GitLab CEO on why AI isn't helping enterprise ship code faster

Key Takeaways

[music] GitLab is the most comprehensive intelligent DevSec ops platform for software innovation. [music] GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce [music] security and compliance risk and accelerate digital transformation. Welcome back to the new [music] stack makers and our guest today is Bill Staples, the CEO of GitLab. Hey everyone, >> Bill, thank you so much for being here. I've covered GitLab for so long, but for some reason we've never gotten the chance to to talk. >> Yeah, thank you so much for having me today. And you said new CEO and it's been a year, a year already. I can't believe it. >> And and and even in this age of AI, a year feels like it's five years. So really, that's [laughter] >> true. In some ways, it seems like it's only been a few months because it has gone so fast. In other ways, I feel like I'm 10 years older. [laughter] >> Why is that? >> Well, you know, I one of the reasons I was so excited to join GitLab is I've been serving developers as a customer for many years, you know, building software at Microsoft and Adobe and then last New Relic before GitLab. I've had developers and engineers, software engineers as a customer for many different products and across all of those companies and um I love having them as customers and so GitLab was a natural, you know, place to go. But also in this age of AI where I see AI completely transforming the world of software engineering, what better place to be than kind of where the heart of software engineering happens for more than half of the Fortune 100 uses GitLab, you know, to run their software factories. So I wanted to be part of it both because of the impact it lab has but also to be part of this transformation for developers which is the most exciting I've ever seen in in 30 years of doing this. I'm more excited about the future of software engineering than I've ever been. >> You weren't that excited about the mobile revol? No, I'm just kidding. [laughter] Well, it was fun as a consumer, but you know, AI [clears throat] is AI is just dramatically changing >> the speed the the the way that we build software and I just can't wait to be, you know, part of that and hopefully um contribute to that in the history books. >> Totally. Now, you came in just over a year ago and we've seen a lot of changes in AI, but I'm always interested in kind of what changes you brought to GitLab as well in ter especially in terms of speeding up in this world of AI. >> Yeah, I spent my first quarter um really out talking to customers. I think I talked to over 60 customers in a 100 days. And um also then spent a lot of time listening to the team, what we were building, what our road maps were, and then kind of trying to marry the two and really assess are we going the direction customers want? Are we going fast enough relative to competition? And you know, how can I help? Um, as a CEO, one of the things that I observed as I was talking to customers is just how hungry every organization is right now to adopt AI. I was a little surprised honestly because you know GitLab serves customers of all sizes in all verticals but one of the places where impressively strong is with larger enterprises highly regulated you know environments financial services um uh public sector and those kinds of customers and typically they move pretty slow but frankly they are all in on AI as well and they're working for vendors who can do that with a level of control, with security, with privacy, you know, with governance in mind because they obviously have high stakes with their software and um it was exciting to hear that they were so ready and hungry for solutions with AR. >> Yeah, those are not exactly the the the verticals where we think things move quickly. But why do you think that is? Why do you Because often when I talk to some more consumer oriented companies, there's a lot of FOMO there as well, right? But for those companies, that's not necessarily or companies, those organizations, that's not always the case. >> Yeah. Um I think it's because everyone, you know, there's a certain magic with software. um both as a consumer of it, when you use it and you're using a really great piece of software, you can it feels like magic sometimes like how it empowers you, the things you can get done with software. And it's also a magical experience to create software. And that's been limited to so few people with the level of technical depth and skill to, you know, handcode very um specialized computer languages to create software. And everyone by now has seen sort of the vibe coding and more agentic approaches to software engineering. And you can't help but see that and say, "Wow, like that is going to open up the opportunity to create way more software and higher quality software if we can make that real." And so I think they're seeing that and they're also wondering like a is that real and b how do I make sure I build the software that can meet the security and the compliance and you know the the guardrails that I'm I'm under as an organization and so that's a really exciting thing and that's really what I've been focusing on with GitLab is you asked earlier like what I've changed or how it's adjusted under my leadership and I think one of the things that I've helped the company do is realize that there's a huge opportunity for us as a full software life cycle company to bring an agentic approach to software engineering. If you look at what you know uh co-pilot originally did with uh from Microsoft bringing Agentic uh sorry build building AI based coding into the IDE and then you see the the follow on with Windurf and Cursor and now you see you know with cloud code and codeex uh CLI based approach to uh agentic based coding you see this transformation information of