--- description: "Comparison between solutions of Fluid Attacks and GitLab." keywords: "Fluid Attacks, Continuous Hacking, GitLab, application security, vulnerability scanning, SCA, reachability, SBOM, containers, SAST, DAST, secrets, tools, support, automated" other: private: false title: GitLab Ultimate --- # GitLab Ultimate import { Table } from "nextra/components"; **How does Fluid Attacks' solution compare to GitLab Ultimate's?** The following comparison table enables you to discern the performance of both providers across various attributes essential for meeting your company’s cybersecurity needs. To better understand each attribute, [read their descriptions in the dedicated page](https://help.fluidattacks.com/portal/en/kb/articles/comparison-attributes). > [!NOTE] > > This comparison focuses exclusively on the product itself, even though it belongs to a larger parent company. All information collected is based on the product's technical, functional, and theoretical capabilities, not on attributes of the parent company. **Organization** **Attribute** **Essential** **Advanced** **GitLab** **Focus** [Native ASPM](https://fluidattacks.com/solutions/application-security-posture-management) with [in-house scanners](https://fluidattacks.com/platform/) AI-powered [PTaaS](https://fluidattacks.com/products/ptaas/) on top of [native ASPM](https://fluidattacks.com/solutions/application-security-posture-management) with [in-house scanners](https://fluidattacks.com/platform/) In-house scanners **Extras** None None None **Headcount** [143](https://www.linkedin.com/company/fluidattacks/insights/) [Same](https://www.linkedin.com/company/fluidattacks/insights/) Indeterminable (no information for this product alone) **Headcount distribution** [Engineering 42%](https://www.linkedin.com/company/fluidattacks/insights/), IT 13%, sales 13%, marketing 2%, operations 4% and others 26% [Same](https://www.linkedin.com/company/fluidattacks/insights/) Indeterminable (no information for this product alone) **Headcount growth** [+8%](https://www.linkedin.com/company/fluidattacks/insights/), +10%, -8% [Same](https://www.linkedin.com/company/fluidattacks/insights/) Indeterminable (no information for this product alone) **Headquarters** [CO](https://www.linkedin.com/company/fluidattacks/about/) and US [Same](https://www.linkedin.com/company/fluidattacks/about/) Indeterminable (no information for this product alone) **Countries** [AR](https://www.linkedin.com/company/fluidattacks/people/), BO, CA, CL, CO, DO, MX, PA, PE and US [Same](https://www.linkedin.com/company/fluidattacks/people/) Indeterminable (no information for this product alone) **Reputation** 9.77 from 209 reviews over 7 years on [Gartner](https://www.gartner.com/reviews/market/application-security-testing/vendor/fluid-attacks/product/continuous-hacking) and [Clutch](https://clutch.co/profile/fluid-attacks#highlights) Same 8.72 from 437 reviews over 9 years on PeerSpot and TrustRadius **Followers** 20K based on the following: [Facebook](https://www.facebook.com/share/i8yDgDtBeW7TZjHr), [Instagram](https://www.instagram.com/fluidattacks?igsh=MWpoNjZma2w4cGM2aw==), [LinkedIn](https://www.linkedin.com/company/fluidattacks), [X](https://x.com/fluidattacks) and [YouTube](https://www.youtube.com/@FluidAttacks) Same Indeterminable (no information for this product alone) **Research firms** None None Forrester **Founded** [2001](https://fluidattacks.com/about-us/) [Same](https://fluidattacks.com/about-us/) 2017 **Funding** Bootstrapped Same Indeterminable (no information for this product alone) **Acquisitions** None None Indeterminable (no information for this product alone) **Revenue** [10M](https://www.crunchbase.com/organization/fluid-attacks) to 15M [Same](https://www.crunchbase.com/organization/fluid-attacks) Indeterminable (no information for this product alone) **CVEs as CNA Researcher** 276 [CVEs reported](https://fluidattacks.com/advisories/) to [MITRE](https://www.cve.org/PartnerInformation/ListofPartners/partner/Fluid_Attacks), ranked in the top 10 [CVE labs worldwide](https://github.com/fluidattacks/awesome-cvelabs) [Same](https://www.cve.org/PartnerInformation/ListofPartners/partner/Fluid_Attacks) 1,007 CVEs reported to MITRE by GitLab **Compliance** [SOC 2 Type II](https://trust.fluidattacks.tech/resources?s=xat56qr2ajdont2hyj85hf&name=soc-2-type-2-report-202407-pdf) and [SOC 3](https://trust.fluidattacks.tech/resources?s=fyik1uuqzj228tg31cpig&name=soc-3-report-202408-pdf) [Same](https://trust.fluidattacks.tech/) None **Bug bounty** [Yes](https://www.openbugbounty.org/bugbounty/fluidattacks/) [Yes](https://www.openbugbounty.org/bugbounty/fluidattacks/) Yes **Visits** [21K](https://www.semrush.com/analytics/traffic/overview/?q=fluidattacks.com&searchType=domain) per month. Top 3: 26% CO, 8% FR, 7% US. Others 59% [Same](https://www.semrush.com/analytics/traffic/overview/?q=fluidattacks.com&searchType=domain) Indeterminable (no information for this product alone) **Authority** [32 out of 100](https://www.semrush.com/analytics/traffic/overview/?q=fluidattacks.com&searchType=domain) [Same](https://www.semrush.com/analytics/traffic/overview/?q=fluidattacks.com&searchType=domain) Indeterminable (no information for this product alone) **Public vulnerability DB** [Discovered](https://db.fluidattacks.com/) and third-party [Same](https://db.fluidattacks.com/) GitLab - Third-party **Content** [Blog](https://fluidattacks.com/blog), [documentation](https://help.fluidattacks.com/portal/en/kb/), [e-books](https://fluidattacks.com/reports), [glossary](https://fluidattacks.com/cybersecurity-essentials), reports, [success stories](https://fluidattacks.com/success-stories), [videos](https://fluidattacks.com/events), webinars and white papers Same Articles, blog, conferences, documentation, guides, success stories, videos, webcast, webinars and workshops **Comprehensive documentation** 13 [documentation sections](https://help.fluidattacks.com/portal/en/kb/articles/documentation-sections), 6 in common and 7 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/documentation-sections) 8 documentation sections, 6 in common and 2 additional **Community** [Forum](https://help.fluidattacks.com/portal/en/community) [Same](https://help.fluidattacks.com/portal/en/community) Chat (Discord) and Forum by GitLab **Sync training** 1 [workshop](https://fluidattacks.com/events/breaking-the-build) [Same](https://fluidattacks.com/events/breaking-the-build) No **Async training** 3 [product use courses](https://training.fluidattacks.tech/collections), all free [Same](https://training.fluidattacks.tech/collections) 5 product use courses by GitLab with certification (subscription-based) **Distribution** [Direct](https://fluidattacks.com/contact-us/) or with any of its 14 [partners](https://fluidattacks.com/partners/) Same Direct or with any of its 377 partners **Marketplaces** [AWS](https://aws.amazon.com/marketplace/pp/prodview-hjaxsy2ne7yua?sr=0-1&ref_=beagle&applicationId=AWSMPContessa) [Same](https://aws.amazon.com/marketplace/pp/prodview-hjaxsy2ne7yua?sr=0-1&ref_=beagle&applicationId=AWSMPContessa) AWS and GCP **Freemium** No No Yes (Application Security Testing not included) **Free trial** [21-day free trial](https://help.fluidattacks.com/portal/en/kb/articles/continuous-hacking-free-trial-plans-and-pricing#Free_trial) [PoV](https://help.fluidattacks.com/portal/en/kb/articles/continuous-hacking-pov#Scope) 30-day free trial and PoV **Demo** [Yes](https://fluidattacks.com/contact-us/) [Yes](https://fluidattacks.com/contact-us/) Yes **Open demo** No No No **Pricing** [Contact sales](https://fluidattacks.com/contact-us) and [marketplace](https://aws.amazon.com/marketplace/pp/prodview-hjaxsy2ne7yua?sr=0-1&ref_=beagle&applicationId=AWSMPContessa) [Contact sales](https://fluidattacks.com/contact-us) Contact sales, marketplaces and public web **Pricing tiers** 1 [plan](https://fluidattacks.com/plans) 1 [plan](https://fluidattacks.com/plans) 1 plan **Minimum term** [Monthly](https://fluidattacks.com/plans) [Monthly](https://fluidattacks.com/plans) Annually **Minimum payment period** [Monthly](https://fluidattacks.com/plans) [Monthly](https://fluidattacks.com/plans) Monthly **Minimum capabilities** [ASPM](https://fluidattacks.com/plans), binary SAST, containers, CSPM, DAST, IaC, SAST, SCA and secrets Same plus: [API security testing](https://fluidattacks.com/plans), PTaaS, RE and SCR API security testing, containers, DAST, IaC, SAST and secrets **Minimum scope** 1 [author](https://fluidattacks.com/plans) [Same](https://fluidattacks.com/plans) 1 user **Pricing drivers** [Authors](https://fluidattacks.com/plans) [Same](https://fluidattacks.com/plans) Users **Free implementation** [Yes](https://fluidattacks.com/plans) [Yes](https://fluidattacks.com/plans) No **Free support** [Yes](https://fluidattacks.com/plans) [Yes](https://fluidattacks.com/plans) No

**Service** **Attribute** **Essential** **Advanced** **GitLab** **PTaaS** No [Yes](https://fluidattacks.com/products/ptaas) No **Reverse engineering** No [Yes](https://fluidattacks.com/products/reverse-engineering) No **Secure code review** No [Yes](https://fluidattacks.com/products/secure-code-review) No **Pivoting** No [Yes](https://fluidattacks.com/products/ptaas) No **Exploitation** No [Yes](https://fluidattacks.com/products/ptaas) No **Manual reattacks** Not applicable [Unlimited reattacks](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks#Request_a_reattack) Not applicable **Zero-day vulnerabilities** None Continuous [zero-day](https://fluidattacks.com/advisories) vulnerability research None **SLA** [Availability](https://help.fluidattacks.com/portal/en/kb/articles/availability-sla) [Accuracy](https://help.fluidattacks.com/portal/en/kb/articles/accuracy-sla), [availability](https://help.fluidattacks.com/portal/en/kb/articles/availability-sla) and [response](https://help.fluidattacks.com/portal/en/kb/articles/response-sla) Response **Minimum availability** [\>=99.95%](https://help.fluidattacks.com/portal/en/kb/articles/availability-sla#Indicator_calculation) per minute LTM [Same](https://help.fluidattacks.com/portal/en/kb/articles/availability-sla#Indicator_calculation) None **After-sale guarantees** No Yes Yes **Accreditations** [CNA](https://www.cve.org/PartnerInformation/ListofPartners/partner/Fluid_Attacks) and [Penetration Testing by CREST](https://trust.fluidattacks.tech/) [Same](https://www.cve.org/PartnerInformation/ListofPartners/partner/Fluid_Attacks) Amazon Linux Ready Product, AWS Graviton Ready Product, CNA, DevOps ISV Competency (as GitLab) **Hacker certifications** Not applicable [202 from 59 different types](https://fluidattacks.com/certifications/) Not applicable **Type of contract** Employee Same Employee **Endpoint control** Not applicable Total Not applicable **Channel control** Not applicable Total Not applicable **Standards** Some requirements from 67 [standards](https://help.fluidattacks.com/portal/en/kb/articles/supported-standards), 15 in common and 52 additional All requirements from the same [standards](https://help.fluidattacks.com/portal/en/kb/articles/supported-standards) 31 standards, 15 in common and 16 additional **Detection method** [Automated tools](https://fluidattacks.com/plans/#essential) [Automated tools](https://fluidattacks.com/solutions/application-security), [AI](https://aws.amazon.com/marketplace/pp/prodview-hjaxsy2ne7yua) and