[{"data":1,"prerenderedAt":1045},["ShallowReactive",2],{"/blog/find-vulnerability-blast-radius-with-gitlab-orbit":3,"navigation-en-us":294,"banner-en-us":731,"footer-en-us":739,"blog-post-authors-en-us-Rebecca Carter":987,"blog-related-posts-en-us-find-vulnerability-blast-radius-with-gitlab-orbit":1001,"blog-share-wrapper-en-us":1025,"next-steps-en-us":1035},{"id":4,"title":5,"authors":6,"body":8,"category":273,"date":274,"description":275,"extension":276,"externalUrl":277,"faq":277,"featured":278,"heroImage":279,"hidePromo":278,"meta":280,"navigation":281,"path":282,"seo":283,"slug":285,"stem":286,"tags":287,"template":292,"updatedDate":277,"__hash__":293},"blogPosts/en-us/blog/find-vulnerability-blast-radius-with-gitlab-orbit.md","GitLab Orbit: Find vulnerability blast radius without the manual hunt",[7],"Rebecca Carter",{"type":9,"value":10,"toc":263},"minimark",[11,15,29,34,42,45,48,63,67,70,73,76,79,94,98,106,115,141,145,148,151,216,224,228,231,235,244],[12,13,14],"p",{},"A critical vulnerability needs a fix and a map. The fix is usually fast. Finding where the vulnerable component lives, who owns it, and whether it's exposed to the Internet is what costs you time. Most security teams piece that answer together from scanner reports, spreadsheets, and a Slack thread asking who owns a service nobody recognizes, and you stay exposed for every hour that takes.",[12,16,17,23,24,28],{},[18,19,22],"a",{"href":20,"rel":21},"https://docs.gitlab.com/orbit/",[],"GitLab Orbit",", now ",[18,25,27],{"href":26},"/blog/gitlab-orbit-ga/","generally available",", replaces this manual work with a single query. Orbit connects code, merge requests, pipelines, security findings, and ownership in one graph that stays current as your teams ship. Ask which projects are affected and who owns them, and you get an answer in minutes. Agents answer from the graph instead of crawling repositories and stitching together API calls, so they need fewer retries and fewer tokens to get there.",[30,31,33],"h2",{"id":32},"why-scanners-alone-cant-answer-the-question","Why scanners alone can't answer the question",[12,35,36,41],{},[18,37,40],{"href":38,"rel":39},"https://about.gitlab.com/blog/gitlab-helps-remediate-critical-php-flaws/",[],"PHP2Shell",", the set of critical PHP flaws disclosed last week, illustrates the problem. PHP is usually installed as a system package, compiled from source, or baked into a container image, not managed as an application dependency. Vulnerable versions can sit on web servers, in container images, in old CI jobs, or in internal tools nobody remembers building. The fix was a version upgrade. Finding every affected installation took time.",[12,43,44],{},"Security tools provide different views of the environment. Dependency scanning identifies vulnerable application dependencies. Container scanning detects vulnerabilities in operating system packages, language dependencies, and other software components. Code search helps locate where images and configurations are referenced. But identifying a vulnerability is only part of the job. Teams still need to know which services are affected, who owns them, which pipelines build and deploy them, and where to apply the fix. That information is often spread across multiple systems.",[12,46,47],{},"That leaves your team to connect the dots, each holding a different piece. Your security engineer can assess the severity but may not see every affected system. Your platform engineer owns the base images and CI templates that hundreds of projects depend on, but can't see every project that uses them. Your developers get pulled off their roadmap to search repositories for a component they may not know they own. Your CISO has to tell leadership whether the company is exposed before anyone has a full list.",[12,49,50,51,56,57,62],{},"An attacker only needs to find one vulnerable system. You need to find all of them. Exploiting a vulnerability is now the most common way breaches begin, at 31% in ",[18,52,55],{"href":53,"rel":54},"https://secureframe.com/blog/2026-verizon-dbir-insights",[],"Verizon's 2026 report",", and the same report found attackers ",[18,58,61],{"href":59,"rel":60},"https://www.darkreading.com/threat-intelligence/verizon-dbir-enterprises-vulnerability-glut",[],"using generative AI at several stages of an attack",". The map needs to exist before the advisory lands.",[30,64,66],{"id":65},"a-first-party-graph-of-your-entire-sdlc","A first-party graph of your entire SDLC",[12,68,69],{},"Orbit draws