[{"data":1,"prerenderedAt":1065},["ShallowReactive",2],{"/blog/cyber-resilience-act-reporting-deadline":3,"navigation-en-us":305,"banner-en-us":737,"footer-en-us":747,"blog-post-authors-en-us-Amit Shalem":1008,"blog-related-posts-en-us-cyber-resilience-act-reporting-deadline":1022,"blog-share-wrapper-en-us":1045,"next-steps-en-us":1055},{"id":4,"title":5,"authors":6,"body":8,"category":287,"date":288,"description":289,"extension":290,"externalUrl":291,"faq":291,"featured":292,"heroImage":293,"meta":294,"navigation":295,"path":296,"seo":297,"slug":299,"stem":300,"tags":301,"template":303,"updatedDate":291,"__hash__":304},"blogPosts/en-us/blog/cyber-resilience-act-reporting-deadline.md","Prepare for the Cyber Resilience Act's 24-hour reporting deadline",[7],"Amit Shalem",{"type":9,"value":10,"toc":273},"minimark",[11,22,25,30,38,60,64,67,72,78,92,96,101,116,120,125,128,132,137,157,161,164,196,200,203,206,215,230,241,268],[12,13,14,15,21],"p",{},"Starting on September 11, 2026, many businesses that place software on the European Union (EU) market will have 24 hours to file a report once they learn that a vulnerability in one of their products is being actively exploited. This is a new requirement under the Cyber Resilience Act (",[16,17,20],"a",{"href":18,"rel":19},"https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act",[],"CRA","), the EU law that sets cybersecurity requirements for products with digital elements sold in Europe, put in place to ensure those products are secure by design and supported against new threats. The most stringent requirements under the CRA apply to the manufacturers that make those products, from large software vendors to companies shipping connected hardware.",[12,23,24],{},"The challenge a business faces to stay compliant is not the filing itself. It is finding out fast enough that a vulnerability in something you shipped is being actively exploited in your software supply chain. The 24-hour clock starts the moment you become aware, this is why detection is so important. Continuous detection is an engineering solution rather than a one-off compliance one. GitLab's software supply chain security capabilities are built to help you find active exploitation in what you shipped, automatically and continuously. This article walks through four questions you should ask yourself about your own pipeline’s continuous detection solution today.",[26,27,29],"h2",{"id":28},"reporting-requirement-starts-in-september-2026","Reporting requirement starts in September 2026",[12,31,32,33,37],{},"Beginning September 11, 2026, manufacturers have to report an actively exploited vulnerability ",[34,35,36],"strong",{},"within 24 hours of becoming aware of it",". The reporting runs in three stages each submitted simultaneously to the European Union Agency for Cybersecurity (ENISA) and to the Computer Security Incident Response Team (CSIRT) designated as coordinator.",[39,40,41,48,54],"ol",{},[42,43,44,47],"li",{},[34,45,46],{},"Early warning, within 24 hours of becoming aware of the actively exploited vulnerability."," A short first alert that exploitation is happening. You are not expected to know the full scope of impact or the fix yet.",[42,49,50,53],{},[34,51,52],{},"Notification, within 72 hours."," A fuller account, covering what is affected, what you know so far, and what you are doing about it.",[42,55,56,59],{},[34,57,58],{},"Final report."," For an actively exploited vulnerability, no later than 14 days after a corrective or mitigating measure is available.",[26,61,63],{"id":62},"four-questions-gitlab-can-help-you-answer","Four questions GitLab can help you answer",[12,65,66],{},"Deciding whether a vulnerability in your product is reportable is your call. Here are four questions you can ask yourself today to prepare for the CRA, and how GitLab can help you answer each one.",[68,69,71],"h3",{"id":70},"spot-active-exploitation-in-what-you-already-shipped","Spot active exploitation in what you already shipped",[12,73,74],{},[75,76,77],"em",{},"Is a component in something I shipped being actively exploited right now?",[12,79,80,85,86,91],{},[16,81,84],{"href":82,"rel":83},"https://docs.gitlab.com/user/application_security/dependency_scanning/continuous_dependency_scanning/",[],"Continuous dependency scanning"," watches your SBOM and flags newly published advisories against it. KEV status and EPSS scores on each finding tell you which ones attackers are actually using, so you