[{"data":1,"prerenderedAt":1096},["ShallowReactive",2],{"/blog/sast-vs-llm-security-scanner":3,"navigation-en-us":321,"banner-en-us":753,"footer-en-us":763,"blog-post-authors-en-us-Meir Benayoun|Chris Widstrom":1024,"blog-related-posts-en-us-sast-vs-llm-security-scanner":1051,"blog-share-wrapper-en-us":1076,"next-steps-en-us":1086},{"id":4,"title":5,"authors":6,"body":9,"category":302,"date":303,"description":304,"extension":305,"externalUrl":306,"faq":306,"featured":307,"heroImage":308,"meta":309,"navigation":307,"path":310,"seo":311,"slug":314,"stem":315,"tags":316,"template":319,"updatedDate":306,"__hash__":320},"blogPosts/en-us/blog/sast-vs-llm-security-scanner.md","When to use SAST versus an LLM security scanner",[7,8],"Meir Benayoun","Chris Widstrom",{"type":10,"value":11,"toc":291},"minimark",[12,16,19,22,137,142,145,161,165,167,170,173,176,179,182,185,188,191,195,198,209,220,224,229,232,237,240,245,248,253,256,260],[13,14,15],"p",{},"You're probably running some version of this experiment already: Point a frontier model at a merge request and ask it to double as a vulnerability scanner. On a single merge request, it often works well. The model reads the code, reasons about what it's supposed to do, and catches real issues, sometimes ones a pattern-based scanner misses entirely.",[13,17,18],{},"So the next thought is reasonable: If a model reviews one merge request this well, why not let it replace the scanner across your whole pipeline? That’s where it breaks down. Running a frontier model as your primary scanner on every commit across an enterprise codebase costs more and behaves less predictably, than asking it to review one merge request.",[13,20,21],{},"If you run application security for a platform or product team, the decision was never mutually exclusive: static application security testing (SAST) or LLM scanners. It's which one runs where. Get that split right and you keep deterministic coverage on every commit, add reasoning where it earns its place, and avoid both an unpredictable inference bill and gaps in your audit trail. Here's how the two compare:",[23,24,25,41],"table",{},[26,27,28],"thead",{},[29,30,31,35,38],"tr",{},[32,33],"th",{"align":34},"left",[32,36,37],{"align":34},"Deterministic scanner (SAST)",[32,39,40],{"align":34},"AI-based review (LLM)",[42,43,44,66,83,100,120],"tbody",{},[29,45,46,50,61],{},[47,48,49],"td",{"align":34},"Cost",[47,51,52,56,57,60],{"align":34},[53,54,55],"strong",{},"Better"," ",[58,59],"br",{}," Fractions of a cent per scan, fixed and predictable.",[47,62,63,65],{"align":34},[58,64],{}," A paid inference call per scan; cost scales with code volume and is hard to forecast.",[29,67,68,71,78],{},[47,69,70],{"align":34},"Consistency",[47,72,73,56,75,77],{"align":34},[53,74,55],{},[58,76],{}," Flags the same vulnerabilities, every time.",[47,79,80,82],{"align":34},[58,81],{}," Can flag or miss different vulnerabilities on the same code, run to run.",[29,84,85,88,95],{},[47,86,87],{"align":34},"Audit evidence",[47,89,90,56,92,94],{"align":34},[53,91,55],{},[58,93],{}," Reproducible: same fixed method every time, mapped to a CWE",[47,96,97,99],{"align":34},[58,98],{}," Output can vary between runs, harder to use as standalone audit evidence.",[29,101,102,105,113],{},[47,103,104],{"align":34},"Vulnerability types",[47,106,107,56,110,112],{"align":34},[53,108,109],{},"Depends on the vulnerability type",[58,111],{}," Pattern-based, traceable flaws (injection)",[47,114,115,56,117,119],{"align":34},[53,116,109],{},[58,118],{}," Intent-based and novel flaws: missing auth checks, broken ownership logic, and issues not yet mapped to a CVE or CWE. Could reason about business logic using context from issues, epics, and docs.",[29,121,122,125,130],{},[47,123,124],{"align":34},"Validating a finding",[47,126,127,129],{"align":34},[58,128],{}," Flags potential vulnerabilities; can't confirm whether one is exploitable",[47,131,132,56,134,136],{"align":34},[53,133,55],{},[58,135],{}," Tests findings by generating a working exploit, so fewer false positives reach your queue.",[138,139,141],"h2",{"id":140},"the-cost-of-scanning-every-commit","The cost of scanning every commit",[13,143,144],{},"Better: SAST",[13,146,147,148,154,155,160],{},"The cost of an ",[149,150,153],"a",{"href":151,"rel":152},"https://about.gitlab.com/blog/what-is-a-large-language-model-llm/",[],"LLM"," reviewing one merge request might seem marginal, but when you point that same