human intelligence Automated tools **Remediation** [5](https://help.fluidattacks.com/portal/en/kb/articles/supported-remediation), 4 in common and 1 additional Same, plus [1](https://help.fluidattacks.com/portal/en/kb/articles/supported-remediation) 5, 4 in common and 1 additional **Outputs** [5](https://help.fluidattacks.com/portal/en/kb/articles/supported-evidence-formats), 4 in common and 1 additional Same, plus [2](https://help.fluidattacks.com/portal/en/kb/articles/supported-evidence-formats) 6, 4 in common and 2 additional

**Product** **Attribute** **Essential** **Advanced** **GitLab** **ASPM** [Yes](https://fluidattacks.com/solutions/application-security-posture-management) [Yes](https://fluidattacks.com/solutions/application-security-posture-management) No **API** [GraphQL with JSON](https://help.fluidattacks.com/portal/en/kb/articles/learn-the-basics-of-the-fluid-attacks-api#Authenticate_to_use_the_API) [Same](https://help.fluidattacks.com/portal/en/kb/articles/learn-the-basics-of-the-fluid-attacks-api#Authenticate_to_use_the_API) REST and GraphQL with JSON **IDE** 5 [functionalities](https://help.fluidattacks.com/portal/en/kb/articles/supported-ide-functionalities), 3 in common and 1 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-ide-functionalities), plus 1 functionality 3 functionalities all in common **CLI** [Yes](https://help.fluidattacks.com/portal/en/kb/articles/use-standalone-scanners#CLI_structure) [Yes](https://help.fluidattacks.com/portal/en/kb/articles/use-standalone-scanners#CLI_structure) Yes **CI/CD** [Breaks the build](https://help.fluidattacks.com/portal/en/kb/articles/prevent-the-deployment-of-builds-with-vulnerabilities) [Same](https://help.fluidattacks.com/portal/en/kb/articles/prevent-the-deployment-of-builds-with-vulnerabilities) Breaks the build **Vulnerability sources** 4 [sources](https://help.fluidattacks.com/portal/en/kb/articles/vulnerability-signature-update), 1 in common and 3 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/vulnerability-signature-update) 2 sources, 1 in common and 1 additional **Threat model alignment** [Yes](https://help.fluidattacks.com/portal/en/kb/articles/correlate-your-threat-model-to-vulnerabilities) [Yes](https://help.fluidattacks.com/portal/en/kb/articles/correlate-your-threat-model-to-vulnerabilities) No **Priority criteria** [CVSS v4.0](https://help.fluidattacks.com/portal/en/kb/articles/cvss-score-adjustment), [CVSSF](https://help.fluidattacks.com/portal/en/kb/articles/cvssf-metric), [EPSS](https://help.fluidattacks.com/portal/en/kb/articles/see-where-vulnerabilities-are-and-more-details#See_the_details_of_a_specific_vulnerability) and KEV [Same](https://help.fluidattacks.com/portal/en/kb/articles/cvssf-metric) CVSS, EPSS and KEV **Custom prioritization** [Priority score](https://help.fluidattacks.com/portal/en/kb/articles/manage-fix-prioritization-policies) [Same](https://help.fluidattacks.com/portal/en/kb/articles/manage-fix-prioritization-policies) Risk score **Scanner origin** [In-house](https://help.fluidattacks.com/portal/en/kb/find-security-vulnerabilities) [In-house](https://help.fluidattacks.com/portal/en/kb/find-security-vulnerabilities) In-house and External (Gemnasium for SCA, KICKS for IaC, Semgrep for SAST and Trivy for Containers) **SCA** 23 [package managers](https://help.fluidattacks.com/portal/en/kb/articles/supported-package-managers), 15 in common and 8 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-package-managers) 16 package managers, 15 in common and 1 additional **AI security** No [Yes](https://db.fluidattacks.com/std/owaspllm/) No **Reachability** 12 [languages](https://help.fluidattacks.com/portal/en/kb/articles/supported-cves-reachability), 4 in common and 8 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-cves-reachability) 