Snyk offers security scanning of open source components and container scanning.
GitLab Ultimate offers not only these capabilities but also Static and Dynamic Application Security Testing and License Management. GitLab Ultimate automatically includes broad security scanning with every code commit including Static and Dynamic Application Security Testing, along with dependency scanning, container scanning, and license management.
| FEATURES |  |  |
|---|---|---|
| Static Application Security Testing
GitLab allows easily running Static Application Security Testing (SAST) in CI/CD pipelines; checking for vulnerable source code or well known security bugs in the libraries that are included by the application. Results are then shown in the Merge Request and in the Pipeline view. This feature is available as part of Auto DevOps to provide security-by-default. | | supports 11 languages |
| Dependency Scanning
GitLab automatically detects well known security bugs in the libraries that are included by the application, protecting your application from vulnerabilities that affect dependencies that are used dynamically. Results are then shown in the Merge Request and in the Pipeline view. This feature is available as part of Auto DevOps to provide security-by-default. | | |
| Container Scanning
When building a Docker image for your application, GitLab can run a security scan to ensure it does not have any known vulnerability in the environment where your code is shipped. Results are then shown in the Merge Request and in the Pipeline view. This feature is available as part of Auto DevOps to provide security-by-default. | | |
| Dynamic Application Security Testing
Once your application is online, GitLab allows running Dynamic Application Security Testing (DAST) in CI/CD pipelines; your application will be scanned to ensure threats like XSS or broken authentication flaws are not affecting it. Results are then shown in the Merge Request and in the Pipeline view. This feature is available as part of Auto DevOps to provide security-by-default. | | |
| Interactive Application Security Testing
IAST combines elements of static and dynamic application security testing methods to improve the overall quality of the results. IAST typically uses an agent to instrument the application to monitor library calls and more. GitLab does not yet offer this feature. | | |
| Runtime Application Security Testing
RASP uses an agent to instrument the application to monitor library calls as the application is running in production. Unlike other security tools, RASP can take action to block threats in real-time, similar to a Web Application Firewall but from within the app’s runtime environment rather than at the network layer. GitLab does not yet offer this feature. | | |
| Cloud Native Network Firewall
Cloud native network firewall provides container-level network micro segmentation which isolates container network communications to limit the “blast radius” of compromise to a specific container or microservice. A container-aware virtual firewall that utilizes machine learning to automatically identify valid traffic flows between app components in your cluster. Limits damage by preventing attackers from moving through your environment when they have already compromised one part of it. GitLab does not yet offer this feature. | | |
| License Management
Check that licenses of your dependencies are compatible with your application, and approve or blacklist them. Results are then shown in the Merge Request and in the Pipeline view. | | |
If you feel there are inaccurate statements in this comparison or a tool missing, please edit this page or propose edits by opening an issue. You can also send an email to devopstools@gitlab.com with your suggested edits if you're unable to open an issue or edit this page.
We strive for technical accuracy and will review and update this post for inaccuracies as quickly as possible.