model at every commit across an enterprise codebase, the math no longer works. Every scan becomes an unpredictable paid inference call, and that cost compounds with every commit, every day. ",[149,156,159],{"href":157,"rel":158},"https://docs.gitlab.com/user/application_security/sast/",[],"SAST"," runs at the same volume for fractions of a cent per scan, the same way every time, predictably. SAST keeps per-commit scanning cheap and predictable, so security coverage never competes with the budget. An LLM in that role makes the cost scale with usage and difficult to forecast.",[138,162,164],{"id":163},"consistency-and-producing-audit-evidence","Consistency and producing audit evidence",[13,166,144],{},[13,168,169],{},"Run the same code through an LLM twice and the vulnerabilities identified may differ. It's not because the model made a mistake, it's how sampling-based reasoning works. That inconsistency becomes a challenge when you need to prove a scan happened and can be trusted for audits. Auditors independently verify the completeness and accuracy of scanners by rerunning them and confirming the results match. Because a deterministic scanner is rules based, it gives you consistency by design. When you rerun it, you get the same result every time.",[138,171,104],{"id":172},"vulnerability-types",[13,174,175],{},"Better: Both",[13,177,178],{},"Static scanners and LLM scanners are strong on different classes of vulnerabilities. A deterministic scanner is built for pattern-based vulnerabilities like injection flaws, hardcoded secrets, and insecure crypto calls. It follows fixed rules, so it flags the same issues on every run.",[13,180,181],{},"An LLM scan works differently. It can read the context around the code, the epics, issues, and docs that describe what the system is supposed to do, which a scanner does not have the ability to process. That context is what lets it flag business logic issues like a missing authorization check or a broken ownership assumption. When that context is available, a LLM can catch what a pattern-based scanner structurally never can.",[138,183,124],{"id":184},"validating-a-finding",[13,186,187],{},"Better: LLM scanners",[13,189,190],{},"A deterministic scanner flags candidates, but it can't tell you whether a finding is actually exploitable. An LLM can go further. It writes a quick test that tries to trigger the flaw, so you see whether a finding is real before it reaches your queue. That saves your team from spending time investigating false positives, and it earns the developer trust in the quality of the findings.",[138,192,194],{"id":193},"security-programs-are-heading-toward-both","Security programs are heading toward both",[13,196,197],{},"Security teams aren't picking one type of scanner, they're building towards a program running both. Deterministic scanning stays the baseline that runs on every commit, no matter what, because that's the coverage a program can't compromise on. LLM scanners layer on top for the reasoning-heavy checks they excel at, usually at the merge request level rather than on every commit. That's where they can catch vulnerabilities where a deterministic scanner structurally cannot. Together they give you comprehensive coverage, the deterministic scanning that catches patterns at a predictable cost and LLM scanners for the reasoning to catch logic flaws.",[13,199,200,203,204],{},[53,201,202],{},"New to GitLab?"," Advanced SAST scans every commit, and Security Review Flow, GitLab’s security LLM scanner, adds reasoning based review, all in the same pipeline. ",[149,205,208],{"href":206,"rel":207},"https://about.gitlab.com/free-trial/?utm_medium=native&utm_source=integrate-market&utm_campaign=eg_global_cmp_content-syndication_security_en_",[],"Start a free trial of GitLab Ultimate.",[13,210,211,56,214,219],{},[53,212,213],{},"Already on GitLab Ultimate?",[149,215,218],{"href":216,"rel":217},"https://docs.gitlab.com/user/duo_agent_platform/flows/foundational_flows/security_review/",[],"Turn Security Review Flow on"," to run alongside the SAST scans you're already running.",[138,221,223],{"id":222},"faq","FAQ",[13,225,226],{},[53,227,228],{},"Can AI replace SAST?",[13,230,231],{},"Not as the only scanner. AI-based review can find real issues, but it can flag or miss different vulnerabilities on the same code from one run to the next, and running an LLM over every commit at enterprise scale costs more and is harder to forecast than