can prioritize the vulnerabilities with real risk. Container Scanning covers the images you ship, and ",[16,87,90],{"href":88,"rel":89},"https://docs.gitlab.com/user/clusters/agent/vulnerabilities/",[],"Operational Container Scanning"," covers what is running in your clusters today.",[68,93,95],{"id":94},"find-every-product-and-repository-affected","Find every product and repository affected",[12,97,98],{},[75,99,100],{},"Which of my products are impacted, and which repository?",[12,102,103,104,109,110,115],{},"One search in the ",[16,105,108],{"href":106,"rel":107},"https://docs.gitlab.com/user/application_security/dependency_list/",[],"group-level dependency list"," returns every project that ships that component. Security attributes tell you which of those are internet-facing or business-critical, so you know where to start. That list is fed from both sides, a CycloneDX SBOM from ",[16,111,114],{"href":112,"rel":113},"https://docs.gitlab.com/user/application_security/dependency_scanning/",[],"Dependency Scanning"," for what your code declares including transitive dependencies, and one from Container Scanning for the OS packages baked into the image.  A single search reaches everything in your software supply chain—everything you actually shipped.",[68,117,119],{"id":118},"document-when-a-vulnerability-was-identified","Document when a vulnerability was identified",[12,121,122],{},[75,123,124],{},"Can I show when I found out?",[12,126,127],{},"The activity log on each vulnerability records when it was detected, in which pipeline, and every status change after it with the person and the time attached. The vulnerability events webhook pushes those same moments into whatever system runs your clock. When someone asks when you found out, the answer is already captured.",[68,129,131],{"id":130},"show-the-fix-shipped-and-when","Show the fix shipped, and when",[12,133,134],{},[75,135,136],{},"Did a fix ship, and when?",[12,138,139,144,145,150,151,156],{},[16,140,143],{"href":141,"rel":142},"https://docs.gitlab.com/user/application_security/remediate/dependency_scanning_auto_remediation/",[],"Dependency scanning auto-remediation"," opens the upgrade merge request for you. ",[16,146,149],{"href":147,"rel":148},"https://docs.gitlab.com/user/application_security/policies/merge_request_approval_policies/",[],"Merge request approval policies"," can gate on known-exploited status, so the rule holds without anyone relitigating it. ",[16,152,155],{"href":153,"rel":154},"https://docs.gitlab.com/user/compliance/compliance_frameworks/",[],"Compliance frameworks"," define the controls behind all of this, the compliance status report tracks where every project stands against them, and the compliance violations report picks up anything that slipped.",[68,158,160],{"id":159},"everything-else-you-are-already-running","Everything else you are already running",[12,162,163],{},"Much of the information you will need to assess your reporting obligations under the CRA is already in the GitLab platform your code lives in. The inventory, the exploitation signals, the continuous re-matching, the timestamps, and the policy gates are not five tools to evaluate, buy, and wire together. They are capabilities you turn on in the pipelines you already run, with no new agents and no new data plane.",[12,165,166,167,172,173,178,179,178,184,189,190,195],{},"GitLab's security scanning, including ",[16,168,171],{"href":169,"rel":170},"https://docs.gitlab.com/user/application_security/sast/",[],"Static Application Security Testing"," (SAST), ",[16,174,177],{"href":175,"rel":176},"https://docs.gitlab.com/user/application_security/secret_detection/",[],"Secret Detection",", ",[16,180,183],{"href":181,"rel":182},"https://docs.gitlab.com/user/application_security/secret_detection/secret_push_protection/",[],"Secret Push Protection",[16,185,188],{"href":186,"rel":187},"https://docs.gitlab.com/user/application_security/iac_scanning/",[],"Infrastructure-as-Code (IaC) Scanning",", and GitLab's ",[16,191,194],{"href":192,"rel":193},"https://docs.gitlab.com/user/application_security/policies/",[],"security policies",", might not be needed to answer these questions, however, they can help address the next phase of CRA requirements that will arrive in December 2027.",[26,197,199],{"id":198},"looking-ahead-stop-risky-packages-before-they-enter-your-supply-chain","Looking ahead: Stop risky packages before they enter your supply chain",[12,201,202],{},"GitLab's