--- title: Vigilant Research description: Vigilant Research delivers cybersecurity analysis, threat intelligence, technical findings, and field-driven insights to help Decision makers and defenders understand real-world risk. image: https://vigilantdefense.com/hubfs/Research_Page_Feature_Image.png --- [![Vigilant](https://vigilantdefense.com/hubfs/Marketing_Assets/logos/vigilant_horizontal_colormark_whitetext_nb.png)](https://vigilantdefense.com) [Platform](https://vigilantdefense.com/platform) [Services](https://vigilantdefense.com/services) [Why Vigilant](https://vigilantdefense.com/why-vigilant) [Vigilant Hope](https://vigilantdefense.com/vigilant-hope) [Company](https://vigilantdefense.com/about) [Research](https://vigilantdefense.com/research) [CyberDNA Login](https://cyberdna.vigilantdefense.com) [Request Demo](https://vigilantdefense.com/contact) [Platform](https://vigilantdefense.com/platform) [Services](https://vigilantdefense.com/services) [Why Vigilant](https://vigilantdefense.com/why-vigilant) [Vigilant Hope](https://vigilantdefense.com/vigilant-hope) [Company](https://vigilantdefense.com/about) [Research](https://vigilantdefense.com/research) [CyberDNA Login](https://cyberdna.vigilantdefense.com) [Request Demo](https://vigilantdefense.com/contact) Vigilant Research # Research Original research, technical analysis, and field-driven security insight from Vigilant. ## [Featured Research We Scanned GitHub's Top 50K Repos for CI/CD Vulnerabilities — Here's What We Found A comprehensive guide from Vigilant's security research team. 50,012 repos scanned. 192,776 vulnerabilities found. 40.6% of repos are vulnerable. 50,012 Repos Scanned 40.6% Vulnerable 192,776 Findings 590M+ Downstream Forks Read the full research →](https://www.vigilantdefense.com/research/github-top-50k-repos-cicd-security-scan) Filter: [All](https://vigilantdefense.com/research) [CICD](https://vigilantdefense.com/research/tag/cicd) [Github](https://vigilantdefense.com/research/tag/github) [Supply-Chain](https://vigilantdefense.com/research/tag/supply-chain) [Iran](https://vigilantdefense.com/research/tag/iran) [Stryker](https://vigilantdefense.com/research/tag/stryker) [litellm](https://vigilantdefense.com/research/tag/litellm) [trivy](https://vigilantdefense.com/research/tag/trivy) ## Latest Research Analysis designed to help defenders understand what attackers see, exploit, and operationalize. [![From Scanner to Weapon: Inside the Supply Chain Attack That Backdoored the #1 AI Key Management Library](https://vigilantdefense.com/hubfs/litellmteampcp.png)](https://www.vigilantdefense.com/research/from-scanner-to-weapon-inside-the-supply-chain-attack-that-backdoored-the-1-ai-key-management-library) Mar 25, 2026, 5:37:42 PM ## [From Scanner to Weapon: Inside the Supply Chain Attack That Backdoored the #1 AI Key Management Library](https://www.vigilantdefense.com/research/from-scanner-to-weapon-inside-the-supply-chain-attack-that-backdoored-the-1-ai-key-management-library) Vigilant breaks down the Trivy-to-LiteLLM supply chain attack chain step by step. How attackers compromised a vulnerability scanner, stole a PyPI publish token, and backdoored 97 million monthly downloads worth of AI infrastructure. Plus: the 50K-repo scan that found it first. [Github](https://vigilantdefense.com/research/tag/github) [CICD](https://vigilantdefense.com/research/tag/cicd) [litellm](https://vigilantdefense.com/research/tag/litellm) [trivy](https://vigilantdefense.com/research/tag/trivy) [Read analysis →](https://www.vigilantdefense.com/research/from-scanner-to-weapon-inside-the-supply-chain-attack-that-backdoored-the-1-ai-key-management-library) [![Beyond Snapshots — Why CI/CD Security Needs Continuous Monitoring](https://vigilantdefense.com/hubfs/articles/cicd-research/images/13-threatcert-radar.png)](https://www.vigilantdefense.com/research/cicd-security-continuous-monitoring-beyond-snapshots) Mar 24, 2026, 2:30:03 PM ## [Beyond Snapshots — Why CI/CD Security Needs Continuous Monitoring](https://www.vigilantdefense.com/research/cicd-security-continuous-monitoring-beyond-snapshots) This