[{"data":1,"prerenderedAt":982},["ShallowReactive",2],{"/blog/security-at-machine-speed":3,"navigation-en-us":230,"banner-en-us":667,"footer-en-us":675,"blog-post-authors-en-us-Bill Staples":923,"blog-related-posts-en-us-security-at-machine-speed":938,"blog-share-wrapper-en-us":962,"next-steps-en-us":972},{"id":4,"title":5,"authors":6,"body":8,"category":210,"date":211,"description":212,"extension":213,"externalUrl":214,"faq":214,"featured":215,"heroImage":216,"hidePromo":217,"meta":218,"navigation":215,"path":219,"seo":220,"slug":224,"stem":225,"tags":226,"template":228,"updatedDate":214,"__hash__":229},"blogPosts/en-us/blog/security-at-machine-speed.md","What happens when vulnerabilities are discovered faster than you can fix them?",[7],"Bill Staples",{"type":9,"value":10,"toc":201},"minimark",[11,15,18,21,28,43,48,51,54,57,63,67,70,73,76,85,94,97,100,105,109,112,115,124,127,132,136,139,142,145,148,157,166,171,175,178,181,184,187,192],[12,13,14],"p",{},"We're entering a new era of application security. Frontier AI models are uncovering complex flaws that traditional tools overlooked, and attackers are using the same models to exploit them faster. Remediation isn't keeping pace: Verizon's 2026 Data Breach Investigations Report (DBIR) measures the median time to fully remediate a known-exploited vulnerability at 43 days, up from 32 in 2025.",[12,16,17],{},"Security teams are already stretched across growing application portfolios, third-party dependencies, and a steady stream of new disclosures. And while agents that find vulnerabilities and write fixes are becoming more accessible, integrating them into how enterprises actually build and ship software remains difficult.",[12,19,20],{},"A generated patch still needs to be tested. Security policies need to be enforced. Changes need to be reviewed and approved. And eventually, the fix needs to reach production safely.",[12,22,23,27],{},[24,25,26],"strong",{},"This is where I believe the next major shift in application security will happen."," We need to put autonomous agents to work inside the software factory. That's why we've brought Anthropic's Claude Mythos 5.1 into GitLab, and why we're connecting discovery, remediation, and prevention in one trusted workflow.",[29,30,33,34],"figure",{"className":31},[32],"video_container","\n  ",[35,36],"iframe",{"src":37,"frameBorder":38,"allow":39,"referrerPolicy":40,"style":41,"title":42},"https://player.vimeo.com/video/1240417071?badge=0&autopause=0&player_id=0&app_id=58479","0","autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share","strict-origin-when-cross-origin","position:absolute;top:0;left:0;width:100%;height:100%;","GL_PHP Bill Video short_102826_v5_1",[44,45,47],"h2",{"id":46},"when-critical-vulnerabilities-emerge-the-clock-starts-ticking","When critical vulnerabilities emerge, the clock starts ticking",[12,49,50],{},"Critical vulnerabilities like PHP2Shell send security teams scrambling to understand exposure. For a large organization, that means assessing impact across hundreds or thousands of repositories, applications, and dependencies.",[12,52,53],{},"Identifying exposure is only the first step. Teams then need to assess exploitability, prioritize affected applications, coordinate fixes, run tests, and get changes into production. Every handoff takes time, and speed is vital: 31% of breaches now start with vulnerability exploitation, the top initial access vector for the first time in the DBIR's 19 years.",[12,55,56],{},"As more critical vulnerabilities emerge, the traditional model of manually investigating findings, assigning tickets, and waiting for developers to write fixes becomes harder to sustain.",[12,58,59,62],{},[24,60,61],{},"The time between vulnerability discovery and verified remediation needs to shrink dramatically."," That requires security workflows capable of operating at machine speed, while preserving the controls organizations depend on to ship reliable software.",[44,64,66],{"id":65},"bring-agentic-remediation-into-the-software-factory","Bring agentic remediation into the software factory",[12,68,69],{},"AI agents can do impressive work in vulnerability discovery and remediation. The challenge is making that work reliable and repeatable across an enterprise.",[12,71,72],{},"An agent can generate a patch in seconds. Whether it understood the application, whether it validated the change against the real build, and whether it followed your security policies are