a scanner built to run continuously and deterministically.",[13,233,234],{},[53,235,236],{},"Why does having reproducible audit evidence matter for compliance?",[13,238,239],{},"Frameworks for secure coding like SOC 2, PCI DSS, and the European Union's Cyber Resilience Act require reproducible, auditable evidence. A scanner is information an auditor independently verifies by rerunning it and confirming the result matches. A deterministic scanner supports independent confirmation by design. A probabilistic model doesn't guarantee the same results with each scan.",[13,241,242],{},[53,243,244],{},"What can AI-based reviews catch that SAST can't?",[13,246,247],{},"AI-based reviews can catch business logic flaws: missing authorization checks, broken ownership validation, and bugs that depend on understanding what the code is supposed to do, not just how it's written. AI-based reviews enable reasoning about intent, which pattern-based scanning isn't built to do.",[13,249,250],{},[53,251,252],{},"Should security teams use both?",[13,254,255],{},"Yes. SAST and AI-based reviews specialize in detecting different vulnerability types. Programs could run SAST continuously, on every commit, and reserve AI-based review for the reasoning-heavy checks, such as business logic vulnerabilities, that a scanner structurally cannot detect.",[138,257,259],{"id":258},"additional-resources","Additional resources",[261,262,263,271,278,284],"ul",{},[264,265,266],"li",{},[149,267,270],{"href":268,"rel":269},"https://about.gitlab.com/blog/delivering-faster-and-smarter-scans-with-advanced-sast/",[],"Delivering faster and smarter scans with Advanced SAST",[264,272,273],{},[149,274,277],{"href":275,"rel":276},"https://docs.gitlab.com/user/application_security/sast/gitlab_advanced_sast/",[],"GitLab Advanced SAST documentation",[264,279,280],{},[149,281,283],{"href":216,"rel":282},[],"GitLab Duo Security Review Flow documentation",[264,285,286],{},[149,287,290],{"href":288,"rel":289},"https://about.gitlab.com/blog/gitlab-duo-security-review-flow/",[],"GitLab Duo Security Review spots logic flaws scanners miss",{"title":292,"searchDepth":293,"depth":293,"links":294},"",2,[295,296,297,298,299,300,301],{"id":140,"depth":293,"text":141},{"id":163,"depth":293,"text":164},{"id":172,"depth":293,"text":104},{"id":184,"depth":293,"text":124},{"id":193,"depth":293,"text":194},{"id":222,"depth":293,"text":223},{"id":258,"depth":293,"text":259},"security","2026-09-16","AI-based review and SAST catch different classes of bugs and both have benefits. Here's how to decide which one runs where, and when your team needs both. ","md",null,true,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1756989645/fojzxakmfdea6jfqjkrl.png",{},"/en-us/blog/sast-vs-llm-security-scanner",{"config":312,"title":5,"description":304},{"noIndex":313},false,"sast-vs-llm-security-scanner","en-us/blog/sast-vs-llm-security-scanner",[302,317,318],"features","product","BlogPost","_99AqNm3aUqOrVmmSbsDCPEczcR-tf5FfEtDCJOSLag",{"logo":322,"freeTrial":327,"sales":332,"login":337,"items":342,"search":673,"minimal":704,"duo":723,"switchNav":732,"pricingDeployment":743},{"config":323},{"href":324,"dataGaName":325,"dataGaLocation":326},"/","gitlab logo","header",{"text":328,"config":329},"Get free trial",{"href":330,"dataGaName":331,"dataGaLocation":326},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":333,"config":334},"Request a demo",{"href":335,"dataGaName":336,"dataGaLocation":326},"/request-a-demo/","sales",{"text":338,"config":339},"Sign in",{"href":340,"dataGaName":341,"dataGaLocation":326},"https://gitlab.com/users/sign_in/","sign in",[343,429,517,522,597,651],{"text":344,"left":307,"config":345,"menu":347},"Platform",{"dataNavLevelOne":346},"platform",{"type":348,"link":349,"columns":353,"feature":418},"lists",{"text":350,"config":351},"Explore the Platform",{"href":352,"dataGaName":346,"dataGaLocation":326},"/platform/",[354,377,400],{"title":355,"items":356},"Execution & Workflows",[357,362,367,372],{"text":358,"config":359},"CI/CD",{"href":360,"dataGaLocation":326,"dataGaName":361},"/solutions/continuous-integration/","ci/cd",{"text":363,"config":364},"Source Code Management",{"href":365,"dataGaLocation":326,"dataGaName":366},"/solutions/source-code-management/","source code management",{"text":368,"config":369},"Agile Delivery",{"href":370,"dataGaLocation":326,"dataGaName":371},"/solutions/agile-delivery/","agile delivery",{"text":373,"config":374},"Artifact