[{"data":1,"prerenderedAt":1078},["ShallowReactive",2],{"/blog/the-ultimate-guide-to-software-supply-chain-security":3,"navigation-en-us":292,"banner-en-us":720,"footer-en-us":730,"blog-post-authors-en-us-Sandra Gittlen":973,"blog-related-posts-en-us-the-ultimate-guide-to-software-supply-chain-security":990,"blog-promotions-en-us":1015,"next-steps-en-us":1068},{"id":4,"title":5,"authors":6,"body":8,"category":270,"date":271,"description":272,"extension":273,"externalUrl":274,"faq":274,"featured":275,"heroImage":276,"meta":277,"navigation":278,"path":279,"seo":280,"slug":284,"stem":285,"tags":286,"template":290,"updatedDate":274,"__hash__":291},"blogPosts/en-us/blog/the-ultimate-guide-to-software-supply-chain-security.md","The ultimate guide to software supply chain security",[7],"Sandra Gittlen",{"type":9,"value":10,"toc":261},"minimark",[11,15,18,21,26,29,43,46,49,62,66,74,84,87,95,121,125,133,154,157,161,169,177,191,199,203,206,213,230,241,255],[12,13,14],"p",{},"Threats to the software supply chain are forcing a sea change in DevOps. Organizations are feeling internal pressure to embed security deep into their software development life cycles and external pressure to comply with numerous federal and industry mandates. What is emerging is a DevSecOps strategy that helps govern how code, applications, and infrastructure are protected across the software supply chain.",[12,16,17],{},"The pairing of DevSecOps with software supply chain security also ensures that, where possible, automation will be used to make processes repeatable, increasing security and reducing the opportunity for human error or malicious activity.",[12,19,20],{},"This comprehensive guide provides deeper dives into all the aspects of software supply chain security so make sure to follow the embedded links.",[22,23,25],"h2",{"id":24},"the-need-for-software-supply-chain-security","The need for software supply chain security",[12,27,28],{},"Securing code is not a new concept. However, promoting security early on in the development life cycle is. The movement to shift security left has taken off, and “sec” is becoming part of the DevOps culture, morphing the concept wholly into DevSecOps.",[12,30,31,32,37,38,42],{},"Along with this evolution has been an increase in outside pressure – as formidable as ",[33,34,36],"a",{"href":35},"/blog/biden-administration-celebrates-1-year-anniversary-of-eo-by-accelerating-software-supply-chain-security/","the federal government"," – to batten down software supply chains so that large attacks such as the ",[33,39,41],{"href":40},"/blog/what-the-solarwinds-attack-can-teach-us-about-devsecops/#a-brief-summary-of-the-solarwinds-incident","SolarWinds hack of 2020"," won’t threaten the nation’s critical infrastructure and cause unmitigated damage.",[12,44,45],{},"Essentially, businesses must figure out how to meld their development, security, and operations teams internally while complying with numerous mandates from external organizations.",[12,47,48],{},"Learn more about the key trends driving software supply chain security:",[50,51,54,55],"figure",{"className":52},[53],"video_container","\n  ",[56,57,61],"iframe",{"src":58,"frameBorder":59,"allowFullScreen":60},"https://www.youtube.com/embed/Tbiscg09-Ac","0","true"," ",[22,63,65],{"id":64},"integrating-sec-into-devsecops","Integrating sec into DevSecOps",[12,67,68,69,73],{},"The first step in securing the software supply chain is to create a cohesive DevSecOps approach to software development. In doing so, organizations can expand security in DevOps beyond basic tasks and better ",[33,70,72],{"href":71},"/blog/top-challenges-to-securing-the-software-supply-chain/","understand myriad threat vectors",".",[12,75,76],{},[77,78,79,83],"em",{},[33,80,82],{"href":81},"/blog/are-you-ready-for-the-newest-era-of-devsecops/","Security in the modern DevOps solution"," goes beyond just shifting security features left to empower the developers to find and fix security flaws, but also provides end-to-end visibility and control over the entire SDLC to create, deliver, and run the applications.",[12,85,86],{},"Teams that integrate security practices throughout their development process are 1.6 times more likely to meet or exceed their organizational goals, according to the Google Cloud DevOps Research and Assessment (DORA) “Accelerate State of DevOps 2021 Report”.",[12,88,89,90,94],{},"Some ",[33,91,93],{"href":92},"/blog/elite-team-strategies-to-secure-software-supply-chains/","best practices elite DevSecOps teams use"," are:",[96,97,98,102,105,112,115,118],"ul",{},[99,100,101],"li",{},"Apply common controls for security and compliance",[99,103,104],{},"Automate common controls and CI/CD",[99,106,107,108],{},"Apply ",[33,109,111],{"href":110},"/blog/why-devops-and-zero-trust-go-together/","zero-trust principles",[99,113,114],{},"Inventory all tools and access, including infrastructure as code",[99,116,117],{},"Consider unconventional scale to find unconventional vulnerabilities",[99,119,120],{},"Secure containers and orchestrators",[22,122,124],{"id":123},"understanding-federal-and-industry-mandates","Understanding federal and industry mandates",[12,126,127,128,73],{},"The Biden administration has been singular in its demand that federal agencies and their vendors ",[33,129,132],{"href":130,"rel":131},"https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/",[],"make significant improvements in software supply chain security",[12,134,135,136,141,142,147,148,153],{},"That sense of urgency has trickled down to the standards bodies, including the National Institute of Standards and Technology (NIST) and its ",[33,137,140],{"href":138,"rel":139},"https://csrc.nist.gov/Projects/ssdf",[],"Secure Software Development Framework",", the Cybersecurity and Infrastructure Agency’s work on ",[33,143,146],{"href":144,"rel":145},"https://www.cisa.gov/sbom",[],"Software Bill of Materials standards",", and ",[33,149,152],{"href":150,"rel":151},"https://slsa.dev/",[],"SLSA",", a cross-industry collaboration on a security framework to secure the supply chain.",[12,155,156],{},"Compliance officers within organizations are looking to DevSecOps teams to make it easy for them to audit the development life cycle and attest to requirements in these mandates.",[22,158,160],{"id":159},"how-a-devops-platform-helps","How a DevOps platform helps",[12,162,163,164,168],{},"In our ",[33,165,167],{"href":166},"/resources/developer-survey/","2022 Global DevSecOps survey",", respondents overwhelmingly told us that secure software development is now an imperative for their organization and that they believe security is the top reason to deploy a DevOps platform.",[12,170,171,172,176],{},"A DevOps platform can certainly help ",[33,173,175],{"href":174},"/blog/devops-platform-supply-chain-attacks/","protect against software supply chain attacks",". Here are some examples how:",[96,178,179,182,185,188],{},[99,180,181],{},"End-to-end visibility and auditability: Who changed what, where, and when.",[99,183,184],{},"Consistent application and administration of policies: Both what policies are used where, and the actions taken for exceptions",[99,186,187],{},"More intelligent response through greater end-to-end context",[99,189,190],{},"Reduced attack surface of a simplified toolchain",[12,192,193,194,198],{},"DevOps platforms can even support more sophisticated software supply chain security techniques such as ",[33,195,197],{"href":196},"/blog/secure-pipeline-with-single-sign-in/","securing pipeline builds with code signing",". Code signing is an area of interest to standards bodies setting requirements for protecting software supply chains.",[22,200,202],{"id":201},"gitlabs-strengths-in-software-supply-chain-security","GitLab’s strengths in software supply chain security",[12,204,205],{},"GitLab has been at the leading edge of DevSecOps, helping organizations to evolve their security practices from traditional application testing.",[12,207,208,209,73],{},"For instance, rather than being performed by security pros, using their own tools, at the end of the development cycle, security testing is automated within the CI pipeline with findings delivered to developers while they are still iterating on their code. Read how GitLab is also ",[33,210,212],{"href":211},"/blog/gitlab-is-setting-standard-for-devsecops/","revolutionizing CI and security, and remediation practices",[12,214,215,216,220,221,225,226,73],{},"GitLab is laser-focused on enabling organizations to establish and manage security and compliance guardrails that allow developers to run fast while also managing risk, including the