on the data GitLab already runs on: your merge requests, pipelines, deployments, and vulnerabilities. A CVE in Orbit's graph connects directly to the services, pipelines, environments, and teams it touches. Because the graph is first-party, there's no second system to keep in sync and no new instrumentation to stand up.",[12,71,72],{},"Without Orbit, an agent or analyst can usually find the vulnerable code but not the full exposure. Someone assembles that picture by hand, tool by tool, and the gaps show up as the long tail of services nobody checked. With Orbit, one query maps the CVE to the services, pipelines, environments, and owners that depend on it, and the output is a scoped, prioritized list your security team can act on.",[12,74,75],{},"Agents without Orbit hit the same wall: they can't see the whole system, so they guess. In GitLab's testing on the same tasks with the same model, agents running through Orbit were up to 11 times faster, used up to 4.5 times fewer tokens, and needed up to 45 times fewer retries. During an incident, faster answers arrive while the team is still triaging, lower token use keeps queries across a large group from becoming a cost problem, and fewer retries mean your team can act on the first answer instead of re-running the question.",[12,77,78],{},"Watch the demo to learn how GitLab Orbit can help you understand your exposure:",[80,81,84,85],"figure",{"className":82},[83],"video_container","\n  ",[86,87],"iframe",{"src":88,"frameBorder":89,"allow":90,"referrerPolicy":91,"style":92,"title":93},"https://player.vimeo.com/video/1240476454?badge=0&autopause=0&player_id=0&app_id=58479","0","autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share","strict-origin-when-cross-origin","position:absolute;top:0;left:0;width:100%;height:100%;","Orbit PHP2Shell Demo",[30,95,97],{"id":96},"one-graph-that-connects-a-cve-to-its-owner","One graph that connects a CVE to its owner",[12,99,100,101,105],{},"Blast radius is how far a vulnerability reaches: which projects contain the flawed component, how it got there, who owns those projects, and what changed recently. GitLab already holds most of those facts in separate places, and Orbit connects them. Turn it on for a top-level group, and Orbit ",[18,102,104],{"href":20,"rel":103},[],"indexes projects, merge requests, pipelines, work items, security findings, and source code"," into one graph of how they relate.",[12,107,108,109,114],{},"From there, you ask in plain language instead of correlating systems by hand: which projects use this library, which merge requests brought it in, and who owns each project? An agent traverses the graph and answers from indexed project data, and you can audit the ",[18,110,113],{"href":111,"rel":112},"https://docs.gitlab.com/orbit/remote/cookbook/",[],"graph queries behind each answer",".",[12,116,117,118,123,124,129,130,135,136,114],{},"Access follows the ",[18,119,122],{"href":120,"rel":121},"https://docs.gitlab.com/orbit/remote/security/",[],"roles you've already set",", so people and agents see only what they're permitted to see. GitLab's built-in agents, including the ",[18,125,128],{"href":126,"rel":127},"https://docs.gitlab.com/user/duo_agent_platform/agents/foundational_agents/security_analyst_agent/",[],"Security Analyst Agent",", ",[18,131,134],{"href":132,"rel":133},"https://docs.gitlab.com/orbit/remote/access/duo/",[],"use Orbit directly",", and external agents such as Claude Code and Codex reach the same graph over ",[18,137,140],{"href":138,"rel":139},"https://docs.gitlab.com/orbit/remote/access/mcp/",[],"MCP",[30,142,144],{"id":143},"contain-your-exposure-quickly","Contain your exposure quickly",[12,146,147],{},"After PHP2Shell, leadership's first question is whether you're exposed. Without a map, your answer is \"we're checking.\" With Orbit, your answer is a list: these projects contain PHP, these teams own them, and these pipelines build them.",[12,149,150],{},"The first hour with Orbit looks like this:",[152,153,154,168,193,210],"ol",{},[155,156,157,161,162,167],"li",{},[158,159,160],"strong",{},"Find every PHP project."," In ",[18,163,166],{"href":164,"rel":165},"https://docs.gitlab.com/user/gitlab_duo_chat/agentic_chat/",[],"GitLab Duo Agentic Chat",", ask: “Use Orbit to map the blast radius of PHP in this group. List every project that contains PHP code, grouped by subgroup, with owners.”",[155,169,170,173,174,179,180,184,185,188,189,192],{},[158,171,172],{},"Confirm the base image and version."," Use ",[18,175,178],{"href":176,"rel":177},"https://docs.gitlab.com/user/search/exact_code_search/",[],"exact code search"," at the top-level group with regular expression mode on. Run ",[181,182,183],"code",{},"lang:Dockerfile ^FROM.