[{"data":1,"prerenderedAt":1431},["ShallowReactive",2],{"/blog/our-step-by-step-guide-to-evaluating-runtime-security-tools":3,"navigation-en-us":634,"banner-en-us":1062,"footer-en-us":1072,"blog-post-authors-en-us-Hiroki Suezawa|Mitra Jozenazemian":1316,"blog-related-posts-en-us-our-step-by-step-guide-to-evaluating-runtime-security-tools":1343,"blog-promotions-en-us":1368,"next-steps-en-us":1421},{"id":4,"title":5,"authors":6,"body":9,"category":613,"date":614,"description":615,"extension":616,"externalUrl":617,"faq":617,"featured":618,"heroImage":619,"meta":620,"navigation":621,"path":622,"seo":623,"slug":627,"stem":628,"tags":629,"template":632,"updatedDate":617,"__hash__":633},"blogPosts/en-us/blog/our-step-by-step-guide-to-evaluating-runtime-security-tools.md","Our step-by-step guide to evaluating runtime security tools",[7,8],"Hiroki Suezawa","Mitra Jozenazemian",{"type":10,"value":11,"toc":594},"minimark",[12,16,19,24,27,32,54,57,61,64,90,97,106,110,113,168,172,175,232,236,241,247,296,299,394,400,405,410,452,513,519,523,526,546,550,554,580,584,587,591],[13,14,15],"p",{},"Choosing the right runtime security tool is critical for protecting modern cloud-native environments.  We recently undertook a rigorous evaluation process using real-world attack simulations on our Kubernetes clusters and Linux servers. Why? Because traditional cloud audit logs do not provide enough detail, leaving critical gaps in threat detection, incident response, and forensic analysis. Our evaluation meticulously examined each critical stage from initial access to lateral movement and data exfiltration.",[13,17,18],{},"While we won't be naming the specific vendor in this post, we want to share our detailed methodology and key learnings, providing a blueprint you can adapt for your own security tool evaluations.",[20,21,23],"h2",{"id":22},"why-are-runtime-security-tools-necessary","Why are runtime security tools necessary?",[13,25,26],{},"Without runtime security tools, detecting “suspicious activities” and understanding “what actually happened” during an attack can become extremely challenging.",[28,29,31],"h3",{"id":30},"limitations-of-cloud-audit-logs","Limitations of cloud audit logs",[33,34,35,46],"ul",{},[36,37,38,42,45],"li",{},[39,40,41],"strong",{},"Lack of runtime details",[43,44],"br",{},"\nCloud audit logs primarily record operations and data access within the cloud. However, they do not capture runtime-level activities on systems such as Kubernetes servers – overlooking fine-grained command executions, process behaviors, and transient network activities.",[36,47,48,51,53],{},[39,49,50],{},"Gaps in investigation and forensics",[43,52],{},"\nIn Kubernetes environments, the absence of continuous, real-time logging can lead to the loss of critical activity records once a container terminates.",[13,55,56],{},"Although well-known open-source runtime security tools are available, we decided to evaluate a commercial product to assess additional capabilities and enterprise-level support through attack simulation testing.",[28,58,60],{"id":59},"the-role-and-purpose-of-runtime-security-tools","The role and purpose of runtime security tools",[13,62,63],{},"Runtime security tools address these cloud audit log limitations by continuously monitoring systems in real time, offering the following functionalities:",[33,65,66,74,82],{},[36,67,68,71,73],{},[39,69,70],{},"Threat detection",[43,72],{},"\nThey monitor command executions, system calls, and network events in real-time to instantly detect abnormal behaviors, which enables the security team to respond rapidly. While some public cloud providers now offer limited runtime monitoring capabilities, these native solutions typically lack the depth and comprehensive coverage of dedicated security tools.",[36,75,76,79,81],{},[39,77,78],{},"Incident response",[43,80],{},"\nBy maintaining detailed chronological records of system activities, these tools provide security teams with the evidence needed to reconstruct attack timelines, determine the full scope of compromise, and conduct thorough forensic investigations after an incident occurs.",[36,83,84,87,89],{},[39,85,86],{},"Scalability in investigations",[43,88],{},"\nUnlike traditional endpoint-by-endpoint forensic analysis, runtime security tools allow teams to collect, store, and analyze data centrally across the entire environment. This enables the efficient investigation of incidents without manually correlating disparate data sources.",[13,91,92,93,96],{},"(",[39,94,95],{},"Note:"," Products that also offer container information or server vulnerability monitoring are outside the scope of this discussion.)",[13,98,99,100,105],{},"Threat detection is only valuable if alerts reach the right people and get acted on efficiently. Learn how GitLab's security team built a ",[101,102,104],"a",{"href":103},"/blog/self-service-security-alert-handling-with-gitlabs-uam/","self-service alert handling workflow"," to do exactly that.",[20,107,109],{"id":108},"key-evaluation-points","Key evaluation points",[13,111,112],{},"Our primary objective in evaluating a runtime security tool was to determine its effectiveness in real-world security investigations. While evaluations often focus on the volume of detections or overall