separate questions. They get harder to answer, and more expensive to get wrong, as you deploy agents across thousands of projects.",[12,74,75],{},"At GitLab, we're bringing agentic security workflows into the environment where teams develop, test, and ship software.",[12,77,78,79,84],{},"Everything an agent does rests on how well it understands your system, and that understanding extends beyond the repository. ",[80,81,83],"a",{"href":82},"/blog/find-vulnerability-blast-radius-with-gitlab-orbit/","GitLab Orbit",", a live context graph of your software lifecycle, connects findings to the changes that introduced them, the pipelines that shipped them, and the teams who own the fix. It's also how you answer the questions that follow a disclosure like PHP2Shell: Are we exposed? Is it reachable? How far does it spread, and how do we fix it without breaking production?",[12,86,87,88,93],{},"GitLab Duo Agent Platform ",[80,89,92],{"href":90,"rel":91},"https://about.gitlab.com/blog/gitlab-scales-remediation/",[],"investigates findings"," in the context of your software and how it's built, filtering out likely false positives and prioritizing by exploitability and reachability.",[12,95,96],{},"For the findings that matter, Duo writes a fix and puts it through your pipeline to check for regressions and rerun security scans. In a single merge request, developers review the change, Duo's explanation, and the pipeline results.",[12,98,99],{},"Security teams move from understanding exposure to initiating remediation in one pass, and developers shift from chasing findings to reviewing fixes. Because these workflows run inside the software factory, agents operate within the same processes and controls that organizations already use to deliver software.",[12,101,102],{},[24,103,104],{},"That's how we turn agentic security from an isolated capability into something an enterprise can trust and operate across thousands of projects, at machine speed.",[44,106,108],{"id":107},"put-frontier-ai-to-work-on-the-most-critical-vulnerabilities","Put frontier AI to work on the most critical vulnerabilities",[12,110,111],{},"Some of the most dangerous application vulnerabilities require a deep understanding of how software is intended to work: missing authorization checks, broken ownership logic, and business logic flaws that expose customer data or let users take actions they shouldn't.",[12,113,114],{},"Traditional scanners struggle with these issues because finding them requires reasoning about the application's behavior and the relationships between components.",[12,116,117,118,123],{},"Our new ",[80,119,122],{"href":120,"rel":121},"https://about.gitlab.com/blog/gitlab-business-logic-security-analyzer/",[],"Business Logic Security Analyzer",", the first GitLab capability to support Anthropic's Claude Mythos 5.1, examines how your application enforces its rules: it reads the whole repository and incoming merge requests, infers what each endpoint should enforce, and flags the gaps that pattern-based scanners often miss.",[12,125,126],{},"But the real opportunity comes from connecting those discoveries to the workflows teams already use. When a critical flaw is found, teams need to understand its impact, initiate remediation, validate the proposed fix, and ship it safely. Integrating frontier AI into the software factory creates a path to run that entire process at machine speed.",[12,128,129],{},[24,130,131],{},"The intelligence of the model is only as valuable as your ability to act on it.",[44,133,135],{"id":134},"prevent-risky-code-from-reaching-production","Prevent risky code from reaching production",[12,137,138],{},"Finding vulnerabilities earlier is valuable, and keeping vulnerable code and unsafe packages out of production altogether is even better. These protections become even more important as agents gain autonomy.",[12,140,141],{},"Security controls need to be embedded throughout the software factory and enforced independently of the people and agents making changes, with every change clearing the same gates before it moves forward.",[12,143,144],{},"GitLab Ultimate brings static analysis, dependency and container scanning, secret detection, policy enforcement, and approval gates directly into the software delivery process. Those policies are set centrally and apply consistently across projects and pipelines, so the author of a change, human or agent, cannot change or waive the controls evaluating its