introduction of ",[33,217,219],{"href":218},"/blog/gitlabs-newest-continuous-compliance-features-bolster-software/","continuous compliance and policy engines",", as well as ",[33,222,224],{"href":223},"/blog/securing-the-software-supply-chain-through-automated-attestation/","automated attestation"," and ",[33,227,229],{"href":228},"/blog/the-ultimate-guide-to-sboms/","SBOMs",[12,231,232,233,225,237,73],{},"The GitLab partner ecosystem helps the platform to meet even more security needs, including ",[33,234,236],{"href":235},"/blog/gitlab-and-testify-sec-witness-alliance/","generating SBOMs\nautomatically",[33,238,240],{"href":239},"/blog/terraform-as-part-of-software-supply-chain-part1-modules-and-providers/","protecting software from malicious modules",[12,242,243,244,248,249,254],{},"More on GitLab’s software supply chain security vision can be found ",[33,245,247],{"href":246},"/blog/gitlab-supply-chain-security/","here",". And learn even more about securing the software supply chain as GitLab Field CTO ",[33,250,253],{"href":251,"rel":252},"https://gitlab.com/lfaus",[],"Lee Faus"," answers some burning questions:",[50,256,54,258],{"className":257},[53],[56,259,61],{"src":260,"frameBorder":59,"allowFullScreen":60},"https://www.youtube.com/embed/HubJIQ-x2EA",{"title":262,"searchDepth":263,"depth":263,"links":264},"",2,[265,266,267,268,269],{"id":24,"depth":263,"text":25},{"id":64,"depth":263,"text":65},{"id":123,"depth":263,"text":124},{"id":159,"depth":263,"text":160},{"id":201,"depth":263,"text":202},"devsecops","2022-08-30","Coupling DevSecOps with software supply chain security results in the advanced protection organizations need.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749667094/Blog/Hero%20Images/container-security.jpg",{},true,"/en-us/blog/the-ultimate-guide-to-software-supply-chain-security",{"title":5,"description":272,"ogTitle":5,"ogDescription":272,"noIndex":275,"ogImage":276,"ogUrl":281,"ogSiteName":282,"ogType":283,"canonicalUrls":281},"https://about.gitlab.com/blog/the-ultimate-guide-to-software-supply-chain-security","https://about.gitlab.com","article","the-ultimate-guide-to-software-supply-chain-security","en-us/blog/the-ultimate-guide-to-software-supply-chain-security",[287,288,289],"security","DevOps","collaboration","BlogPost","7B3MoTdygZ6Tc2TYBLlb-KEFCD4sBiyfLAZzmI7P37I",{"logo":293,"freeTrial":298,"sales":303,"login":308,"items":313,"search":640,"minimal":671,"duo":690,"switchNav":699,"pricingDeployment":710},{"config":294},{"href":295,"dataGaName":296,"dataGaLocation":297},"/","gitlab logo","header",{"text":299,"config":300},"Get free trial",{"href":301,"dataGaName":302,"dataGaLocation":297},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":304,"config":305},"Request a demo",{"href":306,"dataGaName":307,"dataGaLocation":297},"/sales/?contact-topic=request-demo","sales",{"text":309,"config":310},"Sign in",{"href":311,"dataGaName":312,"dataGaLocation":297},"https://gitlab.com/users/sign_in/","sign in",[314,343,443,448,562,618],{"text":315,"config":316,"menu":318},"Platform",{"dataNavLevelOne":317},"platform",{"type":319,"columns":320},"cards",[321,327,335],{"title":315,"description":322,"link":323},"The intelligent orchestration platform for DevSecOps",{"text":324,"config":325},"Explore our Platform",{"href":326,"dataGaName":317,"dataGaLocation":297},"/platform/",{"title":328,"description":329,"link":330},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":331,"config":332},"Meet GitLab Duo",{"href":333,"dataGaName":334,"dataGaLocation":297},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":336,"description":337,"link":338},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":339,"config":340},"Learn more",{"href":341,"dataGaName":342,"dataGaLocation":297},"/why-gitlab/","why gitlab",{"text":344,"left":278,"config":345,"menu":347},"Product",{"dataNavLevelOne":346},"solutions",{"type":348,"link":349,"columns":353,"feature":422},"lists",{"text":350,"config":351},"View all Solutions",{"href":352,"dataGaName":346,"dataGaLocation":297},"/solutions/",[354,378,401],{"title":355,"description":356,"link":357,"items":362},"Automation","CI/CD and automation to accelerate