Your CI/CD Pipeline Is Over-Privileged: Identity Risks in Modern Cloud Platforms

Most organizations spend enormous effort on human identity: SSO, MFA, least privilege, quarterly access reviews. Meanwhile the CI/CD service account quietly holds cluster-admin, a long-lived cloud key, and push access to production. Nobody reviews it, because nobody thinks of a pipeline as an identity. This talk makes the case that your pipeline is the most over-privileged principal in your platform, and the least monitored. We walk through how these permissions accumulate, what an attacker does with a compromised runner, and why secret rotation alone does not fix it. Then we look at what actually reduces the blast radius: short-lived workload identity instead of static keys, scoping credentials per environment rather than per pipeline, and treating pipeline identity as something you audit on the same cadence as human access.