work.",[12,146,147],{},"The same scrutiny needs to extend to third-party software. Modern applications rely heavily on open source dependencies, and a vulnerable or malicious package can introduce serious risk before developers write a single line of code.",[12,149,150,151,156],{},"GitLab's Dependency Firewall blocks policy-violating packages before they enter your build. ",[80,152,155],{"href":153,"rel":154},"https://about.gitlab.com/blog/secrets-manager-ga/",[],"GitLab Secrets Manager"," lets each job access only the credentials it requests and is authorized to use, so a compromised dependency can reach only the secrets of the job it runs in.",[12,158,159,160,165],{},"Agents need the freedom to work quickly, within boundaries they can't cross. GitLab Duo Agent Platform gives each agent a composite identity that limits it to the permissions it shares with the requesting user, a sandbox that's destroyed when the task ends, and a record of every action. These boundaries are part of the ",[80,161,164],{"href":162,"rel":163},"https://about.gitlab.com/gitlab-security-standard/",[],"GitLab Security Standard",", under which agents earn more autonomy only as the controls at each stage are proven to hold.",[12,167,168],{},[24,169,170],{},"The controls that make a change trustworthy need to hold at every step, even when the work happens at machine speed.",[44,172,174],{"id":173},"the-next-chapter-of-security-will-be-defined-by-trusted-execution","The next chapter of security will be defined by trusted execution",[12,176,177],{},"Frontier models will keep improving, security agents will get more capable, and vulnerabilities that were once difficult to discover will become easier to find. That progress will put enormous pressure on how organizations respond.",[12,179,180],{},"A security team can deploy the most advanced models available, but its ability to reduce risk will still depend on how quickly and safely it can turn findings into production-ready fixes.",[12,182,183],{},"This is why the software factory matters. It's where agents get the context needed to understand applications, where changes are validated against real builds and tests, where security policies are enforced, and where human oversight applies without slowing every step of the process.",[12,185,186],{},"At GitLab, we're bringing these capabilities together so you can automate remediation, uncover complex flaws, and prevent unsafe changes from shipping, all inside the workflows you already use.",[12,188,189],{},[24,190,191],{},"The next security advantage will come from how quickly organizations can turn a critical discovery into a verified, trusted fix.",[12,193,194,195,200],{},"We invite you to run your next security sprint on us. Qualifying teams can request access to GitLab Ultimate, GitLab Duo Agent Platform, GitLab Orbit, and GitLab Secrets Manager, with free credits. ",[80,196,199],{"href":197,"rel":198},"https://about.gitlab.com/security-at-machine-speed/",[],"Request access to the security sprint offer",".",{"title":202,"searchDepth":203,"depth":203,"links":204},"",2,[205,206,207,208,209],{"id":46,"depth":203,"text":47},{"id":65,"depth":203,"text":66},{"id":107,"depth":203,"text":108},{"id":134,"depth":203,"text":135},{"id":173,"depth":203,"text":174},"security","2026-10-28","Frontier AI is changing how quickly vulnerabilities can be discovered and exploited. The next challenge is bringing that same speed to remediation and prevention, inside the software factory.","md",null,true,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772195014/ooezwusxjl1f7ijfmbvj.png",false,{},"/en-us/blog/security-at-machine-speed",{"config":221,"title":222,"description":223,"ogDescription":223,"ogTitle":222},{"noIndex":217},"Security at machine speed. Control at every step.","AI is changing how quickly vulnerabilities can be discovered and exploited. The next challenge is bringing that same speed to remediation and prevention","security-at-machine-speed","en-us/blog/security-at-machine-speed",[227,210],"AI","BlogPost","xCuefsb6AoDy_pfWo1CDhl-y7GomaD9M-xdGOp-FlsE",{"logo":231,"freeTrial":236,"sales":241,"login":246,"items":251,"search":586,"minimal":618,"duo":637,"switchNav":646,"pricingDeployment":657},{"config":232},{"href":233,"dataGaName":234,"dataGaLocation":235},"/","gitlab logo","header",{"text":237,"config":238},"Get free trial",{"href":239,"dataGaName":240,"dataGaLocation":235},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":242,"config":243},"Request