coverage, in actual operations, an overload of false positives – or tens of alerts for a single attack chain – can paralyze incident response teams. Therefore, our in-depth investigation centered on whether the tool could be used to support security operations with understanding and responding to actual attacks.",[33,114,115,146],{},[36,116,117,120],{},[39,118,119],{},"Detection capability",[33,121,122,130,138],{},[36,123,124,127,129],{},[39,125,126],{},"Built-in rule",[43,128],{},"\nWe assessed whether the built-in rule sets could effectively detect a variety of attack techniques and provide the necessary detail for accurate detection.",[36,131,132,135,137],{},[39,133,134],{},"Custom detection capabilities",[43,136],{},"\nWe evaluated the ease with which additional rules could be integrated and considered the quality of telemetry data delivered by the product, which enabled us to build our own monitoring solutions leveraging our unique understanding of our environment.",[36,139,140,143,145],{},[39,141,142],{},"Alert quality",[43,144],{},"\nWe also verified the rate of false positives. We confirmed that it effectively focuses on genuine security threats requiring action while minimizing noise that could cause alert fatigue.",[36,147,148,150],{},[39,149,78],{},[33,151,152,160],{},[36,153,154,157,159],{},[39,155,156],{},"Richness of logs",[43,158],{},"\nWe evaluated whether the logs capture sufficient details – including executed commands, network connections, DNS queries, and process information – to fully reconstruct the incident. The ability to piece together the entire attack scenario and determine the full impact is crucial during incident response.",[36,161,162,165,167],{},[39,163,164],{},"Log searchability",[43,166],{},"\nWe assessed how effectively the tool allowed us to search, filter, and correlate events across multiple systems. The ability to quickly query massive volumes of data is essential for timely investigations during security incidents.",[20,169,171],{"id":170},"evaluation-process","Evaluation process",[13,173,174],{},"We divided our evaluation process into four major phases:",[176,177,178,197,216,224],"ol",{},[36,179,180,183,185,186],{},[39,181,182],{},"Development of attack scenarios",[43,184],{},"\nWe designed scenarios that mimicked real-world attack flows. These scenarios, developed in collaboration with our Red Team, included the following elements:",[33,187,188,191,194],{},[36,189,190],{},"attacks exploiting GitLab-specific vulnerabilities (e.g., CVE-2021-22205)",[36,192,193],{},"attacks leveraging the compromise of developer laptops",[36,195,196],{},"detailed step-by-step attack procedures",[36,198,199,202,204,205,213,215],{},[39,200,201],{},"Infrastructure setup",[43,203],{},"\nWe deployed two parallel environments:",[33,206,207,210],{},[36,208,209],{},"Kubernetes environment",[36,211,212],{},"Virtual machine (VM) environment",[43,214],{},"We installed an older version of GitLab to test known vulnerabilities and carried out similar evaluation flows in both the Kubernetes and VM environments.",[36,217,218,221,223],{},[39,219,220],{},"Execution of attacks",[43,222],{},"\nWe executed the attack flow for each scenario and meticulously recorded the timeline – from initial access to lateral movement and data exfiltration.",[36,225,226,229,231],{},[39,227,228],{},"Analysis of results",[43,230],{},"\nWe conducted a comprehensive evaluation of detection capabilities, log richness, and areas for improvement, clearly outlining the strengths and weaknesses of the tools.",[28,233,235],{"id":234},"attack-scenarios","Attack scenarios",[13,237,238],{},[39,239,240],{},"Scenario 1: Exploitation of a known GitLab vulnerability",[13,242,243],{},[244,245],"img",{"alt":240,"src":246},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1750097560/Blog/Content%20Images/Blog/Content%20Images/image1_aHR0cHM6_1750097560795.png",[33,248,249],{},[36,250,251,254],{},[39,252,253],{},"Attack flow",[176,255,256,264,272,280,288],{},[36,257,258,261,263],{},[39,259,260],{},"Initial access",[43,262],{},"\nWe simulated an attack by exploiting CVE-2021-22205, a known GitLab vulnerability that allows remote code execution. This granted us unauthorized access to the target system.",[36,265,266,269,271],{},[39,267,268],{},"Command execution",[43,270],{},"\nAfter gaining access, we executed a reverse shell to interact remotely with the compromised machine and take control.",[36,273,274,277,279],{},[39,275,276],{},"Deployment of a C2 agent",[43,278],{},"\nWe installed a Command and Control (C2) agent to evaluate persistence techniques, enabling us to execute further commands and manage the system remotely.",[36,281,282,285,287],{},[39,283,284],{},"Lateral movement",[43,286],{},"\nWe then moved laterally within the environment, accessing Kubernetes API secrets and PostgreSQL databases.",[36,289,290,293,295],{},[39,291,292],{},"Data exfiltration",[43,294],{},"\nWe exfiltrated sensitive data via a dedicated C2 channel.",[13,297,298],{},"The following table summarizes the attack techniques used at each phase:",[300,301,302,329],"table",{},[303,304,305],"thead",{},[306,307,308,312,315,318,321,323,326],"tr",{},[309,310,260],"th",{"align":311},"left",[309,313,314],{"align":311},"Command and