Challenges
Solution
Results
What is most valuable?
Key quote
What’s next
What is our primary use case?
We use it for secrets detection.
How has it helped my organization?
Before we had GitGuardian we were "blind." We had no detections, which was very bad. We were using another product on GitHub, similar to GitGuardian, but it was not really as good as GitGuardian. The graphical interface and the detail GitGuardian gives you are really amazing. And there are fewer false positives than any other platform. We are able to notify developers of issues on the spot and tell them, "You have exposed a secret." It is absolutely brilliant.
It has definitely helped to efficiently support a shift-left strategy. Before this, we didn't have any detection, and we had a lot of false positives with other products. That meant people were spending and wasting a lot of time on false positives. That is not the case now.
GitGuardian has fewer false positives, which is very advantageous. It has decreased our false positives by a minimum of 20 percent. The secrets detection is more accurate.
Before, we had 20 false positives for every real incident. Now, we only get the one, real incident.
In terms of developers and our security team collaborating on remediation, GitGuardian has made everyone feel better. Usually, for developers, security is an overhead, but GitGuardian has never been an overhead. It is always helping developers understand where they did something wrong, and the need to fix it. That's what has allowed us to protect the developers and the company assets from security breaches.
What is most valuable?
The scope of GitGuardian's detection capabilities is better than anything else. When they give you a description of what happened, it's really easy to follow and to retest. And the ability to retest is something that you don't have in other solutions. If a secret was detected, you can retest if it is still there. It will show you if it is in the history.
It also helps to quickly prioritize remediation.
They provide a score and, although it depends on the context, because what GitGuardian might say is a high-risk vulnerability might not be for us, it does the job properly. The scoring it gives is amazing.
What needs improvement?
There is room for improvement in GitGuardian on Azure DevOps. The implementation is a bit hard there. This is one of the things we requested help with. I would not say their support is not good, but they need them to improve in helping customers on that side.
For how long have I used the solution?
I have been using GitGuardian Internal Monitoring for the last year.
What do I think about the stability of the solution?
Every single time I have accessed the platform, it has been available. And every single time I tried to use a feature, it was working. The stability is spot-on.
What do I think about the scalability of the solution?
In the beginning, they were covering GitHub and then they started doing Azure DevOps. It is scalable and they are getting there.
As long as our company grows and we have more developers, we are going to increase our usage of GitGuardian. It's becoming a very heavy-duty tool that we depend on every single day.
How are customer service and support?
GitGuardian's support is amazing. They helped us to set it up properly all the way. And whenever we give them feedback, they take it into consideration, if it is a new feature. And if it is a bug, they work on it and fix it. The support is superb.
Which solution did I use previously and why did I switch?
How was the initial setup?
The preparation needed on our side to start using GitGuardian wasn't anything out of the normal. It included the types of activities we have had to do with any other product. The onboarding was really good because they were there. They helped us the entire time.
Between developers and security personnel, we have about 25 users, but it does not require any type of maintenance on our side.
What about the implementation team?
What was our ROI?
There's no direct return on investment. Security is overhead, but at least I'm sure that we are protecting our company assets, and that's a return on its own.
What's my experience with pricing, setup cost, and licensing?
The pricing and licensing are fair. It isn't very expensive and it's good value.
Which other solutions did I evaluate?
We evaluated Dependable and GuardDuty. One of the main differences between these solutions and GitGuardian is the interface. The GitGuardian GUI is very good and much easier to use than anything else. It's very user-friendly. It gives you what you want. You can do as much filtering as you want.
And another important difference over other technologies is that GitGuardian has fewer false positives, which is very advantageous. Dependable and Guard Duty give you things that are not relevant or that are false positives, at times. That does not happen often with GitGuardian.
What other advice do I have?
If someone at another company were to say to me that secrets detection is not a priority, I would say that's not a very smart approach.
Secrets detection is a very essential part of security. It's one of the basics that you need to cover all the time.
Otherwise, you're going to expose your endpoints online and you're going to suffer endless attacks. You definitely need to have secrets detection tools. We use a combination of tools, but GitGuardian is my preferred tool.
When it comes to application development, secrets detection is essential to a security program. You need to have it. Otherwise, you'll fail.
In this technology, nothing is perfect yet and it's going to take time. But so far, GitGuardian is the best I've seen. Overall, it's a very good product.