a demo",{"href":244,"dataGaName":245,"dataGaLocation":235},"/request-a-demo/","sales",{"text":247,"config":248},"Sign in",{"href":249,"dataGaName":250,"dataGaLocation":235},"https://gitlab.com/users/sign_in/","sign in",[252,338,425,430,510,564],{"text":253,"left":215,"config":254,"menu":256},"Platform",{"dataNavLevelOne":255},"platform",{"type":257,"link":258,"columns":262,"feature":327},"lists",{"text":259,"config":260},"Explore the Platform",{"href":261,"dataGaName":255,"dataGaLocation":235},"/platform/",[263,286,309],{"title":264,"items":265},"Execution & Workflows",[266,271,276,281],{"text":267,"config":268},"CI/CD",{"href":269,"dataGaLocation":235,"dataGaName":270},"/solutions/continuous-integration/","ci/cd",{"text":272,"config":273},"Source Code Management",{"href":274,"dataGaLocation":235,"dataGaName":275},"/solutions/source-code-management/","source code management",{"text":277,"config":278},"Agile Delivery",{"href":279,"dataGaLocation":235,"dataGaName":280},"/solutions/agile-delivery/","agile delivery",{"text":282,"config":283},"Artifact Management",{"href":284,"dataGaLocation":235,"dataGaName":285},"/artifact-central/","artifact management",{"title":287,"items":288},"Security & Governance",[289,294,299,304],{"text":290,"config":291},"Application Security Testing",{"href":292,"dataGaLocation":235,"dataGaName":293},"/solutions/application-security-testing/","application security testing",{"text":295,"config":296},"Governance & Compliance",{"href":297,"dataGaLocation":235,"dataGaName":298},"/solutions/software-compliance/","governance and compliance",{"text":300,"config":301},"Secrets Management",{"href":302,"dataGaLocation":235,"dataGaName":303},"/gitlab-secrets-manager/","secrets management",{"text":305,"config":306},"Supply Chain Security",{"href":307,"dataGaLocation":235,"dataGaName":308},"/solutions/supply-chain/","supply chain security",{"title":310,"items":311},"Context & AI",[312,317,322],{"text":313,"config":314},"Duo Agent Platform",{"href":315,"dataGaLocation":235,"dataGaName":316},"/gitlab-duo-agent-platform/","duo agent platform",{"text":318,"config":319},"Orbit",{"href":320,"dataGaLocation":235,"dataGaName":321},"/gitlab-orbit/","orbit",{"text":323,"config":324},"Visibility & Measurement",{"href":325,"dataGaLocation":235,"dataGaName":326},"/solutions/visibility-measurement/","visibility and measurement",{"config":328,"title":331,"text":332,"link":333},{"background":329,"textColor":330},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1790185102/o7dn32anqcb6z8dgd3as.jpg')","#000","GitLab Orbit is generally available","Higher agent accuracy, lower token cost",{"text":334,"config":335},"Read the announcement",{"href":336,"dataGaName":337,"dataGaLocation":235},"/blog/gitlab-orbit-ga/","orbit ga announcement",{"text":339,"left":215,"config":340,"menu":342},"Solutions",{"dataNavLevelOne":341},"solutions",{"type":257,"link":343,"columns":347,"feature":417},{"text":344,"config":345},"View all Solutions",{"href":346,"dataGaName":341,"dataGaLocation":235},"/solutions/",[348,366,384],{"title":349,"items":350},"Outcomes",[351,356,361],{"text":352,"config":353},"DevOps Modernization",{"href":354,"dataGaLocation":235,"dataGaName":355},"/assessments/devops-modernization-assessment/","devops modernization",{"text":357,"config":358},"Security Modernization",{"href":359,"dataGaLocation":235,"dataGaName":360},"/assessments/security-modernization-assessment/","security modernization",{"text":362,"config":363},"AI Modernization",{"href":364,"dataGaLocation":235,"dataGaName":365},"/assessments/ai-modernization-assessment/","ai modernization",{"title":367,"items":368},"By size",[369,374,379],{"text":370,"config":371},"Enterprise",{"href":372,"dataGaLocation":235,"dataGaName":373},"/enterprise/","enterprise",{"text":375,"config":376},"Small Business",{"href":377,"dataGaLocation":235,"dataGaName":378},"/small-business/","small business",{"text":380,"config":381},"Startups",{"href":382,"dataGaLocation":235,"dataGaName":383},"/solutions/startups/","startups",{"title":385,"items":386},"Industries",[387,392,397,402,407,412],{"text":388,"config":389},"Financial Services",{"href":390,"dataGaLocation":235,"dataGaName":391},"/solutions/finance/","financial services",{"text":393,"config":394},"Public Sector",{"href":395,"dataGaLocation":235,"dataGaName":396},"/solutions/public-sector/","public