- Acquisition of [[Peach Tech]] and [[Fuzzit]]
- [Blog Post](https://about.gitlab.com/press/releases/2020-06-11-gitlab-acquires-peach-tech-and-fuzzit-to-expand-devsecops-offering.html)
- [Archive](http://web.archive.org/web/20200612000652/https://about.gitlab.com/press/releases/2020-06-11-gitlab-acquires-peach-tech-and-fuzzit-to-expand-devsecops-offering.html)
- __Acquisitions will make GitLab the first security solution to offer both coverage-guided and behavioral fuzz testing__
- **SAN FRANCISCO, CALIFORNIA — June 11, 2020 -** Today [GitLab](https://about.gitlab.com/),
the single application for the DevOps lifecycle, announced it has
acquired Peach Tech, a security software firm specializing in protocol
fuzz testing and dynamic application security testing (DAST) API
testing, and Fuzzit, a continuous fuzz testing solution providing
coverage-guided testing. These acquisitions will add fully-mature
testing solutions including protocol fuzzing, API fuzzing, DAST API
testing, and coverage-guided fuzz testing. This makes GitLab’s DevSecOps
offering the first security solution to offer both coverage-guided and
behavioral fuzz testing techniques as well as the first true DevSecOps
platform to shift fuzz testing left with these new offerings being made
available within the GitLab CI/CD environment.
- “We believe GitLab provides best-in-class tools for the complete
DevOps lifecycle on a single platform,” said Sid Sijbrandij, CEO of
GitLab. “Bringing the fuzzing technologies of Peach Tech and Fuzzit into
GitLab’s security solutions will give our users an even more robust and
thorough application security testing experience while enabling them to
shift security left. This simultaneously simplifies their workflows and
creates collaboration between development, security, and operations
teams.”
- In an era where open source software (OSS) continues to exponentially
gain momentum and organizations push towards a zero-trust model,
enterprise security concerns grow as potential threats and
vulnerabilities extend the available attack surface to a point where
even the largest businesses do not have the time nor resources to
effectively assess their security posture. [Fuzz Testing](https://about.gitlab.com/direction/secure/fuzz-testing/fuzz-testing/),
sometimes referred to as fuzzing, is the process of providing bad
inputs to a program to find bugs, crashes, and faults that could be
exploited. Successful automation of application security testing
combined with a “shift left” DevSecOps approach empowers development and
security teams to test early and often, as well as collaborate in
managing and lowering the organization’s overall security risk. The
addition of both coverage-guided and behavioral fuzz testing into the
DevSecOps toolchain helps organizations find vulnerabilities and
weaknesses traditional application security testing and quality
assurance (QA) testing techniques often miss as these findings may not
be directly tied to a known vulnerability (e.g. CVE IDs).
- Once Peach Tech and Fuzzit technologies are fully-integrated, GitLab
Secure customers will no longer need to depend on standalone fuzz
testing solutions to meet their application security testing needs.
Instead, they will have a fully-integrated security solution, from [Auto DevOps deployment](https://docs.gitlab.com/ee/topics/autodevops/)
of security testing to vulnerability management and remediation.
Furthermore, these acquisitions will allow GitLab to accelerate its
roadmap for interactive application security testing (IAST) by extending
Peach Tech’s DAST API security engine and Fuzzit’s crash correlation
technology.
- “Providing GitLab users with the best security testing tools is key
to GitLab's DevSecOps core mission," said Michael Eddington, Peach Tech
founder and CEO. "The integration of Peach Tech’s technologies expands
GitLab's shift security left capabilities making the future of security
and DevSecOps a reality today for all GitLab users."
- “Fully integrating Fuzzit will make GitLab the first security
solution that provides continuous coverage-guided fuzz testing natively
within the CI/CD pipeline," said Yevgeny Pats, Fuzzit founder and CEO.
"Fuzzit's support for multiple coverage-guided fuzzers combined with its
crash analysis and correlation technology will add an important
capability to the DevSecOps for GitLab users.”
- With the Peach Tech and Fuzzit technologies being incorporated into
GitLab’s DevSecOps platform, GitLab will further accelerate its
application security testing roadmap to bring developers a native and
seamless experience for discovering, fixing, and remediating security
vulnerabilities and weaknesses.
- GitLab provides accurate, automated, and continuous assessment of
your applications, which enables users to proactively identify
vulnerabilities and weaknesses to minimize security risk. GitLab’s
Secure stage is woven into the DevOps cycle to allow users to adapt
security testing and processes, not as an additional step nor tool.
- Please visit the [GitLab website](https://about.gitlab.com/direction/secure/) and watch the [video overview](https://youtu.be/G7pRWDKts_Q)
for more information regarding GitLab’s security strategy and direction
as well as to learn more about how GitLab enables your organization to
adopt [DevSecOps best practices](https://about.gitlab.com/solutions/dev-sec-ops/). GitLab was positioned as a Niche Player in the [2020 Gartner Magic Quadrant report for Application Security Testing](https://about.gitlab.com/press/releases/2020-05-11-gitlab-positioned-niche-players-quadrant-2020-gartner-magic-quadrant-application-security-testing.html) (AST).
- GitLab’s public handbook includes an [acquisition section](https://about.gitlab.com/handbook/acquisitions/)
which outlines the transparent approach the Company takes on Corporate
Development, from sharing a target company profile through to listing
the financial incentives it offers to teams.
- ### About GitLab
- GitLab is a DevOps platform built from the ground up as a single
application for all stages of the DevOps lifecycle enabling Product,
Development, QA, Security, and Operations teams to work concurrently on
the same project. GitLab provides a single data store, one user
interface, and one permission model across the DevOps lifecycle. This
allows teams to significantly reduce cycle time through more efficient
collaboration and enhanced focus. Built on Open Source, GitLab leverages
the community contributions of thousands of developers and millions of
users to continuously deliver new DevOps innovations. More than 100,000
organizations from startups to global enterprises, including
Ticketmaster, Jaguar Land Rover, NASDAQ, Dish Network, and Comcast trust
GitLab to deliver great software faster. GitLab is the world's largest
all-remote company, with more than 1,250 team members in more than 65
countries and regions.
- This is interesting because it's allowing GitLab to further vertically integrate into the [[DevOps]] space (see [[DevOps]] vertical integration)
- [[DevOps]] vertical integration
- Alan likes this document that outlines how integrated they've become in the stack (c. June 2020)
- 
-