Security dashboards | GitLab Docs Skip to main content Go to GitLab Docs homepage What's new? What's new? Get free trial Toggle menu * Use GitLab * GitLab Duo * GitLab Orbit * Extend * Install * Administer * Subscribe * Contribute * Solutions Getting started Tutorials Manage your organization Organize work with projects Plan and track work Manage authentication and authorization Use Git Manage your code Use CI/CD to build your application Secure your application Getting started Tutorials AI Governance Application security Compliance Detect Triage Security center Security dashboard Vulnerability report Risk assessment data Severity levels Analyze Remediate GitLab advisory database CVE ID requests Policies Security glossary Deploy and release your application Manage your infrastructure Monitor your application Analyze GitLab usage Release notes Feature support Find your GitLab version * GitLab Docs / * Use GitLab / * Secure your application / * Triage / * Security dashboard Help us learn about your current experience with the documentation. Take the survey . Security dashboards * Tier : Ultimate * Offering : GitLab.com, GitLab Self-Managed, GitLab Dedicated History * New dashboard with advanced search introduced in GitLab 18.6 with feature flags named project_security_dashboard_new and group_security_dashboard_new . The flags are disabled by default. * New dashboard with advanced search enabled on GitLab.com, GitLab Self-Managed, and GitLab Dedicated in GitLab 18.7. * New dashboard with advanced search generally available in GitLab 18.8. Feature flags project_security_dashboard_new and group_security_dashboard_new removed. GitLab 18.6 introduced an improved version of the security dashboards that use advanced vulnerability management . The new dashboards are enabled by default on GitLab.com and GitLab Dedicated. GitLab Self-Managed users must enable advanced vulnerability management to access the new dashboards. If your organization has not enabled advanced vulnerability management, see legacy security dashboards . Security dashboards History * New dashboard that uses advanced vulnerability management introduced in GitLab 18.6 with feature flags named project_security_dashboard_new and group_security_dashboard_new . The flags are disabled by default. * New dashboard enabled on GitLab Self-Managed and GitLab Dedicated in GitLab 18.7. * New dashboard generally available in GitLab 18.8. Feature flags project_security_dashboard_new and group_security_dashboard_new removed. Use security dashboards to assess the security posture of your applications. GitLab provides you with a collection of metrics, ratings, and charts for the vulnerabilities detected by the security scanners run on your project. The security dashboards provide the following data: * Vulnerability trends over a 30, 60, or 90-day time frame for all projects in a group. * The total number of open vulnerabilities by severity. * The total risk score to compare vulnerability risk across projects. Prerequisites To view the security dashboard for a project, a group, or an organization, you must have: * The Security Manager, Developer, Maintainer, or Owner role for the group or project. * The Owner role for the organization. * At least one security scanner configured in your project. * A successful security scan performed on the default branch of your project. * At least one detected vulnerability in the project. * Advanced vulnerability management with Advanced search enabled. The security dashboards show results of scans from the most recently completed pipeline on the default branch . Dashboards are updated with the results of completed pipelines run on the default branch. They do not include vulnerabilities discovered in pipelines from other un-merged branches. Viewing the security dashboard History * Organization security dashboard introduced in GitLab 19.3 with a feature flag named organization_security_dashboard . Disabled by default. The security dashboard shows filterable charts and panels built with data from vulnerabilities detected in the default branch. Charts and panels include only open (needs triage or confirmed status) vulnerabilities and exclude those that are no longer detected. You can view a security dashboard for a project, a group, or an organization. Each dashboard provides a unique viewpoint into your security posture. All three dashboards include: * Charts * Vulnerabilities over time * Vulnerability severity panels * Risk score * Vulnerabilities by age * Top 10 CWEs * Filter the entire dashboard The SAST triage and remediation funnel chart and the Export as PDF option are available only on project and group dashboards. To view the project or group security dashboard: * In the top bar, select Search or go to and find your project or group. * In the left sidebar, select Secure > Security dashboard . To view the organization security dashboard: * In the top bar, select Search or go to and find your organization. * In the left sidebar, select Secure > Security dashboard . Project security dashboard The project security dashboard shows vulnerabilities detected in the project s default branch. It includes: * The Vulnerabilities over time chart, which includes up to 90 days of history. * The Severity panels , which show open vulnerabilities by severity. * The Risk score panel, which shows the overall security risk of the project. * The Vulnerabilities by age chart, which groups open vulnerabilities by age buckets. * The Top 10 CWEs chart, which shows the 10 most common CWEs. * The SAST triage and remediation funnel chart, which shows how critical and high SAST vulnerabilities progress from detection to fix, including the stages handled by GitLab Duo. Open vulnerabilities are those with Needs triage or Confirmed status. Closed vulnerabilities with Dismissed or Resolved status are not included in these charts. Group security dashboard The group security dashboard