sector",{"text":398,"config":399},"Telecommunications",{"href":400,"dataGaLocation":235,"dataGaName":401},"/solutions/telecommunications/","telecommunications",{"text":403,"config":404},"Automotive",{"href":405,"dataGaLocation":235,"dataGaName":406},"/solutions/automotive/","automotive",{"text":408,"config":409},"Education",{"href":410,"dataGaLocation":235,"dataGaName":411},"/solutions/education/","education",{"text":413,"config":414},"Aerospace",{"href":415,"dataGaLocation":235,"dataGaName":416},"/solutions/aerospace/","aerospace",{"config":418,"title":164,"text":419,"link":420},{"background":329,"textColor":330},"Learn how to harden your software factory and let AI agents earn autonomy, without trading away security.",{"text":421,"config":422},"Explore the standard",{"href":423,"dataGaName":424,"dataGaLocation":235},"/gitlab-security-standard/","gitlab security standard",{"text":426,"config":427},"Pricing",{"href":428,"dataGaName":429,"dataGaLocation":235,"dataNavLevelOne":429},"/pricing/","pricing",{"text":431,"config":432,"menu":434},"Resources",{"dataNavLevelOne":433},"resources",{"type":257,"link":435,"columns":439,"feature":501},{"text":436,"config":437},"View all resources",{"href":438,"dataGaName":433,"dataGaLocation":235},"/resources/",[440,473],{"title":441,"items":442},"Discover",[443,448,453,458,463,468],{"text":444,"config":445},"Docs",{"href":446,"dataGaName":447,"dataGaLocation":235},"https://docs.gitlab.com/","docs",{"text":449,"config":450},"University",{"href":451,"dataGaName":452,"dataGaLocation":235},"https://university.gitlab.com/","university",{"text":454,"config":455},"Demo Series",{"href":456,"dataGaName":457,"dataGaLocation":235},"/gitlab-technical-demo-series/","demo series",{"text":459,"config":460},"Demo Hub",{"href":461,"dataGaName":462,"dataGaLocation":235},"/demo-hub/","demo hub",{"text":464,"config":465},"Services",{"href":466,"dataGaName":467,"dataGaLocation":235},"/services/","services",{"text":469,"config":470},"Well Architected",{"href":471,"dataGaName":472,"dataGaLocation":235},"/resources/well-architected/","well architected",{"title":474,"items":475},"Connect",[476,481,486,491,496],{"text":477,"config":478},"Blog",{"href":479,"dataGaName":480,"dataGaLocation":235},"/blog/","blog",{"text":482,"config":483},"Community",{"href":484,"dataGaName":485,"dataGaLocation":235},"/community/","community",{"text":487,"config":488},"Customers",{"href":489,"dataGaName":490,"dataGaLocation":235},"/customers/","customers",{"text":492,"config":493},"Partners",{"href":494,"dataGaName":495,"dataGaLocation":235},"/partners/","partners",{"text":497,"config":498},"Events",{"href":499,"dataGaName":500,"dataGaLocation":235},"/events/","events",{"config":502,"title":503,"text":504,"link":505},{"background":329,"textColor":330},"What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":506,"config":507},"Read the latest",{"href":508,"dataGaName":509,"dataGaLocation":235},"/whats-new/","whats new",{"text":511,"config":512,"menu":514},"Company",{"dataNavLevelOne":513},"company",{"type":257,"columns":515},[516],{"items":517},[518,523,529,534,539,544,549,554,559],{"text":519,"config":520},"About",{"href":521,"dataGaName":522,"dataGaLocation":235},"/company/","about",{"text":524,"config":525,"footerGa":528},"Jobs",{"href":526,"dataGaName":527,"dataGaLocation":235},"/jobs/","jobs",{"dataGaName":527},{"text":530,"config":531},"Press",{"href":532,"dataGaName":533,"dataGaLocation":235},"/press/","press",{"text":535,"config":536},"Handbook",{"href":537,"dataGaName":538,"dataGaLocation":235},"https://handbook.gitlab.com/","handbook",{"text":540,"config":541},"Leadership",{"href":542,"dataGaName":543,"dataGaLocation":235},"/company/team/e-group/","leadership",{"text":545,"config":546},"Investor relations",{"href":547,"dataGaName":548,"dataGaLocation":235},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":550,"config":551},"Trust Center",{"href":552,"dataGaName":553,"dataGaLocation":235},"/security/","trust center",{"text":555,"config":556},"AI Transparency Center",{"href":557,"dataGaName":558,"dataGaLocation":235},"/ai-transparency-center/","ai transparency center",{"text":560,"config":561},"Newsletter",{"href":562,"dataGaName":563,"dataGaLocation":235},"/company/contact/#contact-forms","newsletter",{"text":565,"config":566,"menu":567},"Contact us",{"dataNavLevelOne":513},{"type":257,"columns":568},[569],{"items":570},[571,576,581],{"text":572,"config":573},"Talk to sales",{"href":574,"dataGaName":575,"dataGaLocation":235},"/sales/","talk to sales",{"text":577,"config":578},"Support