control",[309,316,317],{"align":311},"Enumeration",[309,319,320],{"align":311},"Credential access",[309,322,284],{"align":311},[309,324,325],{"align":311},"Collection",[309,327,328],{"align":311},"Exfiltration",[330,331,332,356,376],"tbody",{},[306,333,334,338,341,344,347,350,353],{},[335,336,337],"td",{"align":311},"Exploit GitLab application using known RCE vulnerability",[335,339,340],{"align":311},"Execute known reverse shell command",[335,342,343],{"align":311},"Harvesting info on the box",[335,345,346],{"align":311},"Get environment variables",[335,348,349],{"align":311},"Get secret from Kubernetes API",[335,351,352],{"align":311},"Get data from Cloud Storage",[335,354,355],{"align":311},"Exfiltration over C2 channel",[306,357,358,360,363,365,368,371,374],{},[335,359],{"align":311},[335,361,362],{"align":311},"Install post-exploitation C2 agent",[335,364],{"align":311},[335,366,367],{"align":311},"Get K8s token",[335,369,370],{"align":311},"Access to database",[335,372,373],{"align":311},"DNS exfiltration",[335,375],{"align":311},[306,377,378,380,383,385,388,390,392],{},[335,379],{"align":311},[335,381,382],{"align":311},"SOCKS proxy",[335,384],{"align":311},[335,386,387],{"align":311},"Get cloud token via Cloud metadata server",[335,389],{"align":311},[335,391],{"align":311},[335,393],{"align":311},[13,395,396,398],{},[43,397],{},[43,399],{},[13,401,402],{},[39,403,404],{},"Scenario 2: Compromise of a developer’s laptop",[13,406,407],{},[244,408],{"alt":404,"src":409},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1750097561/Blog/Content%20Images/Blog/Content%20Images/image2_aHR0cHM6_1750097560796.png",[33,411,412],{},[36,413,414,416],{},[39,415,253],{},[176,417,418,426,434,442],{},[36,419,420,423,425],{},[39,421,422],{},"Initial compromise",[43,424],{},"\nWe simulated an attacker compromising a developer’s laptop and abusing legitimate credentials to gain unauthorized access to internal resources.",[36,427,428,431,433],{},[39,429,430],{},"Privilege escalation",[43,432],{},"\nUsing the compromised credentials, we escalated privileges within the Kubernetes environment.",[36,435,436,439,441],{},[39,437,438],{},"Container manipulation",[43,440],{},"\nWe deployed a privileged container to extract sensitive information.",[36,443,444,447,449,450,298],{},[39,445,446],{},"Data exfiltration and persistence",[43,448],{},"\nWe exfiltrated sensitive data while maintaining persistent access.",[43,451],{},[300,453,454,471],{},[303,455,456],{},[306,457,458,460,463,465,467,469],{},[309,459,260],{"align":311},[309,461,462],{"align":311},"Execution",[309,464,430],{"align":311},[309,466,320],{"align":311},[309,468,284],{"align":311},[309,470,328],{"align":311},[330,472,473,493],{},[306,474,475,478,481,484,487,490],{},[335,476,477],{"align":311},"Valid account (kubectl)",[335,479,480],{"align":311},"Create a new container",[335,482,483],{"align":311},"Create a privileged container",[335,485,486],{"align":311},"Get K8s secrets via privilege of the node",[335,488,489],{"align":311},"Enter a container in the same node",[335,491,492],{"align":311},"Upload credential data to the attacker’s server",[306,494,495,497,499,501,509,511],{},[335,496],{"align":311},[335,498],{"align":311},[335,500],{"align":311},[335,502,503,504,508],{"align":311},"Get an environment variable in the containers via ",[505,506,507],"code",{},"crictl"," command on the node",[335,510],{"align":311},[335,512],{"align":311},[13,514,515,517],{},[43,516],{},[43,518],{},[28,520,522],{"id":521},"execution-of-the-attacks","Execution of the attacks",[13,524,525],{},"During the execution of the attack scenarios, we followed these processes to obtain detailed records:",[33,527,528,534,540],{},[36,529,530,533],{},[39,531,532],{},"Verification of detections:"," We confirmed whether each attack command was detected and if the key points of each scenario were properly flagged.",[36,535,536,539],{},[39,537,538],{},"Timeline recording:"," Every event was logged in sequence to assess how well command executions and network communications were captured.",[36,541,542,545],{},[39,543,544],{},"Scoring and analysis:"," We scored each event based on detection effectiveness to quantitatively evaluate the tool’s performance.",[20,547,549],{"id":548},"what-we-learned","What we learned",[28,551,553],{"id":552},"dont-overestimate-test-commercial-products-yourself","Don't overestimate – test commercial products yourself",[33,555,556,564,572],{},[36,557,558,561,563],{},[39,559,560],{},"Identifying and addressing detection gaps (collaboration with vendors)",[43,562],{},"\nOur evaluation revealed that several critical scenarios and events were not detected or not logged. Consequently, we held meetings with the vendor and submitted multiple improvement requests. As a result, the vendor enhanced the product by adding new features and improving detection capabilities, with many issues identified during our evaluation subsequently addressed.",[36,565,566,569,571],{},[39,567,568],{},"Understanding the limitations",[43,570],{},"\nMany modern runtime security tools use eBPF to monitor Linux system calls for detection. However, because commands executed within a C2 framework do not generate new processes, tracing these attack events proved challenging.",[36,573,574,577,579],{},[39,575,576],{},"Recognizing