaked keys and insecure infrastructure-as-code from reaching production. Tooling spans secrets vaults, scanners, and pipeline policy engines. Licensed per developer, secret, or node.

Pipeline hardening as engineering and infrastructure scale.

Advantages

HashiCorp Vault is the de facto secrets standard
GitGuardian strong on leak detection
Checkov/tfsec free
prevents leaked-key breaches.

Trade-offs

Vault operational complexity
tool sprawl across the pipeline
developer-workflow friction
secrets sprawl is hard to fully close.

Vendors & tools in this area

HashiCorp VaultOpen source

Secrets management (OSS core).

GitGuardianCommercial

Secrets-leak detection across code and repos.

WizCommercial

Agentless CNAPP leader; risk graph, fast UX.

CyberArk ConjurCommercial

Secrets management for DevOps (CyberArk).

Vault OSSOpen source

Open-source core of HashiCorp Vault.

TrivyOpen source

Images/IaC/deps/secrets scanner (Aqua).

CheckovOpen source

IaC security scanning (Prisma/Bridgecrew).

tfsecOpen source

Terraform static analysis.

InfisicalOpen source

Open-source secrets management.

DopplerCommercial

Developer-first secrets manager with predictable per-seat SaaS pricing, positioned against self-hosted Vault.

Start free trial Browse the full atlas

DevSecOps & Secrets Management — Cybersecurity Landscape Atlas — CMDash