Rolling a scanner out to five pipelines is an afternoon. Rolling it out to five hundred — across dozens of teams, YAML and classic definitions, with different owners and different risk profiles — is an operating problem that YAML snippets and wiki pages do not solve.
Enterprises that succeed treat scan coverage as managed state, not as a one-time change request.
Why the copy-paste model collapses
- Every team edits YAML differently; versions, parameters, and exclusions drift immediately.
- New pipelines are born unscanned by default.
- Nobody owns the question 'which builds are actually covered today?'
- Rollbacks and template changes silently remove tasks, and nothing alerts on it.
Security Runtime: coverage instead of invitation
Kangl Pipeline Security Runtime applies security controls to builds in scope without editing each definition. That flips the default: pipelines are covered unless deliberately excluded, instead of uncovered unless someone remembered.
Runtime delivery alone is not the full answer — you still need eligibility rules, per-pipeline state, exclusion governance, and a way to verify that what you intended is what is running.
The managed-pipeline operating model
- Discover: enumerate all build pipelines and classify eligibility (YAML and classic build pipelines; classic release pipelines are out of scope).
- Enroll: enable scanning per pipeline or in bulk, with the state held centrally — not implied by YAML contents.
- Verify: continuously compare intended state with actual configuration and surface drift.
- Repair: fix divergence with a controlled Force Sync, not a ticket asking a team to re-add a task.
- Govern: record every enable, disable, exclusion, and bulk action in an audit trail.
How Kangl implements this
Kangl inventories your Azure DevOps organizations, tracks pipeline eligibility and enrollment as first-class state, drives Pipeline Security Runtime centrally, detects drift, and repairs it with Force Sync. Bulk operations make the 500-pipeline rollout a governed action instead of a quarter-long campaign.