tool boundaries",[43,578],{},"\nOur findings highlighted that, during incident response, relying solely on runtime security tools is insufficient. It is essential to combine them with other logs, such as Kubernetes audit logs and cloud logs, to gain a comprehensive view.",[28,581,583],{"id":582},"the-importance-of-continuous-runtime-event-logging-in-kubernetes","The importance of continuous runtime event logging in Kubernetes",[13,585,586],{},"In Kubernetes environments, there is a risk of losing forensic data when containers terminate, making continuous logging indispensable. Our evaluation confirmed that establishing a scalable, persistent logging infrastructure is crucial. Without proper runtime security tools, a significant amount of critical information could be lost post-attack.",[20,588,590],{"id":589},"summary","Summary",[13,592,593],{},"We do not simply install security tools – we evaluate their utility to help ensure that our customers can safely use GitLab.com. Thorough product assessments like the one outlined above not only reveal unique use cases and areas for improvement that vendors might overlooks, but also provide valuable insights that benefit both the vendor and internal teams in organizing how the tool is best utilized.",{"title":595,"searchDepth":596,"depth":596,"links":597},"",2,[598,603,604,608,612],{"id":22,"depth":596,"text":23,"children":599},[600,602],{"id":30,"depth":601,"text":31},3,{"id":59,"depth":601,"text":60},{"id":108,"depth":596,"text":109},{"id":170,"depth":596,"text":171,"children":605},[606,607],{"id":234,"depth":601,"text":235},{"id":521,"depth":601,"text":522},{"id":548,"depth":596,"text":549,"children":609},[610,611],{"id":552,"depth":601,"text":553},{"id":582,"depth":601,"text":583},{"id":589,"depth":596,"text":590},"security","2025-05-13","Key learnings from the GitLab Security team’s runtime security tool evaluation on Kubernetes clusters and Linux servers using real-world attack simulations.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1750097534/Blog/Hero%20Images/Blog/Hero%20Images/AdobeStock_1097303277_6gTk7M1DNx0tFuovupVFB1_1750097534344.jpg",{},true,"/en-us/blog/our-step-by-step-guide-to-evaluating-runtime-security-tools",{"title":5,"description":615,"ogTitle":5,"ogDescription":615,"noIndex":618,"ogImage":619,"ogUrl":624,"ogSiteName":625,"ogType":626,"canonicalUrls":624},"https://about.gitlab.com/blog/our-step-by-step-guide-to-evaluating-runtime-security-tools","https://about.gitlab.com","article","our-step-by-step-guide-to-evaluating-runtime-security-tools","en-us/blog/our-step-by-step-guide-to-evaluating-runtime-security-tools",[613,630,631],"DevSecOps","inside GitLab","BlogPost","bn_v_D-8yO1hnmw4jhGwTFQRe3OpsnbMv-K0WfL593A",{"logo":635,"freeTrial":640,"sales":645,"login":650,"items":655,"search":982,"minimal":1013,"duo":1032,"switchNav":1041,"pricingDeployment":1052},{"config":636},{"href":637,"dataGaName":638,"dataGaLocation":639},"/","gitlab logo","header",{"text":641,"config":642},"Get free trial",{"href":643,"dataGaName":644,"dataGaLocation":639},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":646,"config":647},"Request a demo",{"href":648,"dataGaName":649,"dataGaLocation":639},"/sales/?contact-topic=request-demo","sales",{"text":651,"config":652},"Sign in",{"href":653,"dataGaName":654,"dataGaLocation":639},"https://gitlab.com/users/sign_in/","sign in",[656,685,785,790,904,960],{"text":657,"config":658,"menu":660},"Platform",{"dataNavLevelOne":659},"platform",{"type":661,"columns":662},"cards",[663,669,677],{"title":657,"description":664,"link":665},"The intelligent orchestration platform for DevSecOps",{"text":666,"config":667},"Explore our Platform",{"href":668,"dataGaName":659,"dataGaLocation":639},"/platform/",{"title":670,"description":671,"link":672},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":673,"config":674},"Meet GitLab Duo",{"href":675,"dataGaName":676,"dataGaLocation":639},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":678,"description":679,"link":680},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":681,"config":682},"Learn more",{"href":683,"dataGaName":684,"dataGaLocation":639},"/why-gitlab/","why gitlab",{"text":686,"left":621,"config":687,"menu":689},"Product",{"dataNavLevelOne":688},"solutions",{"type":690,"link":691,"columns":695,"feature":764},"lists",{"text":692,"config":693},"View all Solutions",{"href":694,"dataGaName":688,"dataGaLocation":639},"/solutions/",[696,720,743],{"title":697,"description":698,"link":699,"items":704},"Automation","CI/CD and automation to accelerate deployment",{"config":700},{"icon":701,"href":702,"dataGaName":703,"dataGaLocation":639},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[705,709,712,716],{"text":706,"config":707},"CI/CD",{"href":708,"dataGaLocation":639,"dataGaName":706},"/solutions/continuous-integration/",{"text":670,"config":710},{"href":675,"dataGaLocation":639,"dataGaName":711},"gitlab duo agent platform - product menu",{"text":713,"config":714},"Source Code Management",{"href":715,"dataGaLocation":639,"dataGaName":713},"/solutions/source-code-management/",{"text":717,"config":718},"Automated Software Delivery",{"href":702,"dataGaLocation":639,"dataGaName":719},"Automated software