security capabilities help you respond fast. It is also worth setting your environment up so you have fewer vulnerabilities to report in the first place.",[12,204,205],{},"Not every supply chain risk arrives as a Common Vulnerabilities and Exposures (CVE) entry. A package published one character away from a library your team types every day never gets an advisory or a severity score, and neither does a package name that an AI assistant invented that somebody else then registered. There is nothing to patch, because the package itself is the attack.",[12,207,208,209,214],{},"Looking forward, GitLab will soon allow you to apply a preventative policy at the registry rather than detecting a vulnerability in a review three weeks later, so you can prevent harmful packages from entering into your supply chain before it reaches a build. To get information about the Dependency Firewall closed beta, coming soon, ",[16,210,213],{"href":211,"rel":212},"https://dfw-beta-signup-0fb9a5.gitlab.io/?utm_medium=blog&utm_source=blog&utm_campaign=eg_global_x_trial_security_en_",[],"fill out our form",".",[12,216,217,220,221,225,226,214],{},[34,218,219],{},"For existing GitLab customers, try it on one component."," Open your group-level dependency list, pick something you know ships in a product, and time how long it takes you to answer all four questions. If the answers come quickly, ",[16,222,224],{"href":112,"rel":223},[],"turn on continuous dependency scanning"," and add known-exploited status to a ",[16,227,229],{"href":192,"rel":228},[],"merge request approval policy",[12,231,232,235,236,214],{},[34,233,234],{},"If you are not on GitLab Ultimate yet,"," see if your shipped components carry vulnerabilities known to be exploited in the wild, in one view. ",[16,237,240],{"href":238,"rel":239},"https://about.gitlab.com/free-trial/?utm_medium=native&utm_source=integrate-market&utm_campaign=eg_global_cmp_content-syndication_security_en",[],"Start a free trial",[12,242,243],{},[75,244,245,246,250,251,256,257,262,263,214],{},"If you'd like to continue your reading, check out the following: The European Commission's ",[16,247,249],{"href":18,"rel":248},[],"Cyber Resilience Act"," overview, its ",[16,252,255],{"href":253,"rel":254},"https://digital-strategy.ec.europa.eu/en/policies/cra-reporting",[],"reporting obligations"," page, the ",[16,258,261],{"href":259,"rel":260},"https://digital-strategy.ec.europa.eu/en/policies/cra-summary",[],"summary of the legislative text",", and the ",[16,264,267],{"href":265,"rel":266},"https://digital-strategy.ec.europa.eu/en/library/commission-publishes-new-guidance-support-timely-cyber-resilience-act-implementation",[],"Commission's implementation guidance",[12,269,270],{},[75,271,272],{},"Amit Shalem is Principal Product Manager, Software Supply Chain Security, at GitLab.",{"title":274,"searchDepth":275,"depth":275,"links":276},"",2,[277,278,286],{"id":28,"depth":275,"text":29},{"id":62,"depth":275,"text":63,"children":279},[280,282,283,284,285],{"id":70,"depth":281,"text":71},3,{"id":94,"depth":281,"text":95},{"id":118,"depth":281,"text":119},{"id":130,"depth":281,"text":131},{"id":159,"depth":281,"text":160},{"id":198,"depth":275,"text":199},"security","2026-09-10","Under the Cyber Resilience Act, manufacturers have 24 hours to report an actively exploited vulnerability in their product. See how GitLab helps you answer fast.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png",{},true,"/en-us/blog/cyber-resilience-act-reporting-deadline",{"config":298,"title":5,"description":289},{"noIndex":292},"cyber-resilience-act-reporting-deadline","en-us/blog/cyber-resilience-act-reporting-deadline",[287,302],"features","BlogPost","JOIjn1zC4DfCGIWesLLmrfY8u25FRs5Gcj_gmgH_kzY",{"logo":306,"freeTrial":311,"sales":316,"login":321,"items":326,"search":657,"minimal":688,"duo":707,"switchNav":716,"pricingDeployment":727},{"config":307},{"href":308,"dataGaName":309,"dataGaLocation":310},"/","gitlab logo","header",{"text":312,"config":313},"Get free trial",{"href":314,"dataGaName":315,"dataGaLocation":310},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":317,"config":318},"Request a demo",{"href":319,"dataGaName":320,"dataGaLocation":310},"/request-a-demo/","sales",{"text":322,"config":323},"Sign in",{"href":324,"dataGaName":325,"dataGaLocation":310},"https://gitlab.com/users/sign_in/","sign