deployment",{"config":358},{"icon":359,"href":360,"dataGaName":361,"dataGaLocation":297},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[363,367,370,374],{"text":364,"config":365},"CI/CD",{"href":366,"dataGaLocation":297,"dataGaName":364},"/solutions/continuous-integration/",{"text":328,"config":368},{"href":333,"dataGaLocation":297,"dataGaName":369},"gitlab duo agent platform - product menu",{"text":371,"config":372},"Source Code Management",{"href":373,"dataGaLocation":297,"dataGaName":371},"/solutions/source-code-management/",{"text":375,"config":376},"Automated Software Delivery",{"href":360,"dataGaLocation":297,"dataGaName":377},"Automated software delivery",{"title":379,"description":380,"link":381,"items":386},"Security","Deliver code faster without compromising security",{"config":382},{"href":383,"dataGaName":384,"dataGaLocation":297,"icon":385},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[387,391,396],{"text":388,"config":389},"Application Security Testing",{"href":383,"dataGaName":390,"dataGaLocation":297},"Application security testing",{"text":392,"config":393},"Software Supply Chain Security",{"href":394,"dataGaLocation":297,"dataGaName":395},"/solutions/supply-chain/","Software supply chain security",{"text":397,"config":398},"Software Compliance",{"href":399,"dataGaName":400,"dataGaLocation":297},"/solutions/software-compliance/","software compliance",{"title":402,"link":403,"items":408},"Measurement",{"config":404},{"icon":405,"href":406,"dataGaName":407,"dataGaLocation":297},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[409,413,417],{"text":410,"config":411},"Visibility & Measurement",{"href":406,"dataGaLocation":297,"dataGaName":412},"Visibility and Measurement",{"text":414,"config":415},"Value Stream Management",{"href":416,"dataGaLocation":297,"dataGaName":414},"/solutions/value-stream-management/",{"text":418,"config":419},"Analytics & Insights",{"href":420,"dataGaLocation":297,"dataGaName":421},"/solutions/analytics-and-insights/","Analytics and insights",{"title":423,"type":348,"items":424},"GitLab for",[425,431,437],{"text":426,"config":427},"Enterprise",{"icon":428,"href":429,"dataGaLocation":297,"dataGaName":430},"Building","/enterprise/","enterprise",{"text":432,"config":433},"Small Business",{"icon":434,"href":435,"dataGaLocation":297,"dataGaName":436},"Work","/small-business/","small business",{"text":438,"config":439},"Public Sector",{"icon":440,"href":441,"dataGaLocation":297,"dataGaName":442},"Organization","/solutions/public-sector/","public sector",{"text":444,"config":445},"Pricing",{"href":446,"dataGaName":447,"dataGaLocation":297,"dataNavLevelOne":447},"/pricing/","pricing",{"text":449,"config":450,"menu":452},"Resources",{"dataNavLevelOne":451},"resources",{"type":348,"link":453,"columns":457,"feature":551},{"text":454,"config":455},"View all resources",{"href":456,"dataGaName":451,"dataGaLocation":297},"/resources/",[458,491,518],{"title":459,"items":460},"Getting started",[461,466,471,476,481,486],{"text":462,"config":463},"Install",{"href":464,"dataGaName":465,"dataGaLocation":297},"/install/","install",{"text":467,"config":468},"Quick start guides",{"href":469,"dataGaName":470,"dataGaLocation":297},"/get-started/","quick setup checklists",{"text":472,"config":473},"Learn",{"href":474,"dataGaLocation":297,"dataGaName":475},"https://university.gitlab.com/","learn",{"text":477,"config":478},"Product documentation",{"href":479,"dataGaName":480,"dataGaLocation":297},"https://docs.gitlab.com/","product documentation",{"text":482,"config":483},"Best practice videos",{"href":484,"dataGaName":485,"dataGaLocation":297},"/getting-started-videos/","best practice videos",{"text":487,"config":488},"Integrations",{"href":489,"dataGaName":490,"dataGaLocation":297},"/integrations/","integrations",{"title":492,"items":493},"Discover",[494,499,504,509,513],{"text":495,"config":496},"Customer success stories",{"href":497,"dataGaName":498,"dataGaLocation":297},"/customers/","customer success stories",{"text":500,"config":501},"Blog",{"href":502,"dataGaName":503,"dataGaLocation":297},"/blog/","blog",{"text":505,"config":506},"Demo Hub",{"href":507,"dataGaName":508,"dataGaLocation":297},"/demo-hub/","demo hub",{"text":510,"config":511},"The Source",{"href":512,"dataGaName":503,"dataGaLocation":297},"/the-source/",{"text":514,"config":515},"Remote",{"href":516,"dataGaName":517,"dataGaLocation":297},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":519,"items":520},"Connect",[521,526,531,536,541,546],{"text":522,"config":523},"GitLab