Get started
Work

Security-as-code: Enforcing Cybersecurity Standards Through Automated Governance in Cloud Pipelines

Year: 2025
Type: article
Abstract: The recent widespread use of the cloud-native architectures and DevSecOps practices has changed the nature of software delivery pipelines, yet created new areas of attack and compliance exposures.Conventional security models cannot scale with the speed and sophistication of current CI/CD environments, resulting in vulnerability detection that is too often performed at the end of the pipeline and compliance issues.To reduce such challenges, this study proposes an automated governance framework using Security-as-Code(SaC) that integrates security requirements in cloud pipelines.The framework embeds policy-as-code, continuous compliance assessment and evidence production to guarantee that policy is enforced at each iteration of the development process.Evaluation on multi-cloud CI/CD pipelines indicated that the framework is effective in detecting policy violations early (82 percent), has low performance overhead during enforcement (reduction by five percent), and full coverage on audit evidence (95 percent completeness).The results indicate that the incorporation of governance as code would be able to substantially decrease the degree of human error, automate the process of Security-as-Code: Enforcing Cybersecurity Standards through Automated Governance in Cloud Pipelines https://iaeme.com/Home/journal/IJCET11 [email protected] enforcement, and support the field of traceable and audit-able decisionmaking.The results demonstrate the possibility of Security-as-Code to achieve proactive vs. reactive DevSecOps governance, both agile and in regulatory compliance with cloud-native.
DOI: 10.34218/ijcet_16_05_002
Language: English
Open Access status: diamond
OpenAlex ID: W4414340867
FWCI:
Cites:
Cited by:
Related to: