Rubrik has been backing up and restoring Azure DevOps and GitHub for a while now: repos and pipelines, protected and recoverable. That's the foundation, and for plenty of failures (like an accidental delete or a bad merge), restoring from a backup is exactly the right answer.
Though lately, attacks have changed the question.
In March 2025, the popular tj-actions/changed-files GitHub Action was compromised (CVE-2025-30066), and CISA advised affected teams to audit every project that used it and rotate any secrets it could have exposed (CISA). The attack started with one compromised bot token. But what did that identity touch?
Announced today at the Rubrik Cloud Resilience Summit, Rubrik DevOps Protection Enterprise Edition brings cyber recovery to GitHub and Azure DevOps by connecting detection, investigation, and recovery in one workflow inside Rubrik Security Cloud. Anomaly Detection flags suspicious identity activity. Blast Radius Investigation shows what that identity touched, grouped by repositories, pipelines, pull requests, platform settings, and access objects. Recovery then draws on the air-gapped, immutable backups Rubrik already holds, so teams restore what the attacker affected and leave the rest alone.
Detect, Investigate, and Recover
Microsoft and Rubrik have been working together on cyber resilience for Azure workloads. If you want the architecture background, I wrote about it with Microsoft earlier this year in Architecting Cyber Resilience: How Microsoft and Rubrik Employ a Secure by Design Approach.
Securing DevOps is the next piece of that work.
Everything starts with a signal. Anomaly Detection flags suspicious identity activity by baselining your GitHub and Azure DevOps audit logs and correlating them with Rubrik backup metadata. That alert is where an investigation begins, and where Blast Radius Investigation comes in, the piece I think teams will care about most.
Today, many security and DevOps teams figure out what is compromised by stitching together audit logs, alerts, and tribal knowledge by hand. That is slow, and it is easy to miss something. Teams end up freezing code and auditing broadly because they cannot say with confidence what is clean.
Blast Radius Investigation addresses this challenge directly. Starting with a suspect identity and a time window. Rubrik correlates GitHub and Azure DevOps audit activity with the backup data it already holds, and produces a categorized view of what was affected across:
- Repositories and commits
- Pipelines and workflows
- Pull requests
- Platform settings
- Access Objects
Instead of a pile of log lines, you get the scope of impact, grouped by what changed. That tells you what needs to be restored and what does not. That helps you understand how far an attacker reached and know what needs to be recovered.
The view draws on both audit logs and Rubrik backup metadata, so you can compare against a captured point in time, not someone's memory of what the repo looked like last week.
Once you know what was affected, recovery follows. Rubrik already gives you several ways to bring data back, from a single repo or specific files to restoring into a different project or organization, all from air-gapped, immutable backups. We're also working on Surgical Recovery, designed to recover only what the attacker changed while preserving everyone else's work.
Separately, Foundation Edition now backs up more of the developer collaboration stack across Azure DevOps and GitHub. Beyond code, that includes issues, pull requests, Azure Boards, wikis, packages, and organization settings, so you can recover the full context of how your teams build software and not just the underlying code.
See It At The Summit And At Ignite
Join us at the Rubrik Cloud Resilience Summit today, or watch on demand afterward. Next week, find the Rubrik team at Microsoft Ignite in San Francisco, booth #1159. To learn more about protecting your development platforms, visit the Rubrik DevOps Protection page.
Safe Harbor Statement: Any unreleased services or features referenced in this blog are not currently available and may not be made generally available on time or at all, as may be determined in our sole discretion. Any such referenced services or features do not represent promises to deliver, commitments, or obligations of Rubrik, Inc. and may not be incorporated into any contract. Customers should make their purchase decisions based upon services and features that are currently generally available.