[{"data":1,"prerenderedAt":1212},["ShallowReactive",2],{"/blog/software-supply-chain-security-guide-why-organizations-struggle":3,"navigation-en-us":427,"banner-en-us":855,"footer-en-us":865,"blog-post-authors-en-us-Itzik Gan Baruch":1110,"blog-related-posts-en-us-software-supply-chain-security-guide-why-organizations-struggle":1125,"blog-promotions-en-us":1150,"next-steps-en-us":1202},{"id":4,"title":5,"authors":6,"body":8,"category":409,"date":410,"description":411,"extension":412,"externalUrl":413,"faq":413,"featured":414,"heroImage":415,"meta":416,"navigation":414,"path":417,"seo":418,"slug":420,"stem":421,"tags":422,"template":425,"updatedDate":413,"__hash__":426},"blogPosts/en-us/blog/software-supply-chain-security-guide-why-organizations-struggle.md","Software supply chain security guide: Why organizations struggle",[7],"Itzik Gan Baruch",{"type":9,"value":10,"toc":392},"minimark",[11,15,22,62,65,74,77,82,85,102,109,114,117,121,124,128,131,163,166,172,176,179,188,191,194,199,202,207,222,227,230,235,255,258,262,265,270,291,296,305,310,331,336,339,343,346,350,364,368,371,375,378,381],[12,13,14],"p",{},"Ask most development teams about supply chain security, and you'll get answers focused on vulnerability scanning or dependency management. While these are components of supply chain security, they represent a dangerously narrow view of a much broader challenge.",[12,16,17,21],{},[18,19,20],"strong",{},"Supply chain security isn't just about scanning dependencies."," It encompasses the entire journey from code creation to production deployment, including:",[23,24,25,38,44,50,56],"ul",{},[26,27,28,31,32,37],"li",{},[18,29,30],{},"Source security:"," ",[33,34,36],"a",{"href":35},"/blog/best-practices-to-keep-secrets-out-of-gitlab-repositories/","protect code repositories",", managing contributor access, ensuring code integrity",[26,39,40,43],{},[18,41,42],{},"Build security:"," secure build environments, preventing tampering during compilation and packaging",[26,45,46,49],{},[18,47,48],{},"Artifact security:"," ensure the integrity of containers, packages, and deployment artifacts",[26,51,52,55],{},[18,53,54],{},"Deployment security:"," secure the delivery mechanisms and runtime environments",[26,57,58,61],{},[18,59,60],{},"Tool security:"," harden the development tools and platforms themselves",[12,63,64],{},"The \"chain\" in supply chain security refers to this interconnected series of steps. A weakness anywhere in the chain can compromise the entire software delivery process.",[12,66,67,68,73],{},"The ",[33,69,72],{"href":70,"rel":71},"https://www.cisa.gov/news-events/news/joint-statement-federal-bureau-investigation-fbi-cybersecurity-and-infrastructure-security",[],"2020 SolarWinds attack"," illustrates this perfectly. In what became one of the largest supply chain attacks in history, state-sponsored attackers compromised the build pipeline of SolarWinds' Orion network management software. Rather than exploiting a vulnerable dependency or hacking the final application, they injected malicious code during the compilation process itself.",[12,75,76],{},"The result was devastating: More than 18,000 organizations, including multiple U.S. government agencies, unknowingly installed backdoored software through normal software updates. The source code was clean, the final application appeared legitimate, but the build process had been weaponized. This attack remained undetected for months, demonstrating how supply chain vulnerabilities can bypass traditional security measures.",[78,79,81],"h3",{"id":80},"common-misconceptions-that-leave-organizations-vulnerable","Common misconceptions that leave organizations vulnerable",[12,83,84],{},"Despite growing awareness of supply chain threats, many organizations remain exposed because they operate under fundamental misunderstandings about what software supply chain security actually entails. These misconceptions create dangerous blind spots:",[23,86,87,90,93,96,99],{},[26,88,89],{},"Thinking software supply chain security equals dependency scanning",[26,91,92],{},"Focusing only on open source components while ignoring proprietary code risks",[26,94,95],{},"Believing that code signing alone provides sufficient protection",[26,97,98],{},"Assuming that secure coding practices eliminate supply chain risks",[26,100,101],{},"Treating it as a security team problem rather than a development workflow challenge",[12,103,104],{},[105,106],"img",{"alt":107,"src":108},"Software supply chain security dependency chart","https://res.cloudinary.com/about-gitlab-com/image/upload/v1753200077/kqndvlxyvncshdiq0xea.png",[110,111,113],"h2",{"id":112},"how-ai-is-changing-the-game","How AI is changing the game",[12,115,116],{},"Just as organizations are grappling with traditional software supply chain security challenges, artificial intelligence (AI)  is introducing entirely new attack vectors and amplifying existing