provides an overview of vulnerabilities found in the default branches of all projects in a group and its subgroups. The group security dashboard supplies the following: * The Vulnerabilities over time chart, which includes up to 90 days of history. * The Severity panels , which show open vulnerabilities by severity. * The Risk score panel, which shows total risk and risk for each project. * The Vulnerabilities by age chart, which groups open vulnerabilities by age buckets. * The Top 10 CWEs chart, which shows the 10 most common CWEs. * The SAST triage and remediation funnel chart, which shows how critical and high SAST vulnerabilities progress from detection to fix, including the stages handled by GitLab Duo. Organization security dashboard History * Introduced in GitLab 19.3 with a feature flag named organization_security_dashboard . Disabled by default. The availability of this feature is controlled by a feature flag. For more information, see the history. This feature is available for testing, but not ready for production use. The organization security dashboard provides an overview of vulnerabilities found in the default branches of all projects in the organization. The dashboard includes: * Vulnerabilities over time : A chart with up to 90 days of history. * Severity panels : Panels that show open vulnerabilities by severity. * Risk score : A panel that shows total risk and the risk for each project. * Vulnerabilities by age : A chart that groups open vulnerabilities by age. * Top 10 CWEs : A chart that shows the 10 most common CWEs. The SAST triage and remediation funnel chart and the Export as PDF option are not available on the organization security dashboard. Charts Security dashboards include several charts that help you understand and act on vulnerabilities in your projects and groups. Vulnerabilities over time The Vulnerabilities over time chart is available on project, group, and organization dashboards. It shows the open vulnerabilities trends over 30-day, 60-day, or 90-day periods. The default range is 30 days. GitLab retains vulnerability data for 365 days. Use the chart to identify when vulnerabilities were introduced and how they change over time. To view details: * Hover over a data point to see the vulnerability count for that day. * Use the time frame selector to switch between 30, 60, or 90 days. * Drag the range handles ( ) to zoom in on a specific period. * Use the dropdown to filter by Severity (for example, Critical , High , Medium ) * Use the buttons to group the data by either of the following options: * Severity : Critical, high, medium, low, info, and unknown. * Report type : SAST, DAST, and dependency scanning and others. * To explore data beyond 90 days, but within the last 365 days, use the SecurityMetrics.vulnerabilitiesOverTime GraphQL API Vulnerability severity panel The vulnerability severity panel shows the total number of open vulnerabilities by severity . To view details: * In the severity panel, locate the severity you want to investigate. * Select View . * The vulnerability report opens and includes only vulnerabilities of that severity. * Any page-level filters you have set are also applied. Risk score panel History * Risk score panel for group dashboards: * Introduced in GitLab 18.6 with a feature flag named security_dashboard_risk_score . Disabled by default. * Enabled on GitLab.com, GitLab Self-Managed, and GitLab Dedicated in GitLab 18.7. * Generally available in GitLab 18.8. Feature flag security_dashboard_risk_score removed. * Risk score chart for project dashboards: * Generally available in GitLab 18.11. The risk score panel shows the overall security risk for the group or project. The panel has two views: * The No grouping (default) view shows the total risk score of the group: * The circular gauge shows the calculated risk score in the center. * The color bars indicate the risk level: * Green: Low risk * Yellow: Medium risk * Orange: High risk * Red: Critical risk * Select Project to compare risk scores for each project: * Each project tile is color-coded according to the project s risk level. * Hover over a tile to see details, including the project name and risk score. * Select a tile and select the project s name to open that project s vulnerability report. Risk scores are calculated from multiple factors, including: * Severity of vulnerabilities * Age of vulnerabilities * KEV (Known Exploited Vulnerabilities) status * EPSS (Exploit Prediction Scoring System) score Vulnerabilities by age History * Vulnerabilities by age chart for project dashboards: * Generally available in GitLab 18.11. The Vulnerabilities by age chart is available on project, group, and organization dashboards. It shows the distribution of unresolved vulnerabilities based on the amount of time after they were first detected. You can group vulnerabilities by severity or by report type, helping you identify where remediation activities may be needed. To view details: * Hover over a data point to see the vulnerability count for that age grouping. * Use the dropdown list to filter by Severity (for example, Critical , High , Medium ) * Use the buttons to group the data by either of the following options: * Severity : Critical, high, medium, low, info, and unknown. * Report type : SAST, DAST, and dependency scanning and others. Top 10 CWEs History * Introduced in GitLab 18.11 with a feature flag named new_security_dashboard_vulnerabilities_by_identifier . Enabled by default. * Generally available in GitLab 19.0. Feature flag new_security_dashboard_vulnerabilities_by_identifier removed. The Top 10 CWEs chart is available on project, group, and organization dashboards. It shows the 10 most common CWE identifiers associated with the open vulnerabilities in the project, group, or organization. To view details: * Hover over a data point to see the total number of vulnerabilities of each CWE type. * Use the