Secure your Jenkins surface
A build system that can reach production, often running plugins years out of date. We don’t connect to Jenkins to collect evidence for its own sake — we connect to secure it, and the compliance artefacts follow from that work.
Book a Demo[01] What This Surface Exposes
Where Jenkins goes wrong
Jenkins goes wrong because it can reach production while running plugins years out of date, several with actively exploited vulnerabilities.
- Plugins well behind current, carrying known and frequently exploited vulnerabilities
- Anonymous read or build permissions left enabled
- Credentials stored at global scope, available to every job including untrusted ones
- Script console accessible to non-administrators, which is remote code execution by design
- Agents connecting over unauthenticated channels
[02] What We Secure
What we watch, catch and fix on Jenkins
On Jenkins we track plugin currency against known exploited vulnerabilities and review credential scope per job.
- Plugin currency tracked against known exploited vulnerabilities, since Jenkins plugins are a standing exploitation target
- Permission model audited for anonymous and authenticated-everyone grants
- Credential scope reviewed per job, because global credentials mean any job compromise is a full compromise
- Script console access treated as administrative privilege
- Agent connection security verified
[03] Where It Lands
Where Jenkins lands in your registers
Repositories and pipelines become asset register entries with their own criticality, because a build system that can deploy to production is a production system. Access reviews cover repository and pipeline permissions alongside your other entitlements, and the risk register carries supply chain exposure — the dependencies you pull, the actions you run, and who can push without review.
[04] How We Engage
On Jenkins specifically
On Jenkins, we restrict permissions, scope credentials to jobs, and drive plugin updates through your maintenance windows. Controller upgrades and agent re-architecture we project-manage given the release-pipeline outage risk.
Platform licence
Everything you need to find and fix it yourself, with no ceiling on the depth of the answer.
- Every connected tool monitored for misconfiguration and drift, with findings mapped to the assets and risks they affect
- Remediation guidance that tells you what is wrong and exactly how to fix it — however deep or awkward the issue is. We are engineers running a security company, so the answer is the real one, not a link to vendor documentation
- Assets, access reviews, and risk register populated from the tools themselves rather than from spreadsheets
- Unlimited integrations and unlimited users, with anything missing built within two weeks
Managed service
Every tool you connect through Konfirmity comes under our care, with our team doing the work.
- Continuous misconfiguration and drift monitoring across every connected tool, watched by our analysts rather than by a dashboard waiting for you
- Incident response led by us, with containment coordinated with your team
- Remediation performed directly wherever you have granted us the authority to act — and where we cannot act, we project-manage the fix to completion rather than handing you a ticket
- Decision support on the tools themselves: where something is failing you on capability or costing more than it returns, we will tell you, and help you replace it
[05] Jenkins FAQs
What Jenkins access does Konfirmity need?
Konfirmity needs a read-only account with Overall/Read and Job/Read, plus API token access. That covers plugin inventory, permission model, credential scoping and job configuration without any ability to trigger builds or modify configuration.
Why is global credential scope a problem?
Because global credentials are available to every job on the controller, including any job an attacker can influence. One compromised pipeline then reaches everything Jenkins can. Scoping credentials to the jobs that need them contains that blast radius substantially.
GitHub
GitLab
Bitbucket
CircleCI
Snyk