Services",{"href":524,"dataGaName":525,"dataGaLocation":297},"/services/","services",{"text":527,"config":528},"Contribute",{"href":529,"dataGaName":530,"dataGaLocation":297},"https://contributors.gitlab.com","contribute",{"text":532,"config":533},"Community",{"href":534,"dataGaName":535,"dataGaLocation":297},"/community/","community",{"text":537,"config":538},"Forum",{"href":539,"dataGaName":540,"dataGaLocation":297},"https://forum.gitlab.com/","forum",{"text":542,"config":543},"Events",{"href":544,"dataGaName":545,"dataGaLocation":297},"/events/","events",{"text":547,"config":548},"Partners",{"href":549,"dataGaName":550,"dataGaLocation":297},"/partners/","partners",{"config":552,"title":555,"text":556,"link":557},{"background":553,"textColor":554},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":558,"config":559},"Read the latest",{"href":560,"dataGaName":561,"dataGaLocation":297},"/whats-new/","whats new",{"text":563,"config":564,"menu":566},"Company",{"dataNavLevelOne":565},"company",{"type":348,"columns":567},[568],{"items":569},[570,575,581,583,588,593,598,603,608,613],{"text":571,"config":572},"About",{"href":573,"dataGaName":574,"dataGaLocation":297},"/company/","about",{"text":576,"config":577,"footerGa":580},"Jobs",{"href":578,"dataGaName":579,"dataGaLocation":297},"/jobs/","jobs",{"dataGaName":579},{"text":542,"config":582},{"href":544,"dataGaName":545,"dataGaLocation":297},{"text":584,"config":585},"Leadership",{"href":586,"dataGaName":587,"dataGaLocation":297},"/company/team/e-group/","leadership",{"text":589,"config":590},"Handbook",{"href":591,"dataGaName":592,"dataGaLocation":297},"https://handbook.gitlab.com/","handbook",{"text":594,"config":595},"Investor relations",{"href":596,"dataGaName":597,"dataGaLocation":297},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":599,"config":600},"Trust Center",{"href":601,"dataGaName":602,"dataGaLocation":297},"/security/","trust center",{"text":604,"config":605},"AI Transparency Center",{"href":606,"dataGaName":607,"dataGaLocation":297},"/ai-transparency-center/","ai transparency center",{"text":609,"config":610},"Newsletter",{"href":611,"dataGaName":612,"dataGaLocation":297},"/company/contact/#contact-forms","newsletter",{"text":614,"config":615},"Press",{"href":616,"dataGaName":617,"dataGaLocation":297},"/press/","press",{"text":619,"config":620,"menu":621},"Contact us",{"dataNavLevelOne":565},{"type":348,"columns":622},[623],{"items":624},[625,630,635],{"text":626,"config":627},"Talk to sales",{"href":628,"dataGaName":629,"dataGaLocation":297},"/sales/","talk to sales",{"text":631,"config":632},"Support portal",{"href":633,"dataGaName":634,"dataGaLocation":297},"https://support.gitlab.com/hc/en-us","support portal",{"text":636,"config":637},"Customer portal",{"href":638,"dataGaName":639,"dataGaLocation":297},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":641,"login":642,"suggestions":649},"Close",{"text":643,"link":644},"To search repositories and projects, login to",{"text":645,"config":646},"gitlab.com",{"href":311,"dataGaName":647,"dataGaLocation":648},"search login","search",{"text":650,"default":651},"Suggestions",[652,654,658,660,664,668],{"text":328,"config":653},{"href":333,"dataGaName":328,"dataGaLocation":648},{"text":655,"config":656},"Code Suggestions (AI)",{"href":657,"dataGaName":655,"dataGaLocation":648},"/solutions/code-suggestions/",{"text":364,"config":659},{"href":366,"dataGaName":364,"dataGaLocation":648},{"text":661,"config":662},"GitLab on AWS",{"href":663,"dataGaName":661,"dataGaLocation":648},"/partners/technology-partners/aws/",{"text":665,"config":666},"GitLab on Google Cloud",{"href":667,"dataGaName":665,"dataGaLocation":648},"/partners/technology-partners/google-cloud-platform/",{"text":669,"config":670},"Why GitLab?",{"href":341,"dataGaName":669,"dataGaLocation":648},{"freeTrial":672,"mobileIcon":677,"desktopIcon":682,"secondaryButton":685},{"text":673,"config":674},"Start free trial",{"href":675,"dataGaName":302,"dataGaLocation":676},"https://gitlab.com/-/trials/new/","nav",{"altText":678,"config":679},"Gitlab Icon",{"src":680,"dataGaName":681,"dataGaLocation":676},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":678,"config":683},{"src":684,"dataGaName":681,"dataGaLocation":676},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":686,"config":687},"Get