Management",{"href":375,"dataGaLocation":326,"dataGaName":376},"/artifact-central/","artifact management",{"title":378,"items":379},"Security & Governance",[380,385,390,395],{"text":381,"config":382},"Application Security Testing",{"href":383,"dataGaLocation":326,"dataGaName":384},"/solutions/application-security-testing/","application security testing",{"text":386,"config":387},"Governance & Compliance",{"href":388,"dataGaLocation":326,"dataGaName":389},"/solutions/software-compliance/","governance and compliance",{"text":391,"config":392},"Secrets Management",{"href":393,"dataGaLocation":326,"dataGaName":394},"/gitlab-secrets-manager/","secrets management",{"text":396,"config":397},"Supply Chain Security",{"href":398,"dataGaLocation":326,"dataGaName":399},"/solutions/supply-chain/","supply chain security",{"title":401,"items":402},"Context & AI",[403,408,413],{"text":404,"config":405},"Agentic Orchestration",{"href":406,"dataGaLocation":326,"dataGaName":407},"/gitlab-duo-agent-platform/","agentic orchestration",{"text":409,"config":410},"Context Graph",{"href":411,"dataGaLocation":326,"dataGaName":412},"/gitlab-orbit/","context graph",{"text":414,"config":415},"Visibility & Measurement",{"href":416,"dataGaLocation":326,"dataGaName":417},"/solutions/visibility-measurement/","visibility and measurement",{"config":419,"title":422,"text":423,"link":424},{"background":420,"textColor":421},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1790185102/o7dn32anqcb6z8dgd3as.jpg')","#000","Why GitLab","One platform for speed with control across your software lifecycle.",{"text":425,"config":426},"Learn more",{"href":427,"dataGaName":428,"dataGaLocation":326},"/why-gitlab/","why gitlab",{"text":430,"left":307,"config":431,"menu":433},"Solutions",{"dataNavLevelOne":432},"solutions",{"type":348,"link":434,"columns":438,"feature":508},{"text":435,"config":436},"View all Solutions",{"href":437,"dataGaName":432,"dataGaLocation":326},"/solutions/",[439,457,475],{"title":440,"items":441},"Outcomes",[442,447,452],{"text":443,"config":444},"DevOps Modernization",{"href":445,"dataGaLocation":326,"dataGaName":446},"/assessments/devops-modernization-assessment/","devops modernization",{"text":448,"config":449},"Security Modernization",{"href":450,"dataGaLocation":326,"dataGaName":451},"/assessments/security-modernization-assessment/","security modernization",{"text":453,"config":454},"AI Modernization",{"href":455,"dataGaLocation":326,"dataGaName":456},"/assessments/ai-modernization-assessment/","ai modernization",{"title":458,"items":459},"By size",[460,465,470],{"text":461,"config":462},"Enterprise",{"href":463,"dataGaLocation":326,"dataGaName":464},"/enterprise/","enterprise",{"text":466,"config":467},"Small Business",{"href":468,"dataGaLocation":326,"dataGaName":469},"/small-business/","small business",{"text":471,"config":472},"Startups",{"href":473,"dataGaLocation":326,"dataGaName":474},"/solutions/startups/","startups",{"title":476,"items":477},"Industries",[478,483,488,493,498,503],{"text":479,"config":480},"Financial Services",{"href":481,"dataGaLocation":326,"dataGaName":482},"/solutions/finance/","financial services",{"text":484,"config":485},"Public Sector",{"href":486,"dataGaLocation":326,"dataGaName":487},"/solutions/public-sector/","public sector",{"text":489,"config":490},"Telecommunications",{"href":491,"dataGaLocation":326,"dataGaName":492},"/solutions/telecommunications/","telecommunications",{"text":494,"config":495},"Automotive",{"href":496,"dataGaLocation":326,"dataGaName":497},"/solutions/automotive/","automotive",{"text":499,"config":500},"Education",{"href":501,"dataGaLocation":326,"dataGaName":502},"/solutions/education/","education",{"text":504,"config":505},"Aerospace",{"href":506,"dataGaLocation":326,"dataGaName":507},"/solutions/aerospace/","aerospace",{"config":509,"title":510,"text":511,"link":512},{"background":420,"textColor":421},"GitLab Security Standard","Learn how to harden your software factory and let AI agents earn autonomy, without trading away security.",{"text":513,"config":514},"Explore the standard",{"href":515,"dataGaName":516,"dataGaLocation":326},"/gitlab-security-standard/","gitlab security standard",{"text":518,"config":519},"Pricing",{"href":520,"dataGaName":521,"dataGaLocation":326,"dataNavLevelOne":521},"/pricing/","pricing",{"text":523,"config":524,"menu":526},"Resources",{"dataNavLevelOne":525},"resources",{"type":348,"link":527,"columns":531,"feature":588},{"text":528,"config":529},"View