Add Ergonomic Security to Your CI/CD Pipeline | Qualys

Summary: Qualys describes integrating its security testing into CI/CD pipelines through plugins for Jenkins, Bamboo, and TeamCity, using the tools' plugin architecture to run dynamic security testing as a post-build action. The article walks through three pipeline examples - web applications scanned with Qualys WAS, containers assessed across Build, Ship, Run, and Host phases, and cloud infrastructure scanned with Qualys Vulnerability Management - with severity thresholds configured to fail the build when exceeded.
What's compelling: The article's own framing is that this wave of innovation too often ignores security or treats it as an afterthought, and that the goal is to keep vulnerable code, containers, machines, and cloud resources out of production. The concrete stake is the build-fail threshold: someone has to decide which severity, QID, CVE, or CVSS criteria stop a release, and that decision sits with security leadership even when the remediation work is handed to developers.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026