GitLab 19.3 introduces bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution, letting teams triage and remediate entire vulnerability backlogs at once rather than one finding at a time. False Positive Detection scores whether a finding is a real risk, while Agentic SAST Vulnerability Resolution opens ready-to-merge fixes for confirmed risks. The features work across any scanner outputting SARIF, can be applied to existing backlogs or configured to run automatically on new Critical/High severity findings, and consume GitLab Duo Agent Platform credits at the same per-execution rate whether run individually or in bulk. Concurrency limits prevent bulk jobs from competing with pipeline build capacity, and jobs can be canceled mid-run.
Table of contents
Dismiss false positives and remediate vulnerabilities in bulkStart automating triage and clearing your backlog todayFAQQuestions this post answers
What new SAST features did GitLab add in version 19.3?
GitLab 19.3 adds SAST False Positive Detection and Agentic SAST Vulnerability Resolution, both usable in bulk on an existing vulnerability backlog. False Positive Detection analyzes a finding's surrounding code and returns a confidence score on whether it is a real risk, while Vulnerability Resolution opens a ready-to-merge fix for confirmed risks. It works on any SAST finding regardless of scanner origin or severity, including third-party findings imported via SARIF. Teams weighing automated SAST triage tools can track GitLab's rollout details on daily.dev.
Does running bulk vulnerability triage in GitLab cost more Duo Agent Platform credits than running it one finding at a time?
No, each finding costs the same per-execution rate whether triggered individually or as part of a bulk job. Bulk triage simply queues many findings at once instead of requiring them to be triggered manually one by one, and concurrency limits keep the bulk job from competing with the pipeline's other build capacity. Developers pricing out AI-assisted security tooling can follow cost details like this on daily.dev.
Are vulnerability exploitation attacks increasing as a breach entry point?
Yes, vulnerability exploitation overtook credential abuse as the top breach entry point, accounting for 31% of breaches versus 13% in previous years, according to Verizon's Data Breach Investigations Report. Only 26% of known exploited vulnerabilities were remediated, down from 38%, meaning more breaches now start with an unpatched vulnerability already sitting in production. Security teams tracking exploitation trends can follow breach data and remediation tooling news on daily.dev.