Originally reported by Help Net Security (helpnetsecurity.com), August 2019.
Overview
Denim Group, an independent application security firm, announced an updated Jenkins Plugin designed to integrate with ThreadFix, their flagship vulnerability management platform. The integration allows development teams to embed application security testing directly into continuous integration and continuous delivery (CI/CD) pipelines, enabling security concerns to be addressed earlier and more consistently in the software development lifecycle.
What Is ThreadFix?
ThreadFix is an application security management platform aimed at both developers and security professionals. It is designed to help organizations aggregate, correlate, and manage vulnerability data from multiple security testing tools, providing a consolidated view of application risk across the software portfolio.
According to Denim Group, the platform is intended to reduce the manual overhead faced by security analysts by centralizing vulnerability tracking and prioritization. The company claims the platform can reduce application vulnerability counts by 35%, though independent verification of this figure is not available.
How the Jenkins Plugin Integration Works
The updated Jenkins Plugin creates a tightly coupled workflow between the Jenkins build system and the ThreadFix platform. The high-level process works as follows:
- Test initiation: Security testing is triggered by the Jenkins Plugin as part of the standard build process.
- Orchestration: The ThreadFix platform orchestrates the testing activity, which can include static analysis (SAST), dynamic analysis (DAST), and vulnerable component or software composition analysis (SCA).
- Policy evaluation: Scan results are ingested by the ThreadFix server, which evaluates them against configurable security policies to determine whether the build should pass or fail.
- Result delivery: Results are returned to Jenkins and, where applicable, pushed to connected defect trackers such as Jira.
- Defect creation: If a policy failure is triggered by an identified vulnerability, a corresponding defect ticket can be automatically created in the developer’s existing issue tracker, reducing mean time to resolution.
This approach keeps developers working within their established tooling. Vulnerability findings surface inside Jenkins build logs and Jira queues rather than requiring context-switching to a separate security portal.
Flexible Policy Creation for Realistic Security Gates
A key design goal of the integration is policy flexibility. Software security teams are typically smaller than the development teams they support, making full automation of security processes essential for scaling coverage. The plugin’s policy engine allows teams to define what constitutes an acceptable risk threshold for a given application or build, rather than applying a binary block on any finding.
This means organizations can tune policies per project, pipeline stage, or risk appetite — for example, failing a production release pipeline on critical or high findings while allowing lower-severity issues to be tracked without blocking the build.
Industry Context: Shifting Security Left
The ThreadFix–Jenkins integration reflects a broader industry trend often referred to as “shifting security left” — moving security testing and remediation earlier in the development process rather than treating it as a gate at the end of the release cycle. Integrating security tooling directly into developer workflows (Jenkins, Jira) rather than isolated security dashboards is widely considered a practical approach to closing the gap between security and development teams.
Quotes from Key Stakeholders
“Our goal is to integrate strong security practices into the development process, and a huge part of achieving this is building security directly into the tools that developers are already using. In fact, that is exactly why ThreadFix was built with defect tracker integrations — this consolidates security tasks directly into the developer’s regular workflow. The ThreadFix Jenkins plugin makes it easier than ever to implement security into the continuous integration process.”
— Dan Cornell, CTO, Denim Group
“Being able to use ThreadFix with Jenkins provides a streamlined process for vulnerability management, and furthers the industry need to create more secure development processes. By integrating security into the development pipeline, companies are better able to prioritize and address security concerns, promoting a more secure ecosystem.”
— Kohsuke Kawaguchi, Chief Scientist at CloudBees and Founder of the Jenkins project
Key Takeaways for DevOps and Security Teams
- The ThreadFix Jenkins Plugin enables automated security test orchestration within existing CI/CD pipelines without requiring separate tooling or dashboards.
- Support for SAST, DAST, and SCA within a single pipeline step allows comprehensive coverage from a unified control point.
- Automatic defect ticket creation in Jira on policy failure reduces manual handoff between security analysts and developers.
- Configurable policies allow organizations to balance security rigidity with development velocity based on real-world risk tolerance.
- The integration addresses the common challenge of security teams being outnumbered by development teams by automating repetitive triage and reporting tasks.
For the most current information on ThreadFix and the Jenkins Plugin, refer to Denim Group’s official documentation and the Jenkins Plugin Index.