portal",{"href":579,"dataGaName":580,"dataGaLocation":235},"https://support.gitlab.com/hc/en-us","support portal",{"text":582,"config":583},"Customer portal",{"href":584,"dataGaName":585,"dataGaLocation":235},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":587,"login":588,"suggestions":595},"Close",{"text":589,"link":590},"To search repositories and projects, login to",{"text":591,"config":592},"gitlab.com",{"href":249,"dataGaName":593,"dataGaLocation":594},"search login","search",{"text":596,"default":597},"Suggestions",[598,601,604,606,610,614],{"text":599,"config":600},"GitLab Duo Agent Platform",{"href":315,"dataGaName":599,"dataGaLocation":594},{"text":602,"config":603},"Code Suggestions (AI)",{"href":315,"dataGaName":602,"dataGaLocation":594},{"text":267,"config":605},{"href":269,"dataGaName":267,"dataGaLocation":594},{"text":607,"config":608},"GitLab on AWS",{"href":609,"dataGaName":607,"dataGaLocation":594},"/partners/technology-partners/aws/",{"text":611,"config":612},"GitLab on Google Cloud",{"href":613,"dataGaName":611,"dataGaLocation":594},"/partners/technology-partners/google-cloud-platform/",{"text":615,"config":616},"Why GitLab?",{"href":617,"dataGaName":615,"dataGaLocation":594},"/why-gitlab/",{"freeTrial":619,"mobileIcon":624,"desktopIcon":629,"secondaryButton":632},{"text":620,"config":621},"Start free trial",{"href":622,"dataGaName":240,"dataGaLocation":623},"https://gitlab.com/-/trials/new/","nav",{"altText":625,"config":626},"Gitlab Icon",{"src":627,"dataGaName":628,"dataGaLocation":623},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":625,"config":630},{"src":631,"dataGaName":628,"dataGaLocation":623},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":633,"config":634},"Get Started",{"href":635,"dataGaName":636,"dataGaLocation":623},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":638,"mobileIcon":642,"desktopIcon":644},{"text":639,"config":640},"Learn more about GitLab Duo",{"href":315,"dataGaName":641,"dataGaLocation":623},"gitlab duo",{"altText":625,"config":643},{"src":627,"dataGaName":628,"dataGaLocation":623},{"altText":625,"config":645},{"src":631,"dataGaName":628,"dataGaLocation":623},{"button":647,"mobileIcon":652,"desktopIcon":654},{"text":648,"config":649},"/switch",{"href":650,"dataGaName":651,"dataGaLocation":623},"#contact","switch",{"altText":625,"config":653},{"src":627,"dataGaName":628,"dataGaLocation":623},{"altText":625,"config":655},{"src":656,"dataGaName":628,"dataGaLocation":623},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":658,"mobileIcon":663,"desktopIcon":665},{"text":659,"config":660},"Back to pricing",{"href":428,"dataGaName":661,"dataGaLocation":623,"icon":662},"back to pricing","GoBack",{"altText":625,"config":664},{"src":627,"dataGaName":628,"dataGaLocation":623},{"altText":625,"config":666},{"src":631,"dataGaName":628,"dataGaLocation":623},{"title":668,"button":669,"config":673},"GitLab Orbit is generally available. Increase agent accuracy and lower token cost",{"text":334,"config":670},{"href":336,"dataGaName":671,"dataGaLocation":672},"orbit-ga-banner","global-banner",{"layout":674,"disabled":217},"release",{"data":676},{"text":677,"config":678,"items":683,"minimal":912},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"twitter":679,"facebook":680,"youtube":681,"linkedin":682},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[684,732,792,839,880],{"title":426,"links":685,"subMenu":701},[686,691,696],{"text":687,"config":688},"View plans",{"href":428,"dataGaName":689,"dataGaLocation":690},"view plans","footer",{"text":692,"config":693},"Why Premium?",{"href":694,"dataGaName":695,"dataGaLocation":690},"/pricing/premium/","why premium",{"text":697,"config":698},"Why Ultimate?",{"href":699,"dataGaName":700,"dataGaLocation":690},"/pricing/ultimate/","why ultimate",[702],{"title":703,"links":704},"Contact Us",[705,708,710,712,717,722,727],{"text":706,"config":707},"Contact sales",{"href":574,"dataGaName":245,"dataGaLocation":690},{"text":577,"config":709},{"href":579,"dataGaName":580,"dataGaLocation":690},{"text":582,"config":711},{"href":584,"dataGaName":585,"dataGaLocation":690},{"text":713,"config":714},"Status",{"href":715,"dataGaName":716,"dataGaLocation":690},"https://status.gitlab.com/","status",{"text":718,"config":719},"Terms of use",{"href":720,"dataGaName":721,"dataGaLocation":690},"/terms/","terms of use",{"text":723,"config":724},"Privacy statement",{"href":725,"dataGaName":726,"dataGaLocation":690},"/privacy/","privacy