4 languages, all in common **Reachability type** [Deterministic](https://help.fluidattacks.com/portal/en/kb/articles/supported-cves-reachability) [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-cves-reachability) Deterministic **SBOM** 22 [package managers](https://help.fluidattacks.com/portal/en/kb/articles/supported-package-managers), 13 in common and 9 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-package-managers) 16 package managers, 13 in common and 3 additional **Malware detection** Yes Yes Yes **Autofix on components** No No Yes **Containers** 4 [distributions](https://help.fluidattacks.com/portal/en/kb/articles/supported-containers), 3 in common and 1 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-containers) 13 distributions, 3 in common and 10 additional **Source SAST ** **(languages)** [12](https://help.fluidattacks.com/portal/en/kb/articles/supported-languages), 11 in common and 1 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-languages) 17, 11 in common and 6 additional **Source SAST ** **(frameworks)** [22](https://help.fluidattacks.com/portal/en/kb/articles/supported-frameworks), 3 in common and 19 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-frameworks) 4, 3 in common and 1 additional **Custom rules** No No Secrets **IaC** [6](https://help.fluidattacks.com/portal/en/kb/articles/supported-languages), 4 in common and 2 additional [4](https://help.fluidattacks.com/portal/en/kb/articles/supported-languages), 2 in common and 2 additional 7, 6 in common and 1 additional **Binary SAST** 1 type of [binary](https://help.fluidattacks.com/portal/en/kb/articles/supported-binaries) [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-binaries), plus 2 types of binaries No **DAST** 7 [attack surface types](https://help.fluidattacks.com/portal/en/kb/articles/supported-attack-surfaces), 6 in common and 1 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-attack-surfaces) 9 attack surface types, 6 in common and 3 additional **API security testing** No 4 [types of APIs](https://help.fluidattacks.com/portal/en/kb/articles/supported-attack-surfaces), all in common 6 types of APIs, 4 in common and 2 additional **IAST** No No No **CSPM** [Yes](https://fluidattacks.com/product/cspm/) [Yes](https://fluidattacks.com/product/cspm/) No **ASM** No No No **Secrets** 15 [secrets types](https://help.fluidattacks.com/portal/en/kb/articles/supported-secrets), 7 in common and 8 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-secrets), plus verify other attack vectors and secrets exploitability 135 secrets types, 7 in common and 128 additional **AI** 3 [function](https://help.fluidattacks.com/portal/en/kb/articles/supported-ai-functions)s, all in common [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-ai-functions) 4 functions, 3 in common and 1 additional **MCP** [Yes](https://help.fluidattacks.com/portal/en/kb/articles/install-and-use-mcp-for-ai-tool-integration) [Yes](https://help.fluidattacks.com/portal/en/kb/articles/install-and-use-mcp-for-ai-tool-integration) Yes **Open-source** [MPL-2.0 license](https://gitlab.com/fluidattacks/universe/-/blob/trunk/LICENSE?ref_type=heads). Totally [equivalent](https://help.fluidattacks.com/portal/en/kb/articles/open-source) to the [paid version](https://fluidattacks.com/plans/) Not applicable MIT. Partially equivalent to the paid version **Provisioning as code** [Yes](https://help.fluidattacks.com/portal/en/kb/articles/stack-terraform#Rationale) [Yes](https://help.fluidattacks.com/portal/en/kb/articles/stack-terraform#Rationale) No **Deployment** [SaaS (multi-tenant)](https://fluidattacks.com/platform) [Same](https://fluidattacks.com/platform) SaaS + on-premises (no tenancy