ones in unprecedented ways.",[78,118,120],{"id":119},"ai-powered-attacks-more-sophisticated-more-scalable","AI-powered attacks: More sophisticated, more scalable",[12,122,123],{},"Attackers are using AI to automate vulnerability discovery, generate convincing social engineering attacks targeting developers, and systematically analyze public codebases for weaknesses. What once required manual effort can now be done at scale — with precision.",[78,125,127],{"id":126},"the-ai-development-supply-chain-introduces-new-risks","The AI development supply chain introduces new risks",[12,129,130],{},"AI is reshaping the entire development lifecycle, but it's also introducing significant security blind spots:",[23,132,133,139,145,151,157],{},[26,134,135,138],{},[18,136,137],{},"Model supply chain attacks:"," Pre-trained models from sources like Hugging Face or GitHub may contain backdoors or poisoned training data.",[26,140,141,144],{},[18,142,143],{},"Insecure AI-generated code:"," Developers using AI coding assistants may unknowingly introduce vulnerable patterns or unsafe dependencies.",[26,146,147,150],{},[18,148,149],{},"Compromised AI toolchains:"," The infrastructure used to train, deploy, and manage AI models creates a new attack surface.",[26,152,153,156],{},[18,154,155],{},"Automated reconnaissance:"," AI enables attackers to scan entire ecosystems to identify high-impact supply chain targets.",[26,158,159,162],{},[18,160,161],{},"Shadow AI and unsanctioned tools:"," Developers may integrate external AI tools that haven't been vetted.",[12,164,165],{},"The result? AI doesn't just introduce new vulnerabilities, it amplifies the scale and impact of existing ones. Organizations can no longer rely on incremental improvements. The threat landscape is evolving faster than current security practices can adapt.",[12,167,168],{},[105,169],{"alt":170,"src":171},"AI amplification effect","https://res.cloudinary.com/about-gitlab-com/image/upload/v1753200139/xuxezxld6ztlvjocgjlx.png",[110,173,175],{"id":174},"why-most-organizations-still-struggle","Why most organizations still struggle",[12,177,178],{},"Even organizations that understand supply chain security often fail to act effectively. The statistics reveal a troubling pattern of awareness without corresponding behavior change.",[12,180,181,182,187],{},"When ",[33,183,186],{"href":184,"rel":185},"https://www.cnn.com/2021/05/19/politics/colonial-pipeline-ransom/index.html",[],"Colonial Pipeline paid hackers $4.4 million"," in 2021 to restore operations, or when 18,000 organizations fell victim to the SolarWinds attack, the message was clear: Supply chain vulnerabilities can bring down critical infrastructure and compromise sensitive data at unprecedented scale.",[12,189,190],{},"Yet, despite this awareness, most organizations continue with business as usual. The real question isn't whether organizations care about supply chain security — it's why caring alone isn't translating into effective protection.",[12,192,193],{},"The answer lies in four critical barriers that prevent effective action:",[12,195,196],{},[18,197,198],{},"1. The false economy mindset",[12,200,201],{},"Organizations sometimes focus on the cost instead of \"what's the most effective approach?\" This cost-first thinking creates expensive downstream problems.",[12,203,204],{},[18,205,206],{},"2. Skills shortage reality",[12,208,209,210,215,216,221],{},"With ",[33,211,214],{"href":212,"rel":213},"https://codific.com/bsimm-building-security-in-maturity-model-a-complete-guide/",[],"organizations averaging 4 security professionals per 100 developers",", according to BSIMM research, and ",[33,217,220],{"href":218,"rel":219},"https://www.isc2.org/Insights/2024/09/Employers-Must-Act-Cybersecurity-Workforce-Growth-Stalls-as-Skills-Gaps-Widen",[],"90% of organizations reporting critical cybersecurity skills gaps",", according to ISC2, traditional approaches are mathematically impossible to scale.",[12,223,224],{},[18,225,226],{},"3. Misaligned organizational incentives",[12,228,229],{},"Developer OKRs focus on feature velocity while security teams measure different outcomes. When C-suite priorities emphasize speed-to-market over security posture, friction becomes inevitable.",[12,231,232],{},[18,233,234],{},"4. Tool complexity overload",[12,236,67,237,242,243,248,249,254],{},[33,238,241],{"href":239,"rel":240},"https://www.gartner.com/en/newsroom/press-releases/2025-03-03-gartner-identifiesthe-top-cybersecurity-trends-for-2025",[],"average enterprise uses 45 cybersecurity tools",", with ",[33,244,247],{"href":245,"rel":246},"https://www.ponemon.org/news-updates/blog/security/new-ponemon-study-on-malware-detection-prevention-released.html",[],"40% of security alerts being false positives"," and must ",[33,250,253],{"href":251,"rel":252},"https://newsroom.ibm.com/2020-06-30-IBM-Study-Security-Response-Planning-on-the-Rise-But-Containing-Attacks-Remains-an-Issue",[],"coordinate