all resources",{"href":530,"dataGaName":525,"dataGaLocation":326},"/resources/",[532,560],{"title":533,"items":534},"Discover",[535,540,545,550,555],{"text":536,"config":537},"Docs",{"href":538,"dataGaName":539,"dataGaLocation":326},"https://docs.gitlab.com/","docs",{"text":541,"config":542},"University",{"href":543,"dataGaName":544,"dataGaLocation":326},"https://university.gitlab.com/","university",{"text":546,"config":547},"Demo Series",{"href":548,"dataGaName":549,"dataGaLocation":326},"/gitlab-technical-demo-series/","demo series",{"text":551,"config":552},"Demo Hub",{"href":553,"dataGaName":554,"dataGaLocation":326},"/demo-hub/","demo hub",{"text":556,"config":557},"Services",{"href":558,"dataGaName":559,"dataGaLocation":326},"/services/","services",{"title":561,"items":562},"Connect",[563,568,573,578,583],{"text":564,"config":565},"Blog",{"href":566,"dataGaName":567,"dataGaLocation":326},"/blog/","blog",{"text":569,"config":570},"Community",{"href":571,"dataGaName":572,"dataGaLocation":326},"/community/","community",{"text":574,"config":575},"Customers",{"href":576,"dataGaName":577,"dataGaLocation":326},"/customers/","customers",{"text":579,"config":580},"Partners",{"href":581,"dataGaName":582,"dataGaLocation":326},"/partners/","partners",{"text":584,"config":585},"Events",{"href":586,"dataGaName":587,"dataGaLocation":326},"/events/","events",{"config":589,"title":590,"text":591,"link":592},{"background":420,"textColor":421},"What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":593,"config":594},"Read the latest",{"href":595,"dataGaName":596,"dataGaLocation":326},"/whats-new/","whats new",{"text":598,"config":599,"menu":601},"Company",{"dataNavLevelOne":600},"company",{"type":348,"columns":602},[603],{"items":604},[605,610,616,621,626,631,636,641,646],{"text":606,"config":607},"About",{"href":608,"dataGaName":609,"dataGaLocation":326},"/company/","about",{"text":611,"config":612,"footerGa":615},"Jobs",{"href":613,"dataGaName":614,"dataGaLocation":326},"/jobs/","jobs",{"dataGaName":614},{"text":617,"config":618},"Press",{"href":619,"dataGaName":620,"dataGaLocation":326},"/press/","press",{"text":622,"config":623},"Handbook",{"href":624,"dataGaName":625,"dataGaLocation":326},"https://handbook.gitlab.com/","handbook",{"text":627,"config":628},"Leadership",{"href":629,"dataGaName":630,"dataGaLocation":326},"/company/team/e-group/","leadership",{"text":632,"config":633},"Investor relations",{"href":634,"dataGaName":635,"dataGaLocation":326},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":637,"config":638},"Trust Center",{"href":639,"dataGaName":640,"dataGaLocation":326},"/security/","trust center",{"text":642,"config":643},"AI Transparency Center",{"href":644,"dataGaName":645,"dataGaLocation":326},"/ai-transparency-center/","ai transparency center",{"text":647,"config":648},"Newsletter",{"href":649,"dataGaName":650,"dataGaLocation":326},"/company/contact/#contact-forms","newsletter",{"text":652,"config":653,"menu":654},"Contact us",{"dataNavLevelOne":600},{"type":348,"columns":655},[656],{"items":657},[658,663,668],{"text":659,"config":660},"Talk to sales",{"href":661,"dataGaName":662,"dataGaLocation":326},"/sales/","talk to sales",{"text":664,"config":665},"Support portal",{"href":666,"dataGaName":667,"dataGaLocation":326},"https://support.gitlab.com/hc/en-us","support portal",{"text":669,"config":670},"Customer portal",{"href":671,"dataGaName":672,"dataGaLocation":326},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":674,"login":675,"suggestions":682},"Close",{"text":676,"link":677},"To search repositories and projects, login to",{"text":678,"config":679},"gitlab.com",{"href":340,"dataGaName":680,"dataGaLocation":681},"search login","search",{"text":683,"default":684},"Suggestions",[685,688,691,693,697,701],{"text":686,"config":687},"GitLab Duo Agent Platform",{"href":406,"dataGaName":686,"dataGaLocation":681},{"text":689,"config":690},"Code Suggestions (AI)",{"href":406,"dataGaName":689,"dataGaLocation":681},{"text":358,"config":692},{"href":360,"dataGaName":358,"dataGaLocation":681},{"text":694,"config":695},"GitLab on AWS",{"href":696,"dataGaName":694,"dataGaLocation":681},"/partners/technology-partners/aws/",{"text":698,"config":699},"GitLab on Google Cloud",{"href":700,"dataGaName":698,"dataGaLocation":681},"/partners/technology-partners/google-cloud-platform/",{"text":702,"config":703},"Why