Case Study: Checkmarx achieves least-privilege GitHub Actions security at enterprise scale with StepSecurity

Checkmarx identifies 76 end-of-life actions across 263 repositories with StepSecurity

Checkmarx, a security company, faced the challenge of securing its extensive use of GitHub Actions at an enterprise scale. The flexibility of the platform introduced significant security risks, and they needed to establish stronger guardrails and enforce least-privilege principles across hundreds of repositories. They turned to vendor StepSecurity and its Harden-Runner product to gain centralized control and visibility.

StepSecurity provided a solution that enabled Checkmarx to implement block-by-default network egress policies with narrowly-scoped allowlists. This significantly improved security posture by giving teams visibility into pipeline activity and enforcing least privilege. The measurable results included identifying and replacing 76 end-of-life third-party actions across 263 repositories, which greatly reduced action sprawl and its associated risk.

Checkmarx