across 19 tools on average for each incident",".",[12,256,257],{},"These barriers create a vicious cycle: Organizations recognize the threat, invest in security solutions, but implement them in ways that don't drive the desired outcomes.",[110,259,261],{"id":260},"the-true-price-of-supply-chain-insecurity","The true price of supply chain insecurity",[12,263,264],{},"Supply chain attacks create risk and expenses that extend far beyond initial remediation. Understanding these hidden multipliers helps explain why prevention is not just preferable – it's essential for business continuity.",[12,266,267],{},[18,268,269],{},"Time becomes the enemy",[23,271,272,280,288],{},[26,273,274,275],{},"Average time to identify and contain a supply chain breach: ",[33,276,279],{"href":277,"rel":278},"https://keepnetlabs.com/blog/171-cyber-security-statistics-2024-s-updated-trends-and-data",[],"277 days",[26,281,282,283],{},"Customer trust rebuilding period: ",[33,284,287],{"href":285,"rel":286},"https://www.bcg.com/publications/2024/rebuilding-corporate-trust",[],"2-3+ years",[26,289,290],{},"Engineering hours diverted from product development to security remediation",[12,292,293],{},[18,294,295],{},"Reputation damage compounds",[12,297,298,299,304],{},"When attackers compromise your supply chain, they don't just steal data – they undermine the foundation of customer trust. ",[33,300,303],{"href":301,"rel":302},"https://www.metacompliance.com/blog/data-breaches/5-damaging-consequences-of-a-data-breach",[],"Customer churn rates typically increase 33% post-breach",", while partner relationships require costly re-certification processes. Competitive positioning suffers as prospects choose alternatives perceived as \"safer.\"",[12,306,307],{},[18,308,309],{},"Regulatory reality bites",[12,311,312,313,318,319,324,325,330],{},"The regulatory landscape has fundamentally shifted. ",[33,314,317],{"href":315,"rel":316},"https://www.skillcast.com/blog/20-biggest-gdpr-fines",[],"GDPR fines now average over $50 million for significant data breache","s. The EU's new ",[33,320,323],{"href":321,"rel":322},"https://about.gitlab.com/blog/gitlab-supports-banks-in-navigating-regulatory-challenges/#european-cyber-resilience-act-(cra)",[],"Cyber Resilience Act"," mandates supply chain transparency. U.S. federal contractors must provide software bills of materials (",[33,326,329],{"href":327,"rel":328},"https://about.gitlab.com/blog/the-ultimate-guide-to-sboms/",[],"SBOMs",") for all software purchases — a requirement that's rapidly spreading to private sector procurement.",[12,332,333],{},[18,334,335],{},"Operational disruption multiplies",[12,337,338],{},"Beyond the direct costs, supply chain attacks create operational chaos such as platform downtime during attack remediation, emergency security audits across entire technology stacks, and legal costs from customer lawsuits and regulatory investigations.",[110,340,342],{"id":341},"whats-wrong-with-current-approaches","What's wrong with current approaches",[12,344,345],{},"Most organizations confuse security activity with security impact. They deploy scanners, generate lengthy reports, and chase teams to address through manual follow-ups. But these efforts often backfire — creating more problems than they solve.",[78,347,349],{"id":348},"massive-scanning-vs-effective-protection","Massive scanning vs. effective protection",[12,351,352,353,31,358,363],{},"Enterprises generate over ",[33,354,357],{"href":355,"rel":356},"https://www.securityweek.com/enterprises-generate-10000-security-events-day-average-report/",[],"10,000 security alerts each month, with the most active generating roughly 150,000 events per day.",[33,359,362],{"href":360,"rel":361},"https://panther.com/blog/identifying-and-mitigating-false-positive-alerts",[],"But 63%"," of these are false positives or low-priority noise. Security teams become overwhelmed and turn into bottlenecks instead of enablers.",[78,365,367],{"id":366},"the-collaboration-breakdown","The collaboration breakdown",[12,369,370],{},"The most secure organizations don't have the most tools; they have the strongest DevSecOps collaboration. But most current setups make this harder by splitting workflows across incompatible tools, failing to show developers security results in their environment, and offering no shared visibility into risk and business impact.",[110,372,374],{"id":373},"the-path-forward","The path forward",[12,376,377],{},"Understanding these challenges is the first step toward building effective supply chain security. The organizations that succeed don't just add more security tools, they fundamentally rethink how security integrates with development workflows. They also review end-to-end software delivery workflows to simplify processes, reduce tools and improve collaboration.",[12,379,380],{},"At GitLab, we've seen how integrated DevSecOps