Securing CI/CD Pipelines through AI-Assisted Threat Modeling and Software Supply Chain Attestation

Abstract

Continuous Integration and Continuous Deployment (CI/CD) pipelines have become essential components of modern software development, enabling rapid integration, automated testing, and continuous software delivery. However, their extensive reliance on third-party dependencies, automated workflows, privileged credentials, and interconnected development tools introduces significant security risks. Traditional security approaches often struggle to identify evolving threats across complex software supply chains. This study examines how artificial intelligence (AI)-assisted threat modeling and software supply chain attestation can strengthen CI/CD pipeline security. The proposed approach integrates machine learning-based anomaly detection, automated threat identification, risk prioritization, and cryptographic provenance verification to improve the visibility and integrity of software delivery processes. AI-assisted threat modeling supports the systematic identification of vulnerabilities, malicious workflow modifications, unauthorized access, dependency compromise, and credential misuse. Meanwhile, software supply chain attestation provides verifiable evidence regarding software origins, build environments, dependencies, and artifact integrity. The research adopts a design-oriented methodology involving security requirement analysis, conceptual framework development, threat scenario modeling, and evaluation through predefined security metrics. The framework is assessed in terms of threat detection effectiveness, attestation coverage, false-positive rates, verification latency, and operational overhead. The study aims to establish a practical security model that combines intelligent threat analysis with verifiable software provenance, enabling organizations to improve supply chain resilience, reduce attack exposure, and establish trustworthy automated software delivery