Started",{"href":688,"dataGaName":689,"dataGaLocation":676},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":691,"mobileIcon":695,"desktopIcon":697},{"text":692,"config":693},"Learn more about GitLab Duo",{"href":333,"dataGaName":694,"dataGaLocation":676},"gitlab duo",{"altText":678,"config":696},{"src":680,"dataGaName":681,"dataGaLocation":676},{"altText":678,"config":698},{"src":684,"dataGaName":681,"dataGaLocation":676},{"button":700,"mobileIcon":705,"desktopIcon":707},{"text":701,"config":702},"/switch",{"href":703,"dataGaName":704,"dataGaLocation":676},"#contact","switch",{"altText":678,"config":706},{"src":680,"dataGaName":681,"dataGaLocation":676},{"altText":678,"config":708},{"src":709,"dataGaName":681,"dataGaLocation":676},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":711,"mobileIcon":716,"desktopIcon":718},{"text":712,"config":713},"Back to pricing",{"href":446,"dataGaName":714,"dataGaLocation":676,"icon":715},"back to pricing","GoBack",{"altText":678,"config":717},{"src":680,"dataGaName":681,"dataGaLocation":676},{"altText":678,"config":719},{"src":684,"dataGaName":681,"dataGaLocation":676},{"title":721,"titleMobile":722,"button":723,"config":728},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":339,"config":724},{"href":725,"dataGaName":726,"dataGaLocation":727},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":729,"disabled":275},"release",{"data":731},{"text":732,"source":733,"edit":739,"contribute":744,"config":749,"items":754,"minimal":962},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":734,"config":735},"View page source",{"href":736,"dataGaName":737,"dataGaLocation":738},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":740,"config":741},"Edit this page",{"href":742,"dataGaName":743,"dataGaLocation":738},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":745,"config":746},"Please contribute",{"href":747,"dataGaName":748,"dataGaLocation":738},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":750,"facebook":751,"youtube":752,"linkedin":753},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[755,802,854,898,930],{"title":444,"links":756,"subMenu":771},[757,761,766],{"text":758,"config":759},"View plans",{"href":446,"dataGaName":760,"dataGaLocation":738},"view plans",{"text":762,"config":763},"Why Premium?",{"href":764,"dataGaName":765,"dataGaLocation":738},"/pricing/premium/","why premium",{"text":767,"config":768},"Why Ultimate?",{"href":769,"dataGaName":770,"dataGaLocation":738},"/pricing/ultimate/","why ultimate",[772],{"title":773,"links":774},"Contact Us",[775,778,780,782,787,792,797],{"text":776,"config":777},"Contact sales",{"href":628,"dataGaName":307,"dataGaLocation":738},{"text":631,"config":779},{"href":633,"dataGaName":634,"dataGaLocation":738},{"text":636,"config":781},{"href":638,"dataGaName":639,"dataGaLocation":738},{"text":783,"config":784},"Status",{"href":785,"dataGaName":786,"dataGaLocation":738},"https://status.gitlab.com/","status",{"text":788,"config":789},"Terms of use",{"href":790,"dataGaName":791,"dataGaLocation":738},"/terms/","terms of use",{"text":793,"config":794},"Privacy statement",{"href":795,"dataGaName":796,"dataGaLocation":738},"/privacy/","privacy statement",{"text":798,"config":799},"Cookie preferences",{"dataGaName":800,"dataGaLocation":738,"id":801,"isOneTrustButton":278},"cookie preferences","ot-sdk-btn",{"title":344,"links":803,"subMenu":812},[804,808],{"text":805,"config":806},"DevSecOps platform",{"href":326,"dataGaName":807,"dataGaLocation":738},"devsecops platform",{"text":809,"config":810},"AI-Assisted Development",{"href":333,"dataGaName":811,"dataGaLocation":738},"ai-assisted development",[813],{"title":814,"links":815},"Topics",[816,821,826,830,835,839,844,849],{"text":817,"config":818},"CICD",{"href":819,"dataGaName":820,"dataGaLocation":738},"/topics/ci-cd/","cicd",{"text":822,"config":823},"GitOps",{"href":824,"dataGaName":825,"dataGaLocation":738},"/topics/gitops/","gitops",{"text":288,"config":827},{"href":828,"dataGaName":829,"dataGaLocation":738},"/topics/devops/","devops",{"text":831,"config":832},"Version Control",{"href":833,"dataGaName":834,"dataGaLocation":738},"/topics/version-control/","version