platforms can address these challenges by bringing security directly into the development workflow. In our next article in this series, we'll explore how leading organizations are transforming their approach to supply chain security through developer-native solutions, AI-powered automation, and platforms that make security a natural part of building great software.",[382,383,384],"blockquote",{},[12,385,386,387,254],{},"Learn more about ",[33,388,391],{"href":389,"rel":390},"https://about.gitlab.com/solutions/supply-chain/",[],"GitLab's software supply chain security capabilities",{"title":393,"searchDepth":394,"depth":394,"links":395},"",2,[396,398,402,403,404,408],{"id":80,"depth":397,"text":81},3,{"id":112,"depth":394,"text":113,"children":399},[400,401],{"id":119,"depth":397,"text":120},{"id":126,"depth":397,"text":127},{"id":174,"depth":394,"text":175},{"id":260,"depth":394,"text":261},{"id":341,"depth":394,"text":342,"children":405},[406,407],{"id":348,"depth":397,"text":349},{"id":366,"depth":397,"text":367},{"id":373,"depth":394,"text":374},"security","2025-07-24","Part 1 of this new series explores fundamental challenges, practical solutions, and emerging trends, including AI, that every development team needs to understand.","md",null,true,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1750097701/Blog/Hero%20Images/Blog/Hero%20Images/blog-image-template-1800x945%20%285%29_1iy516k40hwBDChKcUJ2zb_1750097700983.png",{},"/en-us/blog/software-supply-chain-security-guide-why-organizations-struggle",{"noIndex":419,"title":5,"description":411},false,"software-supply-chain-security-guide-why-organizations-struggle","en-us/blog/software-supply-chain-security-guide-why-organizations-struggle",[409,423,424],"product","tutorial","BlogPost","_pylmSZVNTqvJ4nZIyR0qOMeBs0WjLrHfqErkuN9seg",{"logo":428,"freeTrial":433,"sales":438,"login":443,"items":448,"search":775,"minimal":806,"duo":825,"switchNav":834,"pricingDeployment":845},{"config":429},{"href":430,"dataGaName":431,"dataGaLocation":432},"/","gitlab logo","header",{"text":434,"config":435},"Get free trial",{"href":436,"dataGaName":437,"dataGaLocation":432},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":439,"config":440},"Request a demo",{"href":441,"dataGaName":442,"dataGaLocation":432},"/sales/?contact-topic=request-demo","sales",{"text":444,"config":445},"Sign in",{"href":446,"dataGaName":447,"dataGaLocation":432},"https://gitlab.com/users/sign_in/","sign in",[449,478,578,583,697,753],{"text":450,"config":451,"menu":453},"Platform",{"dataNavLevelOne":452},"platform",{"type":454,"columns":455},"cards",[456,462,470],{"title":450,"description":457,"link":458},"The intelligent orchestration platform for DevSecOps",{"text":459,"config":460},"Explore our Platform",{"href":461,"dataGaName":452,"dataGaLocation":432},"/platform/",{"title":463,"description":464,"link":465},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":466,"config":467},"Meet GitLab Duo",{"href":468,"dataGaName":469,"dataGaLocation":432},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":471,"description":472,"link":473},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":474,"config":475},"Learn more",{"href":476,"dataGaName":477,"dataGaLocation":432},"/why-gitlab/","why gitlab",{"text":479,"left":414,"config":480,"menu":482},"Product",{"dataNavLevelOne":481},"solutions",{"type":483,"link":484,"columns":488,"feature":557},"lists",{"text":485,"config":486},"View all Solutions",{"href":487,"dataGaName":481,"dataGaLocation":432},"/solutions/",[489,513,536],{"title":490,"description":491,"link":492,"items":497},"Automation","CI/CD and automation to accelerate deployment",{"config":493},{"icon":494,"href":495,"dataGaName":496,"dataGaLocation":432},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[498,502,505,509],{"text":499,"config":500},"CI/CD",{"href":501,"dataGaLocation":432,"dataGaName":499},"/solutions/continuous-integration/",{"text":463,"config":503},{"href":468,"dataGaLocation":432,"dataGaName":504},"gitlab duo agent platform - product menu",{"text":506,"config":507},"Source Code Management",{"href":508,"dataGaLocation":432,"dataGaName":506},"/solutions/source-code-management/",{"text":510,"config":511},"Automated Software Delivery",{"href":495,"dataGaLocation":432,"dataGaName":512},"Automated software delivery",{"title":514,"description":515,"link":516,"items":521},"Security","Deliver code faster without compromising security",{"config":517},{"href":518,"dataGaName":519,"dataGaLocation":432,"icon":520},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[522,526,531],{"text":523,"config":524},"Application Security Testing",{"href":518,"dataGaName":525,"dataGaLocation":432},"Application security testing",{"text":527,"config":528},"Software Supply Chain Security",{"href":529,"dataGaLocation":432,"dataGaName":530},"/solutions/supply-chain/","Software supply chain