What CYBO Attest is

Attest is the authorization console for the cDSO pipeline. It reads scan results and pipeline outcomes from GitLab as they happen, evaluates a fixed gate policy against them, and presents the result to the three people who need it: the developer who has to fix or justify a finding, the reviewer who has to decide, and the risk owner who has to answer for the decision later.

What it does

Attest covers three jobs.

1. Review. The assessor sees each submission's gate results, evidence, and what changed since the last run, and approves or denies the review merge request. Explainable AI explains the gate state and the evidence in plain language. It does not make or sign the authorization decision; a named person does.
2. Security posture. A portfolio wide view of authorization state, vulnerability exposure, and build impact, for leadership and the CISO.
3. Engineer support. Each engineer sees their own applications ranked by what is blocking authorization, with one next action per container, the evidence in plain language, and guidance on remediation and justification.

What it does not do

Attest does not scan anything. The cDSO pipeline scans, and Attest reads what the pipeline publishes. Attest cannot change the pipeline or its policy; it sits on top and works with whatever the pipeline produces.

Attest does not approve anything. The first five steps of the process run without a person. The sixth is a person: a named reviewer approves under their own identity, and the platform enforces that. There is no bot and no acting on someone's behalf.

Attest does not hold your code or your evidence. Scan output lands in your own security repository in GitLab, in directories that are never rewritten and can be verified by hash. Every record Attest produces points back to a hash you can check yourself.

Transparent, traceable, on record

When we say the process is transparent, we mean something specific: you can follow the lineage from code commit to build pipeline to merge request to decision. Every screen in Attest can be traced back to the GitLab object it came from, and every decision records who made it, when, on what evidence, and the reason they wrote.

GitLab is the system of record. Every cache Attest keeps can be thrown away and rebuilt from GitLab. If the two ever disagree, GitLab is right.

Where it came from

Ulap partnered with Army Cyber and U.S. Cyber Command to build and operate cDSO, the framework that automates security scanning, testing, and approval of containerized software for IL5+ environments in days, not weeks or months. Ulap manages 130+ containers through it today.

CYBO Attest is built on that engine and extends it. What the pipeline produces arrives as raw output, log files, and markdown. Attest adds the part that was missing: Explainable AI that puts every verdict in plain language, and a console that walks developers, reviewers, and risk owners through submission, remediation, review, and approval, so nobody has to read a log file to find out where they stand.

None of that is specific to defense. A signed decision tied to evidence is what a SOC 2 auditor wants, what an ISO 27001 surveillance review wants, what the EU Cyber Resilience Act requires of software vendors selling into Europe, and what your largest customer's security questionnaire is really asking for.

Next

The seven steps walks through the process from push to record.