Configuration drift is the divergence between the configuration you intend and the configuration actually in effect. In CI/CD security, drift looks like a pipeline that was enrolled in scanning but no longer runs the scanner — after a template refactor, a clone, a rename, or a 'temporary' disable nobody reverted.
Why security drift is invisible
A pipeline that stops scanning does not fail; it goes green faster. Every incentive in the delivery loop rewards the drifted state, and unless something compares intended coverage to observed configuration, nothing raises an alarm.
The reconciliation answer
- Hold desired state centrally — enrollment, settings, policy mode.
- Observe actual state on a schedule, from the platform's own APIs.
- Diff the two; attach divergence to the specific pipeline as a drift signal.
- Repair through a deliberate, audited action — not silently, and not by ticket-and-hope.
