Gitlab: cybersecurity software

GitLab relies entirely on open source tooling to do the actual scanning, and their reporting is hard to use. Only recommended for organizations that are already on Ultimate tier, and even then the results are very mixed.

What Gitlab is

GitLab relies entirely on open source tooling to do the actual scanning, and their reporting is hard to use. Only recommended for organizations that are already on Ultimate tier, and even then the results are very mixed. The vendor site is about.gitlab.com. This profile is an entry in the oneNorma directory, not a vendor landing page.

What Gitlab covers

Gitlab is in the catalog for these capabilities. Categories: SCA. Catalog tags: Hands-on, Included, and Best for MidMarket.

How to evaluate Gitlab in a security program

Use Gitlab as a stack candidate, not as diligence evidence. The oneNorma score for Gitlab is 3.8/10 (percentile 9). If the real gap is in SCA, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what about.gitlab.com publishes. Contrast it with pentesting and Security Cloud & Compliance.

Classification

Categories

SCA

Tags

Hands-onIncludedBest for MidMarket

Frequently asked questions

What is Gitlab?

GitLab relies entirely on open source tooling to do the actual scanning, and their reporting is hard to use. Only recommended for organizations that are already on Ultimate tier, and even then the results are very mixed. Site: about.gitlab.com.

Which categories does Gitlab fall into?

Gitlab appears in the oneNorma directory under SCA. Use those labels to compare it with other vendors for the same problem, not as an official ranking.

Does oneNorma resell or implement Gitlab?

No. The Gitlab profile (about.gitlab.com) is for inventory and comparison. oneNorma delivers offensive and compliance evidence (pentesting, cloud compliance), not a vendor license.

Other cybersecurity vendors

More profiles from the vendor directory.