techlist.io
KREN
gitlab

Automate remediation with ready-to-merge AI code fixes (opens in new tab)

devsecopsai-mlsastsecuritygitlab-18.11vulnerability-remediationcvss-4.0

GitLab 18.11 makes Agentic SAST Vulnerability Resolution generally available, using AI to analyze vulnerabilities, generate code fixes, test them, and open ready-to-merge merge requests. The release aims to reduce developer context switching and AppSec triage while addressing vulnerabilities before production. It also adds faster scanning, risk-based prioritization, and stronger security governance.

Automated Remediation in the Developer Workflow

  • Confirmed SAST true positives automatically enter GitLab Duo Agent Platform’s remediation flow.
  • The agent:
    • Analyzes the vulnerability in context.
    • Generates a root-cause fix.
    • Validates the change with automated tests.
  • Developers receive a ready-to-merge MR with a confidence score.
  • Incremental scanning for Advanced SAST provides results before a complete scan finishes.
  • The approach addresses the growing remediation burden as AI-generated code increases vulnerability volume.

Prioritizing Vulnerabilities by Business Risk

  • Vulnerability scoring now uses CVSS 4.0 for more detailed exploitability assessment.
  • Policy-based severity overrides can use:
    • CVE information.
    • CWE classifications.
    • File paths and directories.
  • Approval policies can block or warn on merges based on:
    • Known Exploited Vulnerabilities (KEV).
    • EPSS score thresholds.
  • The Top CWEs dashboard chart helps teams identify recurring vulnerability classes and address systemic causes.

Security Controls and Scanner Coverage

  • The new Security Manager role gives security teams permissions to:
    • Enforce scanners.
    • Configure security policies.
    • Manage triage and remediation.
    • Maintain compliance frameworks and audit streams.
  • The role excludes code modification and deployment permissions, keeping access appropriately scoped.
  • SAST configuration profiles allow teams to define scanning centrally and apply it across group projects without maintaining project-level YAML or relying on developers for configuration.

GitLab 18.11 combines agentic remediation, faster and more risk-aware scanning, and centralized governance. Organizations seeking to reduce vulnerability backlogs can use these capabilities to automate routine fixes while preserving developer oversight through merge requests and confidence scores.