statement",{"text":728,"config":729},"Cookie preferences",{"dataGaName":730,"dataGaLocation":690,"id":731,"isOneTrustButton":215},"cookie preferences","ot-sdk-btn",{"title":253,"links":733,"subMenu":749},[734,737,739,741,743,745],{"text":735,"config":736},"Explore the platform",{"href":261,"dataGaName":255,"dataGaLocation":690},{"text":313,"config":738},{"href":315,"dataGaName":316,"dataGaLocation":690},{"text":267,"config":740},{"href":269,"dataGaName":270,"dataGaLocation":690},{"text":318,"config":742},{"href":320,"dataGaName":321,"dataGaLocation":690},{"text":300,"config":744},{"href":302,"dataGaName":303,"dataGaLocation":690},{"text":746,"config":747},"Why GitLab",{"href":617,"dataGaName":748,"dataGaLocation":690},"why gitlab",[750],{"title":751,"links":752},"Topics",[753,757,762,767,772,777,782,787],{"text":267,"config":754},{"href":755,"dataGaName":756,"dataGaLocation":690},"/topics/ci-cd/","cicd",{"text":758,"config":759},"GitOps",{"href":760,"dataGaName":761,"dataGaLocation":690},"/topics/gitops/","gitops",{"text":763,"config":764},"DevOps",{"href":765,"dataGaName":766,"dataGaLocation":690},"/topics/devops/","devops",{"text":768,"config":769},"Version Control",{"href":770,"dataGaName":771,"dataGaLocation":690},"/topics/version-control/","version control",{"text":773,"config":774},"DevSecOps",{"href":775,"dataGaName":776,"dataGaLocation":690},"/topics/devsecops/","devsecops",{"text":778,"config":779},"Cloud Native",{"href":780,"dataGaName":781,"dataGaLocation":690},"/topics/cloud-native/","cloud native",{"text":783,"config":784},"AI for Coding",{"href":785,"dataGaName":786,"dataGaLocation":690},"/topics/devops/ai-for-coding/","ai for coding",{"text":788,"config":789},"Agentic AI",{"href":790,"dataGaName":791,"dataGaLocation":690},"/topics/agentic-ai/","agentic ai",{"title":339,"links":793},[794,797,800,803,806,809,811,813,815,817,819,822,824,827,831,835],{"text":795,"config":796},"DevOps modernization",{"href":354,"dataGaName":355,"dataGaLocation":690},{"text":798,"config":799},"Security modernization",{"href":359,"dataGaName":360,"dataGaLocation":690},{"text":801,"config":802},"AI modernization",{"href":364,"dataGaName":365,"dataGaLocation":690},{"text":804,"config":805},"Financial services",{"href":390,"dataGaName":391,"dataGaLocation":690},{"text":807,"config":808},"Public sector",{"href":395,"dataGaName":396,"dataGaLocation":690},{"text":398,"config":810},{"href":400,"dataGaName":401,"dataGaLocation":690},{"text":403,"config":812},{"href":405,"dataGaName":406,"dataGaLocation":690},{"text":408,"config":814},{"href":410,"dataGaName":411,"dataGaLocation":690},{"text":413,"config":816},{"href":415,"dataGaName":416,"dataGaLocation":690},{"text":370,"config":818},{"href":372,"dataGaName":373,"dataGaLocation":690},{"text":820,"config":821},"Small business",{"href":377,"dataGaName":378,"dataGaLocation":690},{"text":380,"config":823},{"href":382,"dataGaName":383,"dataGaLocation":690},{"text":758,"config":825},{"href":826,"dataGaName":761,"dataGaLocation":690},"/solutions/gitops/",{"text":828,"config":829},"Software composition analysis",{"href":307,"dataGaName":830,"dataGaLocation":690},"software composition analysis",{"text":832,"config":833},"Value stream management",{"href":325,"dataGaName":834,"dataGaLocation":690},"value stream management",{"text":836,"config":837},"All solutions",{"href":346,"dataGaName":838,"dataGaLocation":690},"all solutions",{"title":431,"links":840},[841,846,851,853,855,857,859,861,863,865,867,869,871,873,876],{"text":842,"config":843},"Install",{"href":844,"dataGaName":845,"dataGaLocation":690},"/install/","install",{"text":847,"config":848},"Quick start guides",{"href":849,"dataGaName":850,"dataGaLocation":690},"/get-started/","quick setup checklists",{"text":444,"config":852},{"href":446,"dataGaName":447,"dataGaLocation":690},{"text":449,"config":854},{"href":451,"dataGaName":452,"dataGaLocation":690},{"text":454,"config":856},{"href":456,"dataGaName":457,"dataGaLocation":690},{"text":459,"config":858},{"href":461,"dataGaName":462,"dataGaLocation":690},{"text":464,"config":860},{"href":466,"dataGaName":467,"dataGaLocation":690},{"text":477,"config":862},{"href":479,"dataGaName":480,"dataGaLocation":690},{"text":482,"config":864},{"href":484,"dataGaName":485,"dataGaLocation":690},{"text":487,"config":866},{"href":489,"dataGaName":490,"dataGaLocation":690},{"text":492,"config":868},{"href":494,"dataGaName":495,"dataGaLocation":690},{"text":497,"config":870},{"href":499,"dataGaName":500,"dataGaLocation":690},{"text":560,"config":872},{"href":562,"dataGaName":563,"dataGaLocation":690},{"text":874,"config":875},"What's