information) **Regions** [US](https://status.fluidattacks.tech/) [Same](https://status.fluidattacks.tech/) US **Status** [Yes](https://status.fluidattacks.tech/) [Yes](https://status.fluidattacks.tech/) Yes **Incidents** [4 per year](https://status.fluidattacks.tech/) [Same](https://status.fluidattacks.tech/) 11.5 per year

**Integrations** **Attribute** **Essential** **Advanced** **GitLab** **SCM** [6](https://help.fluidattacks.com/portal/en/kb/articles/supported-scm-systems), 1 in common and 5 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-scm-systems) 1 in common **Binary repositories** None None None **Ticketing** [3](https://help.fluidattacks.com/portal/en/kb/articles/supported-ticketing-systems), 2 in common and 1 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-ticketing-systems) 9, 2 in common and 7 additional **ChatOps** None None 3 **IDE** [3](https://help.fluidattacks.com/portal/en/kb/articles/supported-ide-functionalities), 2 in common and 1 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-ide-functionalities) 15, 2 in common and 13 additional **CI/CD** [21](https://help.fluidattacks.com/portal/en/kb/articles/supported-ci-cd), 4 in common and 17 additional [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-ci-cd) 4, all in common **SCA** [Native](https://fluidattacks.com/products/sca) [Same](https://fluidattacks.com/products/sca) Native powered by Gemnasium and 8 integrations **Container** [Native](https://fluidattacks.com/targets/containers) [Same](https://fluidattacks.com/targets/containers) Native powered by Trivy and 3 integrations **SAST** [Native](https://fluidattacks.com/products/sast) [Same](https://fluidattacks.com/products/sast) Native powered by Semgrep and 5 integrations **DAST** [Native](https://fluidattacks.com/products/dast) [Same](https://fluidattacks.com/products/dast) Native and 3 integrations **IAST** None None None **Cloud** [3](https://help.fluidattacks.com/portal/en/kb/articles/supported-clouds) [Same](https://help.fluidattacks.com/portal/en/kb/articles/supported-clouds) None **CSPM** [Native](https://fluidattacks.com/products/cspm) [Same](https://fluidattacks.com/products/cspm) 1 **Secrets** [Native](https://help.fluidattacks.com/portal/en/kb/articles/security-requirements-by-language) [Same](https://help.fluidattacks.com/portal/en/kb/articles/security-requirements-by-language) Native and 1 integration **Remediation** None None None **Bug bounty** None None 1 **Vulnerability management** None None None **Compliance** None None 1

> [!TIP] > > The latest update to this comparison was on **Dec 15, 2025**. The primary sources of information were **about.gitlab.com** and **docs.gitlab.com**, which were supplemented by specialized information-gathering sites, social media, and other sources. **More like GitLab Ultimate ** 1. [Aikido](https://help.fluidattacks.com/portal/en/kb/articles/compare-with-aikido) 1. [Checkmarx ](https://help.fluidattacks.com/portal/en/kb/articles/compare-with-checkmarx) 1. [FortiDevSec ](https://help.fluidattacks.com/portal/en/kb/articles/compare-with-fortidevsec) 1. [GitHub Advanced Security](https://help.fluidattacks.com/portal/en/kb/articles/compare-with-ghas) 1. [Jit](https://help.fluidattacks.com/portal/en/kb/articles/compare-with-jit) 1. [Snyk ](https://help.fluidattacks.com/portal/en/kb/articles/compare-with-snyk) 1. [ZAP](https://help.fluidattacks.com/portal/en/kb/articles/compare-with-zap) > [!TIP] > > **Free trial**Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your [21-day free trial](https://app.fluidattacks.com/SignUp) and discover the benefits of the [Continuous Hacking](https://fluidattacks.com/services/continuous-hacking/) [Essential plan](https://fluidattacks.com/plans/). If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out [this contact form](https://fluidattacks.com/contact-us/).