  Agile and DevOps are widely adopted by the industry. Hence, integrating
security activities with industrial practices, such as continuous integration
(CI) pipelines, is necessary to detect security flaws and adhere to regulators'
demands early. In this paper, we analyze automated security activities in CI
pipelines of enterprise-driven open source software (OSS). This shall allow us,
in the long-run, to better understand the extent to which security activities
are (or should be) part of automated pipelines. In particular, we mine publicly
available OSS repositories and survey a sample of project maintainers to better
understand the role that security activities and their related tools play in
their CI pipelines. To increase transparency and allow other researchers to
replicate our study (and to take different perspectives), we further disclose
our research artefacts. Our results indicate that security activities in
enterprise-driven OSS projects are scarce and protection coverage is rather
low. Only 6.83% of the analyzed 8,243 projects apply security automation in
their CI pipelines, even though maintainers consider security to be rather
important. This alerts industry to keep the focus on vulnerabilities of 3rd
Party software and it opens space for other improvements of practice which we
outline in this manuscript.
