Use case, so all the reports from GitLeaks, DefectDojo, GitLeaks or dependency check or Trivy, they make reports, and we send this report to DefectDojo to have CVMs, Central Vulnerability Management. DefectDojo is Central Vulnerability Management. If you have a dashboard to set, we have vulnerability in this product, on this pipeline, and they expose that. It's easy for us to have a report for all our vulnerabilities.
Easy to use with efficient vulnerability reporting and team collaboration
What is our primary use case?
How has it helped my organization?
With the pipeline of detection and DefectDojo, we are able to see the real vulnerabilities, and we fix them.
What is most valuable?
The solution is easy to use and it is easy to share data with everybody. Setting the status of vulnerabilities in the product and being able to share the information with each team in our organization is helpful.
What needs improvement?
We need something to notify the team responsible for a product when vulnerabilities are found. We are able to attach a team or a manager for a product, however, we are not able to send them a notification that they have a vulnerability.
For how long have I used the solution?
We use all this product now for easily nine or ten months.
What do I think about the stability of the solution?
The solution is really stable. We are a government organization, so we have a lot of pipelines and a lot of applications. We are not Google or Microsoft or any other big company. We are a smart company with around 200 developers.
What do I think about the scalability of the solution?
We don't use a scalable solution. Actually, we don't use any scalable solution for DefectDojo.
How are customer service and support?
We don't receive any customer service from DefectDojo. We support ourselves.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
We tested multiple other solutions, like Microsoft's solution. That said, they don't have a lot of flexibility like DefectDojo. Other products have a high cost.
How was the initial setup?
The solution is easy to install and easy to use.
One person handles maintenance. They check for any new version, update it, and start the pipeline.
What was our ROI?
The solution is free. The most important thing is it's easy to see our vulnerabilities, make modifications, and avoid big problems.
What's my experience with pricing, setup cost, and licensing?
The pricing is great. It is much cheaper compared to other solutions. We don't want to pay for things we are able to do on our own.
Which other solutions did I evaluate?
We evaluated Microsoft Defender Vulnerability and another solution. I don't recall the name.
What other advice do I have?
The solution is easy to install, easy to use, and easy to integrate with all other products. Any security product is easily integrated since it has a connector with DefectDojo. I'd rate the solution eight out of ten.
Which deployment model are you using for this solution?
On-premises
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Other
