Datadog’s 2026 DevSecOps Report Highlights CI/CD and Supply-Chain Risks
Summary
Datadog’s 2026 State of DevSecOps report finds widespread exploitable vulnerabilities, stale and newly released dependencies in use, and weak GitHub Actions pinning. StepSecurity uses the findings to promote controls including SHA pinning and runtime monitoring.
Key points
- Datadog says its report analyzed tens of thousands of applications and supply-chain dependencies; 87% of organizations had at least one exploitable vulnerability, affecting 40% of services.
- The median dependency was 278 days behind its latest major version; libraries published in 2023 averaged 3.8 vulnerabilities per service, compared with 1.3 for 2025 libraries.
- Half of organizations used third-party libraries within a day of release; Datadog also found that 1.6% of organizations using npm had used at least one malicious dependency in the past year.
- Only 4% of organizations pinned every GitHub Marketplace action to a hash, while 71% pinned none; 80% used at least one third-party action not pinned to a commit hash.
- After runtime and CVE context adjustments, only 18% of critical dependency vulnerabilities remained critical, according to the report.
- StepSecurity promotes controls including pinning actions to commit SHAs, delaying new package adoption, checking for known compromised packages, and monitoring CI/CD runtime behavior.
Article Details
- Publisher
- StepSecurity
- Report Period
- 2026
- Scope
- Datadog's State of DevSecOps report on applications and software supply-chain dependencies, including vulnerabilities, dependency freshness, and CI/CD security.
- Sample Size
- Tens of thousands of applications; exact count not disclosed.
- Key Statistics
- Datadog reported that 87% of organizations had at least one exploitable vulnerability, affecting 40% of services.
- The median dependency was 278 days behind its latest major version, compared with 215 days the previous year.
- Datadog reported that 50% of organizations used third-party libraries within a day of release; 1.6% of organizations using npm had used at least one malicious dependency in the past year.
- Only 4% of organizations pinned every marketplace action to a hash, while 71% pinned none; 80% used at least one third-party marketplace action not pinned to a commit hash.
- Only 18% of critical dependency vulnerabilities remained critical after adjustment using runtime and CVE context.
- Recommendations
- Pin GitHub Actions to full-length commit SHAs.
- Use a dependency cooldown before adopting newly published packages; Datadog recommended a one-week cooldown.
- Require checks that block known compromised packages.
- Add Harden-Runner to workflows for runtime monitoring and egress control.
- Use NPM Package Search and Threat Center to assess exposure and monitor supply-chain compromises.
People
Vendors
DatadogDatadog just released their State of DevSecOps 2026 report, analyzing tens of thousands of applications and their supply chain dependencies. The findings confirm a reality we've been documenting through real-worldGitHub"GitHub Actions workflows routinely handle production credentials, generate release builds, and execute third-party code in highly privileged contexts, yet most organizations don't secure them with the same rigor theyStepSecurityThe data is in, and it validates the warnings StepSecurity has been sounding for years.
Products
Artifact MonitorArtifact Monitor provides continuous compliance monitoring for your own published artifacts, verifying that every version is tied to a trusted CI/CD release process.GitHub Actions"GitHub Actions workflows routinely handle production credentials, generate release builds, and execute third-party code in highly privileged contexts, yet most organizations don't secure them with the same rigor theyHarden-Runnerthrough compromised dependencies, outdated libraries, and insecure build processes. StepSecurity's Harden-Runner provides runtime security for GitHub Actions workflows by monitoring network traffic, file systemNPM Package Compromised Updates CheckNPM Package Compromised Updates runs as a GitHub Check on every pull request, ensuring that no dependency update introduces a package that is known to be compromised. StepSecurity maintains an internal database ofnpm Package CooldownNPM Package Cooldown is a GitHub Check that automatically blocks any pull request that introduces a dependency published within a configurable waiting period (default: 2 days). If a PR tries to add a package that wasnpm Package SearchNPM Package Search lets security teams search across their entire organization to identify where specific packages were introduced via pull requests.Orchestrate SecurityOrchestrate Security automatically pins GitHub Actions and container images to full-length commit SHAs across your repositories. This is the exact mitigation that both Datadog and GitHub recommend as the only way toStepSecurity Dev Machine GuardDev Machine Guard extends supply chain protection to developer machines, where the risk often starts before code ever reaches a pipeline. With Local npm Monitoring, security teams gain full visibility into packagesStepSecurity Maintained ActionsStepSecurity Maintained Actions go a step further by providing curated, security-reviewed replacements for popular third-party actions. Every maintained action undergoes rigorous manual secure code review beforeThreat CenterThreat Center serves as a central hub for tracking active supply chain compromises across open-source ecosystems. When an incident like Shai-Hulud breaks, security teams can investigate details and apply remediation