Security teams have historically struggled to keep up with triage and remediation when development was happening at human speed. Today, that challenge is exacerbated by developers writing and shipping code at machine speed with AI.

At the same time, AI is helping attackers find and exploit vulnerabilities faster in production. Verizon's 2026 Data Breach Investigations Report found vulnerability exploitation overtook credential abuse as the top breach entry point. Vulnerability exploitation accounts for 31% of breaches versus just 13% in previous years, and only 26% of known exploited vulnerabilities were remediated this year, down from 38%. That means more breaches are starting with a vulnerability that was already sitting in production, unpatched.

In GitLab 19.3, teams can now run Static Application Security Testing (SAST) False Positive Detection and Agentic SAST Vulnerability Resolution, in bulk, on their existing vulnerability backlog.

Most teams have a known vulnerabilities backlog already running in production, far more than any team has time to open and triage one at a time. That used to be a workload problem. Now it's a timing problem too: The same AI accelerating development is accelerating exploitation, which means findings that sit in the backlog longer carry more risk than they used to.

GitLab addresses this with two layers of automated triage and remediation. The first covers active vulnerabilities in production. With GitLab 19.3, teams can bulk-select multiple vulnerabilities to run agentic flows, SAST False Positive Detection and Agentic SAST Vulnerability Resolution, against the vulnerability backlog in production. SAST False Positive Detection analyzes a finding's surrounding code and returns a confidence score and explanation for whether it's a real risk or a false positive. Agentic SAST Vulnerability Resolution takes findings confirmed as real risk and opens a ready-to-merge fix that remediates the vulnerabilities, so a developer reviews and merges the fixes instead of writing it from scratch.

This applies to all SAST vulnerabilities in the vulnerability report, no matter the scanner origin or severity. You can import findings from any third-party scanner that outputs SARIF; GitLab ingests them into a unified vulnerability report.

With bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution teams can cut years of accumulated risk in a single action instead of one vulnerability at a time and to reduce the risk of vulnerabilities being exploited in production.

See these two features in action:

The second layer covers any new vulnerabilities identified. Teams can configure pipelines to run SAST False Positive Detection and Agentic SAST Vulnerability Resolution automatically on Critical and High severity vulnerabilities (watch an interactive demo). New findings get triaged automatically, and when one is deemed a real risk, GitLab creates a ready-to-merge fix before anyone has to open the finding by hand.

Start automating triage and clearing your backlog today

With bulk triage and remediation developers spend less time confirming false positives and more time shipping fixes that drive down real risk.

Start a free trial of GitLab Duo Agent Platform to try it today.

FAQ

Do bulk SAST False Positive Detection and Agentic Vulnerability Resolution consume GitLab Duo Agent Platform credits?
Yes. Please see the pricing page for further details.

Does bulk triage and remediation cost more credits than running detection one at a time?
No. Each finding still costs the same per-execution rate; bulk just queues many at once instead of triggering them manually one by one.

Which vulnerabilities qualify for bulk triage?
Any SAST vulnerability in your vulnerability report, no matter the scanner origin or severity.

Will running this on my whole backlog overwhelm my pipeline?
No. Concurrency limits keep the bulk job from competing with your pipeline's other work, so clearing thousands of findings doesn't come at the cost of build capacity.

Can I stop a bulk job once it's running?
Yes. A progress indicator tracks the job while it runs, and you can cancel it at any point.