Example solutions protect a continuous integration/continuous deployment (CI/CD) pipeline. Examples collect data from a CI/CD pipeline execution data source and/or a CI/CD pipeline task data source. Based on the collected data, a feature group comprising a plurality of records is created. Each record in the feature group represents an execution of the CI/CD pipeline. An anomaly score is generated, using a model representing historical feature groups, for the feature group representing the execution of the CI/CD pipeline. If the anomaly score is above a threshold, an alert is generated to indicate that the collected data represents an anomalous activity.