in",[327,413,501,506,581,635],{"text":328,"left":295,"config":329,"menu":331},"Platform",{"dataNavLevelOne":330},"platform",{"type":332,"link":333,"columns":337,"feature":402},"lists",{"text":334,"config":335},"Explore the Platform",{"href":336,"dataGaName":330,"dataGaLocation":310},"/platform/",[338,361,384],{"title":339,"items":340},"Execution & Workflows",[341,346,351,356],{"text":342,"config":343},"CI/CD",{"href":344,"dataGaLocation":310,"dataGaName":345},"/solutions/continuous-integration/","ci/cd",{"text":347,"config":348},"Source Code Management",{"href":349,"dataGaLocation":310,"dataGaName":350},"/solutions/source-code-management/","source code management",{"text":352,"config":353},"Agile Delivery",{"href":354,"dataGaLocation":310,"dataGaName":355},"/solutions/agile-delivery/","agile delivery",{"text":357,"config":358},"Artifact Management",{"href":359,"dataGaLocation":310,"dataGaName":360},"/artifact-central/","artifact management",{"title":362,"items":363},"Security & Governance",[364,369,374,379],{"text":365,"config":366},"Application Security Testing",{"href":367,"dataGaLocation":310,"dataGaName":368},"/solutions/application-security-testing/","application security testing",{"text":370,"config":371},"Governance & Compliance",{"href":372,"dataGaLocation":310,"dataGaName":373},"/solutions/software-compliance/","governance and compliance",{"text":375,"config":376},"Secrets Management",{"href":377,"dataGaLocation":310,"dataGaName":378},"/gitlab-secrets-manager/","secrets management",{"text":380,"config":381},"Supply Chain Security",{"href":382,"dataGaLocation":310,"dataGaName":383},"/solutions/supply-chain/","supply chain security",{"title":385,"items":386},"Context & AI",[387,392,397],{"text":388,"config":389},"Agentic Orchestration",{"href":390,"dataGaLocation":310,"dataGaName":391},"/gitlab-duo-agent-platform/","agentic orchestration",{"text":393,"config":394},"Context Graph",{"href":395,"dataGaLocation":310,"dataGaName":396},"/gitlab-orbit/","context graph",{"text":398,"config":399},"Visibility & Measurement",{"href":400,"dataGaLocation":310,"dataGaName":401},"/solutions/visibility-measurement/","visibility and measurement",{"config":403,"title":406,"text":407,"link":408},{"background":404,"textColor":405},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1790185102/o7dn32anqcb6z8dgd3as.jpg')","#000","Why GitLab","One platform for speed with control across your software lifecycle.",{"text":409,"config":410},"Learn more",{"href":411,"dataGaName":412,"dataGaLocation":310},"/why-gitlab/","why gitlab",{"text":414,"left":295,"config":415,"menu":417},"Solutions",{"dataNavLevelOne":416},"solutions",{"type":332,"link":418,"columns":422,"feature":492},{"text":419,"config":420},"View all Solutions",{"href":421,"dataGaName":416,"dataGaLocation":310},"/solutions/",[423,441,459],{"title":424,"items":425},"Outcomes",[426,431,436],{"text":427,"config":428},"DevOps Modernization",{"href":429,"dataGaLocation":310,"dataGaName":430},"/assessments/devops-modernization-assessment/","devops modernization",{"text":432,"config":433},"Security Modernization",{"href":434,"dataGaLocation":310,"dataGaName":435},"/assessments/security-modernization-assessment/","security modernization",{"text":437,"config":438},"AI Modernization",{"href":439,"dataGaLocation":310,"dataGaName":440},"/assessments/ai-modernization-assessment/","ai modernization",{"title":442,"items":443},"By size",[444,449,454],{"text":445,"config":446},"Enterprise",{"href":447,"dataGaLocation":310,"dataGaName":448},"/enterprise/","enterprise",{"text":450,"config":451},"Small Business",{"href":452,"dataGaLocation":310,"dataGaName":453},"/small-business/","small business",{"text":455,"config":456},"Startups",{"href":457,"dataGaLocation":310,"dataGaName":458},"/solutions/startups/","startups",{"title":460,"items":461},"Industries",[462,467,472,477,482,487],{"text":463,"config":464},"Financial Services",{"href":465,"dataGaLocation":310,"dataGaName":466},"/solutions/finance/","financial services",{"text":468,"config":469},"Public Sector",{"href":470,"dataGaLocation":310,"dataGaName":471},"/solutions/public-sector/","public sector",{"text":473,"config":474},"Telecommunications",{"href":475,"dataGaLocation":310,"dataGaName":476},"/solutions/telecommunications/","telecommunications",{"text":478,"config":479},"Automotive",{"href":480,"dataGaLocation":310,"dataGaName":481},"/solutions/automotive/","automotive",{"text":483,"config":484},"Education",{"href":485,"dataGaLocation":310,"dataGaName":486},"/solutions/education/","education",{"text":488,"config":489},"Aerospace",{"href":490,"dataGaLocation":310,"dataGaName":491},"/solutions/aerospace/","aerospace",{"config":493,"title":494,"text":495,"link":496},{"background":404,"textColor":405},"GitLab