entire 50K-repo research series is a single snapshot — already aging. CI/CD pipelines change daily. Point-in-time scans miss the drift. Here's why continuous monitoring is the only defense that matches the speed of modern supply chain attacks. [Github](https://vigilantdefense.com/research/tag/github) [CICD](https://vigilantdefense.com/research/tag/cicd) [Read analysis →](https://www.vigilantdefense.com/research/cicd-security-continuous-monitoring-beyond-snapshots) Mar 24, 2026, 2:21:44 PM ## [What's Next, Fixing 50K Repos, One PR at a Time](https://www.vigilantdefense.com/research/fixing-50k-repos-automated-pull-requests) We scanned 50K repos and found 192,776 CI/CD vulnerabilities. Now we're submitting pull requests to fix them — automated remediation at ecosystem scale. Here's the plan, the limits, and what happens to the repos nobody maintains anymore. [Github](https://vigilantdefense.com/research/tag/github) [CICD](https://vigilantdefense.com/research/tag/cicd) [Read analysis →](https://www.vigilantdefense.com/research/fixing-50k-repos-automated-pull-requests) [![The Software Supply Chain Crisis — 74.5% of Findings Are Unpinned Actions](https://vigilantdefense.com/hubfs/articles/cicd-research/images/06-top-unpinned-actions.png)](https://www.vigilantdefense.com/research/supply-chain-crisis-unpinned-github-actions) Mar 24, 2026, 2:14:52 PM ## [The Software Supply Chain Crisis — 74.5% of Findings Are Unpinned Actions](https://www.vigilantdefense.com/research/supply-chain-crisis-unpinned-github-actions) 143,616 of 192,776 CI/CD findings in GitHub's top 50K repos trace to one problem: mutable action tags. One compromised maintainer account. Thousands of repos. [Github](https://vigilantdefense.com/research/tag/github) [Supply-Chain](https://vigilantdefense.com/research/tag/supply-chain) [CICD](https://vigilantdefense.com/research/tag/cicd) [Read analysis →](https://www.vigilantdefense.com/research/supply-chain-crisis-unpinned-github-actions) Mar 24, 2026, 2:11:31 PM ## [Fix It — SHA Pinning, Least Privilege, and the 5-Minute Security Upgrade](https://www.vigilantdefense.com/research/fix-cicd-security-sha-pinning-least-privilege) 246,496 CI/CD findings across GitHub's top 50K repos are auto-fixable. SHA pinning, permission scoping, input validation — most take under 5 minutes. Step-by-step fixes for every vulnerability class. [Github](https://vigilantdefense.com/research/tag/github) [CICD](https://vigilantdefense.com/research/tag/cicd) [Read analysis →](https://www.vigilantdefense.com/research/fix-cicd-security-sha-pinning-least-privilege) [![The Language Risk Matrix — Why Rust Repos Are the Most Vulnerable](https://vigilantdefense.com/hubfs/articles/cicd-research/images/10-language-risk-matrix.png)](https://www.vigilantdefense.com/research/language-risk-matrix-rust-repos-cicd-security) Mar 24, 2026, 2:05:51 PM ## [The Language Risk Matrix — Why Rust Repos Are the Most Vulnerable](https://www.vigilantdefense.com/research/language-risk-matrix-rust-repos-cicd-security) Rust, the language built to eliminate memory bugs — has a 77.9% CI/CD vulnerability rate, the highest in GitHub's top 50K repos. The paradox: complex toolchains drive complex pipelines, and complex pipelines create attack surface. [Github](https://vigilantdefense.com/research/tag/github) [CICD](https://vigilantdefense.com/research/tag/cicd) [Read analysis →](https://www.vigilantdefense.com/research/language-risk-matrix-rust-repos-cicd-security) Mar 24, 2026, 1:56:14 PM ## [AI Agents as Force Multipliers — The Next Evolution of Supply Chain Attacks](https://www.vigilantdefense.com/research/ai-agents-cicd-supply-chain-force-multipliers) The tj-actions attack was human-paced — detected in days. AI agents automate every step of the same chain attack and compress the window to hours. We scanned 50K repos and found the attack surface already staged. [Github](https://vigilantdefense.com/research/tag/github) [CICD](https://vigilantdefense.com/research/tag/cicd) [Read analysis →](https://www.vigilantdefense.com/research/ai-agents-cicd-supply-chain-force-multipliers) [![The