new",{"href":508,"dataGaName":509,"dataGaLocation":690},{"text":877,"config":878},"All resources",{"href":438,"dataGaName":879,"dataGaLocation":690},"all resources",{"title":511,"links":881},[882,884,886,888,890,892,894,896,898,902,907],{"text":519,"config":883},{"href":521,"dataGaName":513,"dataGaLocation":690},{"text":524,"config":885},{"href":526,"dataGaName":527,"dataGaLocation":690},{"text":530,"config":887},{"href":532,"dataGaName":533,"dataGaLocation":690},{"text":535,"config":889},{"href":537,"dataGaName":538,"dataGaLocation":690},{"text":540,"config":891},{"href":542,"dataGaName":543,"dataGaLocation":690},{"text":545,"config":893},{"href":547,"dataGaName":548,"dataGaLocation":690},{"text":550,"config":895},{"href":552,"dataGaName":553,"dataGaLocation":690},{"text":555,"config":897},{"href":557,"dataGaName":558,"dataGaLocation":690},{"text":899,"config":900},"Sustainability",{"href":901,"dataGaName":899,"dataGaLocation":690},"/sustainability/",{"text":903,"config":904},"Diversity, inclusion and belonging (DIB)",{"href":905,"dataGaName":906,"dataGaLocation":690},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":908,"config":909},"Modern Slavery Transparency Statement",{"href":910,"dataGaName":911,"dataGaLocation":690},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":913},[914,917,920],{"text":915,"config":916},"Terms",{"href":720,"dataGaName":721,"dataGaLocation":690},{"text":918,"config":919},"Cookies",{"dataGaName":730,"dataGaLocation":690,"id":731,"isOneTrustButton":215},{"text":921,"config":922},"Privacy",{"href":725,"dataGaName":726,"dataGaLocation":690},[924],{"id":925,"title":7,"body":214,"config":926,"content":928,"description":214,"extension":932,"meta":933,"navigation":215,"path":934,"seo":935,"stem":936,"__hash__":937},"blogAuthors/en-us/blog/authors/bill-staples.yml",{"template":927},"BlogAuthor",{"name":7,"config":929,"role":931},{"headshot":930},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1750434080/glxv59lh9qftpdbsb4ph.png","CEO","yml",{},"/en-us/blog/authors/bill-staples",{},"en-us/blog/authors/bill-staples","K-ulWVa7KOFAxgiGSmeiIjz3KeQyIkhm95lIRX_r6Zc",[939,947,955],{"title":940,"description":941,"heroImage":942,"category":210,"date":943,"authors":944,"slug":946,"externalUrl":214},"GitLab Orbit: Find vulnerability blast radius without the manual hunt","Exploitation happens at machine speed now. Map every project, owner, and pipeline a critical CVE touches so remediation can keep up.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1780996524/sd1vpl8empy26wizarqj.png","2026-10-29",[945],"Rebecca Carter","find-vulnerability-blast-radius-with-gitlab-orbit",{"title":948,"description":949,"heroImage":950,"category":210,"date":951,"authors":952,"slug":954,"externalUrl":214},"Uncover the business logic vulnerabilities SAST scanners miss","Now in early access, Business Logic Security Analyzer reads your repository, infers what each endpoint should enforce, and flags the gaps.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-10-20",[953],"Chris Widstrom","gitlab-business-logic-security-analyzer",{"title":956,"description":957,"heroImage":958,"category":210,"date":951,"authors":959,"slug":961,"externalUrl":214},"AI Governance: One view of agent activity","See AI agent activity in one place with the GitLab AI Governance Dashboard, across Duo Agent Platform and the externally connected agents your developers use.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1773860699/gf9bdnis6ggrn4huvfrl.png",[960],"Alisa Ho","ai-governance-dashboard",{"header":963,"text":964,"button":968,"disclaimer":971},"Start your free\n\n30-day GitLab trial\n",[965,966,967],"GitLab Duo Agent Platform access","Try our most advanced features","Automate complex tasks with AI",{"text":237,"config":969},{"href":970,"dataGaName":240,"dataGaLocation":480},"https://gitlab.com/-/trials/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/blog/","No credit card required.",{"header":973,"blurb":974,"button":975,"secondaryButton":980},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":976,"config":977},"Get your free trial",{"href":978,"dataGaName":240,"dataGaLocation":979},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":706,"config":981},{"href":574,"dataGaName":245,"dataGaLocation":979},1793312033512]