Security Standard","Learn how to harden your software factory and let AI agents earn autonomy, without trading away security.",{"text":497,"config":498},"Explore the standard",{"href":499,"dataGaName":500,"dataGaLocation":310},"/gitlab-security-standard/","gitlab security standard",{"text":502,"config":503},"Pricing",{"href":504,"dataGaName":505,"dataGaLocation":310,"dataNavLevelOne":505},"/pricing/","pricing",{"text":507,"config":508,"menu":510},"Resources",{"dataNavLevelOne":509},"resources",{"type":332,"link":511,"columns":515,"feature":572},{"text":512,"config":513},"View all resources",{"href":514,"dataGaName":509,"dataGaLocation":310},"/resources/",[516,544],{"title":517,"items":518},"Discover",[519,524,529,534,539],{"text":520,"config":521},"Docs",{"href":522,"dataGaName":523,"dataGaLocation":310},"https://docs.gitlab.com/","docs",{"text":525,"config":526},"University",{"href":527,"dataGaName":528,"dataGaLocation":310},"https://university.gitlab.com/","university",{"text":530,"config":531},"Demo Series",{"href":532,"dataGaName":533,"dataGaLocation":310},"/gitlab-technical-demo-series/","demo series",{"text":535,"config":536},"Demo Hub",{"href":537,"dataGaName":538,"dataGaLocation":310},"/demo-hub/","demo hub",{"text":540,"config":541},"Services",{"href":542,"dataGaName":543,"dataGaLocation":310},"/services/","services",{"title":545,"items":546},"Connect",[547,552,557,562,567],{"text":548,"config":549},"Blog",{"href":550,"dataGaName":551,"dataGaLocation":310},"/blog/","blog",{"text":553,"config":554},"Community",{"href":555,"dataGaName":556,"dataGaLocation":310},"/community/","community",{"text":558,"config":559},"Customers",{"href":560,"dataGaName":561,"dataGaLocation":310},"/customers/","customers",{"text":563,"config":564},"Partners",{"href":565,"dataGaName":566,"dataGaLocation":310},"/partners/","partners",{"text":568,"config":569},"Events",{"href":570,"dataGaName":571,"dataGaLocation":310},"/events/","events",{"config":573,"title":574,"text":575,"link":576},{"background":404,"textColor":405},"What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":577,"config":578},"Read the latest",{"href":579,"dataGaName":580,"dataGaLocation":310},"/whats-new/","whats new",{"text":582,"config":583,"menu":585},"Company",{"dataNavLevelOne":584},"company",{"type":332,"columns":586},[587],{"items":588},[589,594,600,605,610,615,620,625,630],{"text":590,"config":591},"About",{"href":592,"dataGaName":593,"dataGaLocation":310},"/company/","about",{"text":595,"config":596,"footerGa":599},"Jobs",{"href":597,"dataGaName":598,"dataGaLocation":310},"/jobs/","jobs",{"dataGaName":598},{"text":601,"config":602},"Press",{"href":603,"dataGaName":604,"dataGaLocation":310},"/press/","press",{"text":606,"config":607},"Handbook",{"href":608,"dataGaName":609,"dataGaLocation":310},"https://handbook.gitlab.com/","handbook",{"text":611,"config":612},"Leadership",{"href":613,"dataGaName":614,"dataGaLocation":310},"/company/team/e-group/","leadership",{"text":616,"config":617},"Investor relations",{"href":618,"dataGaName":619,"dataGaLocation":310},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":621,"config":622},"Trust Center",{"href":623,"dataGaName":624,"dataGaLocation":310},"/security/","trust center",{"text":626,"config":627},"AI Transparency Center",{"href":628,"dataGaName":629,"dataGaLocation":310},"/ai-transparency-center/","ai transparency center",{"text":631,"config":632},"Newsletter",{"href":633,"dataGaName":634,"dataGaLocation":310},"/company/contact/#contact-forms","newsletter",{"text":636,"config":637,"menu":638},"Contact us",{"dataNavLevelOne":584},{"type":332,"columns":639},[640],{"items":641},[642,647,652],{"text":643,"config":644},"Talk to sales",{"href":645,"dataGaName":646,"dataGaLocation":310},"/sales/","talk to sales",{"text":648,"config":649},"Support portal",{"href":650,"dataGaName":651,"dataGaLocation":310},"https://support.gitlab.com/hc/en-us","support portal",{"text":653,"config":654},"Customer portal",{"href":655,"dataGaName":656,"dataGaLocation":310},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":658,"login":659,"suggestions":666},"Close",{"text":660,"link":661},"To search repositories and projects, login to",{"text":662,"config":663},"gitlab.com",{"href":324,"dataGaName":664,"dataGaLocation":665},"search