security",{"text":532,"config":533},"Software Compliance",{"href":534,"dataGaName":535,"dataGaLocation":432},"/solutions/software-compliance/","software compliance",{"title":537,"link":538,"items":543},"Measurement",{"config":539},{"icon":540,"href":541,"dataGaName":542,"dataGaLocation":432},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[544,548,552],{"text":545,"config":546},"Visibility & Measurement",{"href":541,"dataGaLocation":432,"dataGaName":547},"Visibility and Measurement",{"text":549,"config":550},"Value Stream Management",{"href":551,"dataGaLocation":432,"dataGaName":549},"/solutions/value-stream-management/",{"text":553,"config":554},"Analytics & Insights",{"href":555,"dataGaLocation":432,"dataGaName":556},"/solutions/analytics-and-insights/","Analytics and insights",{"title":558,"type":483,"items":559},"GitLab for",[560,566,572],{"text":561,"config":562},"Enterprise",{"icon":563,"href":564,"dataGaLocation":432,"dataGaName":565},"Building","/enterprise/","enterprise",{"text":567,"config":568},"Small Business",{"icon":569,"href":570,"dataGaLocation":432,"dataGaName":571},"Work","/small-business/","small business",{"text":573,"config":574},"Public Sector",{"icon":575,"href":576,"dataGaLocation":432,"dataGaName":577},"Organization","/solutions/public-sector/","public sector",{"text":579,"config":580},"Pricing",{"href":581,"dataGaName":582,"dataGaLocation":432,"dataNavLevelOne":582},"/pricing/","pricing",{"text":584,"config":585,"menu":587},"Resources",{"dataNavLevelOne":586},"resources",{"type":483,"link":588,"columns":592,"feature":686},{"text":589,"config":590},"View all resources",{"href":591,"dataGaName":586,"dataGaLocation":432},"/resources/",[593,626,653],{"title":594,"items":595},"Getting started",[596,601,606,611,616,621],{"text":597,"config":598},"Install",{"href":599,"dataGaName":600,"dataGaLocation":432},"/install/","install",{"text":602,"config":603},"Quick start guides",{"href":604,"dataGaName":605,"dataGaLocation":432},"/get-started/","quick setup checklists",{"text":607,"config":608},"Learn",{"href":609,"dataGaLocation":432,"dataGaName":610},"https://university.gitlab.com/","learn",{"text":612,"config":613},"Product documentation",{"href":614,"dataGaName":615,"dataGaLocation":432},"https://docs.gitlab.com/","product documentation",{"text":617,"config":618},"Best practice videos",{"href":619,"dataGaName":620,"dataGaLocation":432},"/getting-started-videos/","best practice videos",{"text":622,"config":623},"Integrations",{"href":624,"dataGaName":625,"dataGaLocation":432},"/integrations/","integrations",{"title":627,"items":628},"Discover",[629,634,639,644,648],{"text":630,"config":631},"Customer success stories",{"href":632,"dataGaName":633,"dataGaLocation":432},"/customers/","customer success stories",{"text":635,"config":636},"Blog",{"href":637,"dataGaName":638,"dataGaLocation":432},"/blog/","blog",{"text":640,"config":641},"Demo Hub",{"href":642,"dataGaName":643,"dataGaLocation":432},"/demo-hub/","demo hub",{"text":645,"config":646},"The Source",{"href":647,"dataGaName":638,"dataGaLocation":432},"/the-source/",{"text":649,"config":650},"Remote",{"href":651,"dataGaName":652,"dataGaLocation":432},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":654,"items":655},"Connect",[656,661,666,671,676,681],{"text":657,"config":658},"GitLab Services",{"href":659,"dataGaName":660,"dataGaLocation":432},"/services/","services",{"text":662,"config":663},"Contribute",{"href":664,"dataGaName":665,"dataGaLocation":432},"https://contributors.gitlab.com","contribute",{"text":667,"config":668},"Community",{"href":669,"dataGaName":670,"dataGaLocation":432},"/community/","community",{"text":672,"config":673},"Forum",{"href":674,"dataGaName":675,"dataGaLocation":432},"https://forum.gitlab.com/","forum",{"text":677,"config":678},"Events",{"href":679,"dataGaName":680,"dataGaLocation":432},"/events/","events",{"text":682,"config":683},"Partners",{"href":684,"dataGaName":685,"dataGaLocation":432},"/partners/","partners",{"config":687,"title":690,"text":691,"link":692},{"background":688,"textColor":689},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":693,"config":694},"Read the latest",{"href":695,"dataGaName":696,"dataGaLocation":432},"/whats-new/","whats new",{"text":698,"config":699,"menu":701},"Company",{"dataNavLevelOne":700},"company",{"type":483,"columns":702},[703],{"items":704},[705,710,716,718,723,728,733,738,743,748],{"text":706,"config":707},"About",{"href":708,"dataGaName":709,"dataGaLocation":432},"/company/","about",{"text":711,"config":712,"footerGa":715},"Jobs",{"href":713,"dataGaName":714,"dataGaLocation":432},"/jobs/","jobs",{"dataGaName":714},{"text":677,"config":717},{"href":679,"dataGaName":680,"dataGaLocation":432},{"text":719,"config":720},"Leadership",{"href":721,"dataGaName":722,"dataGaLocation":432},"/company/team/e-group/","leadership",{"text":724,"config":725},"Handbook",{"href":726,"dataGaName":727,"dataGaLocation":432},"https://handbook.gitlab.com/","handbook",{"text":729,"config":730},"Investor