like how fast code can be built and and the level of sort of steering and interaction between the engineer and the AI doing the code. you see that accelerating and and going higher and higher level um with you know now CLI based approaches starting to dominate the way that engineers are writing code but it's all focused around code and as we've you know as we've studied for more than a decade how engineers not only write code but take it from idea all the way through production we know that there is a lot of work required to do that and the coding is just one little part and uh in fact when I go talk to customers it's it was fascinating they would say hey like we you know we've invested we're we're using these coding tools our engineers you know love them but we're not seeing an acceleration in our uh innovation velocity we're not delivering more software faster and that was a kind of aha moment for me and the team in terms of how we adjust our strategy >> yeah we should talk about that a little bit this paradox right we're creating more code faster But we're not really shipping more code faster. At least a lot of organizations don't. And that's where I think it comes down to a platform like yours to break down those bottlenecks and figure out ways to to speed up the rest of the process that is not just coding. >> Exactly. You know, I'm sure there are startups um maybe green field projects where there are very few constraints, no legacy code, no compliance or security guard rails that you're under where where today using you know just cloud code you can go way faster than maybe hand coding things. for the you know for the mainstream businesses out there that are relying on software to run their business that do have all of the you know traditional enterprise requirements what's happened um is that portion of the day that engineers get to write code and in our studies that can be 10 to 20% of the day so think of one to two hours maybe an engineer gets to write code that part is awesome it's getting way faster. >> Unfortunately, what teams are seeing though is that code being generated even faster just gets stuck in the cues that follow on the coding. So, for example, the very next thing often is a code review, >> right? >> And yes, there are agentic based code reviews. Um, but most teams are not willing or ready to fully accept the results of an AI code review. >> Maybe rightly so. Right. Rightly so. >> Exactly. And then there's, you know, the pipelines's got to run. The security scans have to happen. The compliance checks need to, you know, be validated. Like there's building, there's deploying. All of that is still left for the engineering uh team to to to to drive and to respond to issues that pop up. And none of that today has been accelerated with AI. And so that's what we've shifted our focus on is, you know, we love the AI coding tools, but um we think in order to really unlock accelerated software innovation where more more code is reaching consumers every single day, the entire life cycle must be automated. >> What does that look like in practice now? Because the the Duo platform that you offer just went GA just a few weeks ago, right? that you've you've definitely feel comfortable with what you have now that it's GA. >> Yeah, I mean it's honestly it's the start of a multi-year journey. We see so much opportunity ahead in terms of accelerating all tasks, all steps across the software life cycle. What we've landed with this initial GA is really the building blocks for a multi-year journey that we'll be building on. >> And um you know there's the really important building blocks. It's not like we've just added on to GitLab. We really thought about AI from a platform perspective. So we've thought about it fundamentally starting with our user experience. How do we make interactions with agents as intuitive and as simple as interactions with users? So I can, you know, assign an issue to an to a user. I can assign an issue to an agent. I can chat with another user. can chat with an agent um you know uh in comments for example in code reviews and so we're we're making all of those interaction patterns um seamless we're also looking at the API layer to make sure that agents can be triggered just like you know um humans can get emails to notify them to do work we can now instantly uh start to action agents and tell them to engage and do some work um through events across the software life cycle and Then contextwise as well, we've taken a look at all of the metadata as well as the code that we store for customers >> and we're stitching that together into a knowledge graph which is a semantic graph representation of everything related to your software project. And we build that for both humans but also for agents because you know with agents context is king. Sure. And the more context we can give them, which is really a differentiator for GitLab, you know, with with [snorts] all of the AI coding tools that we've talked about, they have the the local codebase. you know, you maybe you've synced your code to your lo to your desktop or your laptop from your repository and they can use that as context, but the the agents themselves don't have, for example, um they may not have access to the issue or the bug report or the epic that defines why this code exists, right? right? You don't have access to the pipeline to the you know um test cases to the security scans to all of the things that GitLab has unless you use Duo agent platform. Then we can bring all of that context in for your agents to to both use as context but also to then start to action uh automated actions on. >> Yeah. Because context has become so important in this business. I think I think early on we thought maybe the agent just a well-trained agent will figure it out. But it's really a question of every company having