login","search",{"text":667,"default":668},"Suggestions",[669,672,675,677,681,685],{"text":670,"config":671},"GitLab Duo Agent Platform",{"href":390,"dataGaName":670,"dataGaLocation":665},{"text":673,"config":674},"Code Suggestions (AI)",{"href":390,"dataGaName":673,"dataGaLocation":665},{"text":342,"config":676},{"href":344,"dataGaName":342,"dataGaLocation":665},{"text":678,"config":679},"GitLab on AWS",{"href":680,"dataGaName":678,"dataGaLocation":665},"/partners/technology-partners/aws/",{"text":682,"config":683},"GitLab on Google Cloud",{"href":684,"dataGaName":682,"dataGaLocation":665},"/partners/technology-partners/google-cloud-platform/",{"text":686,"config":687},"Why GitLab?",{"href":411,"dataGaName":686,"dataGaLocation":665},{"freeTrial":689,"mobileIcon":694,"desktopIcon":699,"secondaryButton":702},{"text":690,"config":691},"Start free trial",{"href":692,"dataGaName":315,"dataGaLocation":693},"https://gitlab.com/-/trials/new/","nav",{"altText":695,"config":696},"Gitlab Icon",{"src":697,"dataGaName":698,"dataGaLocation":693},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":695,"config":700},{"src":701,"dataGaName":698,"dataGaLocation":693},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":703,"config":704},"Get Started",{"href":705,"dataGaName":706,"dataGaLocation":693},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":708,"mobileIcon":712,"desktopIcon":714},{"text":709,"config":710},"Learn more about GitLab Duo",{"href":390,"dataGaName":711,"dataGaLocation":693},"gitlab duo",{"altText":695,"config":713},{"src":697,"dataGaName":698,"dataGaLocation":693},{"altText":695,"config":715},{"src":701,"dataGaName":698,"dataGaLocation":693},{"button":717,"mobileIcon":722,"desktopIcon":724},{"text":718,"config":719},"/switch",{"href":720,"dataGaName":721,"dataGaLocation":693},"#contact","switch",{"altText":695,"config":723},{"src":697,"dataGaName":698,"dataGaLocation":693},{"altText":695,"config":725},{"src":726,"dataGaName":698,"dataGaLocation":693},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":728,"mobileIcon":733,"desktopIcon":735},{"text":729,"config":730},"Back to pricing",{"href":504,"dataGaName":731,"dataGaLocation":693,"icon":732},"back to pricing","GoBack",{"altText":695,"config":734},{"src":697,"dataGaName":698,"dataGaLocation":693},{"altText":695,"config":736},{"src":701,"dataGaName":698,"dataGaLocation":693},{"title":738,"button":739,"config":745},"Ship at agent speed. Prove every step. Transcend is here.",{"text":740,"config":741},"Watch now",{"href":742,"dataGaName":743,"dataGaLocation":744},"/events/transcend/virtual/#watch-gitlab-transcend","transcend-october-2026-banner","global-banner",{"layout":746,"disabled":292},"release",{"data":748},{"text":749,"source":750,"edit":756,"contribute":761,"config":766,"items":771,"minimal":997},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":751,"config":752},"View page source",{"href":753,"dataGaName":754,"dataGaLocation":755},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":757,"config":758},"Edit this page",{"href":759,"dataGaName":760,"dataGaLocation":755},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":762,"config":763},"Please contribute",{"href":764,"dataGaName":765,"dataGaLocation":755},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":767,"facebook":768,"youtube":769,"linkedin":770},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[772,819,877,924,965],{"title":502,"links":773,"subMenu":788},[774,778,783],{"text":775,"config":776},"View plans",{"href":504,"dataGaName":777,"dataGaLocation":755},"view plans",{"text":779,"config":780},"Why Premium?",{"href":781,"dataGaName":782,"dataGaLocation":755},"/pricing/premium/","why premium",{"text":784,"config":785},"Why Ultimate?",{"href":786,"dataGaName":787,"dataGaLocation":755},"/pricing/ultimate/","why ultimate",[789],{"title":790,"links":791},"Contact Us",[792,795,797,799,804,809,814],{"text":793,"config":794},"Contact sales",{"href":645,"dataGaName":320,"dataGaLocation":755},{"text":648,"config":796},{"href":650,"dataGaName":651,"dataGaLocation":755},{"text":653,"config":798},{"href":655,"dataGaName":656,"dataGaLocation":755},{"text":800,"config":801},"Status",{"href":802,"dataGaName":803,"dataGaLocation":755},"https://status.gitlab.com/","status",{"text":805,"config":806},"Terms of use",{"href":807,"dataGaName":808,"dataGaLocation":755},"/terms/","terms of use",{"text":810,"config":811},"Privacy