control",{"text":836,"config":837},"DevSecOps",{"href":838,"dataGaName":270,"dataGaLocation":738},"/topics/devsecops/",{"text":840,"config":841},"Cloud Native",{"href":842,"dataGaName":843,"dataGaLocation":738},"/topics/cloud-native/","cloud native",{"text":845,"config":846},"AI for Coding",{"href":847,"dataGaName":848,"dataGaLocation":738},"/topics/devops/ai-for-coding/","ai for coding",{"text":850,"config":851},"Agentic AI",{"href":852,"dataGaName":853,"dataGaLocation":738},"/topics/agentic-ai/","agentic ai",{"title":855,"links":856},"Solutions",[857,859,861,866,870,873,877,880,882,885,888,893],{"text":388,"config":858},{"href":383,"dataGaName":388,"dataGaLocation":738},{"text":377,"config":860},{"href":360,"dataGaName":361,"dataGaLocation":738},{"text":862,"config":863},"Agile development",{"href":864,"dataGaName":865,"dataGaLocation":738},"/solutions/agile-delivery/","agile delivery",{"text":867,"config":868},"SCM",{"href":373,"dataGaName":869,"dataGaLocation":738},"source code management",{"text":817,"config":871},{"href":366,"dataGaName":872,"dataGaLocation":738},"continuous integration & delivery",{"text":874,"config":875},"Value stream management",{"href":416,"dataGaName":876,"dataGaLocation":738},"value stream management",{"text":822,"config":878},{"href":879,"dataGaName":825,"dataGaLocation":738},"/solutions/gitops/",{"text":426,"config":881},{"href":429,"dataGaName":430,"dataGaLocation":738},{"text":883,"config":884},"Small business",{"href":435,"dataGaName":436,"dataGaLocation":738},{"text":886,"config":887},"Public sector",{"href":441,"dataGaName":442,"dataGaLocation":738},{"text":889,"config":890},"Education",{"href":891,"dataGaName":892,"dataGaLocation":738},"/solutions/education/","education",{"text":894,"config":895},"Financial services",{"href":896,"dataGaName":897,"dataGaLocation":738},"/solutions/finance/","financial services",{"title":449,"links":899},[900,902,904,906,909,911,914,916,918,920,922,924,926,928],{"text":462,"config":901},{"href":464,"dataGaName":465,"dataGaLocation":738},{"text":467,"config":903},{"href":469,"dataGaName":470,"dataGaLocation":738},{"text":472,"config":905},{"href":474,"dataGaName":475,"dataGaLocation":738},{"text":477,"config":907},{"href":479,"dataGaName":908,"dataGaLocation":738},"docs",{"text":500,"config":910},{"href":502,"dataGaName":503,"dataGaLocation":738},{"text":912,"config":913},"What's new",{"href":560,"dataGaName":561,"dataGaLocation":738},{"text":495,"config":915},{"href":497,"dataGaName":498,"dataGaLocation":738},{"text":514,"config":917},{"href":516,"dataGaName":517,"dataGaLocation":738},{"text":522,"config":919},{"href":524,"dataGaName":525,"dataGaLocation":738},{"text":527,"config":921},{"href":529,"dataGaName":530,"dataGaLocation":738},{"text":532,"config":923},{"href":534,"dataGaName":535,"dataGaLocation":738},{"text":537,"config":925},{"href":539,"dataGaName":540,"dataGaLocation":738},{"text":542,"config":927},{"href":544,"dataGaName":545,"dataGaLocation":738},{"text":547,"config":929},{"href":549,"dataGaName":550,"dataGaLocation":738},{"title":563,"links":931},[932,934,936,938,940,942,946,951,953,955,957],{"text":571,"config":933},{"href":573,"dataGaName":565,"dataGaLocation":738},{"text":576,"config":935},{"href":578,"dataGaName":579,"dataGaLocation":738},{"text":584,"config":937},{"href":586,"dataGaName":587,"dataGaLocation":738},{"text":589,"config":939},{"href":591,"dataGaName":592,"dataGaLocation":738},{"text":594,"config":941},{"href":596,"dataGaName":597,"dataGaLocation":738},{"text":943,"config":944},"Sustainability",{"href":945,"dataGaName":943,"dataGaLocation":738},"/sustainability/",{"text":947,"config":948},"Diversity, inclusion and belonging (DIB)",{"href":949,"dataGaName":950,"dataGaLocation":738},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":599,"config":952},{"href":601,"dataGaName":602,"dataGaLocation":738},{"text":609,"config":954},{"href":611,"dataGaName":612,"dataGaLocation":738},{"text":614,"config":956},{"href":616,"dataGaName":617,"dataGaLocation":738},{"text":958,"config":959},"Modern Slavery Transparency