GitLab?",{"href":427,"dataGaName":702,"dataGaLocation":681},{"freeTrial":705,"mobileIcon":710,"desktopIcon":715,"secondaryButton":718},{"text":706,"config":707},"Start free trial",{"href":708,"dataGaName":331,"dataGaLocation":709},"https://gitlab.com/-/trials/new/","nav",{"altText":711,"config":712},"Gitlab Icon",{"src":713,"dataGaName":714,"dataGaLocation":709},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":711,"config":716},{"src":717,"dataGaName":714,"dataGaLocation":709},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":719,"config":720},"Get Started",{"href":721,"dataGaName":722,"dataGaLocation":709},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":724,"mobileIcon":728,"desktopIcon":730},{"text":725,"config":726},"Learn more about GitLab Duo",{"href":406,"dataGaName":727,"dataGaLocation":709},"gitlab duo",{"altText":711,"config":729},{"src":713,"dataGaName":714,"dataGaLocation":709},{"altText":711,"config":731},{"src":717,"dataGaName":714,"dataGaLocation":709},{"button":733,"mobileIcon":738,"desktopIcon":740},{"text":734,"config":735},"/switch",{"href":736,"dataGaName":737,"dataGaLocation":709},"#contact","switch",{"altText":711,"config":739},{"src":713,"dataGaName":714,"dataGaLocation":709},{"altText":711,"config":741},{"src":742,"dataGaName":714,"dataGaLocation":709},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":744,"mobileIcon":749,"desktopIcon":751},{"text":745,"config":746},"Back to pricing",{"href":520,"dataGaName":747,"dataGaLocation":709,"icon":748},"back to pricing","GoBack",{"altText":711,"config":750},{"src":713,"dataGaName":714,"dataGaLocation":709},{"altText":711,"config":752},{"src":717,"dataGaName":714,"dataGaLocation":709},{"title":754,"button":755,"config":761},"Ship at agent speed. Prove every step. Transcend is here.",{"text":756,"config":757},"Watch now",{"href":758,"dataGaName":759,"dataGaLocation":760},"/events/transcend/virtual/#watch-gitlab-transcend","transcend-october-2026-banner","global-banner",{"layout":762,"disabled":313},"release",{"data":764},{"text":765,"source":766,"edit":772,"contribute":777,"config":782,"items":787,"minimal":1013},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":767,"config":768},"View page source",{"href":769,"dataGaName":770,"dataGaLocation":771},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":773,"config":774},"Edit this page",{"href":775,"dataGaName":776,"dataGaLocation":771},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":778,"config":779},"Please contribute",{"href":780,"dataGaName":781,"dataGaLocation":771},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":783,"facebook":784,"youtube":785,"linkedin":786},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[788,835,893,940,981],{"title":518,"links":789,"subMenu":804},[790,794,799],{"text":791,"config":792},"View plans",{"href":520,"dataGaName":793,"dataGaLocation":771},"view plans",{"text":795,"config":796},"Why Premium?",{"href":797,"dataGaName":798,"dataGaLocation":771},"/pricing/premium/","why premium",{"text":800,"config":801},"Why Ultimate?",{"href":802,"dataGaName":803,"dataGaLocation":771},"/pricing/ultimate/","why ultimate",[805],{"title":806,"links":807},"Contact Us",[808,811,813,815,820,825,830],{"text":809,"config":810},"Contact sales",{"href":661,"dataGaName":336,"dataGaLocation":771},{"text":664,"config":812},{"href":666,"dataGaName":667,"dataGaLocation":771},{"text":669,"config":814},{"href":671,"dataGaName":672,"dataGaLocation":771},{"text":816,"config":817},"Status",{"href":818,"dataGaName":819,"dataGaLocation":771},"https://status.gitlab.com/","status",{"text":821,"config":822},"Terms of use",{"href":823,"dataGaName":824,"dataGaLocation":771},"/terms/","terms of use",{"text":826,"config":827},"Privacy statement",{"href":828,"dataGaName":829,"dataGaLocation":771},"/privacy/","privacy statement",{"text":831,"config":832},"Cookie preferences",{"dataGaName":833,"dataGaLocation":771,"id":834,"isOneTrustButton":307},"cookie preferences","ot-sdk-btn",{"title":344,"links":836,"subMenu":850},[837,840,842,844,846,848],{"text":838,"config":839},"Explore the