# GitLab leverages AI to automatically clear vulnerability backlogs

AI-powered bulk vulnerability detection and remediation helps teams rapidly reduce risks

- **Source:** [GitLab](https://brifing.si/source/76101668-80db-4240-8676-e968d2b72546)
- **Published:** 2026-08-20
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://about.gitlab.com/blog/gitlab-scales-remediation/>
- **On Brifing:** https://brifing.si/s/3755d4a8-a3c1-4601-9010-e9f55a657458

## New era in vulnerability management

According to Verizon's 2026 Data Breach Investigations Report, vulnerability exploitation has surpassed credential abuse as the top breach method. 31% of breaches now stem from vulnerabilities, up from just 13% in previous years. Only 26% of known vulnerabilities were patched this year, down from 38%. With AI accelerating both development and attack speeds, the time vulnerabilities remain in production has become a critical risk factor.

## GitLab's bulk approach

GitLab 19.3 introduces two features enabling teams to address accumulated vulnerabilities in bulk: SAST False Positive Detection and Agentic SAST Vulnerability Resolution. These features save significant time compared to traditional one-by-one review methods. Even years of accumulated vulnerabilities in large projects can now be addressed with a single action.

## Automated false positive filtering

SAST False Positive Detection analyzes code surrounding a security finding to provide a confidence score and explanation about whether it's a real risk or false positive. This allows teams to focus on genuine threats. The feature works across all SAST vulnerabilities regardless of scanner origin or severity.

## Automated remediation mechanism

Agentic SAST Vulnerability Resolution creates ready-to-merge fixes for findings confirmed as real risks. Developers review and merge these fixes instead of writing code from scratch. The process can be configured specifically for critical and high-severity vulnerabilities.

## Third-party integration advantage

GitLab's solution supports findings from any third-party scanner that outputs SARIF format. These findings are ingested into a unified vulnerability report, allowing teams to manage vulnerabilities from different sources through a single interface.

## Proactive protection for new vulnerabilities

As a second defense layer, teams can configure automated workflows for newly detected vulnerabilities. Critical and high-severity vulnerabilities are automatically scanned and remediated, eliminating the need for manual review.

## Resource optimization

Bulk operations run without impacting pipeline capacity. Concurrency limits prevent workflow disruptions during processing of thousands of findings. Additionally, running bulk jobs can be stopped at any time.

## Impact on developer productivity

This automation allows developers to spend less time verifying false positives and more time implementing fixes that reduce real risks. GitLab Duo Agent Platform's free trial enables teams to test these features, helping optimize the balance between security and development efficiency.

## Sources covering this story

- https://about.gitlab.com/blog/gitlab-scales-remediation/ — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._