Docker Chokepoint — One Org, Six Actions, Thousands of Pipelines](https://vigilantdefense.com/hubfs/articles/cicd-research/images/08-docker-pipeline-flow.png)](https://www.vigilantdefense.com/research/docker-chokepoint-github-actions-supply-chain) Mar 24, 2026, 1:45:50 PM ## [The Docker Chokepoint — One Org, Six Actions, Thousands of Pipelines](https://www.vigilantdefense.com/research/docker-chokepoint-github-actions-supply-chain) Docker's 6 official GitHub Actions run unpinned in 2,740+ of GitHub's top repos. One compromised org would poison container builds and registry credentials across the open-source ecosystem. [Read analysis →](https://www.vigilantdefense.com/research/docker-chokepoint-github-actions-supply-chain) [![Anatomy of a CI/CD Chain Attack — From Recon to Exfiltration](https://vigilantdefense.com/hubfs/articles/cicd-research/images/09-chain-attack-flow.png)](https://www.vigilantdefense.com/research/cicd-chain-attack-anatomy-recon-to-exfiltration) Mar 24, 2026, 1:41:07 PM ## [Anatomy of a CI/CD Chain Attack — From Recon to Exfiltration](https://www.vigilantdefense.com/research/cicd-chain-attack-anatomy-recon-to-exfiltration) 611 repos in GitHub's top 50K have every ingredient for a full CI/CD compromise — unpinned action, write permissions, dangerous trigger. Here's the 5-step chain attack, mapped to real scan data. [Supply-Chain](https://vigilantdefense.com/research/tag/supply-chain) [CICD](https://vigilantdefense.com/research/tag/cicd) [Read analysis →](https://www.vigilantdefense.com/research/cicd-chain-attack-anatomy-recon-to-exfiltration) [![INTEL BRIEFING SITREP - STRYKER ATTACK](https://vigilantdefense.com/hubfs/StrykerFeatureImage.png)](https://www.vigilantdefense.com/research/intel-briefing-sitrep-stryker-attack) Mar 13, 2026, 6:00:54 PM ## [INTEL BRIEFING SITREP - STRYKER ATTACK](https://www.vigilantdefense.com/research/intel-briefing-sitrep-stryker-attack) Iranian state-linked hackers executed a destructive cyberattack against Stryker, wiping 200,000 devices and stealing 50TB of data [Stryker](https://vigilantdefense.com/research/tag/stryker) [Iran](https://vigilantdefense.com/research/tag/iran) [Read analysis →](https://www.vigilantdefense.com/research/intel-briefing-sitrep-stryker-attack) Subscribe to Vigilant Research Subscribe [![Vigilant](https://vigilantdefense.com/hubfs/Marketing_Assets/logos/vigilant_horizontal_colormark_whitetext_nb.png)](https://vigilantdefense.com) The platform that sees what others miss. Forensically validated detection turns untrusted data into trusted intelligence. [(855) 238-4445](tel:8552384445) [sales@vigilantdefense.com](mailto:sales@vigilantdefense.com) **Global Headquarters** 7570 Bales St. Suite 250 Cincinnati, Ohio 45069 **Remote Operations** Lexington, Kentucky #### Platform [CyberDNA Platform](https://vigilantdefense.com/platform) [ThreatCERT](https://vigilantdefense.com/threatcert) [Vigilant AI](https://vigilantdefense.com/platform) [FVDR Network Sensor](https://vigilantdefense.com/platform) [Proof of Vigilance](https://vigilantdefense.com/pov) #### Services [Managed SOC](https://vigilantdefense.com/services/managed) [Platform + Overwatch](https://vigilantdefense.com/services/platform-overwatch) [Data Sources](https://vigilantdefense.com/platform) [Service Overview](https://vigilantdefense.com/services) #### Company [About Us](https://vigilantdefense.com/about) [Why Vigilant](https://vigilantdefense.com/why-vigilant) [Vigilant Hope](https://vigilantdefense.com/vigilant-hope) [Partners](https://vigilantdefense.com/partners) [Contact](https://vigilantdefense.com/contact) #### Resources [Research & Blog](https://vigilantdefense.com/research) [Request Whitepapers](https://vigilantdefense.com/research) [Runner Guard](https://vigilantdefense.com/runner-guard) [Request Demo](https://vigilantdefense.com/contact) © Vigilant. All rights reserved. [Terms & Conditions](https://vigilantdefense.com/terms) [Partner Terms](https://vigilantdefense.com/partner-terms) ♥ 25% of profits donated to protect the vulnerable