relations",{"href":731,"dataGaName":732,"dataGaLocation":432},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":734,"config":735},"Trust Center",{"href":736,"dataGaName":737,"dataGaLocation":432},"/security/","trust center",{"text":739,"config":740},"AI Transparency Center",{"href":741,"dataGaName":742,"dataGaLocation":432},"/ai-transparency-center/","ai transparency center",{"text":744,"config":745},"Newsletter",{"href":746,"dataGaName":747,"dataGaLocation":432},"/company/contact/#contact-forms","newsletter",{"text":749,"config":750},"Press",{"href":751,"dataGaName":752,"dataGaLocation":432},"/press/","press",{"text":754,"config":755,"menu":756},"Contact us",{"dataNavLevelOne":700},{"type":483,"columns":757},[758],{"items":759},[760,765,770],{"text":761,"config":762},"Talk to sales",{"href":763,"dataGaName":764,"dataGaLocation":432},"/sales/","talk to sales",{"text":766,"config":767},"Support portal",{"href":768,"dataGaName":769,"dataGaLocation":432},"https://support.gitlab.com/hc/en-us","support portal",{"text":771,"config":772},"Customer portal",{"href":773,"dataGaName":774,"dataGaLocation":432},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":776,"login":777,"suggestions":784},"Close",{"text":778,"link":779},"To search repositories and projects, login to",{"text":780,"config":781},"gitlab.com",{"href":446,"dataGaName":782,"dataGaLocation":783},"search login","search",{"text":785,"default":786},"Suggestions",[787,789,793,795,799,803],{"text":463,"config":788},{"href":468,"dataGaName":463,"dataGaLocation":783},{"text":790,"config":791},"Code Suggestions (AI)",{"href":792,"dataGaName":790,"dataGaLocation":783},"/solutions/code-suggestions/",{"text":499,"config":794},{"href":501,"dataGaName":499,"dataGaLocation":783},{"text":796,"config":797},"GitLab on AWS",{"href":798,"dataGaName":796,"dataGaLocation":783},"/partners/technology-partners/aws/",{"text":800,"config":801},"GitLab on Google Cloud",{"href":802,"dataGaName":800,"dataGaLocation":783},"/partners/technology-partners/google-cloud-platform/",{"text":804,"config":805},"Why GitLab?",{"href":476,"dataGaName":804,"dataGaLocation":783},{"freeTrial":807,"mobileIcon":812,"desktopIcon":817,"secondaryButton":820},{"text":808,"config":809},"Start free trial",{"href":810,"dataGaName":437,"dataGaLocation":811},"https://gitlab.com/-/trials/new/","nav",{"altText":813,"config":814},"Gitlab Icon",{"src":815,"dataGaName":816,"dataGaLocation":811},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":813,"config":818},{"src":819,"dataGaName":816,"dataGaLocation":811},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":821,"config":822},"Get Started",{"href":823,"dataGaName":824,"dataGaLocation":811},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":826,"mobileIcon":830,"desktopIcon":832},{"text":827,"config":828},"Learn more about GitLab Duo",{"href":468,"dataGaName":829,"dataGaLocation":811},"gitlab duo",{"altText":813,"config":831},{"src":815,"dataGaName":816,"dataGaLocation":811},{"altText":813,"config":833},{"src":819,"dataGaName":816,"dataGaLocation":811},{"button":835,"mobileIcon":840,"desktopIcon":842},{"text":836,"config":837},"/switch",{"href":838,"dataGaName":839,"dataGaLocation":811},"#contact","switch",{"altText":813,"config":841},{"src":815,"dataGaName":816,"dataGaLocation":811},{"altText":813,"config":843},{"src":844,"dataGaName":816,"dataGaLocation":811},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":846,"mobileIcon":851,"desktopIcon":853},{"text":847,"config":848},"Back to pricing",{"href":581,"dataGaName":849,"dataGaLocation":811,"icon":850},"back to pricing","GoBack",{"altText":813,"config":852},{"src":815,"dataGaName":816,"dataGaLocation":811},{"altText":813,"config":854},{"src":819,"dataGaName":816,"dataGaLocation":811},{"title":856,"titleMobile":857,"button":858,"config":863},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":474,"config":859},{"href":860,"dataGaName":861,"dataGaLocation":862},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":864,"disabled":419},"release",{"data":866},{"text":867,"source":868,"edit":874,"contribute":879,"config":884,"items":889,"minimal":1099},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":869,"config":870},"View page source",{"href":871,"dataGaName":872,"dataGaLocation":873},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":875,"config":876},"Edit this page",{"href":877,"dataGaName":878,"dataGaLocation":873},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":880,"config":881},"Please contribute",{"href":882,"dataGaName":883,"dataGaLocation":873},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":885,"facebook":886,"youtube":887,"linkedin":888},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[890,937,991,1035,1067],{"title":579,"links":891,"subMenu":906},[892,896,901],{"text":893,"config":894},"View