The following page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features or functionality remain at the sole discretion of GitLab Inc.
Driving Actionable Security Risk Management with Seamless Automation and Scalability
The Security Risk Management stage will deliver actionable insights and seamless workflows that empower Application Security (AppSec) and Development teams to rapidly assess risk through comprehensive visibility, intelligent prioritization, and automated resolution workflows across the software development lifecycle (SDLC).
The stage will own the end-to-end user journey, including:
The Security Risk Management stage is also responsible for building and maintaining the underlying infrastructure that ensures high performance, scalability, and extensibility. This infrastructure will be foundational in driving continuous innovation, while addressing scale and efficiency needs as the landscape evolves
GitLab Security Stage stands at a unique position in the application security market by offering a broad set of integrated security scanners embedded directly within developers' daily workflows. Our strength lies in consolidating security capabilities within the platform developers already use, significantly reducing the integration costs typically associated with application security solutions. With integration across all stages of the software development lifecycle and strong AI investments, we enable security to shift left while maintaining visibility throughout the entire process, making security an accessible part of development rather than a specialized discipline requiring separate tooling.
Our strategy will focus on three key areas:
The SRM stage is made up of four groups:
Security Insights - Enable application security and development teams to efficiently assess, prioritize, triage, and remediate application security risks while keeping an up-to-date, comprehensive view of their applications' structure. Core areas of focus include:
Security Platform Management - Enable application security and development teams to orchestrate and control their application security tools from within the GitLab platform, integrate seamlessly with external tools, and provide a frictionless, holistic operational experience across GitLab's suite of security offerings. Core areas of focus include:
Security Policies - Enable Application security teams to define and enforce security policies across their organization’s fleet of applications and services. Empower developers to adhere to organizational security standards within the context of their daily workflows. Support the underlying frameworks for GitLab’s security and compliance enforcement functionality. Core areas of focus include:
Security Infrastructure Group - Provide the required infrastructure and database resources to meet enterprise customer demand and required functionalities as a competitive application security platform. Core areas of focus include:
Unified security policy management provides security and compliance teams with a way to enforce controls across their organization for all of GitLab's scanners and security technologies. Policies can be used to ensure security scanners are enforced in development team pipelines with proper configuration, all scan jobs execute without any changes or alterations, and proper approvals are provided on merge requests based on results from those findings. This category is at the "viable" level of maturity.
Priority: medium • Documentation • Direction
Vulnerability Management enables collaboration between security teams by providing a uniform interface to assess the security posture of their applications. Security teams can view, triage, trend, track, and resolve vulnerabilities detected by the various GitLab scanners. This category is at the "complete" level of maturity.
Priority: high • Documentation • Direction
Seamlessly configure and onboard application security testing. This category is at the "minimal" level of maturity.
Identify security gaps by understanding which assets are covered by security testing, and when and where security tests have run. This category is at the "minimal" level of maturity.
Integrate external security testing tools for complete visibility and consolidation of your security workflows. This category is at the "minimal" level of maturity.
Last Updated: 2025-03-18