*php"," to find container base images, and ",[181,186,187],{},"file:composer\\.json$"," to find Composer projects with no Dockerfile. Compare each ",[181,190,191],{},"FROM"," tag with the fixed versions.",[155,194,195,198,199,204,205,114],{},[158,196,197],{},"Find open findings."," Once scans have run, ask Agentic Chat to collect every container scanning finding for CVE-2026-109618 and CVE-2026-109619 across the group from the ",[18,200,203],{"href":201,"rel":202},"https://docs.gitlab.com/user/application_security/vulnerability_report/",[],"vulnerability report",". This requires Ultimate and the ",[18,206,209],{"href":207,"rel":208},"https://docs.gitlab.com/orbit/remote/security/#roles-required-to-query-gitlab-orbit",[],"Security Manager role",[155,211,212,215],{},[158,213,214],{},"Check against what’s running."," Orbit and code search cover what your repositories declare on the default branch. Compare that list with your runtime inventory from configuration management or cloud tooling, starting with internet-facing services, since PHP can also run on hand-built servers outside any repository.",[12,217,218,219,223],{},"The ",[18,220,222],{"href":38,"rel":221},[],"PHP2Shell remediation guide"," covers fixed versions and how to check for compromise. Teams on GitLab Self-Managed or GitLab Dedicated can start with the guide's advanced search and repository languages API steps until Orbit reaches their instance.",[30,225,227],{"id":226},"run-the-same-check-for-any-shared-component","Run the same check for any shared component",[12,229,230],{},"The steps above work beyond PHP. When a widely used library ships a security fix, a package you depend on is flagged as malicious, a CI template many projects inherit needs a change, or an internal SDK ships a breaking security upgrade, you start with the same question: what depends on it, and who owns it? Orbit answers from the same graph each time, so your team starts from a list instead of a search.",[30,232,234],{"id":233},"map-your-blast-radius-before-the-next-disclosure","Map your blast radius before the next disclosure",[12,236,237,238,243],{},"GitLab Orbit is now generally available for Premium and Ultimate customers, starting with GitLab.com today and reaching Self-Managed and GitLab Dedicated over the coming weeks. Customers can try it free for 30 days through their GitLab account team. If you're new to GitLab, ",[18,239,242],{"href":240,"rel":241},"https://about.gitlab.com/sales/?contact-topic=request-demo",[],"talk to our team"," about getting started with a paid plan, and we can add an Orbit trial as part of it.",[12,245,246,247,252,253,258,259,262],{},"Check out the ",[18,248,251],{"href":249,"rel":250},"https://docs.gitlab.com/orbit/remote/",[],"documentation"," to get started. For a broader view of your security posture, ",[18,254,257],{"href":255,"rel":256},"https://about.gitlab.com/gitlab-security-standard/#assessment",[],"request your GitLab Security Standard assessment"," to see how blast radius mapping fits into the rest of your security program. If your teams run PHP, start with the ",[18,260,222],{"href":38,"rel":261},[]," and upgrade now.",{"title":264,"searchDepth":265,"depth":265,"links":266},"",2,[267,268,269,270,271,272],{"id":32,"depth":265,"text":33},{"id":65,"depth":265,"text":66},{"id":96,"depth":265,"text":97},{"id":143,"depth":265,"text":144},{"id":226,"depth":265,"text":227},{"id":233,"depth":265,"text":234},"security","2026-10-29","Exploitation happens at machine speed now. Map every project, owner, and pipeline a critical CVE touches so remediation can keep up.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1780996524/sd1vpl8empy26wizarqj.png",{},true,"/en-us/blog/find-vulnerability-blast-radius-with-gitlab-orbit",{"config":284,"title":5,"description":275},{"noIndex":278},"find-vulnerability-blast-radius-with-gitlab-orbit","en-us/blog/find-vulnerability-blast-radius-with-gitlab-orbit",[288,289,290,291],"product","AI","news","features","BlogPost","KDT96LBvKLiAJrNvHK241wYgUfvGNWN4oD3AtBRPwVc",{"logo":295,"freeTrial":300,"sales":305,"login":310,"items":315,"search":650,"minimal":682,"duo":701,"switchNav":710,"pricingDeployment":721},{"config":296},{"href":297,"dataGaName":298,"dataGaLocation":299},"/","gitlab logo","header",{"text":301,"config":302},"Get