statement",{"href":812,"dataGaName":813,"dataGaLocation":755},"/privacy/","privacy statement",{"text":815,"config":816},"Cookie preferences",{"dataGaName":817,"dataGaLocation":755,"id":818,"isOneTrustButton":295},"cookie preferences","ot-sdk-btn",{"title":328,"links":820,"subMenu":834},[821,824,826,828,830,832],{"text":822,"config":823},"Explore the platform",{"href":336,"dataGaName":330,"dataGaLocation":755},{"text":388,"config":825},{"href":390,"dataGaName":391,"dataGaLocation":755},{"text":342,"config":827},{"href":344,"dataGaName":345,"dataGaLocation":755},{"text":393,"config":829},{"href":395,"dataGaName":396,"dataGaLocation":755},{"text":375,"config":831},{"href":377,"dataGaName":378,"dataGaLocation":755},{"text":406,"config":833},{"href":411,"dataGaName":412,"dataGaLocation":755},[835],{"title":836,"links":837},"Topics",[838,842,847,852,857,862,867,872],{"text":342,"config":839},{"href":840,"dataGaName":841,"dataGaLocation":755},"/topics/ci-cd/","cicd",{"text":843,"config":844},"GitOps",{"href":845,"dataGaName":846,"dataGaLocation":755},"/topics/gitops/","gitops",{"text":848,"config":849},"DevOps",{"href":850,"dataGaName":851,"dataGaLocation":755},"/topics/devops/","devops",{"text":853,"config":854},"Version Control",{"href":855,"dataGaName":856,"dataGaLocation":755},"/topics/version-control/","version control",{"text":858,"config":859},"DevSecOps",{"href":860,"dataGaName":861,"dataGaLocation":755},"/topics/devsecops/","devsecops",{"text":863,"config":864},"Cloud Native",{"href":865,"dataGaName":866,"dataGaLocation":755},"/topics/cloud-native/","cloud native",{"text":868,"config":869},"AI for Coding",{"href":870,"dataGaName":871,"dataGaLocation":755},"/topics/devops/ai-for-coding/","ai for coding",{"text":873,"config":874},"Agentic AI",{"href":875,"dataGaName":876,"dataGaLocation":755},"/topics/agentic-ai/","agentic ai",{"title":414,"links":878},[879,882,885,888,891,894,896,898,900,902,904,907,909,912,916,920],{"text":880,"config":881},"DevOps modernization",{"href":429,"dataGaName":430,"dataGaLocation":755},{"text":883,"config":884},"Security modernization",{"href":434,"dataGaName":435,"dataGaLocation":755},{"text":886,"config":887},"AI modernization",{"href":439,"dataGaName":440,"dataGaLocation":755},{"text":889,"config":890},"Financial services",{"href":465,"dataGaName":466,"dataGaLocation":755},{"text":892,"config":893},"Public sector",{"href":470,"dataGaName":471,"dataGaLocation":755},{"text":473,"config":895},{"href":475,"dataGaName":476,"dataGaLocation":755},{"text":478,"config":897},{"href":480,"dataGaName":481,"dataGaLocation":755},{"text":483,"config":899},{"href":485,"dataGaName":486,"dataGaLocation":755},{"text":488,"config":901},{"href":490,"dataGaName":491,"dataGaLocation":755},{"text":445,"config":903},{"href":447,"dataGaName":448,"dataGaLocation":755},{"text":905,"config":906},"Small business",{"href":452,"dataGaName":453,"dataGaLocation":755},{"text":455,"config":908},{"href":457,"dataGaName":458,"dataGaLocation":755},{"text":843,"config":910},{"href":911,"dataGaName":846,"dataGaLocation":755},"/solutions/gitops/",{"text":913,"config":914},"Software composition analysis",{"href":382,"dataGaName":915,"dataGaLocation":755},"software composition analysis",{"text":917,"config":918},"Value stream management",{"href":400,"dataGaName":919,"dataGaLocation":755},"value stream management",{"text":921,"config":922},"All solutions",{"href":421,"dataGaName":923,"dataGaLocation":755},"all solutions",{"title":507,"links":925},[926,931,936,938,940,942,944,946,948,950,952,954,956,958,961],{"text":927,"config":928},"Install",{"href":929,"dataGaName":930,"dataGaLocation":755},"/install/","install",{"text":932,"config":933},"Quick start guides",{"href":934,"dataGaName":935,"dataGaLocation":755},"/get-started/","quick setup checklists",{"text":520,"config":937},{"href":522,"dataGaName":523,"dataGaLocation":755},{"text":525,"config":939},{"href":527,"dataGaName":528,"dataGaLocation":755},{"text":530,"config":941},{"href":532,"dataGaName":533,"dataGaLocation":755},{"text":535,"config":943},{"href":537,"dataGaName":538,"dataGaLocation":755},{"text":540,"config":945},{"href":542,"dataGaName":543,"dataGaLocation":755},{"text":548,"config":947},{"href":550,"dataGaName":551,"dataGaLocation":755},{"text":553,"config":949},{"href":555,"dataGaName":556,"dataGaLocation":755},{"text":558,"config":951},{"href":560,"dataGaName":561,"dataGaLocation":755},{"text":563,"config":953},{"href":565,"dataGaName":566,"dataGaLocation":755},{"text":568,"config":955},{"href":570,"dataGaName":571,"dataGaLocation":755},{"text":631,"config":957},{"href":633,"dataGaName":634,"dataGaLocation":755},{"text":959,"config":960},"What's