delivery",{"title":721,"description":722,"link":723,"items":728},"Security","Deliver code faster without compromising security",{"config":724},{"href":725,"dataGaName":726,"dataGaLocation":639,"icon":727},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[729,733,738],{"text":730,"config":731},"Application Security Testing",{"href":725,"dataGaName":732,"dataGaLocation":639},"Application security testing",{"text":734,"config":735},"Software Supply Chain Security",{"href":736,"dataGaLocation":639,"dataGaName":737},"/solutions/supply-chain/","Software supply chain security",{"text":739,"config":740},"Software Compliance",{"href":741,"dataGaName":742,"dataGaLocation":639},"/solutions/software-compliance/","software compliance",{"title":744,"link":745,"items":750},"Measurement",{"config":746},{"icon":747,"href":748,"dataGaName":749,"dataGaLocation":639},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[751,755,759],{"text":752,"config":753},"Visibility & Measurement",{"href":748,"dataGaLocation":639,"dataGaName":754},"Visibility and Measurement",{"text":756,"config":757},"Value Stream Management",{"href":758,"dataGaLocation":639,"dataGaName":756},"/solutions/value-stream-management/",{"text":760,"config":761},"Analytics & Insights",{"href":762,"dataGaLocation":639,"dataGaName":763},"/solutions/analytics-and-insights/","Analytics and insights",{"title":765,"type":690,"items":766},"GitLab for",[767,773,779],{"text":768,"config":769},"Enterprise",{"icon":770,"href":771,"dataGaLocation":639,"dataGaName":772},"Building","/enterprise/","enterprise",{"text":774,"config":775},"Small Business",{"icon":776,"href":777,"dataGaLocation":639,"dataGaName":778},"Work","/small-business/","small business",{"text":780,"config":781},"Public Sector",{"icon":782,"href":783,"dataGaLocation":639,"dataGaName":784},"Organization","/solutions/public-sector/","public sector",{"text":786,"config":787},"Pricing",{"href":788,"dataGaName":789,"dataGaLocation":639,"dataNavLevelOne":789},"/pricing/","pricing",{"text":791,"config":792,"menu":794},"Resources",{"dataNavLevelOne":793},"resources",{"type":690,"link":795,"columns":799,"feature":893},{"text":796,"config":797},"View all resources",{"href":798,"dataGaName":793,"dataGaLocation":639},"/resources/",[800,833,860],{"title":801,"items":802},"Getting started",[803,808,813,818,823,828],{"text":804,"config":805},"Install",{"href":806,"dataGaName":807,"dataGaLocation":639},"/install/","install",{"text":809,"config":810},"Quick start guides",{"href":811,"dataGaName":812,"dataGaLocation":639},"/get-started/","quick setup checklists",{"text":814,"config":815},"Learn",{"href":816,"dataGaLocation":639,"dataGaName":817},"https://university.gitlab.com/","learn",{"text":819,"config":820},"Product documentation",{"href":821,"dataGaName":822,"dataGaLocation":639},"https://docs.gitlab.com/","product documentation",{"text":824,"config":825},"Best practice videos",{"href":826,"dataGaName":827,"dataGaLocation":639},"/getting-started-videos/","best practice videos",{"text":829,"config":830},"Integrations",{"href":831,"dataGaName":832,"dataGaLocation":639},"/integrations/","integrations",{"title":834,"items":835},"Discover",[836,841,846,851,855],{"text":837,"config":838},"Customer success stories",{"href":839,"dataGaName":840,"dataGaLocation":639},"/customers/","customer success stories",{"text":842,"config":843},"Blog",{"href":844,"dataGaName":845,"dataGaLocation":639},"/blog/","blog",{"text":847,"config":848},"Demo Hub",{"href":849,"dataGaName":850,"dataGaLocation":639},"/demo-hub/","demo hub",{"text":852,"config":853},"The Source",{"href":854,"dataGaName":845,"dataGaLocation":639},"/the-source/",{"text":856,"config":857},"Remote",{"href":858,"dataGaName":859,"dataGaLocation":639},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":861,"items":862},"Connect",[863,868,873,878,883,888],{"text":864,"config":865},"GitLab Services",{"href":866,"dataGaName":867,"dataGaLocation":639},"/services/","services",{"text":869,"config":870},"Contribute",{"href":871,"dataGaName":872,"dataGaLocation":639},"https://contributors.gitlab.com","contribute",{"text":874,"config":875},"Community",{"href":876,"dataGaName":877,"dataGaLocation":639},"/community/","community",{"text":879,"config":880},"Forum",{"href":881,"dataGaName":882,"dataGaLocation":639},"https://forum.gitlab.com/","forum",{"text":884,"config":885},"Events",{"href":886,"dataGaName":887,"dataGaLocation":639},"/events/","events",{"text":889,"config":890},"Partners",{"href":891,"dataGaName":892,"dataGaLocation":639},"/partners/","partners",{"config":894,"title":897,"text":898,"link":899},{"background":895,"textColor":896},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":900,"config":901},"Read the latest",{"href":902,"dataGaName":903,"dataGaLocation":639},"/whats-new/","whats new",{"text":905,"config":906,"menu":908},"Company",{"dataNavLevelOne":907},"company",{"type":690,"columns":909},[910],{"items":911},[912,917,923,925,930,935,940,945,950,955],{"text":913,"config":914},"About",{"href":915,"dataGaName":916,"dataGaLocation":639},"/company/","about",{"text":918,"config":919,"footerGa":922},"Jobs",{"href":920,"dataGaName":921,"dataGaLocation":639},"/jobs/","jobs",{"dataGaName":921},{"text":884,"config":924},{"href":886,"dataGaName":887,"dataGaLocation":639},{"text":926,"config":927},"Leadership",{"href":928,"dataGaName":929,"dataGaLocation":639},"/company/team/e-group/","leadership",{"text":931,"config":932},"Handbook",{"href":933,"dataGaName":934,"dataGaLocation":639},"https://handbook.gitlab.com/","handbook",{"text":936,"config":937},"Investor