Security at machine speed. Control at every step.
Find and fix flaws with AI, while your gates still decide what ships.
Discovery and exploitation take hours. Remediation takes weeks.
Today's reality: AI is upending application security. Adapting requires agentic security, under controls that always hold.
Vulnerabilities are surging
+263%
growth in CVE submissions from 2020 to 2025. 2026 is on pace for 37% more.
Exploitation leads
31%
of breaches start with vulnerability exploitation, now the top initial access vector.
Fixes can't keep up
43 days
median time to fully remediate a known-exploited vulnerability.
Recent incidents
Risk is growing at machine speed
Supply chain compromises, agent escapes, and long-dormant flaws found by frontier models. Each one moved faster than a human review cycle.
Sources: NIST (2026) and Verizon Data Breach Investigations Report (2026).
Trivy · March 2026
Attackers stole a token, then poisoned the scanner's releases and harvested secrets from downstream pipelines.
Hugging Face · July 2026
Agents escaped a sandbox, stole cloud credentials, and moved across clusters and third-party services.
PHP2Shell · October 2026
Frontier models found two pre-auth RCEs, dormant since 2012 in software supporting 69% of websites.
01 · Find
Investigate vulnerabilities with full engineering context
Investigate vulnerabilities with full engineering context
After a disclosure like PHP2Shell, GitLab Orbit helps answer three questions. Are we exposed? Is it reachable? How do we fix it without breaking production?
Live map
Orbit links code, merge requests, pipelines, deployments, vulnerabilities, and work items.
Factual grounding
Agents work from your system's actual state.
Open
External agents like Claude Code use the same graph, within your permissions.
Automated triage
Dismiss false positives, so your team works real risk first.
Risk in context
See which findings threaten production, or whether a flaw is reachable from your payments system.
Deep reasoning
Catch flaws traditional scanners miss with analysis powered by Anthropic's Claude Mythos, available in approved environments.
02 · Fix
Automate remediation through your build and test pipelines
Shift from chasing findings to reviewing fixes.
Fix with GitLab:
Root-cause fixes: GitLab Duo writes a fix for confirmed findings, explains it in a merge request, and validates it in your pipelines.
Automated dependency remediation: GitLab Duo upgrades vulnerable dependencies and resolves breaking changes with pipeline-validated fixes.
03 · Govern
Enforce independent controls across the software factory
Enforce independent controls across the software factory
Every change, human or agent, clears the same gates.
Scan every change
Turn on SAST, dependency, container, secret, IaC, and DAST scans for every pipeline.
Enforce policy centrally
Set once and apply to every pipeline. Gate merges with high-risk findings until a reviewer approves.
Agent guardrails
Composite identity capped at the user's permissions, a sandbox destroyed when the task ends, and allowlisted tools, models, and MCP servers.
Supply chain
Control what enters your builds
The Trivy incident showed you must control what enters your builds and limit what an exposed secret can reach.
See how it works
These demos showcase some of the capabilities described above.
SAST
Agentic SAST Auto-Resolution
Watch an agent propose a SAST vulnerability fix and route it through a merge request.
Watch the demoDependencies
Dependency scanning auto-remediation
Follow a vulnerable package through automated dependency remediation.
Watch the demoReview
Security review flow
See a security-focused review in a merge request.
Watch the demoSecrets
GitLab Secrets Manager
See scoped secrets used in CI/CD and Kubernetes workloads.
Watch the demoAudit
AI Audit Events Report
See how agent activity is recorded for review.
Watch the demo
Attackers have moved to machine speed.
Keeping pace means letting AI do more of the finding and fixing. Every change, human or agent, clears the same gates.
Available by request to qualifying teams*. Requests must be submitted by November 13, 2026. Requires on-demand billing enabled on the account. Free credits are scaled to the number of paid seats, up to $10,000, and expire when the sprint ends. Sprint access runs 14 days from activation. At the end of the sprint your account team will follow up with Ultimate upgrade and credit commitment options. Not combinable with other promotions; specific feature entitlements approval and availability are subject to GitLab’s sole discretion.
*This limited-time offer is subject to GitLab’s internal qualifications process. Applying does not guarantee acceptance or participation. Any offer or participation is subject to the applicable Subscription Agreement or other governing agreement between the customer and GitLab, as supplemented by any Security Sprint Promotional Terms.
All fields required