free trial",{"href":303,"dataGaName":304,"dataGaLocation":299},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":306,"config":307},"Request a demo",{"href":308,"dataGaName":309,"dataGaLocation":299},"/request-a-demo/","sales",{"text":311,"config":312},"Sign in",{"href":313,"dataGaName":314,"dataGaLocation":299},"https://gitlab.com/users/sign_in/","sign in",[316,401,489,494,574,628],{"text":317,"left":281,"config":318,"menu":320},"Platform",{"dataNavLevelOne":319},"platform",{"type":321,"link":322,"columns":326,"feature":391},"lists",{"text":323,"config":324},"Explore the Platform",{"href":325,"dataGaName":319,"dataGaLocation":299},"/platform/",[327,350,373],{"title":328,"items":329},"Execution & Workflows",[330,335,340,345],{"text":331,"config":332},"CI/CD",{"href":333,"dataGaLocation":299,"dataGaName":334},"/solutions/continuous-integration/","ci/cd",{"text":336,"config":337},"Source Code Management",{"href":338,"dataGaLocation":299,"dataGaName":339},"/solutions/source-code-management/","source code management",{"text":341,"config":342},"Agile Delivery",{"href":343,"dataGaLocation":299,"dataGaName":344},"/solutions/agile-delivery/","agile delivery",{"text":346,"config":347},"Artifact Management",{"href":348,"dataGaLocation":299,"dataGaName":349},"/artifact-central/","artifact management",{"title":351,"items":352},"Security & Governance",[353,358,363,368],{"text":354,"config":355},"Application Security Testing",{"href":356,"dataGaLocation":299,"dataGaName":357},"/solutions/application-security-testing/","application security testing",{"text":359,"config":360},"Governance & Compliance",{"href":361,"dataGaLocation":299,"dataGaName":362},"/solutions/software-compliance/","governance and compliance",{"text":364,"config":365},"Secrets Management",{"href":366,"dataGaLocation":299,"dataGaName":367},"/gitlab-secrets-manager/","secrets management",{"text":369,"config":370},"Supply Chain Security",{"href":371,"dataGaLocation":299,"dataGaName":372},"/solutions/supply-chain/","supply chain security",{"title":374,"items":375},"Context & AI",[376,381,386],{"text":377,"config":378},"Duo Agent Platform",{"href":379,"dataGaLocation":299,"dataGaName":380},"/gitlab-duo-agent-platform/","duo agent platform",{"text":382,"config":383},"Orbit",{"href":384,"dataGaLocation":299,"dataGaName":385},"/gitlab-orbit/","orbit",{"text":387,"config":388},"Visibility & Measurement",{"href":389,"dataGaLocation":299,"dataGaName":390},"/solutions/visibility-measurement/","visibility and measurement",{"config":392,"title":395,"text":396,"link":397},{"background":393,"textColor":394},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1790185102/o7dn32anqcb6z8dgd3as.jpg')","#000","GitLab Orbit is generally available","Higher agent accuracy, lower token cost",{"text":398,"config":399},"Read the announcement",{"href":26,"dataGaName":400,"dataGaLocation":299},"orbit ga announcement",{"text":402,"left":281,"config":403,"menu":405},"Solutions",{"dataNavLevelOne":404},"solutions",{"type":321,"link":406,"columns":410,"feature":480},{"text":407,"config":408},"View all Solutions",{"href":409,"dataGaName":404,"dataGaLocation":299},"/solutions/",[411,429,447],{"title":412,"items":413},"Outcomes",[414,419,424],{"text":415,"config":416},"DevOps Modernization",{"href":417,"dataGaLocation":299,"dataGaName":418},"/assessments/devops-modernization-assessment/","devops modernization",{"text":420,"config":421},"Security Modernization",{"href":422,"dataGaLocation":299,"dataGaName":423},"/assessments/security-modernization-assessment/","security modernization",{"text":425,"config":426},"AI Modernization",{"href":427,"dataGaLocation":299,"dataGaName":428},"/assessments/ai-modernization-assessment/","ai modernization",{"title":430,"items":431},"By size",[432,437,442],{"text":433,"config":434},"Enterprise",{"href":435,"dataGaLocation":299,"dataGaName":436},"/enterprise/","enterprise",{"text":438,"config":439},"Small Business",{"href":440,"dataGaLocation":299,"dataGaName":441},"/small-business/","small business",{"text":443,"config":444},"Startups",{"href":445,"dataGaLocation":299,"dataGaName":446},"/solutions/startups/","startups",{"title":448,"items":449},"Industries",[450,455,460,465,470,475],{"text":451,"config":452},"Financial Services",{"href":453,"dataGaLocation":299,"dataGaName":454},"/solutions/finance/","financial services",{"text":456,"config":457},"Public Sector",{"href":458,"dataGaLocation":299,"dataGaName":459},"/solutions/public-sector/","public