diff --git a/build/azure-pipelines/cli/cli-compile.yml b/build/azure-pipelines/cli/cli-compile.yml
index e77ba78a999..23faf9f6618 100644
--- a/build/azure-pipelines/cli/cli-compile.yml
+++ b/build/azure-pipelines/cli/cli-compile.yml
@@ -108,6 +108,22 @@ steps:
             ${{ pair.key }}: ${{ pair.value }}
 
     - ${{ if contains(parameters.VSCODE_CLI_TARGET, '-windows-') }}:
+      - task: CopyFiles@2
+        inputs:
+          SourceFolder: $(Build.SourcesDirectory)/cli/target/${{ parameters.VSCODE_CLI_TARGET }}/release
+          Contents: 'code.*'
+          TargetFolder: $(Agent.TempDirectory)/binskim-cli
+        displayName: Copy files for BinSkim
+
+      - task: BinSkim@4
+        inputs:
+          InputType: Basic
+          Function: analyze
+          TargetPattern: guardianGlob
+          AnalyzeTargetGlob: $(Agent.TempDirectory)/binskim-cli/*.*
+          AnalyzeSymPath: $(Agent.TempDirectory)/binskim-cli
+        displayName: Run BinSkim
+
       - powershell: |
           . build/azure-pipelines/win32/exec.ps1
           $ErrorActionPreference = "Stop"