Where GitLab Ultimate is stronger
If these matter most, Ultimate is the simpler answer.
GitLab Ultimate security features, on GitLab Free or Premium
GitLab Ultimate puts vulnerability management inside GitLab. On Free and Premium some scanners still run, but their results are downloadable reports. MopokeHQ gives Free and Premium teams a different path, and your GitLab tier stays the same.
The short answer
Choose GitLab Ultimate if
You want every security result inside GitLab, security approval policies on merge requests, and one vendor for everything.
Choose MopokeHQ if
You want to stay on Free or Premium, you need proof that a fix reached production, or you are an agency that has to tell clients what was fixed.
What GitLab Free and Premium give you
From GitLab’s own documentation, checked on 23 October 2026. GitLab ships monthly, so follow the links for the current state.
| Capability | Free and Premium | Ultimate |
|---|---|---|
| SAST with open-source analysers | Yes, downloadable JSON report | Included |
| Pipeline secret detection | Yes, downloadable output | Included |
| Container scanning | Yes, JSON report and CycloneDX SBOM as artifacts | Included |
| Dependency scanning | Not included | Included |
| Continuous vulnerability scanning | Not included | Included |
| Vulnerability report | Not included | Included |
| Security dashboards | Not included | Included |
| DAST | Not included | Included |
| Security policies | Not included | Included |
- Everything is in GitLab. Developers see findings in the merge request and the vulnerability report without opening another app.
- Security policies can require approvals before a merge.
- Advanced SAST does cross-file, cross-function analysis.
- DAST is built in.
- One vendor, one contract, one place to manage users.
- Hosting choice: GitLab.com, self-managed, or GitLab Dedicated.
What MopokeHQ adds on Free or Premium
One CI include line runs a pinned scanner image on your own runners. MopokeHQ matches the results against new advisories, ranks them, tracks fixes until they are live, and keeps the evidence.
How it works- Dependency scanning without Ultimate. The
mopokeCLI builds an SBOM with syft on your runner. - Continuous re-matching. Every stored SBOM is re-checked when an advisory lands, including last month’s builds.
- Priority you can explain. CVSS, CISA KEV, EPSS, live confidence and project criticality, with SLAs of 48 hours, 14 days and 30 days.
- Proof a fix is live. An exposure closes on its own only when the fixed version is seen deployed.
- Gates that ignore old debt. Merge request pipelines fail only on new findings.
- Client notices and evidence packs for agencies and audits.
Feature comparison
| GitLab Free or Premium | GitLab Ultimate | Free or Premium with MopokeHQ | |
|---|---|---|---|
| Dependency scanning (SBOM) | No | Yes | Yes, SBOM built by syft on your runner |
| Re-match old builds against new advisories | No | Yes, from the default-branch SBOM | Yes, every stored SBOM |
| Findings shown inside GitLab | Downloadable reports only | Yes, merge requests and vulnerability report | Merge request comments, full view in MopokeHQ |
| Merge request gate | No security policies | Security approval policies | Fails on a new critical, new secret or new known-exploited dependency |
| Fix merge requests | No | Vulnerability resolution features | mopoke act opens them from your runner |
| DAST | No | Yes | ZAP baseline, ZAP active opt-in inside your window |
| Advanced SAST | No | Yes | No. SAST arrives as SARIF, Semgrep by default |
| Client notices and white-label portal | No | No | Yes |
| Evidence packs for ISO 27001 A 8.8, SOC 2 CC7.1, Essential Eight | No | See GitLab’s compliance features | Yes, PDF plus JSON with chain hashes |
| Pricing basis | Per user | Per user, custom pricing | Your GitLab tier, plus MopokeHQ by active project with unlimited users |
| Where data is stored | Your GitLab hosting | Your GitLab hosting | MopokeHQ data in Sydney |
How the pricing models differ
GitLab lists Premium at US$29 per user per month, billed annually, and Ultimate at custom pricing (checked 23 October 2026). Moving to Ultimate changes the price for every user.
MopokeHQ is priced by band of active projects. Users are unlimited, including client portal viewers.
How MopokeHQ pricing worksSelf-managed GitLab behind a firewall
MopokeHQ never connects into your network. The CLI runs on your runners and uploads. Fix merge requests come from mopoke act on a schedule in your runner, so MopokeHQ needs no write access to GitLab.
Questions
Is dependency scanning available on GitLab Premium?
No. GitLab’s documentation lists dependency scanning as an Ultimate feature (checked 23 October 2026). MopokeHQ builds an SBOM on your runner, so you get dependency findings on Free or Premium.
How much does GitLab Ultimate cost?
GitLab’s pricing page shows custom pricing for Ultimate, and US$29 per user per month, billed annually, for Premium (checked 23 October 2026).
What security features do GitLab Free and Premium include?
SAST, pipeline secret detection and container scanning run on every tier, and on Free and Premium their results are downloadable reports. The vulnerability report, merge request findings, security dashboards, DAST and security policies are Ultimate features.
Is GitLab Ultimate worth it just for security?
It depends on how many users you have and whether you need security policies inside GitLab. Ultimate is priced per user. MopokeHQ is priced by active projects with unlimited users.
Does MopokeHQ replace GitLab Ultimate?
For security results on Free or Premium it covers dependency scanning, continuous re-matching, priority, fix merge requests and evidence. It does not add GitLab’s security approval policies or Advanced SAST inside GitLab.
Does MopokeHQ work with self-managed GitLab behind a firewall?
Yes. The CLI runs on your runners and uploads. MopokeHQ never connects into your network.
Put a mopoke on night watch
One job in your CI pipeline. Your first SBOM is matched against every advisory we hold within minutes.