sector",{"text":461,"config":462},"Telecommunications",{"href":463,"dataGaLocation":299,"dataGaName":464},"/solutions/telecommunications/","telecommunications",{"text":466,"config":467},"Automotive",{"href":468,"dataGaLocation":299,"dataGaName":469},"/solutions/automotive/","automotive",{"text":471,"config":472},"Education",{"href":473,"dataGaLocation":299,"dataGaName":474},"/solutions/education/","education",{"text":476,"config":477},"Aerospace",{"href":478,"dataGaLocation":299,"dataGaName":479},"/solutions/aerospace/","aerospace",{"config":481,"title":482,"text":483,"link":484},{"background":393,"textColor":394},"GitLab Security Standard","Learn how to harden your software factory and let AI agents earn autonomy, without trading away security.",{"text":485,"config":486},"Explore the standard",{"href":487,"dataGaName":488,"dataGaLocation":299},"/gitlab-security-standard/","gitlab security standard",{"text":490,"config":491},"Pricing",{"href":492,"dataGaName":493,"dataGaLocation":299,"dataNavLevelOne":493},"/pricing/","pricing",{"text":495,"config":496,"menu":498},"Resources",{"dataNavLevelOne":497},"resources",{"type":321,"link":499,"columns":503,"feature":565},{"text":500,"config":501},"View all resources",{"href":502,"dataGaName":497,"dataGaLocation":299},"/resources/",[504,537],{"title":505,"items":506},"Discover",[507,512,517,522,527,532],{"text":508,"config":509},"Docs",{"href":510,"dataGaName":511,"dataGaLocation":299},"https://docs.gitlab.com/","docs",{"text":513,"config":514},"University",{"href":515,"dataGaName":516,"dataGaLocation":299},"https://university.gitlab.com/","university",{"text":518,"config":519},"Demo Series",{"href":520,"dataGaName":521,"dataGaLocation":299},"/gitlab-technical-demo-series/","demo series",{"text":523,"config":524},"Demo Hub",{"href":525,"dataGaName":526,"dataGaLocation":299},"/demo-hub/","demo hub",{"text":528,"config":529},"Services",{"href":530,"dataGaName":531,"dataGaLocation":299},"/services/","services",{"text":533,"config":534},"Well Architected",{"href":535,"dataGaName":536,"dataGaLocation":299},"/resources/well-architected/","well architected",{"title":538,"items":539},"Connect",[540,545,550,555,560],{"text":541,"config":542},"Blog",{"href":543,"dataGaName":544,"dataGaLocation":299},"/blog/","blog",{"text":546,"config":547},"Community",{"href":548,"dataGaName":549,"dataGaLocation":299},"/community/","community",{"text":551,"config":552},"Customers",{"href":553,"dataGaName":554,"dataGaLocation":299},"/customers/","customers",{"text":556,"config":557},"Partners",{"href":558,"dataGaName":559,"dataGaLocation":299},"/partners/","partners",{"text":561,"config":562},"Events",{"href":563,"dataGaName":564,"dataGaLocation":299},"/events/","events",{"config":566,"title":567,"text":568,"link":569},{"background":393,"textColor":394},"What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":570,"config":571},"Read the latest",{"href":572,"dataGaName":573,"dataGaLocation":299},"/whats-new/","whats new",{"text":575,"config":576,"menu":578},"Company",{"dataNavLevelOne":577},"company",{"type":321,"columns":579},[580],{"items":581},[582,587,593,598,603,608,613,618,623],{"text":583,"config":584},"About",{"href":585,"dataGaName":586,"dataGaLocation":299},"/company/","about",{"text":588,"config":589,"footerGa":592},"Jobs",{"href":590,"dataGaName":591,"dataGaLocation":299},"/jobs/","jobs",{"dataGaName":591},{"text":594,"config":595},"Press",{"href":596,"dataGaName":597,"dataGaLocation":299},"/press/","press",{"text":599,"config":600},"Handbook",{"href":601,"dataGaName":602,"dataGaLocation":299},"https://handbook.gitlab.com/","handbook",{"text":604,"config":605},"Leadership",{"href":606,"dataGaName":607,"dataGaLocation":299},"/company/team/e-group/","leadership",{"text":609,"config":610},"Investor relations",{"href":611,"dataGaName":612,"dataGaLocation":299},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":614,"config":615},"Trust Center",{"href":616,"dataGaName":617,"dataGaLocation":299},"/security/","trust center",{"text":619,"config":620},"AI Transparency Center",{"href":621,"dataGaName":622,"dataGaLocation":299},"/ai-transparency-center/","ai transparency center",{"text":624,"config":625},"Newsletter",{"href":626,"dataGaName":627,"dataGaLocation":299},"/company/contact/#contact-forms","newsletter",{"text":629,"config":630,"menu":631},"Contact us",{"dataNavLevelOne":577},{"type":321,"columns":632},[633],{"items":634},[635,640,645],{"text":636,"config":637},"Talk to sales",{"href":638,"dataGaName":639,"dataGaLocation":299},"/sales/","talk