Statement",{"href":960,"dataGaName":961,"dataGaLocation":738},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":963},[964,967,970],{"text":965,"config":966},"Terms",{"href":790,"dataGaName":791,"dataGaLocation":738},{"text":968,"config":969},"Cookies",{"dataGaName":800,"dataGaLocation":738,"id":801,"isOneTrustButton":278},{"text":971,"config":972},"Privacy",{"href":795,"dataGaName":796,"dataGaLocation":738},[974],{"id":975,"title":7,"body":274,"config":976,"content":978,"description":274,"extension":984,"meta":985,"navigation":278,"path":986,"seo":987,"stem":988,"__hash__":989},"blogAuthors/en-us/blog/authors/sandra-gittlen.yml",{"template":977},"BlogAuthor",{"role":979,"name":7,"config":980},"Managing Editor, GitLab Blog",{"headshot":981,"linkedin":982,"ctfId":983},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659648/Blog/Author%20Headshots/Sgittlen-headshot.jpg","https://www.linkedin.com/in/sandra-gittlen-48557a294/","sgittlen","yml",{},"/en-us/blog/authors/sandra-gittlen",{},"en-us/blog/authors/sandra-gittlen","Y1hpWIa-4iLRjGVQU7Rsuo7D3zGggeSoWHEaLRZQ104",[991,999,1007],{"title":992,"description":993,"heroImage":994,"category":270,"date":995,"authors":996,"slug":998,"externalUrl":274},"Consolidate your GitLab stack with Gitaly on Kubernetes","Discover how to install Gitaly on Kubernetes, which is now generally available.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756500636/wmey6kqzzuhirk88w2de.png","2026-05-07",[997],"Olivier Campeau","gitaly-on-kubernetes-generally-available",{"title":1000,"description":1001,"heroImage":1002,"category":270,"date":1003,"authors":1004,"slug":1006,"externalUrl":274},"Teaching software development the easy way using GitLab","Learn how University of Washington lecturer Stephen G. Dame uses GitLab for Education to manage student assignments, distribute course materials, and provide inline code feedback at scale.\n","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659537/Blog/Hero%20Images/display-article-image-0679-1800x945-fy26.png","2026-04-29",[1005],"Rod Burns","teaching-software-development-the-easy-way-using-gitlab",{"title":1008,"description":1009,"heroImage":1010,"category":270,"date":1011,"authors":1012,"slug":1014,"externalUrl":274},"AI is reshaping DevSecOps: Attend GitLab Transcend to see what’s next","AI-generated code is 34% of development work. Discover how to balance productivity gains with quality, reliability, and security.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1767982271/e9ogyosmuummq7j65zqg.png","2026-01-08",[1013],"Manav Khurana","ai-is-reshaping-devsecops-attend-gitlab-transcend-to-see-whats-next",{"promotions":1016},[1017,1031,1043,1054],{"id":1018,"categories":1019,"header":1021,"text":1022,"button":1023,"image":1028},"ai-modernization",[1020],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1024,"config":1025},"Get your AI maturity score",{"href":1026,"dataGaName":1027,"dataGaLocation":503},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1029},{"src":1030},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1032,"categories":1033,"header":1035,"text":1022,"button":1036,"image":1040},"devops-modernization",[1034,270],"product","Are you just managing tools or shipping innovation?",{"text":1037,"config":1038},"Get your DevOps maturity score",{"href":1039,"dataGaName":1027,"dataGaLocation":503},"/assessments/devops-modernization-assessment/",{"config":1041},{"src":1042},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1044,"categories":1045,"header":1046,"text":1022,"button":1047,"image":1051},"security-modernization",[287],"Are you trading speed for security?",{"text":1048,"config":1049},"Get your security maturity score",{"href":1050,"dataGaName":1027,"dataGaLocation":503},"/assessments/security-modernization-assessment/",{"config":1052},{"src":1053},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1055,"paths":1056,"header":1059,"text":1060,"button":1061,"image":1066},"github-azure-migration",[1057,1058],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1062,"config":1063},"See how GitLab compares to GitHub",{"href":1064,"dataGaName":1065,"dataGaLocation":503},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1067},{"src":1042},{"header":1069,"blurb":1070,"button":1071,"secondaryButton":1076},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1072,"config":1073},"Get your free trial",{"href":1074,"dataGaName":302,"dataGaLocation":1075},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":776,"config":1077},{"href":628,"dataGaName":307,"dataGaLocation":1075},1786803774078]