relations",{"href":938,"dataGaName":939,"dataGaLocation":639},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":941,"config":942},"Trust Center",{"href":943,"dataGaName":944,"dataGaLocation":639},"/security/","trust center",{"text":946,"config":947},"AI Transparency Center",{"href":948,"dataGaName":949,"dataGaLocation":639},"/ai-transparency-center/","ai transparency center",{"text":951,"config":952},"Newsletter",{"href":953,"dataGaName":954,"dataGaLocation":639},"/company/contact/#contact-forms","newsletter",{"text":956,"config":957},"Press",{"href":958,"dataGaName":959,"dataGaLocation":639},"/press/","press",{"text":961,"config":962,"menu":963},"Contact us",{"dataNavLevelOne":907},{"type":690,"columns":964},[965],{"items":966},[967,972,977],{"text":968,"config":969},"Talk to sales",{"href":970,"dataGaName":971,"dataGaLocation":639},"/sales/","talk to sales",{"text":973,"config":974},"Support portal",{"href":975,"dataGaName":976,"dataGaLocation":639},"https://support.gitlab.com/hc/en-us","support portal",{"text":978,"config":979},"Customer portal",{"href":980,"dataGaName":981,"dataGaLocation":639},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":983,"login":984,"suggestions":991},"Close",{"text":985,"link":986},"To search repositories and projects, login to",{"text":987,"config":988},"gitlab.com",{"href":653,"dataGaName":989,"dataGaLocation":990},"search login","search",{"text":992,"default":993},"Suggestions",[994,996,1000,1002,1006,1010],{"text":670,"config":995},{"href":675,"dataGaName":670,"dataGaLocation":990},{"text":997,"config":998},"Code Suggestions (AI)",{"href":999,"dataGaName":997,"dataGaLocation":990},"/solutions/code-suggestions/",{"text":706,"config":1001},{"href":708,"dataGaName":706,"dataGaLocation":990},{"text":1003,"config":1004},"GitLab on AWS",{"href":1005,"dataGaName":1003,"dataGaLocation":990},"/partners/technology-partners/aws/",{"text":1007,"config":1008},"GitLab on Google Cloud",{"href":1009,"dataGaName":1007,"dataGaLocation":990},"/partners/technology-partners/google-cloud-platform/",{"text":1011,"config":1012},"Why GitLab?",{"href":683,"dataGaName":1011,"dataGaLocation":990},{"freeTrial":1014,"mobileIcon":1019,"desktopIcon":1024,"secondaryButton":1027},{"text":1015,"config":1016},"Start free trial",{"href":1017,"dataGaName":644,"dataGaLocation":1018},"https://gitlab.com/-/trials/new/","nav",{"altText":1020,"config":1021},"Gitlab Icon",{"src":1022,"dataGaName":1023,"dataGaLocation":1018},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1020,"config":1025},{"src":1026,"dataGaName":1023,"dataGaLocation":1018},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1028,"config":1029},"Get Started",{"href":1030,"dataGaName":1031,"dataGaLocation":1018},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1033,"mobileIcon":1037,"desktopIcon":1039},{"text":1034,"config":1035},"Learn more about GitLab Duo",{"href":675,"dataGaName":1036,"dataGaLocation":1018},"gitlab duo",{"altText":1020,"config":1038},{"src":1022,"dataGaName":1023,"dataGaLocation":1018},{"altText":1020,"config":1040},{"src":1026,"dataGaName":1023,"dataGaLocation":1018},{"button":1042,"mobileIcon":1047,"desktopIcon":1049},{"text":1043,"config":1044},"/switch",{"href":1045,"dataGaName":1046,"dataGaLocation":1018},"#contact","switch",{"altText":1020,"config":1048},{"src":1022,"dataGaName":1023,"dataGaLocation":1018},{"altText":1020,"config":1050},{"src":1051,"dataGaName":1023,"dataGaLocation":1018},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1053,"mobileIcon":1058,"desktopIcon":1060},{"text":1054,"config":1055},"Back to pricing",{"href":788,"dataGaName":1056,"dataGaLocation":1018,"icon":1057},"back to pricing","GoBack",{"altText":1020,"config":1059},{"src":1022,"dataGaName":1023,"dataGaLocation":1018},{"altText":1020,"config":1061},{"src":1026,"dataGaName":1023,"dataGaLocation":1018},{"title":1063,"titleMobile":1064,"button":1065,"config":1070},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":681,"config":1066},{"href":1067,"dataGaName":1068,"dataGaLocation":1069},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1071,"disabled":618},"release",{"data":1073},{"text":1074,"source":1075,"edit":1081,"contribute":1086,"config":1091,"items":1096,"minimal":1305},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1076,"config":1077},"View page source",{"href":1078,"dataGaName":1079,"dataGaLocation":1080},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1082,"config":1083},"Edit this page",{"href":1084,"dataGaName":1085,"dataGaLocation":1080},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1087,"config":1088},"Please contribute",{"href":1089,"dataGaName":1090,"dataGaLocation":1080},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1092,"facebook":1093,"youtube":1094,"linkedin":1095},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1097,1144,1197,1241,1273],{"title":786,"links":1098,"subMenu":1113},[1099,1103,1108],{"text":1100,"config":1101},"View