to sales",{"text":641,"config":642},"Support portal",{"href":643,"dataGaName":644,"dataGaLocation":299},"https://support.gitlab.com/hc/en-us","support portal",{"text":646,"config":647},"Customer portal",{"href":648,"dataGaName":649,"dataGaLocation":299},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":651,"login":652,"suggestions":659},"Close",{"text":653,"link":654},"To search repositories and projects, login to",{"text":655,"config":656},"gitlab.com",{"href":313,"dataGaName":657,"dataGaLocation":658},"search login","search",{"text":660,"default":661},"Suggestions",[662,665,668,670,674,678],{"text":663,"config":664},"GitLab Duo Agent Platform",{"href":379,"dataGaName":663,"dataGaLocation":658},{"text":666,"config":667},"Code Suggestions (AI)",{"href":379,"dataGaName":666,"dataGaLocation":658},{"text":331,"config":669},{"href":333,"dataGaName":331,"dataGaLocation":658},{"text":671,"config":672},"GitLab on AWS",{"href":673,"dataGaName":671,"dataGaLocation":658},"/partners/technology-partners/aws/",{"text":675,"config":676},"GitLab on Google Cloud",{"href":677,"dataGaName":675,"dataGaLocation":658},"/partners/technology-partners/google-cloud-platform/",{"text":679,"config":680},"Why GitLab?",{"href":681,"dataGaName":679,"dataGaLocation":658},"/why-gitlab/",{"freeTrial":683,"mobileIcon":688,"desktopIcon":693,"secondaryButton":696},{"text":684,"config":685},"Start free trial",{"href":686,"dataGaName":304,"dataGaLocation":687},"https://gitlab.com/-/trials/new/","nav",{"altText":689,"config":690},"Gitlab Icon",{"src":691,"dataGaName":692,"dataGaLocation":687},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":689,"config":694},{"src":695,"dataGaName":692,"dataGaLocation":687},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":697,"config":698},"Get Started",{"href":699,"dataGaName":700,"dataGaLocation":687},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":702,"mobileIcon":706,"desktopIcon":708},{"text":703,"config":704},"Learn more about GitLab Duo",{"href":379,"dataGaName":705,"dataGaLocation":687},"gitlab duo",{"altText":689,"config":707},{"src":691,"dataGaName":692,"dataGaLocation":687},{"altText":689,"config":709},{"src":695,"dataGaName":692,"dataGaLocation":687},{"button":711,"mobileIcon":716,"desktopIcon":718},{"text":712,"config":713},"/switch",{"href":714,"dataGaName":715,"dataGaLocation":687},"#contact","switch",{"altText":689,"config":717},{"src":691,"dataGaName":692,"dataGaLocation":687},{"altText":689,"config":719},{"src":720,"dataGaName":692,"dataGaLocation":687},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":722,"mobileIcon":727,"desktopIcon":729},{"text":723,"config":724},"Back to pricing",{"href":492,"dataGaName":725,"dataGaLocation":687,"icon":726},"back to pricing","GoBack",{"altText":689,"config":728},{"src":691,"dataGaName":692,"dataGaLocation":687},{"altText":689,"config":730},{"src":695,"dataGaName":692,"dataGaLocation":687},{"title":732,"button":733,"config":737},"GitLab Orbit is generally available. Increase agent accuracy and lower token cost",{"text":398,"config":734},{"href":26,"dataGaName":735,"dataGaLocation":736},"orbit-ga-banner","global-banner",{"layout":738,"disabled":278},"release",{"data":740},{"text":741,"config":742,"items":747,"minimal":976},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"twitter":743,"facebook":744,"youtube":745,"linkedin":746},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[748,796,856,903,944],{"title":490,"links":749,"subMenu":765},[750,755,760],{"text":751,"config":752},"View plans",{"href":492,"dataGaName":753,"dataGaLocation":754},"view plans","footer",{"text":756,"config":757},"Why Premium?",{"href":758,"dataGaName":759,"dataGaLocation":754},"/pricing/premium/","why premium",{"text":761,"config":762},"Why Ultimate?",{"href":763,"dataGaName":764,"dataGaLocation":754},"/pricing/ultimate/","why ultimate",[766],{"title":767,"links":768},"Contact Us",[769,772,774,776,781,786,791],{"text":770,"config":771},"Contact sales",{"href":638,"dataGaName":309,"dataGaLocation":754},{"text":641,"config":773},{"href":643,"dataGaName":644,"dataGaLocation":754},{"text":646,"config":775},{"href":648,"dataGaName":649,"dataGaLocation":754},{"text":777,"config":778},"Status",{"href":779,"dataGaName":780,"dataGaLocation":754},"https://status.gitlab.com/","status",{"text":782,"config":783},"Terms of use",{"href":784,"dataGaName":785,"dataGaLocation":754},"/terms/","terms of use",{"text":787,"config":788},"Privacy statement",{"href":789,"dataGaName":790,"dataGaLocation":754},"/privacy/","privacy