Prisma Cloud vs GitLab

GitLab compared to other DevOps tools



Twistlock was recently acquired by Palo Alto and was subsequently rebranded as Prisma Cloud. Prisma Cloud plays in several categories that overlap with GitLab. Pricing is based on the number of “workload” (aka. pods) that are protected.

Palo Alto’s Prisma Cloud product provides lifecycle security for containerized environments, “from pipeline to perimeter”. Prisma Cloud capabilities include runtime defense, vulnerability management, cloud native firewalls, and pre-built compliance templates for HIPAA, PCI, GDPR, and NIST SP 800-190. It can be integrated into your CI/CD pipeline. Automated and custom policies can block builds or deployments based on vulnerabilities or compliance requirements. Runtime capabilities were recently expanded from only containerized applications to include VMs.

Comparison to GitLab

Prisma Cloud's runtime and container security features are robust, but they do not offer the breadth of GitLab’s security scans. GitLab Ultimate automatically includes broad security scanning with every code commit including Static and Dynamic Application Security Testing, along with dependency scanning, container scanning, and license management. Prisma Cloud is also expensive, while much of the current feature set that GitLab provides is available for free. Additionally, the heavy operational maintenance burden of Prisma Cloud further adds to the cost. If what GitLab provides today can be considered ‘good enough’, then customers can potentially save a huge amount of money.

Security Scanning

Prisma Cloud is a decent choice for customers that only need basic vulnerability scanning; however, their vulnerability management tool only intakes data from a single, limited source: known CVEs. This leaves them blind to other vulnerabilities that may be identified through SAST or DAST scans. For customers to properly secure their applications, they should consider a solution that includes good SAST and DAST scanners. Rather than using separate scanners to meet their needs, it will be much simpler and easier to use GitLab, which both has a wide range of scanning capabilities, a native integration with SCM, and has been recognized in the Gartner Magic Quadrant for Application Security Testing (AST).

Strengths and Weaknesses

  GitLab Prisma Cloud
Strengths   •     Integrated security as part of DevOps workflow for all developers
  •     High-quality container security by leveraging all the latest feeds for vulnerabilities
  •     Security leadership by being a CVE Numbering Authority
  •     End-to-end DevOps offering from SCM to CI to CD to Security and more
  •     Provides a basic analysis of installed packages vs. known CVEs
  •     Nice, clean UX and design
Weaknesses   •     Requires users to use GitLab for CI if they are not already   •     Does not provide a full suite of code scanning to adequately detect all vulnerabilities - no SAST or DAST
  •     Shifting left and integrating with SCM tools requires an integration to be built with their APIs and does not exist natively

Feature Lineup

  GitLab Prisma Cloud
SCA: Vulnerability Scanning
SCA: Open Source Audit  
Fuzz Testing  


Additionally, using Prima Cloud requires customers to integrate a separate product into their CI/CD pipeline jobs. Customers can save time and money by instead using GitLab's built-in vulnerability management capabilities that come available out-of-the-box. For customers who do decide to use Prisma Cloud, it is possible to feed their scan results into GitLab and combine them with the results from other GitLab scans.

Strengths and Weaknesses

  GitLab Prisma Cloud
Strengths   •     One tool - vulnerability management is integrated out-of-the-box
  •     Visualizes data from all of GitLab’s scanning engines, including DAST, SAST, and SCA
  •     Capable of enforcing policy rules and preventing vulnerable code from running
  •     Good visualization of a complex risk analysis
  •     Capable of showing CVE severity together with the container’s actual exposure to the specific attack
Weaknesses   •     Although the roadmap is robust, current functionality is new and lacks features
  •     Risk assessment capabilities do not exist and priorities do not take into context the configuration of the container, which could mitigate some vulnerabilities
  •     Lacks good scanners to identify vulnerabilities
  •     Not natively integrated with SCM tools - an API is available but the integration has to be built into CI/CD
  •     Limited to containerized applications

Feature Lineup

  GitLab Prisma Cloud
Vulnerability Assessment limited
Risk Assessment  
Vulnerability Prioritization limited limited

Container Security

As GitLab's container security capabilities are relatively new, Prisma Cloud has a much more robust feature/functionality set than GitLab in securing containerized workloads. Additionally, Prisma Cloud is capable of protecting serverless code as well as virtual machines. GitLab's container security roadmap is robust and the feature set is maturing quickly. Additionally, all of the base security capabilities are available in GitLab's free, Core tier.