plans",{"href":581,"dataGaName":895,"dataGaLocation":873},"view plans",{"text":897,"config":898},"Why Premium?",{"href":899,"dataGaName":900,"dataGaLocation":873},"/pricing/premium/","why premium",{"text":902,"config":903},"Why Ultimate?",{"href":904,"dataGaName":905,"dataGaLocation":873},"/pricing/ultimate/","why ultimate",[907],{"title":908,"links":909},"Contact Us",[910,913,915,917,922,927,932],{"text":911,"config":912},"Contact sales",{"href":763,"dataGaName":442,"dataGaLocation":873},{"text":766,"config":914},{"href":768,"dataGaName":769,"dataGaLocation":873},{"text":771,"config":916},{"href":773,"dataGaName":774,"dataGaLocation":873},{"text":918,"config":919},"Status",{"href":920,"dataGaName":921,"dataGaLocation":873},"https://status.gitlab.com/","status",{"text":923,"config":924},"Terms of use",{"href":925,"dataGaName":926,"dataGaLocation":873},"/terms/","terms of use",{"text":928,"config":929},"Privacy statement",{"href":930,"dataGaName":931,"dataGaLocation":873},"/privacy/","privacy statement",{"text":933,"config":934},"Cookie preferences",{"dataGaName":935,"dataGaLocation":873,"id":936,"isOneTrustButton":414},"cookie preferences","ot-sdk-btn",{"title":479,"links":938,"subMenu":947},[939,943],{"text":940,"config":941},"DevSecOps platform",{"href":461,"dataGaName":942,"dataGaLocation":873},"devsecops platform",{"text":944,"config":945},"AI-Assisted Development",{"href":468,"dataGaName":946,"dataGaLocation":873},"ai-assisted development",[948],{"title":949,"links":950},"Topics",[951,956,961,966,971,976,981,986],{"text":952,"config":953},"CICD",{"href":954,"dataGaName":955,"dataGaLocation":873},"/topics/ci-cd/","cicd",{"text":957,"config":958},"GitOps",{"href":959,"dataGaName":960,"dataGaLocation":873},"/topics/gitops/","gitops",{"text":962,"config":963},"DevOps",{"href":964,"dataGaName":965,"dataGaLocation":873},"/topics/devops/","devops",{"text":967,"config":968},"Version Control",{"href":969,"dataGaName":970,"dataGaLocation":873},"/topics/version-control/","version control",{"text":972,"config":973},"DevSecOps",{"href":974,"dataGaName":975,"dataGaLocation":873},"/topics/devsecops/","devsecops",{"text":977,"config":978},"Cloud Native",{"href":979,"dataGaName":980,"dataGaLocation":873},"/topics/cloud-native/","cloud native",{"text":982,"config":983},"AI for Coding",{"href":984,"dataGaName":985,"dataGaLocation":873},"/topics/devops/ai-for-coding/","ai for coding",{"text":987,"config":988},"Agentic AI",{"href":989,"dataGaName":990,"dataGaLocation":873},"/topics/agentic-ai/","agentic ai",{"title":992,"links":993},"Solutions",[994,996,998,1003,1007,1010,1014,1017,1019,1022,1025,1030],{"text":523,"config":995},{"href":518,"dataGaName":523,"dataGaLocation":873},{"text":512,"config":997},{"href":495,"dataGaName":496,"dataGaLocation":873},{"text":999,"config":1000},"Agile development",{"href":1001,"dataGaName":1002,"dataGaLocation":873},"/solutions/agile-delivery/","agile delivery",{"text":1004,"config":1005},"SCM",{"href":508,"dataGaName":1006,"dataGaLocation":873},"source code management",{"text":952,"config":1008},{"href":501,"dataGaName":1009,"dataGaLocation":873},"continuous integration & delivery",{"text":1011,"config":1012},"Value stream management",{"href":551,"dataGaName":1013,"dataGaLocation":873},"value stream management",{"text":957,"config":1015},{"href":1016,"dataGaName":960,"dataGaLocation":873},"/solutions/gitops/",{"text":561,"config":1018},{"href":564,"dataGaName":565,"dataGaLocation":873},{"text":1020,"config":1021},"Small business",{"href":570,"dataGaName":571,"dataGaLocation":873},{"text":1023,"config":1024},"Public sector",{"href":576,"dataGaName":577,"dataGaLocation":873},{"text":1026,"config":1027},"Education",{"href":1028,"dataGaName":1029,"dataGaLocation":873},"/solutions/education/","education",{"text":1031,"config":1032},"Financial services",{"href":1033,"dataGaName":1034,"dataGaLocation":873},"/solutions/finance/","financial services",{"title":584,"links":1036},[1037,1039,1041,1043,1046,1048,1051,1053,1055,1057,1059,1061,1063,1065],{"text":597,"config":1038},{"href":599,"dataGaName":600,"dataGaLocation":873},{"text":602,"config":1040},{"href":604,"dataGaName":605,"dataGaLocation":873},{"text":607,"config":1042},{"href":609,"dataGaName":610,"dataGaLocation":873},{"text":612,"config":1044},{"href":614,"dataGaName":1045,"dataGaLocation":873},"docs",{"text":635,"config":1047},{"href":637,"dataGaName":638,"dataGaLocation":873},{"text":1049,"config":1050},"What's