Today GitLab, the single application for the DevOps lifecycle, announced it has acquired Peach Tech, a security software firm specialising in protocol fuzz testing and dynamic application security testing (DAST) API testing, and Fuzzit, a continuous fuzz testing solution providing coverage-guided testing. 

These acquisitions will add fully-mature testing solutions including protocol fuzzing, API fuzzing, DAST API testing, and coverage-guided fuzz testing. This makes GitLab’s DevSecOps offering the first security solution to offer both coverage-guided and behavioural fuzz testing techniques as well as the first true DevSecOps platform to shift fuzz testing left with these new offerings being made available within the GitLab CI/CD environment.

“We believe GitLab provides best-in-class tools for the complete DevOps lifecycle on a single platform,” said Sid Sijbrandij, CEO of GitLab. “Bringing the fuzzing technologies of Peach Tech and Fuzzit into GitLab’s security solutions will give our users an even more robust and thorough application security testing experience while enabling them to shift security left. This simultaneously simplifies their workflows and creates collaboration between development, security, and operations teams.”

In an era where open source software (OSS) continues to exponentially gain momentum and organisations push towards a zero-trust model, enterprise security concerns grow as potential threats and vulnerabilities extend the available attack surface to a point where even the largest businesses do not have the time nor resources to effectively assess their security posture. Fuzz Testing, sometimes referred to as fuzzing, is the process of providing bad inputs to a program to find bugs, crashes, and faults that could be exploited. 

Successful automation of application security testing combined with a “shift left” DevSecOps approach empowers development and security teams to test early and often, as well as collaborate in managing and lowering the organisation’s overall security risk. The addition of both coverage-guided and behavioral fuzz testing into the DevSecOps toolchain helps organisations find vulnerabilities and weaknesses traditional application security testing and quality assurance (QA) testing techniques often miss as these findings may not be directly tied to a known vulnerability (e.g. CVE IDs).

Once Peach Tech and Fuzzit technologies are fully-integrated, GitLab Secure customers will no longer need to depend on standalone fuzz testing solutions to meet their application security testing needs. Instead, they will have a fully-integrated security solution, from Auto DevOps deployment of security testing to vulnerability management and remediation. Furthermore, these acquisitions will allow GitLab to accelerate its roadmap for interactive application security testing (IAST) by extending Peach Tech’s DAST API security engine and Fuzzit’s crash correlation technology.

“Providing GitLab users with the best security testing tools is key to GitLab's DevSecOps core mission," said Michael Eddington, Peach Tech founder and CEO. "The integration of Peach Tech’s technologies expands GitLab's shift security left capabilities making the future of security and DevSecOps a reality today for all GitLab users."

“Fully integrating Fuzzit will make GitLab the first security solution that provides continuous coverage-guided fuzz testing natively within the CI/CD pipeline," said Yevgeny Pats, Fuzzit founder and CEO. "Fuzzit's support for multiple coverage-guided fuzzers combined with its crash analysis and correlation technology will add an important capability to the DevSecOps for GitLab users.”

With the Peach Tech and Fuzzit technologies being incorporated into GitLab’s DevSecOps platform, GitLab will further accelerate its application security testing roadmap to bring developers a native and seamless experience for discovering, fixing, and remediating security vulnerabilities and weaknesses.

GitLab provides accurate, automated, and continuous assessment of your applications, which enables users to proactively identify vulnerabilities and weaknesses to minimise security risk. GitLab’s Secure stage is woven into the DevOps cycle to allow users to adapt security testing and processes, not as an additional step nor tool.

Please visit the GitLab website and watch the video overview for more information regarding GitLab’s security strategy and direction as well as to learn more about how GitLab enables your organisation to adopt DevSecOps best practices. GitLab was positioned as a Niche Player in the 2020 Gartner Magic Quadrant report for Application Security Testing (AST).

GitLab’s public handbook includes an acquisition section which outlines the transparent approach the Company takes on Corporate Development, from sharing a target company profile through to listing the financial incentives it offers to teams.