statement",{"text":792,"config":793},"Cookie preferences",{"dataGaName":794,"dataGaLocation":754,"id":795,"isOneTrustButton":281},"cookie preferences","ot-sdk-btn",{"title":317,"links":797,"subMenu":813},[798,801,803,805,807,809],{"text":799,"config":800},"Explore the platform",{"href":325,"dataGaName":319,"dataGaLocation":754},{"text":377,"config":802},{"href":379,"dataGaName":380,"dataGaLocation":754},{"text":331,"config":804},{"href":333,"dataGaName":334,"dataGaLocation":754},{"text":382,"config":806},{"href":384,"dataGaName":385,"dataGaLocation":754},{"text":364,"config":808},{"href":366,"dataGaName":367,"dataGaLocation":754},{"text":810,"config":811},"Why GitLab",{"href":681,"dataGaName":812,"dataGaLocation":754},"why gitlab",[814],{"title":815,"links":816},"Topics",[817,821,826,831,836,841,846,851],{"text":331,"config":818},{"href":819,"dataGaName":820,"dataGaLocation":754},"/topics/ci-cd/","cicd",{"text":822,"config":823},"GitOps",{"href":824,"dataGaName":825,"dataGaLocation":754},"/topics/gitops/","gitops",{"text":827,"config":828},"DevOps",{"href":829,"dataGaName":830,"dataGaLocation":754},"/topics/devops/","devops",{"text":832,"config":833},"Version Control",{"href":834,"dataGaName":835,"dataGaLocation":754},"/topics/version-control/","version control",{"text":837,"config":838},"DevSecOps",{"href":839,"dataGaName":840,"dataGaLocation":754},"/topics/devsecops/","devsecops",{"text":842,"config":843},"Cloud Native",{"href":844,"dataGaName":845,"dataGaLocation":754},"/topics/cloud-native/","cloud native",{"text":847,"config":848},"AI for Coding",{"href":849,"dataGaName":850,"dataGaLocation":754},"/topics/devops/ai-for-coding/","ai for coding",{"text":852,"config":853},"Agentic AI",{"href":854,"dataGaName":855,"dataGaLocation":754},"/topics/agentic-ai/","agentic ai",{"title":402,"links":857},[858,861,864,867,870,873,875,877,879,881,883,886,888,891,895,899],{"text":859,"config":860},"DevOps modernization",{"href":417,"dataGaName":418,"dataGaLocation":754},{"text":862,"config":863},"Security modernization",{"href":422,"dataGaName":423,"dataGaLocation":754},{"text":865,"config":866},"AI modernization",{"href":427,"dataGaName":428,"dataGaLocation":754},{"text":868,"config":869},"Financial services",{"href":453,"dataGaName":454,"dataGaLocation":754},{"text":871,"config":872},"Public sector",{"href":458,"dataGaName":459,"dataGaLocation":754},{"text":461,"config":874},{"href":463,"dataGaName":464,"dataGaLocation":754},{"text":466,"config":876},{"href":468,"dataGaName":469,"dataGaLocation":754},{"text":471,"config":878},{"href":473,"dataGaName":474,"dataGaLocation":754},{"text":476,"config":880},{"href":478,"dataGaName":479,"dataGaLocation":754},{"text":433,"config":882},{"href":435,"dataGaName":436,"dataGaLocation":754},{"text":884,"config":885},"Small business",{"href":440,"dataGaName":441,"dataGaLocation":754},{"text":443,"config":887},{"href":445,"dataGaName":446,"dataGaLocation":754},{"text":822,"config":889},{"href":890,"dataGaName":825,"dataGaLocation":754},"/solutions/gitops/",{"text":892,"config":893},"Software composition analysis",{"href":371,"dataGaName":894,"dataGaLocation":754},"software composition analysis",{"text":896,"config":897},"Value stream management",{"href":389,"dataGaName":898,"dataGaLocation":754},"value stream management",{"text":900,"config":901},"All solutions",{"href":409,"dataGaName":902,"dataGaLocation":754},"all solutions",{"title":495,"links":904},[905,910,915,917,919,921,923,925,927,929,931,933,935,937,940],{"text":906,"config":907},"Install",{"href":908,"dataGaName":909,"dataGaLocation":754},"/install/","install",{"text":911,"config":912},"Quick start guides",{"href":913,"dataGaName":914,"dataGaLocation":754},"/get-started/","quick setup checklists",{"text":508,"config":916},{"href":510,"dataGaName":511,"dataGaLocation":754},{"text":513,"config":918},{"href":515,"dataGaName":516,"dataGaLocation":754},{"text":518,"config":920},{"href":520,"dataGaName":521,"dataGaLocation":754},{"text":523,"config":922},{"href":525,"dataGaName":526,"dataGaLocation":754},{"text":528,"config":924},{"href":530,"dataGaName":531,"dataGaLocation":754},{"text":541,"config":926},{"href":543,"dataGaName":544,"dataGaLocation":754},{"text":546,"config":928},{"href":548,"dataGaName":549,"dataGaLocation":754},{"text":551,"config":930},{"href":553,"dataGaName":554,"dataGaLocation":754},{"text":556,"config":932},{"href":558,"dataGaName":559,"dataGaLocation":754},{"text":561,"config":934},{"href":563,"dataGaName":564,"dataGaLocation":754},{"text":624,"config":936},{"href":626,"dataGaName":627,"dataGaLocation":754},{"text":938,"config":939},"What's