dropdown list to filter by Severity (for example, Critical , Medium , or High ). SAST triage and remediation funnel History * Introduced in GitLab 19.3 with a feature flag named security_dashboard_agentic_adoption . Enabled by default. * Generally available in GitLab 19.4. Feature flag security_dashboard_agentic_adoption removed. The SAST triage and remediation funnel chart is available on group and project dashboards. It shows how critical and high SAST vulnerabilities progress through triage and remediation over a 30, 60, or 90-day period. The default range is 30 days. The funnel has up to four stages. Each stage shows the number of vulnerabilities that reach it: * Critical & High SAST vulnerabilities : Vulnerabilities detected by SAST. * True positive : Vulnerabilities confirmed as true positives by SAST false positive detection . * Vulnerabilities with AI-created MRs : Vulnerabilities with a merge request created by Agentic SAST Vulnerability Resolution . * Vulnerabilities fixed : Vulnerabilities fixed by a merged AI-created merge request. Use the time frame selector to switch the funnel between 30, 60, or 90 days. The last three stages use GitLab Duo. To populate these stages: * Turn on GitLab Duo for the group and its projects. * Configure SAST false positive detection . * Configure Agentic SAST Vulnerability Resolution . When one of these features is turned off, the funnel replaces the affected stages with a message that explains which feature to turn on. The message differs for project and group dashboards, and by which feature is unavailable. Filter the entire dashboard You can filter results at two levels: * Dashboard filters : Apply to the entire dashboard. All charts update when you use these filters. * Chart and panel filters : Apply only to the chart or panel you are viewing. Available dashboard filters include: * Report type : Filter by scanner, including SAST, DAST, dependency scanning, and others. * Project : Limit results to specific projects. Available on group and organization security dashboards. On the group security dashboard, you can also filter by: * Security attributes : Filter by the security attributes applied to your projects, which include categories for business impact, application, business unit, internet exposure, and location. These filters can be inclusive (using the is one of operator) or exclusive (using the is not one of operator). To configure your security attributes and apply them to projects, see security attributes . Dashboard filter behavior: * Filters apply immediately across all dashboard charts and panels. * Filters that you apply continue to apply throughout your session unless you remove them. * When you open a vulnerability report from the dashboard, active filters are automatically applied to the vulnerability report. To apply a filter to the whole dashboard: * In the filter bar at the top of the dashboard, select Filter results . * From the dropdown list, choose the filter type. * Select one or more filter values. Export as PDF History * Introduced in GitLab 18.10 with a feature flag named new_security_dashboard_pdf_export . Disabled by default. * Enabled on GitLab.com, GitLab Self-Managed, and GitLab Dedicated in GitLab 18.11. * Generally available in GitLab 19.0. Feature flag new_security_dashboard_pdf_export removed. You can export the security dashboard as a PDF for use in reports and presentations. The export captures the current state of all of the charts and panels in the dashboard, including any active filters. To export the dashboard as a PDF: * In the top bar, select Search or go to and find your project or group. * In the left sidebar, select Secure > Security dashboard . * Optional. Apply filters to customize the data included in the export. * Select Export as PDF . Legacy security dashboards * Offering : GitLab Self-Managed GitLab Self-Managed customers that have not enabled advanced vulnerability management cannot access the latest security dashboards. In this case, you still have access to the legacy security dashboards. Security dashboards are used to assess the security posture of your applications. GitLab provides you with a collection of metrics, ratings, and charts for the vulnerabilities detected by the security scanners run on your project. The security dashboard provides data such as: * Vulnerability trends over a 30, 60, or 90-day time-frame for all projects in a group * A letter grade rating for each project based on vulnerability severity * The total number of vulnerabilities detected within the last 365 days including their severity Use security dashboard data to improve your security posture. For example, the 365-day trend view shows which days had a spike in vulnerabilities. Examine the code changes from those days to perform a root-cause analysis and build better policies to prevent future vulnerabilities. For an overview, see Security Dashboard - Advanced Security Testing . Prerequisites for the legacy dashboards To view the security dashboards, the following is required: * You must have the Developer role for the group or project. * At least one security scanner configured in your project. * A successful security scan performed on the default branch of your project. * At least 1 detected vulnerability in the project. The security dashboards show results of scans from the most recent completed pipeline on the default branch . Dashboards are updated with the results of completed pipelines run on the default branch; they do not include vulnerabilities discovered in pipelines from other un-merged branches. Viewing the legacy security dashboard The security dashboard can be seen at the project, group, and the Security Center levels. Each dashboard provides a unique viewpoint of your security posture. Project security dashboard The Project security dashboard shows the total number of vulnerabilities detected over time, with up to 365 days of historical