platform",{"href":352,"dataGaName":346,"dataGaLocation":771},{"text":404,"config":841},{"href":406,"dataGaName":407,"dataGaLocation":771},{"text":358,"config":843},{"href":360,"dataGaName":361,"dataGaLocation":771},{"text":409,"config":845},{"href":411,"dataGaName":412,"dataGaLocation":771},{"text":391,"config":847},{"href":393,"dataGaName":394,"dataGaLocation":771},{"text":422,"config":849},{"href":427,"dataGaName":428,"dataGaLocation":771},[851],{"title":852,"links":853},"Topics",[854,858,863,868,873,878,883,888],{"text":358,"config":855},{"href":856,"dataGaName":857,"dataGaLocation":771},"/topics/ci-cd/","cicd",{"text":859,"config":860},"GitOps",{"href":861,"dataGaName":862,"dataGaLocation":771},"/topics/gitops/","gitops",{"text":864,"config":865},"DevOps",{"href":866,"dataGaName":867,"dataGaLocation":771},"/topics/devops/","devops",{"text":869,"config":870},"Version Control",{"href":871,"dataGaName":872,"dataGaLocation":771},"/topics/version-control/","version control",{"text":874,"config":875},"DevSecOps",{"href":876,"dataGaName":877,"dataGaLocation":771},"/topics/devsecops/","devsecops",{"text":879,"config":880},"Cloud Native",{"href":881,"dataGaName":882,"dataGaLocation":771},"/topics/cloud-native/","cloud native",{"text":884,"config":885},"AI for Coding",{"href":886,"dataGaName":887,"dataGaLocation":771},"/topics/devops/ai-for-coding/","ai for coding",{"text":889,"config":890},"Agentic AI",{"href":891,"dataGaName":892,"dataGaLocation":771},"/topics/agentic-ai/","agentic ai",{"title":430,"links":894},[895,898,901,904,907,910,912,914,916,918,920,923,925,928,932,936],{"text":896,"config":897},"DevOps modernization",{"href":445,"dataGaName":446,"dataGaLocation":771},{"text":899,"config":900},"Security modernization",{"href":450,"dataGaName":451,"dataGaLocation":771},{"text":902,"config":903},"AI modernization",{"href":455,"dataGaName":456,"dataGaLocation":771},{"text":905,"config":906},"Financial services",{"href":481,"dataGaName":482,"dataGaLocation":771},{"text":908,"config":909},"Public sector",{"href":486,"dataGaName":487,"dataGaLocation":771},{"text":489,"config":911},{"href":491,"dataGaName":492,"dataGaLocation":771},{"text":494,"config":913},{"href":496,"dataGaName":497,"dataGaLocation":771},{"text":499,"config":915},{"href":501,"dataGaName":502,"dataGaLocation":771},{"text":504,"config":917},{"href":506,"dataGaName":507,"dataGaLocation":771},{"text":461,"config":919},{"href":463,"dataGaName":464,"dataGaLocation":771},{"text":921,"config":922},"Small business",{"href":468,"dataGaName":469,"dataGaLocation":771},{"text":471,"config":924},{"href":473,"dataGaName":474,"dataGaLocation":771},{"text":859,"config":926},{"href":927,"dataGaName":862,"dataGaLocation":771},"/solutions/gitops/",{"text":929,"config":930},"Software composition analysis",{"href":398,"dataGaName":931,"dataGaLocation":771},"software composition analysis",{"text":933,"config":934},"Value stream management",{"href":416,"dataGaName":935,"dataGaLocation":771},"value stream management",{"text":937,"config":938},"All solutions",{"href":437,"dataGaName":939,"dataGaLocation":771},"all solutions",{"title":523,"links":941},[942,947,952,954,956,958,960,962,964,966,968,970,972,974,977],{"text":943,"config":944},"Install",{"href":945,"dataGaName":946,"dataGaLocation":771},"/install/","install",{"text":948,"config":949},"Quick start guides",{"href":950,"dataGaName":951,"dataGaLocation":771},"/get-started/","quick setup checklists",{"text":536,"config":953},{"href":538,"dataGaName":539,"dataGaLocation":771},{"text":541,"config":955},{"href":543,"dataGaName":544,"dataGaLocation":771},{"text":546,"config":957},{"href":548,"dataGaName":549,"dataGaLocation":771},{"text":551,"config":959},{"href":553,"dataGaName":554,"dataGaLocation":771},{"text":556,"config":961},{"href":558,"dataGaName":559,"dataGaLocation":771},{"text":564,"config":963},{"href":566,"dataGaName":567,"dataGaLocation":771},{"text":569,"config":965},{"href":571,"dataGaName":572,"dataGaLocation":771},{"text":574,"config":967},{"href":576,"dataGaName":577,"dataGaLocation":771},{"text":579,"config":969},{"href":581,"dataGaName":582,"dataGaLocation":771},{"text":584,"config":971},{"href":586,"dataGaName":587,"dataGaLocation":771},{"text":647,"config":973},{"href":649,"dataGaName":650,"dataGaLocation":771},{"text":975,"config":976},"What's new",{"href":595,"dataGaName":596,"dataGaLocation":771},{"text":978,"config":979},"All resources",{"href":530,"dataGaName":980,"dataGaLocation":771},"all