Product Solutions Resources Partners Pricing Support Talk to an expert Get free trial Login GitLab vs Anchore Decision Kit Summary Anchore is a company that offers security scanning for Docker containers, Docker container registries, and Kubernetes clusters. They offer an Open Source, Enterprise, and Federal version of their products. They leverage public vulnerability feeds to scan customers’ environments for vulnerabilities and alert them so end users can take action. Comparison to GitLab Although Anchore does software composition analysis well, they do very little beyond that narrow scope. Comparatively, GitLab provides a superior experience for ALL types of security scanning - not only container scanning, but also SAST, DAST, Fuzz Testing, and others. This approach maximizes the kinds of vulnerabilities that can be detected while only incurring the maintenance costs of a single tool. Anchore leverages publicly-available vulnerability feeds to identify their vulnerabilities. GitLab does this as well; however, GitLab is also a CVE Numbering Authority, which means that security researchers can work directly with GitLab on any security issues they find. GitLab’s commitment to leveraging the latest vulnerability feeds is also publicly visible to customers at advisories.gitlab.com. Finally, GitLab provides a superior experience for developers in viewing, correcting, and responding to vulnerabilities. Because GitLab’s scanning capabilities are integrated with the rest of GitLab, the vulnerabilities appear as part of the developer’s regular workflow, inline within their MRs. This visibility is critical to be able to effectively shift security left. With Anchore, developers will need to look at an external tool to see the details about their vulnerabilities, making them much less likely to correct them before the code goes to production. Anchore can be complementary to GitLab if users have already bought both. GitLab supports integration with tools that customers are already using and plays well with others. Software Composition Analysis (SCA) Strengths and Weaknesses GitLab Anchore Strengths • Integrated security as part of DevOps workflow for all developers • High-quality container security by leveraging all the latest feeds for vulnerabilities • Supports on-premise deployments including disconnected, offline, or air-gapped environments • Security leadership by being a CVE Numbering Authority and a recognized in the Gartner AST magic quadrant • End-to-end DevOps offering from SCM to CI to CD to Security and more • Single-focused, purpose built container scanning product • Can work with many CI/CD providers (e.g. GitHub, GitLab, BitBucket) Weaknesses • Pricing requires buying all of GitLab Ultimate, not just Container Scanning • Narrow product offering only focused on one type of scanning • It is difficult to justify the cost of maintaining an entire security tool when the tool addresses such limited scope (SCA only) Feature Lineup GitLab Anchore Vulnerability Scanning ✅ ✅ Secrets and Passwords ✅ ✅ Open Source & Third Party Package Audit ✅ ✅ Air-gapped Support ✅ ✅ Security results shown to developers as part of their daily work ✅ Feature Comparison FEATURES Secret Detection SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE GitLab allows you to perform Secret Detection in CI/CD pipelines; checking for unintentionally committed secrets and credentials. Results are then shown in the Merge Request and in the Pipeline view. This feature is available as part of Auto DevOps to provide security-by-default. Learn more about Secret Detection Dependency Scanning SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE Protect your application from vulnerabilities that affect dynamic dependencies by automatically detecting well-known security bugs in your included libraries. Learn more about Dependency Scanning Container Scanning SaaS FREE PREMIUM ULTIMATE Self-Managed FREE PREMIUM ULTIMATE Run a security scan to ensure the Docker images for your application do not have any known vulnerabilities in the environment where your code is shipped. Learn more about container scanning Twitter Facebook YouTube LinkedIn Why GitLab? Product Solutions Services DevOps tools Is it any good? Releases Pricing Get started Resources All resources All-Remote Blog Newsletter Events Webcasts Topics Training Docs Developer Portal Install Community Customers Contribute Community Programs Direction Technology Partners Channel Partners Open Source Partners GitLab for Open Source GitLab for Education GitLab for Startups Shop Community Forum Support Get help Contact Sales Contact Support Support options Status Customers Portal Company About What is GitLab? Jobs Culture Leadership Team Press Investor Relations Analysts Handbook Security Contact Terms Privacy Cookie Preferences Trademark Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license View page source — Edit in Web IDE — please contribute. © 2021 GitLab B.V. This website uses cookies We use cookies to make our websites and services operate correctly, to understand how visitors engage with us and to improve our product and marketing efforts. See our cookie policy for more information.Cookie Policy Cookies Settings Accept All Cookies