plans",{"href":788,"dataGaName":1102,"dataGaLocation":1080},"view plans",{"text":1104,"config":1105},"Why Premium?",{"href":1106,"dataGaName":1107,"dataGaLocation":1080},"/pricing/premium/","why premium",{"text":1109,"config":1110},"Why Ultimate?",{"href":1111,"dataGaName":1112,"dataGaLocation":1080},"/pricing/ultimate/","why ultimate",[1114],{"title":1115,"links":1116},"Contact Us",[1117,1120,1122,1124,1129,1134,1139],{"text":1118,"config":1119},"Contact sales",{"href":970,"dataGaName":649,"dataGaLocation":1080},{"text":973,"config":1121},{"href":975,"dataGaName":976,"dataGaLocation":1080},{"text":978,"config":1123},{"href":980,"dataGaName":981,"dataGaLocation":1080},{"text":1125,"config":1126},"Status",{"href":1127,"dataGaName":1128,"dataGaLocation":1080},"https://status.gitlab.com/","status",{"text":1130,"config":1131},"Terms of use",{"href":1132,"dataGaName":1133,"dataGaLocation":1080},"/terms/","terms of use",{"text":1135,"config":1136},"Privacy statement",{"href":1137,"dataGaName":1138,"dataGaLocation":1080},"/privacy/","privacy statement",{"text":1140,"config":1141},"Cookie preferences",{"dataGaName":1142,"dataGaLocation":1080,"id":1143,"isOneTrustButton":621},"cookie preferences","ot-sdk-btn",{"title":686,"links":1145,"subMenu":1154},[1146,1150],{"text":1147,"config":1148},"DevSecOps platform",{"href":668,"dataGaName":1149,"dataGaLocation":1080},"devsecops platform",{"text":1151,"config":1152},"AI-Assisted Development",{"href":675,"dataGaName":1153,"dataGaLocation":1080},"ai-assisted development",[1155],{"title":1156,"links":1157},"Topics",[1158,1163,1168,1173,1178,1182,1187,1192],{"text":1159,"config":1160},"CICD",{"href":1161,"dataGaName":1162,"dataGaLocation":1080},"/topics/ci-cd/","cicd",{"text":1164,"config":1165},"GitOps",{"href":1166,"dataGaName":1167,"dataGaLocation":1080},"/topics/gitops/","gitops",{"text":1169,"config":1170},"DevOps",{"href":1171,"dataGaName":1172,"dataGaLocation":1080},"/topics/devops/","devops",{"text":1174,"config":1175},"Version Control",{"href":1176,"dataGaName":1177,"dataGaLocation":1080},"/topics/version-control/","version control",{"text":630,"config":1179},{"href":1180,"dataGaName":1181,"dataGaLocation":1080},"/topics/devsecops/","devsecops",{"text":1183,"config":1184},"Cloud Native",{"href":1185,"dataGaName":1186,"dataGaLocation":1080},"/topics/cloud-native/","cloud native",{"text":1188,"config":1189},"AI for Coding",{"href":1190,"dataGaName":1191,"dataGaLocation":1080},"/topics/devops/ai-for-coding/","ai for coding",{"text":1193,"config":1194},"Agentic AI",{"href":1195,"dataGaName":1196,"dataGaLocation":1080},"/topics/agentic-ai/","agentic ai",{"title":1198,"links":1199},"Solutions",[1200,1202,1204,1209,1213,1216,1220,1223,1225,1228,1231,1236],{"text":730,"config":1201},{"href":725,"dataGaName":730,"dataGaLocation":1080},{"text":719,"config":1203},{"href":702,"dataGaName":703,"dataGaLocation":1080},{"text":1205,"config":1206},"Agile development",{"href":1207,"dataGaName":1208,"dataGaLocation":1080},"/solutions/agile-delivery/","agile delivery",{"text":1210,"config":1211},"SCM",{"href":715,"dataGaName":1212,"dataGaLocation":1080},"source code management",{"text":1159,"config":1214},{"href":708,"dataGaName":1215,"dataGaLocation":1080},"continuous integration & delivery",{"text":1217,"config":1218},"Value stream management",{"href":758,"dataGaName":1219,"dataGaLocation":1080},"value stream management",{"text":1164,"config":1221},{"href":1222,"dataGaName":1167,"dataGaLocation":1080},"/solutions/gitops/",{"text":768,"config":1224},{"href":771,"dataGaName":772,"dataGaLocation":1080},{"text":1226,"config":1227},"Small business",{"href":777,"dataGaName":778,"dataGaLocation":1080},{"text":1229,"config":1230},"Public sector",{"href":783,"dataGaName":784,"dataGaLocation":1080},{"text":1232,"config":1233},"Education",{"href":1234,"dataGaName":1235,"dataGaLocation":1080},"/solutions/education/","education",{"text":1237,"config":1238},"Financial services",{"href":1239,"dataGaName":1240,"dataGaLocation":1080},"/solutions/finance/","financial services",{"title":791,"links":1242},[1243,1245,1247,1249,1252,1254,1257,1259,1261,1263,1265,1267,1269,1271],{"text":804,"config":1244},{"href":806,"dataGaName":807,"dataGaLocation":1080},{"text":809,"config":1246},{"href":811,"dataGaName":812,"dataGaLocation":1080},{"text":814,"config":1248},{"href":816,"dataGaName":817,"dataGaLocation":1080},{"text":819,"config":1250},{"href":821,"dataGaName":1251,"dataGaLocation":1080},"docs",{"text":842,"config":1253},{"href":844,"dataGaName":845,"dataGaLocation":1080},{"text":1255,"config":1256},"What's new",{"href":902,"dataGaName":903,"dataGaLocation":1080},{"text":837,"config":1258},{"href":839,"dataGaName":840,"dataGaLocation":1080},{"text":856,"config":1260},{"href":858,"dataGaName":859,"dataGaLocation":1080},{"text":864,"config":1262},{"href":866,"dataGaName":867,"dataGaLocation":1080},{"text":869,"config":1264},{"href":871,"dataGaName":872,"dataGaLocation":1080},{"text":874,"config":1266},{"href":876,"dataGaName":877,"dataGaLocation":1080},{"text":879,"config":1268},{"href":881,"dataGaName":882,"dataGaLocation":1080},{"text":884,"config":1270},{"href":886,"dataGaName":887,"dataGaLocation":1080},{"text":889,"config":1272},{"href":891,"dataGaName":892,"dataGaLocation":1080},{"title":905,"links":1274},[1275,1277,1279,1281,1283,1285,1289,1294,1296,1298,1300],{"text":913,"config":1276},{"href":915,"dataGaName":907,"dataGaLocation":1080},{"text":918,"config":1278},{"href":920,"dataGaName":921,"dataGaLocation":1080},{"text":926,"config":1280},{"href":928,"dataGaName":929,"dataGaLocation":1080},{"text":931,"config":1282},{"href":933,"dataGaName":934,"dataGaLocation":1080},{"text":936,"config":1284},{"href":938,"dataGaName":939,"dataGaLocation":1080},{"text":1286,"config":1287},"Sustainability",{"href":1288,"dataGaName":1286,"dataGaLocation":1080},"/sustainability/",{"text":1290,"config":1291},"Diversity, inclusion