THE CYBER TOOLCHAIN
Top pick for October 2026
One product, chosen from everything that won a weekly Head pick over October 2026. Always a product, never a vendor.
GitLab
SAST / SCA / Code Security
- Head weeks
- 2/5
- Feature releases
- 9
- Finalists
- 8
The Cyber Toolchain
The month’s pick
GitLab closed real capability gaps across source, supply chain and secrets in one month.
The Dependency Firewall blocks malicious, vulnerable and non-compliant packages before they enter a build with warn/block modes and a logged bypass across npm, pip and Maven, while the Business Logic Security Analyzer runs whole-repository scans for broken object-level authorization, missing authorization and mass assignment that pattern-based SAST cannot detect, reporting them in the merge-request widget. GitLab Secrets Manager also reached GA with per-job build-time scoping via OpenBao and full audit trails.
The story
Before this month, a lot of risk slipped in quietly. A bad package could land in your build before anyone noticed, and once it was in, pulling it back out was painful. Your scanners caught known patterns, but the logic flaws that let one user read another user's data often sailed through. And build-time secrets sat in places that were hard to scope and harder to audit.
GitLab went after all three in October 2026. Early in the month, the Dependency Firewall arrived, so you can block malicious, vulnerable or non-compliant npm, pip and Maven packages before a build, with a warn mode to ease in and a logged bypass when you need an exception. Then Secrets Manager reached general availability, giving each job its own scoped secret and a full audit trail. Later came the Business Logic Security Analyzer, which scans a whole repository for broken object-level authorization, missing authorization and mass assignment, then reports them right in the merge-request widget. There's also one view of agent activity across the pipeline.
Rivals shipped strong pieces too. GitHub previewed a package firewall and made agentic autofix general. Endor Labs added AI code review and autonomous fixes. But GitLab closed source, supply chain and secrets gaps together, in one month. If you run the whole pipeline, that breadth is the win.
One month, three real holes shut.
How it won
Five Head weeks in October 2026 put 22 products in their top five. One of them is the month’s pick.
- 1 Cribl
- 2 Qualys VMDR
- 3 Qualys Patch Management
- 4 Metasploit Pro
- 5 Bedrock Security
- 1 GitLab
- 2 Zenity
- 3 SonarQube
- 4 Elastic Security Labs
- 5 GitHub
- 1 Operant AI
- 2 Belkasoft
- 3 Token Security
- 4 Endor Labs
- 5 Aembit
- 1 Zenity
- 2 SentinelOne
- 3 GitLab
- 4 Microsoft Entra
- 5 Qualys Patch Management
- 1 Aikido Security
- 2 CyberArk
- 3 Aviatrix
- 4 OpenSSL
- 5 Dreadnode
The pick Other finalists Numbers are that week’s Head ranking
What you can do with it
- Turn on the Dependency Firewall in block mode to stop risky npm/pip/Maven packages before the build, with a logged bypass for exceptions
- Run the Business Logic Security Analyzer to catch BOLA, missing authorization and mass assignment that your SAST misses
- Migrate build-time secrets to GitLab Secrets Manager (GA) for per-job scoping and audit trails via OpenBao
- Use AI Governance to get one view of agent activity across the pipeline
Examples from what it shipped
Oct 6
Dependency Firewall: Block risky packages before the build
GitLab Dependency Firewall (early access) blocks malicious, vulnerable, and non-compliant packages before they enter a build.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Adds warn and block enforcement modes to Dependency Firewall
Adds warn and block enforcement modes to Dependency Firewall: warn logs every policy match as an audit event and CI summary line without stopping the build; block halts the pipeline and records the reason.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Adds policy dimensions for malicious status (GitLab malware advisory database)…
Adds policy dimensions for malicious status (GitLab malware advisory database), vulnerability severity (critical, high, medium, low) with a configurable finding count, license type (allow/deny by full name, plus handling for undetermined licenses), and package age (minimum age before a version may enter a build).
Adds a logged bypass mechanism that lets a designated user or token push an approved…
Adds a logged bypass mechanism that lets a designated user or token push an approved package through Dependency Firewall on the record.
Adds a GitLab CLI command to check whether a package will pass or be blocked by policy…
Adds a GitLab CLI command to check whether a package will pass or be blocked by policy before adding the dependency, covering npm, pip, Poetry, Maven, Gradle, and Bundler.
Oct 6
Every artifact your teams ship, assembled right the first time
GitLab Artifact Central launches in beta: one org-level registry for MavenMavenA build-automation and dependency-management tool maintained by the Apache Software Foundation for Java projects; cyber tools built on it get a standardized way to declare libraries, compile code, and publish artifacts., npm, Docker, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. with built-in build provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build..︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Introduces CI_JOB_TOKEN as the authentication mechanism for publishing and pulling…
Introduces CI_JOB_TOKEN as the authentication mechanism for publishing and pulling artifacts through Artifact Central, eliminating the need for separate service accounts.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Introduces GitLab Artifact Central, an organization-level registry replacing…
Introduces GitLab Artifact Central, an organization-level registry replacing per-project package and container registries, with centralized retention rules, storage quotas, and access policies.
Supports three repository types
Supports three repository types — Hosted (private packages your teams publish), Remote (proxy with caching for external sources like Docker Hub or Maven Central), and Virtual (single endpoint combining hosted and remote, with automatic fallback and cache).
Introduces four dedicated artifact roles
Introduces four dedicated artifact roles — Admin, Manager, Contributor, and Viewer — kept separate from existing GitLab project roles so artifact access never affects project privileges.
Oct 15
GitLab Secrets Manager: Govern secrets like your code
GitLab Secrets Manager (GA, 19.5) scopes build-time secrets per job via the secrets: keyword in .gitlab-ci.yml, encrypts at rest with AES-256-GCMAES-256-GCMAES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. via OpenBao, streams full CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. audit events with pipeline/job IDs, and inherits group-level secrets through existing project membership.
Declares secrets in .gitlab-ci.yml using the secrets: keyword, injecting values…
Declares secrets in .gitlab-ci.yml using the secrets: keyword, injecting values only into jobs that declare them and fall within scope (branch, protected-branch flag, production/* environment wildcards).
Streams every secret create, read, update, and delete event
Streams every secret create, read, update, and delete event — including pipeline and job IDs — to audit event destinations and the GitLab audit trail.
Writes secret values to a temporary file inside the job and exposes only the file path…
Writes secret values to a temporary file inside the job and exposes only the file path, limiting exposure in subprocesses, crash dumps, and telemetry.
Includes a secret audit tool for CI/CD variables that flags variables likely to hold…
Includes a secret audit tool for CI/CD variables that flags variables likely to hold credentials, enabling targeted migration.
Projects inherit secrets defined in parent groups, allowing a shared credential to be…
Projects inherit secrets defined in parent groups, allowing a shared credential to be defined once and accessed via existing project membership.
Adds Secure > Secrets Manager navigation in top-level group settings on GitLab.com…
Adds Secure > Secrets Manager navigation in top-level group settings on GitLab.com, with a 30-day / 500-credit free trial via Start 30-day trial.
New supported platformGenerally available for GitLab Premium and Ultimate on GitLab.com and GitLab…
Generally available for GitLab Premium and Ultimate on GitLab.com and GitLab Self-Managed (19.5), billed at 1 credit per secret per month and 1 credit per 2,500 reads.
- New integration External Secrets Operator (Kubernetes) integration
- New integration Terraform and OpenTofu data source integration