new",{"href":572,"dataGaName":573,"dataGaLocation":754},{"text":941,"config":942},"All resources",{"href":502,"dataGaName":943,"dataGaLocation":754},"all resources",{"title":575,"links":945},[946,948,950,952,954,956,958,960,962,966,971],{"text":583,"config":947},{"href":585,"dataGaName":577,"dataGaLocation":754},{"text":588,"config":949},{"href":590,"dataGaName":591,"dataGaLocation":754},{"text":594,"config":951},{"href":596,"dataGaName":597,"dataGaLocation":754},{"text":599,"config":953},{"href":601,"dataGaName":602,"dataGaLocation":754},{"text":604,"config":955},{"href":606,"dataGaName":607,"dataGaLocation":754},{"text":609,"config":957},{"href":611,"dataGaName":612,"dataGaLocation":754},{"text":614,"config":959},{"href":616,"dataGaName":617,"dataGaLocation":754},{"text":619,"config":961},{"href":621,"dataGaName":622,"dataGaLocation":754},{"text":963,"config":964},"Sustainability",{"href":965,"dataGaName":963,"dataGaLocation":754},"/sustainability/",{"text":967,"config":968},"Diversity, inclusion and belonging (DIB)",{"href":969,"dataGaName":970,"dataGaLocation":754},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":972,"config":973},"Modern Slavery Transparency Statement",{"href":974,"dataGaName":975,"dataGaLocation":754},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":977},[978,981,984],{"text":979,"config":980},"Terms",{"href":784,"dataGaName":785,"dataGaLocation":754},{"text":982,"config":983},"Cookies",{"dataGaName":794,"dataGaLocation":754,"id":795,"isOneTrustButton":281},{"text":985,"config":986},"Privacy",{"href":789,"dataGaName":790,"dataGaLocation":754},[988],{"id":989,"title":7,"body":277,"config":990,"content":992,"description":277,"extension":995,"meta":996,"navigation":281,"path":997,"seo":998,"stem":999,"__hash__":1000},"blogAuthors/en-us/blog/authors/rebecca-carter.yml",{"template":991},"BlogAuthor",{"name":7,"config":993},{"headshot":994},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1771439187/akva6hmo8z5qrd1fhrzp.jpg","yml",{},"/en-us/blog/authors/rebecca-carter",{},"en-us/blog/authors/rebecca-carter","cIftCmya7qHrmJaiagb4Rk48mtLKd0x2Ye5Ogpl_818",[1002,1010,1018],{"title":1003,"description":1004,"heroImage":1005,"category":273,"date":1006,"authors":1007,"slug":1009,"externalUrl":277},"What happens when vulnerabilities are discovered faster than you can fix them?","Frontier AI is changing how quickly vulnerabilities can be discovered and exploited. The next challenge is bringing that same speed to remediation and prevention, inside the software factory.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1772195014/ooezwusxjl1f7ijfmbvj.png","2026-10-28",[1008],"Bill Staples","security-at-machine-speed",{"title":1011,"description":1012,"heroImage":1013,"category":273,"date":1014,"authors":1015,"slug":1017,"externalUrl":277},"Uncover the business logic vulnerabilities SAST scanners miss","Now in early access, Business Logic Security Analyzer reads your repository, infers what each endpoint should enforce, and flags the gaps.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-10-20",[1016],"Chris Widstrom","gitlab-business-logic-security-analyzer",{"title":1019,"description":1020,"heroImage":1021,"category":273,"date":1014,"authors":1022,"slug":1024,"externalUrl":277},"AI Governance: One view of agent activity","See AI agent activity in one place with the GitLab AI Governance Dashboard, across Duo Agent Platform and the externally connected agents your developers use.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1773860699/gf9bdnis6ggrn4huvfrl.png",[1023],"Alisa Ho","ai-governance-dashboard",{"header":1026,"text":1027,"button":1031,"disclaimer":1034},"Start your free\n\n30-day GitLab trial\n",[1028,1029,1030],"GitLab Duo Agent Platform access","Try our most advanced features","Automate complex tasks with AI",{"text":301,"config":1032},{"href":1033,"dataGaName":304,"dataGaLocation":544},"https://gitlab.com/-/trials/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/blog/","No credit card required.",{"header":1036,"blurb":1037,"button":1038,"secondaryButton":1043},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1039,"config":1040},"Get your free trial",{"href":1041,"dataGaName":304,"dataGaLocation":1042},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":770,"config":1044},{"href":638,"dataGaName":309,"dataGaLocation":1042},1793305748788]