PRESS RELEASE

“When Development and Security work from the same pipeline, security stops being a gate and becomes an accelerator. Give engineers guardrails — short-lived credentials, policy-as-code, and default secret detection — and you reduce incidents while increasing velocity,” says Dennis Baltazar.

Baltazar says, “Leaders should ask two questions today: Do we know where secrets and privileged access still live in code, pipelines and SaaS integrations — and how fast can we rotate or remove them? And do we measure dependency integrity and anomalous pipeline behaviour with the same rigour we apply to production systems?” He adds that if these core questions are not understood and actioned, organisations may be at risk.

“Your code is more than just code — it’s your identity, your infrastructure, your business; it accesses your critical data. Organisations should treat it like any other valuable asset by ensuring it is protected from vulnerabilities,” says Baltazar.

“The risks of not taking action are exposure of cryptographic keys and passwords; cloud-infrastructure compromise; identity theft and privilege escalation; and long-term reputational and operational damage,” Baltazar warns.

“Good security teams rotate secrets; great teams eradicate them from code, instrument their pipelines, and catch abuse in runtime before it becomes an incident,” Baltazar added.

Baltazar recommends taking the 4 following steps. For full insights, including the first 72 hours plan and subsequent 7-day plan, read his full blog

How Avocado can help.

• Audit secrets and unmanaged privileged/non-human accounts across repositories, CI/CD, cloud and SaaS; revoke stale credentials and right-size access.

• Comprehensive review of code repositories, from intellectual property to open-source packages. Ask about Avocado’s identity scan. This scan will identify unmanaged identities including secrets, keys and tokens used in CI/CD pipelines and native cloud infrastructures.
• Workload identity and secrets analysis mapped to OWASP Top 10 risks for non-human identities.
• Pipeline hardening from build to operate, including policy-as-code and runbook updates.
• DevSecOps enablement: embed developer-friendly controls (push protection, secret scanning at commit/push/build, policy-as-code, short-lived credentials) so secure practice is the default, not an afterthought.

Media contact
Amy Kitson: [email protected] | 0455 515 060

About Avocado Consulting
Avocado Consulting helps organisations deliver with certainty across cloud, security, testing and DevSecOps – uplifting teams and hardening platforms with practical, outcome-focused services.