Having a monolithic CI/CD pipeline for both CI/CD and Security (SAST/DAST/SCA) is very common, however maintaining a single pipeline to take care of all security needs is becoming an anti-pattern. Security slows down CI/CD and creates friction between Sec & Dev needs. Creating completely separate/shadow/parallel pipeline for DevSecOps needs seems to be working very well for big enterprises.