and belonging (DIB)",{"href":1292,"dataGaName":1293,"dataGaLocation":1080},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":941,"config":1295},{"href":943,"dataGaName":944,"dataGaLocation":1080},{"text":951,"config":1297},{"href":953,"dataGaName":954,"dataGaLocation":1080},{"text":956,"config":1299},{"href":958,"dataGaName":959,"dataGaLocation":1080},{"text":1301,"config":1302},"Modern Slavery Transparency Statement",{"href":1303,"dataGaName":1304,"dataGaLocation":1080},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1306},[1307,1310,1313],{"text":1308,"config":1309},"Terms",{"href":1132,"dataGaName":1133,"dataGaLocation":1080},{"text":1311,"config":1312},"Cookies",{"dataGaName":1142,"dataGaLocation":1080,"id":1143,"isOneTrustButton":621},{"text":1314,"config":1315},"Privacy",{"href":1137,"dataGaName":1138,"dataGaLocation":1080},[1317,1331],{"id":1318,"title":7,"body":617,"config":1319,"content":1321,"description":617,"extension":1325,"meta":1326,"navigation":621,"path":1327,"seo":1328,"stem":1329,"__hash__":1330},"blogAuthors/en-us/blog/authors/hiroki-suezawa.yml",{"template":1320},"BlogAuthor",{"name":7,"config":1322},{"headshot":1323,"ctfId":1324},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749662370/Blog/Author%20Headshots/hiroki_suezawa.png","cw6ZIj0yjr1uw2LAFr23h","yml",{},"/en-us/blog/authors/hiroki-suezawa",{},"en-us/blog/authors/hiroki-suezawa","5SalhkDKL3j3O2JyjOofwTFjgEeNhoGH8nLQDeI7N7c",{"id":1332,"title":8,"body":617,"config":1333,"content":1334,"description":617,"extension":1325,"meta":1338,"navigation":621,"path":1339,"seo":1340,"stem":1341,"__hash__":1342},"blogAuthors/en-us/blog/authors/mitra-jozenazemian.yml",{"template":1320},{"name":8,"config":1335},{"headshot":1336,"ctfId":1337},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749662373/Blog/Author%20Headshots/Screenshot_2024-10-25_at_8.23.56_AM.png","4suqsutT8w5ZmkIvSVrmWQ",{},"/en-us/blog/authors/mitra-jozenazemian",{},"en-us/blog/authors/mitra-jozenazemian","DzsXAQdHz5kyKwnJ-xGAs_Wr_lt8XWi_J9LQijwLiVY",[1344,1352,1360],{"title":1345,"description":1346,"heroImage":1347,"category":613,"date":1348,"authors":1349,"slug":1351,"externalUrl":617},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1350],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1353,"description":1354,"heroImage":1347,"category":613,"date":1355,"authors":1356,"slug":1359,"externalUrl":617},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1357,1358],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1361,"description":1362,"heroImage":1363,"category":613,"date":1364,"authors":1365,"slug":1367,"externalUrl":617},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1366],"Alisa Ho","claude-security-and-gitlab",{"promotions":1369},[1370,1384,1396,1407],{"id":1371,"categories":1372,"header":1374,"text":1375,"button":1376,"image":1381},"ai-modernization",[1373],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1377,"config":1378},"Get your AI maturity score",{"href":1379,"dataGaName":1380,"dataGaLocation":845},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1382},{"src":1383},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1385,"categories":1386,"header":1388,"text":1375,"button":1389,"image":1393},"devops-modernization",[1387,1181],"product","Are you just managing tools or shipping innovation?",{"text":1390,"config":1391},"Get your DevOps maturity score",{"href":1392,"dataGaName":1380,"dataGaLocation":845},"/assessments/devops-modernization-assessment/",{"config":1394},{"src":1395},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1397,"categories":1398,"header":1399,"text":1375,"button":1400,"image":1404},"security-modernization",[613],"Are you trading speed for security?",{"text":1401,"config":1402},"Get your security maturity score",{"href":1403,"dataGaName":1380,"dataGaLocation":845},"/assessments/security-modernization-assessment/",{"config":1405},{"src":1406},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1408,"paths":1409,"header":1412,"text":1413,"button":1414,"image":1419},"github-azure-migration",[1410,1411],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1415,"config":1416},"See how GitLab compares to GitHub",{"href":1417,"dataGaName":1418,"dataGaLocation":845},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1420},{"src":1395},{"header":1422,"blurb":1423,"button":1424,"secondaryButton":1429},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1425,"config":1426},"Get your free trial",{"href":1427,"dataGaName":644,"dataGaLocation":1428},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1118,"config":1430},{"href":970,"dataGaName":649,"dataGaLocation":1428},1786803772072]