new",{"href":579,"dataGaName":580,"dataGaLocation":755},{"text":962,"config":963},"All resources",{"href":514,"dataGaName":964,"dataGaLocation":755},"all resources",{"title":582,"links":966},[967,969,971,973,975,977,979,981,983,987,992],{"text":590,"config":968},{"href":592,"dataGaName":584,"dataGaLocation":755},{"text":595,"config":970},{"href":597,"dataGaName":598,"dataGaLocation":755},{"text":601,"config":972},{"href":603,"dataGaName":604,"dataGaLocation":755},{"text":606,"config":974},{"href":608,"dataGaName":609,"dataGaLocation":755},{"text":611,"config":976},{"href":613,"dataGaName":614,"dataGaLocation":755},{"text":616,"config":978},{"href":618,"dataGaName":619,"dataGaLocation":755},{"text":621,"config":980},{"href":623,"dataGaName":624,"dataGaLocation":755},{"text":626,"config":982},{"href":628,"dataGaName":629,"dataGaLocation":755},{"text":984,"config":985},"Sustainability",{"href":986,"dataGaName":984,"dataGaLocation":755},"/sustainability/",{"text":988,"config":989},"Diversity, inclusion and belonging (DIB)",{"href":990,"dataGaName":991,"dataGaLocation":755},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":993,"config":994},"Modern Slavery Transparency Statement",{"href":995,"dataGaName":996,"dataGaLocation":755},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":998},[999,1002,1005],{"text":1000,"config":1001},"Terms",{"href":807,"dataGaName":808,"dataGaLocation":755},{"text":1003,"config":1004},"Cookies",{"dataGaName":817,"dataGaLocation":755,"id":818,"isOneTrustButton":295},{"text":1006,"config":1007},"Privacy",{"href":812,"dataGaName":813,"dataGaLocation":755},[1009],{"id":1010,"title":7,"body":291,"config":1011,"content":1013,"description":291,"extension":1016,"meta":1017,"navigation":295,"path":1018,"seo":1019,"stem":1020,"__hash__":1021},"blogAuthors/en-us/blog/authors/amit-shalem.yml",{"template":1012},"BlogAuthor",{"name":7,"config":1014},{"headshot":1015},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1789051782/t66kjqncbzsznqsokogo.png","yml",{},"/en-us/blog/authors/amit-shalem",{},"en-us/blog/authors/amit-shalem","myYkfCRRxt-YcE_B3aEI5IBr8ZsVXHZ7UdbKwEabo4I",[1023,1031,1038],{"title":1024,"description":1025,"heroImage":1026,"category":287,"date":1027,"authors":1028,"slug":1030,"externalUrl":291},"Track organization-wide security risk in one dashboard","For enterprises with many top-level groups, GitLab now aggregates vulnerabilities and a single risk score across your entire organization.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-10-08",[1029],"Alisa Ho","security-risk-in-one-dashboard",{"title":1032,"description":1033,"heroImage":1034,"category":287,"date":1035,"authors":1036,"slug":1037,"externalUrl":291},"Dependency Firewall: Block risky packages before the build","GitLab Dependency Firewall helps keep malicious and vulnerable packages out of your build automatically, so teams and their agents ship fast with trusted dependencies.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1791198675/kmajkudog4fj3xc6qfyb.png","2026-10-06",[1029,7],"transcend-dependency-firewall",{"title":1039,"description":1040,"heroImage":293,"category":287,"date":1041,"authors":1042,"slug":1044,"externalUrl":291},"Securing the software factory at machine speed","The foundation for agentic software development must evolve with AI models, continuously shortening the path from detection to verified remediation.","2026-09-18",[1043],"Chaim Mazal","securing-the-software-factory-at-machine-speed",{"header":1046,"text":1047,"button":1051,"disclaimer":1054},"Start your free\n\n30-day GitLab trial\n",[1048,1049,1050],"GitLab Duo Agent Platform access","Try our most advanced features","Automate complex tasks with AI",{"text":312,"config":1052},{"href":1053,"dataGaName":315,"dataGaLocation":551},"https://gitlab.com/-/trials/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/blog/","No credit card required.",{"header":1056,"blurb":1057,"button":1058,"secondaryButton":1063},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1059,"config":1060},"Get your free trial",{"href":1061,"dataGaName":315,"dataGaLocation":1062},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":793,"config":1064},{"href":645,"dataGaName":320,"dataGaLocation":1062},1791944929008]