Cost-Sensitive Security Controls for Continuous Integration Pipelines

CI security controls combine contract, semantic, policy, provenance, dependency, and review evidence before release. Binary gates are difficult to tune: low thresholds interrupt benign changes, while high thresholds allow residual security risk to pass. This study evaluates a cost-sensitive decision framework that aggregates stage evidence and selects thresholds under explicit trade-offs among escaped risk, bad-block rate, and review load. The evaluation uses a deterministic campaign with 960 integration changes, 60 seeded replicates across eight stress profiles, a REST interface check, and a retrospective publication-cohort audit of 32,281 GitHub-reviewed security advisories linked to the CISA Known Exploited Vulnerabilities catalog. In the deterministic campaign, threshold 5 holds changes containing 99.35% of generated risk with one false block; across seeded campaigns, mean held-change risk coverage is 99.30% under baseline conditions. At 1% faulty-change prevalence, transported mean precision is 77.7% at threshold 5 and 29.0% at threshold 3. Stratified score permutation reduces threshold-5 held-change risk coverage to 65.25%, exposing dependence on the generator’s score ordering. In the advisory audit, a balanced unweighted point covers 96.23% of observed KEV risk at 48.58% review share, while a review-limited regularized point covers 62.26% at 3.45%. Current EPSS is stronger on the matched CVE subset, so the audit demonstrates cross-domain risk–workload analysis rather than validating the CI gate or establishing scoring superiority. The results support explicit, locally validated operating points rather than universal thresholds.