Strengths and Weaknesses

  GitLab Prisma Cloud
Strengths   •     Current functionality provides a respectable baseline of security (Web application firewall, container Network Policies, container host monitoring)
  •     Base security capabilities are currently available in the free Core tier
  •     Extensive set of features and capabilities
  •     "Radar" capability gives a wow factor in visualizing the network
  •     Protection for VMs, containers, and serverless code
Weaknesses   •     Although the GitLab roadmap is robust, current functionality is new and lacks features
  •     Current capabilities are supported in containerized environments only
  •     Pricing model can get expensive fast with lots of containers
  •     Behind the nice UX, the solution is hard to manage and can require a lot of time from a dedicated team

Feature Lineup

  GitLab Prisma Cloud
Network Firewall  
Machine Learning  
Active Vulnerability Scanning (of an application running in production)  
Malware Scanning  
Exploit Protection  
File Integrity Monitoring
Application/Binary Allow Listing
Log Monitoring
Identity and Access Management  
Active Response / Blocking
Virtual machine Support  
Kubernetes/Container Support
Serverless Support  

GitLab-Prisma Cloud Comparison Infographic

This summary infographic compares Prisma Cloud and GitLab across several DevOps Stages and Categories.

GitLab Prisma Cloud Comparison Chart



構築済みのKubernetesクラスターをプロジェクトに追加できます。CI/CDパイプラインから、 追加したKubernetesクラスターへ簡単にアクセスでき、Review Appsをホストしたり、アプリケーションをデプロイしたりすることができます。


Web やメールのカスタムヘッダー/フッターシステムメッセージ

GitLab 全体やメールにカスタムヘッダー/フッターシステムメッセージを含めます。

Web やメールのカスタムヘッダー/フッターシステムメッセージについて読む


GitLab では、CI/CD パイプラインで静的アプリケーションセキュリティテスト (SAST) を簡単に実行することができます。 アプリケーションに含まれるライブラリの中に脆弱なソースコードや よく知られたセキュリティバグがないかどうかをチェックします。 結果はマージリクエストとパイプラインビューに表示されます。 この機能は [Auto DevOps]( の一部として利用可能で、デフォルトでのセキュリティを提供しています。



GitLabはアプリケーションが使用するライブラリに存在する既知のセキュリティバグを自動的に検出し、アプリケーションを脆弱性から保護します。 依存性スキャンの結果はマージリクエストおよびパイプラインの画面に表示されます。 この機能は[Auto DevOps](の一部として利用できます。



アプリケーションのDockerイメージをビルドする際に、コードをデプロイする環境に既知の脆弱性が存在しないかGitLabで確認できます。 コンテナスキャンの結果はマージリクエストとパイプラインに表示されます。 この機能は[Auto DevOps](の一部として利用できます。



オンラインのアプリケーションに対して、GitLabのCI/CDパイプラインで動的アプリケーションセキュリティテスト(DAST)を実行できます。 これにより、アプリケーションにXSSや認証フローの不備のような脆弱性が存在しないかをテストできます。 テスト結果はマージリクエストとパイプラインに表示されます。 この機能は[Auto DevOps](の一部として利用できます。



[IAST]( は静的 / 動的アプリケーションセキュリティテスト方法の要素を組み合わせて、結果の全体的な品質を改善します。通常 IAST はライブラリの呼び出しなどを監視するために、エージェントを使用してアプリケーションを計測します。GitLab はまだこの機能を提供していません。


GitLab の脆弱性管理は、資産やアプリケーションの脆弱性スキャンを確実に行うためのもので 、脆弱性を記録、管理、緩和するプロセスも含まれています。 脆弱性管理は 、セキュリティ組織だけでなく、チーム全体で緩和、管理、対応が可能な、資産とアプリケーションコードの両方に存在する意味のある一連の脆弱性を特定するのに役立ちます。 また、~"devops::secure" ステージからの結果を管理するために、チームがすでに使用しているシステムと統一されたインターフェイスを 提供することで、セキュリティ結果を管理するための単一の信頼できる情報源として使用できます。



Cloud native network firewall provides container-level network micro segmentation which isolates container network communications to limit the “blast radius” of compromise to a specific container or microservice. A container-aware virtual firewall identifies valid traffic flows between app components in your cluster and limits damage by preventing attackers from moving through your environment when they have already compromised one part of it.

Learn more about Container Network Security

Container Host Monitoring and Blocking

"With Container Host Monitoring, you can monitor running containers for malicious or unusual activity. This includes process starts, file changes, or opened network ports. You can also block or prevent these activities from occurring."

Learn more about Container Host Monitoring and Blocking


アクセシビリティテストを実施することは、製品を利用するすべてのユーザーにサービスを提供するために重要です。 GitLab では、masterにマージする前にアクセシビリティレポートを自動的に生成することができます。





Compliance Dashboard

Compliance management within GitLab is easier with an aggregate view of all project activity. View the compliance status of your group in a fast, simple way. Easily spot when projects are out of compliance and take informed actions to remediate any issues.

Learn more about Compliance Dashboard