Product Solutions Resources Partners Pricing Support Talk to an expert Get free trial Login GitLab vs MicroFocus Fortify Decision Kit Summary Both Fortify and GitLab Ultimate offer open source component scanning along with Static and Dynamic Application Security Testing. Fortify uses Sonatype for open source scanning in its SaaS product as an OEM service. Fortify on-premise is integrated with SonaType and BlackDuck for open source scanning on-premise, both of those require separate licensing and set up. Fortify is a mature product. Fortify offers IAST (with DAST) and RASP, though it does not offer container scanning. In spite of its strengths as a stand-alone product, Fortify is a separate process outside of the developer’s merge request workflow. The Fortify RASP product, Application Defender, is limited to Java and .Net applications. The Fortify Security Center (SSC) is needed if you want to pull results together from across the various Fortify scanners. Fortify can be easily integrated into GitLab CI process using Command Line and API integrations. A key difference is that Fortify does not yet provide incremental scanning while GitLab clearly shows the scan results based upon the diff, or code changed since the last commit. GitLab automatically includes broad security scanning with every code commit including Static and Dynamic Application Security Testing, dependency scanning, container scanning, license management, secrets detection, and most recently fuzz testing. Results are provided to the developer in the CI pipeline (Merge Request) with no integration required. GitLab also aggregates and displays all results in a single dashboard both at Group and Project levels. Finding vulnerabilities is only the beginning. Delivering those findings to the developer for immediate remediation is key to shifting left to reduce both cost and risk. GitLab does so without added integrations to maintain. Feature Comparison FEATURES Static Application Security Testing SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE GitLab allows easily running Static Application Security Testing (SAST) in CI/CD pipelines; checking for vulnerable source code or well known security bugs in the libraries that are included by the application. Results are then shown in the Merge Request and in the Pipeline view. This feature is available as part of Auto DevOps to provide security-by-default. Learn more about Static Application Security Testing Infrastructure as Code (IaC) Security Scanning SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE “With Gitlab 14.5 we’re introducing security scanning for Infrastructure as Code (IaC) configuration files.” Learn more about IaC security scanning Secret Detection SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE GitLab allows you to perform Secret Detection in CI/CD pipelines; checking for unintentionally committed secrets and credentials. Results are then shown in the Merge Request and in the Pipeline view. This feature is available as part of Auto DevOps to provide security-by-default. Learn more about Secret Detection Dependency Scanning SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE Protect your application from vulnerabilities that affect dynamic dependencies by automatically detecting well-known security bugs in your included libraries. Learn more about Dependency Scanning Dynamic Application Security Testing SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE Ensure you are not exposed to web application vulnerabilities like broken authentication, cross-site scripting, or SQL injection by dynamically investigating your running test applications in CI/CD pipelines. Learn more about application security for containers Interactive Application Security Testing SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE IAST combines elements of static and dynamic application security testing methods to improve the overall quality of the results. IAST typically uses an agent to instrument the application to monitor library calls and more. GitLab does not yet offer this feature. Vulnerability Management SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE Empower your entire team, and not just Security, to act on security findings with a unified interface for scan results from all GitLab Security scanners. Learn more about Vulnerability Management Cloud Native Network Firewall SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE Prevent attackers from moving through your environment by restricting container network communications to only allow valid traffic flows between application components. Learn more about Container Network Security Container Scanning SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE Run a security scan to ensure the Docker images for your application do not have any known vulnerabilities in the environment where your code is shipped. Learn more about container scanning License Compliance SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE Check that licenses of your dependencies are compatible with your application, and approve or deny them. Results are then shown in the Merge Request and in the Pipeline view. Learn more about License Compliance On-demand DAST SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE Identify vulnerabilities in your running application, independent of code changes or merge requests. Learn more about On-demand DAST Site and Scanner profiles for On-demand DAST scans SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE Reuse configuration profiles quickly with on-demand DAST scans, instead of reconfiguring scans every time you need to run one. Mix different scan profiles with site profiles to quickly conduct scans that cover different areas or depths of your application and API. Learn more about application security for containers DAST Configuration UI SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE Enabling DAST is now as simple as three clicks. This guided configuration experience makes it easier for non-CI experts to get started with GitLab DAST. The tool helps a user create a merge request to enable DAST scanning while leveraging best configuration practices like using the GitLab-managed DAST.gitlab-ci.yml template. Learn more about the DAST Configuration UI Scheduling On-demand DAST scans SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE Set on-demand DAST scans to run on ad hoc or recurring schedules. Learn more about scheduling on-demand scans Twitter Facebook YouTube LinkedIn Why GitLab? Product Solutions Services DevOps tools Is it any good? Releases Pricing Get started Resources All resources All-Remote Blog Newsletter Events Webcasts Topics Training Docs Developer Portal Install Community Customers Contribute Community Programs Direction Technology Partners Channel Partners Open Source Partners GitLab for Open Source GitLab for Education GitLab for Startups Shop Community Forum Support Get help Contact Sales Contact Support Support options Status Customers Portal Company About What is GitLab? Jobs Culture Leadership Team Press Investor Relations Analysts Handbook Security Contact Terms Privacy Cookie Preferences Trademark Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license View page source — Edit in Web IDE — please contribute. © 2021 GitLab B.V. This website uses cookies We use cookies to make our websites and services operate correctly, to understand how visitors engage with us and to improve our product and marketing efforts. See our cookie policy for more information.Cookie Policy Cookies Settings Accept All Cookies