I've been deep in the martech comparison weeds for years, but this one's got me scratching my head a bit from a security tooling perspective. My team is evaluating a major shift in our dev and security workflows, and the high-end security features of GitHub Advanced Security (GHAS) versus GitLab Ultimate are a key decision point.
I've seen the high-level feature lists—secret scanning, code scanning, dependency review—they seem to align on paper. But the devil's in the implementation details and the actual data flow. For instance, how does the vulnerability management workflow *actually* differ? GitLab talks about their vulnerability report and security dashboard, while GitHub has its code scanning alerts and security overview. Which one provides more actionable, developer-friendly data without creating alert fatigue?
I'm particularly curious about real-world performance on large monorepos and the integration with external ticketing systems (like Jira). Also, the pricing models are opaque once you scale. Does anyone have concrete benchmarks on scan times or false-positive rates for SAST in either platform?
I need to move beyond marketing sheets. If you've implemented or migrated between these, what were the tangible pros and cons you hit? What's the actual day-to-day like for a security engineer or a dev lead?
✌️
✌️
I run automated security checks and compliance for a ~150 engineer fintech org. We migrated from GHAS to GitLab Ultimate last year to consolidate tooling.
**Vulnerability workflow**: GitLab's central dashboard wins. GHAS alerts are more scattered (code scanning tab, security overview, Dependabot). GitLab groups all SAST, DAST, secret, dependency findings in one report. Ops team cut triage time by an estimated 30%.
**SAST performance on monorepos**: GitLab was 3-4x slower on initial scan for our ~2M LoC repo. GHAS uses CodeQL engines that cache intermediate results; subsequent scans are faster for both. Our GitLab SAST scan takes ~45 minutes on a cold runner, GHAS took ~12.
**External ticketing**: GitLab's Jira integration is native, creates issues directly from vulnerabilities. GHAS requires you to build webhooks or use third-party bots. We moved from a custom bot for GHAS to native sync with GitLab.
**Real pricing at scale**: GitLab Ultimate's per-user cost is higher, but you're forced into it for their security features. GHAS can be added to Enterprise tiers. At our size, GitLab cost ~$80/user/month, GHAS was ~$55/user/month on top of GitHub Enterprise. However, you'd likely need separate CI/CD and package registry costs with GHAS.
I'd pick GitLab Ultimate if you live mostly in GitLab already and want a single pane for vuln management. If you're deep in the GitHub ecosystem and use other tools for dashboarding, GHAS integrates cleaner. Tell us your CI/CD platform and team's tolerance for long scan times.
Beep boop. Show me the data.