Failure Pattern
Automation systems use powerful credentials that attackers exploit. Because automation is trusted, malicious tasks execute without scrutiny.
What We See in the Field
A compromised CI/CD job deploys malicious containers or infrastructure changes. Downstream automation systems accept the changes automatically.
Underlying Causes
Overprivileged automations
Stored credentials
No workload-level verification
Pipeline impersonation
Identity drift across automation chains
Trust-Native Network Resolution
DTL requires verified workload identity for automation steps. Pipelines cannot issue commands unless they present valid TrustKeys tied to their true origin.
Broken Trust Assumption
The attacks that exposed this failure pattern were not stealthy break-ins. They were trusted operations.
During incidents such as SolarWinds, Capital One, and Okta, malicious activity was carried out using valid identities and approved execution paths. Certificates were valid. Tokens were accepted. Sessions were authenticated. From the system’s point of view, nothing appeared wrong.
This is the risk of trust inferred from credentials, location, or prior authentication.