new",{"href":695,"dataGaName":696,"dataGaLocation":873},{"text":630,"config":1052},{"href":632,"dataGaName":633,"dataGaLocation":873},{"text":649,"config":1054},{"href":651,"dataGaName":652,"dataGaLocation":873},{"text":657,"config":1056},{"href":659,"dataGaName":660,"dataGaLocation":873},{"text":662,"config":1058},{"href":664,"dataGaName":665,"dataGaLocation":873},{"text":667,"config":1060},{"href":669,"dataGaName":670,"dataGaLocation":873},{"text":672,"config":1062},{"href":674,"dataGaName":675,"dataGaLocation":873},{"text":677,"config":1064},{"href":679,"dataGaName":680,"dataGaLocation":873},{"text":682,"config":1066},{"href":684,"dataGaName":685,"dataGaLocation":873},{"title":698,"links":1068},[1069,1071,1073,1075,1077,1079,1083,1088,1090,1092,1094],{"text":706,"config":1070},{"href":708,"dataGaName":700,"dataGaLocation":873},{"text":711,"config":1072},{"href":713,"dataGaName":714,"dataGaLocation":873},{"text":719,"config":1074},{"href":721,"dataGaName":722,"dataGaLocation":873},{"text":724,"config":1076},{"href":726,"dataGaName":727,"dataGaLocation":873},{"text":729,"config":1078},{"href":731,"dataGaName":732,"dataGaLocation":873},{"text":1080,"config":1081},"Sustainability",{"href":1082,"dataGaName":1080,"dataGaLocation":873},"/sustainability/",{"text":1084,"config":1085},"Diversity, inclusion and belonging (DIB)",{"href":1086,"dataGaName":1087,"dataGaLocation":873},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":734,"config":1089},{"href":736,"dataGaName":737,"dataGaLocation":873},{"text":744,"config":1091},{"href":746,"dataGaName":747,"dataGaLocation":873},{"text":749,"config":1093},{"href":751,"dataGaName":752,"dataGaLocation":873},{"text":1095,"config":1096},"Modern Slavery Transparency Statement",{"href":1097,"dataGaName":1098,"dataGaLocation":873},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1100},[1101,1104,1107],{"text":1102,"config":1103},"Terms",{"href":925,"dataGaName":926,"dataGaLocation":873},{"text":1105,"config":1106},"Cookies",{"dataGaName":935,"dataGaLocation":873,"id":936,"isOneTrustButton":414},{"text":1108,"config":1109},"Privacy",{"href":930,"dataGaName":931,"dataGaLocation":873},[1111],{"id":1112,"title":7,"body":413,"config":1113,"content":1115,"description":413,"extension":1119,"meta":1120,"navigation":414,"path":1121,"seo":1122,"stem":1123,"__hash__":1124},"blogAuthors/en-us/blog/authors/itzik-gan-baruch.yml",{"template":1114},"BlogAuthor",{"name":7,"config":1116},{"headshot":1117,"ctfId":1118},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749658921/Blog/Author%20Headshots/iganbaruch-headshot.jpg","iganbaruch","yml",{},"/en-us/blog/authors/itzik-gan-baruch",{},"en-us/blog/authors/itzik-gan-baruch","bz9VMiTQ1ixvnoxUFk0jiUcnLG3oQsymgXNCqyRqfsk",[1126,1134,1142],{"title":1127,"description":1128,"heroImage":1129,"category":409,"date":1130,"authors":1131,"slug":1133,"externalUrl":413},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1132],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1135,"description":1136,"heroImage":1129,"category":409,"date":1137,"authors":1138,"slug":1141,"externalUrl":413},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1139,1140],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1143,"description":1144,"heroImage":1145,"category":409,"date":1146,"authors":1147,"slug":1149,"externalUrl":413},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1148],"Alisa Ho","claude-security-and-gitlab",{"promotions":1151},[1152,1166,1177,1188],{"id":1153,"categories":1154,"header":1156,"text":1157,"button":1158,"image":1163},"ai-modernization",[1155],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1159,"config":1160},"Get your AI maturity score",{"href":1161,"dataGaName":1162,"dataGaLocation":638},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1164},{"src":1165},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1167,"categories":1168,"header":1169,"text":1157,"button":1170,"image":1174},"devops-modernization",[423,975],"Are you just managing tools or shipping innovation?",{"text":1171,"config":1172},"Get your DevOps maturity score",{"href":1173,"dataGaName":1162,"dataGaLocation":638},"/assessments/devops-modernization-assessment/",{"config":1175},{"src":1176},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1178,"categories":1179,"header":1180,"text":1157,"button":1181,"image":1185},"security-modernization",[409],"Are you trading speed for security?",{"text":1182,"config":1183},"Get your security maturity score",{"href":1184,"dataGaName":1162,"dataGaLocation":638},"/assessments/security-modernization-assessment/",{"config":1186},{"src":1187},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1189,"paths":1190,"header":1193,"text":1194,"button":1195,"image":1200},"github-azure-migration",[1191,1192],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1196,"config":1197},"See how GitLab compares to GitHub",{"href":1198,"dataGaName":1199,"dataGaLocation":638},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1201},{"src":1176},{"header":1203,"blurb":1204,"button":1205,"secondaryButton":1210},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1206,"config":1207},"Get your free trial",{"href":1208,"dataGaName":437,"dataGaLocation":1209},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":911,"config":1211},{"href":763,"dataGaName":442,"dataGaLocation":1209},1786803752728]