resources",{"title":598,"links":982},[983,985,987,989,991,993,995,997,999,1003,1008],{"text":606,"config":984},{"href":608,"dataGaName":600,"dataGaLocation":771},{"text":611,"config":986},{"href":613,"dataGaName":614,"dataGaLocation":771},{"text":617,"config":988},{"href":619,"dataGaName":620,"dataGaLocation":771},{"text":622,"config":990},{"href":624,"dataGaName":625,"dataGaLocation":771},{"text":627,"config":992},{"href":629,"dataGaName":630,"dataGaLocation":771},{"text":632,"config":994},{"href":634,"dataGaName":635,"dataGaLocation":771},{"text":637,"config":996},{"href":639,"dataGaName":640,"dataGaLocation":771},{"text":642,"config":998},{"href":644,"dataGaName":645,"dataGaLocation":771},{"text":1000,"config":1001},"Sustainability",{"href":1002,"dataGaName":1000,"dataGaLocation":771},"/sustainability/",{"text":1004,"config":1005},"Diversity, inclusion and belonging (DIB)",{"href":1006,"dataGaName":1007,"dataGaLocation":771},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1009,"config":1010},"Modern Slavery Transparency Statement",{"href":1011,"dataGaName":1012,"dataGaLocation":771},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1014},[1015,1018,1021],{"text":1016,"config":1017},"Terms",{"href":823,"dataGaName":824,"dataGaLocation":771},{"text":1019,"config":1020},"Cookies",{"dataGaName":833,"dataGaLocation":771,"id":834,"isOneTrustButton":307},{"text":1022,"config":1023},"Privacy",{"href":828,"dataGaName":829,"dataGaLocation":771},[1025,1039],{"id":1026,"title":7,"body":306,"config":1027,"content":1029,"description":306,"extension":1033,"meta":1034,"navigation":307,"path":1035,"seo":1036,"stem":1037,"__hash__":1038},"blogAuthors/en-us/blog/authors/meir-benayoun.yml",{"template":1028},"BlogAuthor",{"name":7,"config":1030,"bio":1032},{"headshot":1031},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1789567036/cmh9k7589tbxsswrlp1r.jpg","Principal Engineer - Application Security Testing","yml",{},"/en-us/blog/authors/meir-benayoun",{},"en-us/blog/authors/meir-benayoun","tqcxebR6ASjrSQT0gxrYu8NC0-E3H6ythC8qJElMYOc",{"id":1040,"title":8,"body":306,"config":1041,"content":1042,"description":306,"extension":1033,"meta":1046,"navigation":307,"path":1047,"seo":1048,"stem":1049,"__hash__":1050},"blogAuthors/en-us/blog/authors/chris-widstrom.yml",{"template":1028},{"config":1043,"name":8,"bio":1045},{"headshot":1044},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1789567036/sg1tlg9ctpwcmsbak2ij.jpg","Senior PM, SAST & SCA",{},"/en-us/blog/authors/chris-widstrom",{},"en-us/blog/authors/chris-widstrom","aKDm1EPnJF7ZeX_kF88TW3So_WnmvuVjk7NgeZDNBfI",[1052,1060,1068],{"title":1053,"description":1054,"heroImage":1055,"category":302,"date":1056,"authors":1057,"slug":1059,"externalUrl":306},"Track organization-wide security risk in one dashboard","For enterprises with many top-level groups, GitLab now aggregates vulnerabilities and a single risk score across your entire organization.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-10-08",[1058],"Alisa Ho","security-risk-in-one-dashboard",{"title":1061,"description":1062,"heroImage":1063,"category":302,"date":1064,"authors":1065,"slug":1067,"externalUrl":306},"Dependency Firewall: Block risky packages before the build","GitLab Dependency Firewall helps keep malicious and vulnerable packages out of your build automatically, so teams and their agents ship fast with trusted dependencies.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1791198675/kmajkudog4fj3xc6qfyb.png","2026-10-06",[1058,1066],"Amit Shalem","transcend-dependency-firewall",{"title":1069,"description":1070,"heroImage":1071,"category":302,"date":1072,"authors":1073,"slug":1075,"externalUrl":306},"Securing the software factory at machine speed","The foundation for agentic software development must evolve with AI models, continuously shortening the path from detection to verified remediation.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-09-18",[1074],"Chaim Mazal","securing-the-software-factory-at-machine-speed",{"header":1077,"text":1078,"button":1082,"disclaimer":1085},"Start your free\n\n30-day GitLab trial\n",[1079,1080,1081],"GitLab Duo Agent Platform access","Try our most advanced features","Automate complex tasks with AI",{"text":328,"config":1083},{"href":1084,"dataGaName":331,"dataGaLocation":567},"https://gitlab.com/-/trials/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/blog/","No credit card required.",{"header":1087,"blurb":1088,"button":1089,"secondaryButton":1094},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1090,"config":1091},"Get your free trial",{"href":1092,"dataGaName":331,"dataGaLocation":1093},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":809,"config":1095},{"href":661,"dataGaName":336,"dataGaLocation":1093},1791944933817]