6. Secure and Optimize Automation (10-15%)

The smallest domain by weight, and the one that reaches into every other. A workflow is code with credentials running on a machine you may not own, triggered by events strangers can cause — which makes CI/CD an attractive target and makes these controls load-bearing. The second half of the phase turns to the other constant pressure: making all of this fast enough and cheap enough that teams keep using it.