← Exposure ManagementPreviewDevSPM · Built on Skyreach Orion

Connect who can change software to what reaches production.

Development Security Posture models repositories, pipelines, runners, dependencies, tokens and deployment identities. Orion links the software supply chain to runtime workloads so teams can see where a source-control or CI/CD compromise could become production exposure.

Discuss your environmentSee what it reveals
Evidence in

What Orion connects

The exact coverage depends on the integrations and authorised evidence available in your environment. Every record retains where it came from.

Example sources

  • GitHub, GitLab and supported source control
  • Azure DevOps and CI/CD platforms
  • Repositories, branches and protection settings
  • Pipelines, runners and deployment environments
  • SBOM and dependency evidence
  • Tokens, deploy keys and workload identities

What the ontology models

  • Repositories, code owners and contributors
  • Build and deployment pipelines
  • Runners, agents and execution environments
  • Packages, artifacts and dependencies
  • Credentials and deployment identities
  • Runtime workloads produced by the pipeline
Intelligence out

What visibility and insight you gain

The module uses the shared Orion model, so its findings can be understood through evidence collected by other security disciplines.

Code-to-runtime traceability

Follow a repository and artifact through build and deployment to the workloads that execute it.

Pipeline privilege

Show what CI/CD identities, runners and tokens can modify or deploy.

Control coverage

Assess available evidence for branch protection, review, signing and pipeline isolation.

Supply-chain exposure

Connect vulnerable dependencies and development access to production impact.

Connected analysis

An example of the exposure Orion can reveal

This is an illustrative relationship chain, not a claim that every path represents a confirmed compromise. Orion preserves evidence and confidence so teams can validate what is effective.

Developer tokenSource repositoryDeployment pipelineProduction workload
Risks made visible

What the module is looking for

  • Over-privileged pipeline and runner identities
  • Unprotected branches feeding production deployments
  • Long-lived tokens and unowned deploy keys
  • Vulnerable dependencies in deployed artifacts
  • Untrusted build environments with production access
  • Repository compromise paths to critical services
Questions it helps answer

Move from findings to decisions

  • Who can change code that reaches production?
  • What can this pipeline identity modify?
  • Where is this vulnerable package deployed?
  • Which repositories lack controls for their runtime importance?
Why Orion matters

This discipline does not operate in isolation

Development Security Posture Management contributes its evidence to the same ontology used by the rest of Exposure Management. That allows a finding to inherit network reachability, identity privilege, data sensitivity, software, application and business context where those facts exist.

See the complete Exposure Management product
DevSPM evidence+Shared ontology+Cross-domain context=Prioritised exposure

See what this means in your environment

Tell us which sources you use and the questions your teams struggle to answer today.

Talk to SkyReach