GitGuardian Platform

We are leveraging GitGuardian Platform first to augment governance over security control mechanisms in relationship from the developer through the CI/CD process out to resources such as vaults and so on, so that we can get active control over how security is, what is security, and how we can improve it.

For instance, we envision using GitGuardian Platform with developers using IDEs or APIs, AI tools, operating through the automated pipelines of CI/CD, up to a vault out there in the cloud environment that contains the security rules that we have in play. We want to watch that process, whether it be a container, an artifact, or a pipeline, and see how, first, what is it? And then secondly, how can we improve it? So that we can use security key template models versus access account models.

We are also wanting to gravitate from the strategy of using traditional style security templates that require account access, ID/user password models, and use GitGuardian Platform to develop a strategy to use API keys and signature encryption keys instead. To do that, we need a tool that gives clear transparency for that requirement.

GitGuardian Platform has positively impacted our organization during the evaluation phase as this is a new realm. These are new tools, and they do not really have a standard. So the key thing by working with this is to get a better sense overall of the guardianship and governance, setting the standard for what that inevitable gold standard needs to be when working with these kinds of tools.

A gold standard for my organization using GitGuardian Platform would look like using the guardian process to establish the regular nature of a code update process from the developer who initiates the code change through the guidelines that they have to follow, which will not allow them to do anything else except for the steps that are required to be tested with quality assurance and walk through a regimented series of processes that have human intervention involved in that process to make sure that they clear the proper security requirements.

I think GitGuardian Platform could add value and help regulate unnecessary man hours in a phased approach. Using the governance platform to help cover what we would have normally done with man hours would be a value add. The more important thing is it shows transparency of compliance, which is a very important detail.

GitGuardian Platform has good integration with Git. It works well with pull requests and Git actions. It does not have too much difficulty with Docker images, different CI/CD environments, Ansible, Puppet, and so on. The current integration to Confluence, Jira, and Slack for working with different environments is valuable for bringing the common form of tools into this particular style tool and having ease of work with those environments.

All integrations including Git, Jira, Slack, and CI/CD environments add value for our team, but they have to happen in a specific process because the actions generate analytics. Those analytics drive up through Jira and Confluence and so on to generate analytic reporting. It is all important, and there is not just one tool.

GitGuardian Platform meets the CDE security requirements guidelines specified for secops and infosec. I would describe the overall user experience and interface design of GitGuardian Platform as usable and functional.

I think it would be advantageous to see GitGuardian Platform's CI/CD protection get better developed because of the new adaptations that are coming with CI/CD. More flexibility regarding installations versus code updates versus bug fixes versus incidents in which we will generate RCA reports, and that they also concur with this same tool, would be beneficial. All of that needs to be clearly and transparently shown in this tool.

GitGuardian Platform can be improved with better analytics and better analytics integration, specifically with Confluence for generating leadership levels of reports so that leadership can translate all of this information into something that is viable for the profit loss margins that they have to address each month.

I chose seven out of ten because better and more seamless dashboard analytics design and better analytics integration would help it get to a higher score for me.

Regarding GitGuardian Platform's AI capabilities, its accuracy and reliability of output is getting there, but along with all the new introductions of AI services versus chat forms, there is still a lot to be desired about the functionality and the integration. It is something that is ongoing because this year is the year that these features and functions are coming in. I expect it to improve over time, and that will improve the reliability and output as well.

The biggest challenge my team has faced so far with GitGuardian Platform is integration, specifically integrating it to everything.

GitGuardian Platform is currently in the evaluation phase.

GitGuardian Platform is stable.

We have not gotten to the point where we can initiate scalability with GitGuardian Platform. Right now, we are establishing the framework of the services and their roles and then look to scale it across multiple clouds.

GitGuardian Platform's documentation has been helpful during my evaluation.

GitGuardian Platform's customer support has been good so far.

I rate GitGuardian Platform's customer support an eight on a scale of one to ten.

We did not previously use a different solution. We used open source and manual processes. Now we are looking for a consolidation platform to do the same work.

GitGuardian Platform is deployed in a mixture, usually between a hybrid cloud and on-premise. For my hybrid cloud deployment, we use an on-premise localized cloud deployment.

Integrating GitGuardian Platform with my existing tools and workflows during my evaluation has been fifty-fifty, because some of their APIs are custom made.

The reason the learning curve for GitGuardian Platform is so high is because I am introducing a whole new platform to what we already know, and that process is nothing we are familiar with. So there is a learning curve.

I would expect GitGuardian Platform to not require hiring additional resources, but to more effectively use the resources we have on hand now regarding return on investment.

Regarding my experience with pricing, setup cost, and licensing, we have not identified what the licensing model will look like depending on how much of the compliance components we will use versus cost. We are still working that out with the reps.

The main factors that influenced my decision to evaluate GitGuardian Platform over other solutions include the need for a centralized single pane of glass of governance and compliance, which has been very fractured over the past three years. But now companies are starting to understand what these look like.

Before choosing GitGuardian Platform, I am in evaluation of three different vendors. I cannot disclose those at this time due to NDA agreements, but GitGuardian Platform is and was actively being compared to two other vendors at this time.

The most critical advice I would give to others looking into using GitGuardian Platform is to understand that it is brand new technology and a brand new standard, with nothing truly written in stone. The learning curve will be significant as an adaptation is put in place. The key thing is to fully know all of your key tools that you use in your CI/CD processes, as well as planning for future tools, so that you can properly map the right compliance tool that supports those tools you have picked and become part of your platform.

I am not in it that much yet to get a full scope of its yearly add-ons or features and improvements regarding how satisfied I am with the pace of innovation and new features being released by GitGuardian Platform. But for now, they are adequate.

I rate GitGuardian Platform a seven out of ten.