a different way of doing some things and just just you know that context is so important for how all of this plays together. I think >> for sure. Yeah. >> What Oh, sorry. Go ahead. I think you >> No, I I think you nailed it. You know, that's one of the things we're so excited about is that context we have is far more than just the code. >> [clears throat] >> Um, you know, even thinking about code for a minute, because we have the repository, um, we're exploring, giving context, historical context, how the code has changed over time, previous bug fixes on this code block, what changed by whom and why, as context for the next code change that may need to happen to make sure something doesn't regress. to make sure that you know we're taking into account the evolution of the code not just its current state. >> Yeah. Yeah. How much of this platform do you feel is now able to run almost autonomously? How much is still human in the loop and how much do your customers still want the human in the loop as well? >> Yeah. Um there are certain workflows that uh we are unlocking what we call um agent flows which is really a multi-step orchestration. You can think of them as um for example taking an issue where maybe a feature set of feature requirements are defined and taking that all the way through a merge request. So all of the planning steps, breaking down the code blocks, implementing the code, creating test cases for that code, um you know, validating the code, creating a merge request for the code and the tests and so etc. So that's a multi- aent multi-step flow and we do allow customers with the platform to start to build and consume those. today. Um, we imagine a set of those flows across the software life cycle that customers will want to create. And the cool thing is they can kind of customize and tune them exactly the way they want their engineers to work. And those those can be more autonomous because you're sort of prescribing the set of actions you want the agents to take to go from step one to step Z. Um, uh, most of the interactions that we're seeing with the platform today though are more chatbased interactions where you may have a ongoing stream of work, but you're you're going back and forth with the agent to steer it to give it more more context or more prompts as it as it works. >> Yeah, they still need that to to a large degree, right? Mo most organizations want that level of control today and most developers do as well to just make sure the right things get done. >> Yeah. Yeah. So we started out talking about the the bottleneck and kind of few solutions for that. What's your experience so far in how much of that bottleneck has been reduced or really opened up at this point I guess [laughter] is the the right way to put it. >> Yeah. Uh well you know it's interesting. One of the number one questions customers ask me is like I talk about AI with them and their their AI journey and our AI strategy is they're like how do I measure impact? >> Um you know I know how much I'm spending how do I measure the value of that and the impact is for me >> and honestly it is it is a question that is difficult to answer for a couple of reasons. you know first you can you can measure for example how many lines of code get created you can measure um you know how many MRS are created uh per developer per day you can measure how many in the case of GitLab for example we apply AI to pipelines and pipeline failures so you can start to measure how many pipelines are failing yeah >> and what recovery of those take >> you can measure even time you know issue to MR or to deployment Um but what is missing is you know the business translating that to real business impact the more code generated doesn't necessarily mean higher quality software or better business outcomes right more MRS may just mean more small changes instead of large changes >> yeah yeah >> and uh what we're doing with our dual agent platform is we're actually building an AI impact dashboard that starts to help um engineering leaders start to do that translation with more kind of endtoend tasks. Not just like what users are using which agents or which tasks, but like how do entire cycle times get faster? Where do bottlenecks within the software development life cycle start to shrink um in terms of resolution times? And so, you know, we're we're doing a ton of thinking about that and that's part of our offering as well is to like put that data front and center as part of the use. >> Yeah, it's been a a question at Dingerong across the industry to figure out just how do we measure this because just lines of code produced isn't the answer either, right? So, it's a really interesting question to that we still need solving. um what are the bottlenecks that are still left right now you know I think having built software for 30 years uh what's interesting is every organization there there's definitely themes you know for example every project I've been part of there are 10 more ideas than for every one you can implement we've been really constrained on just like software engineer capacity. >> Yeah. >> Uh and then for every project we undertake, there's 10 to 100 times more bugs than we ever can fix. when you you're used to like resolve it by design, resolve it duplicate, maybe it's get fixed somewhere else, resolve it as won't fix because you know you got to focus on just the ones that are critical to you know achieve the user requirements or the business outcomes instead of creating really uh great experiences and unlocking unknown opportunities. I think the opportunity for agent for gentic AI is truly we're at the very early stages. We're just solving like the known problems that are hard and starting to see incremental gains on those. We don't even know what will happen when the capacity of you know humans steering agents is less gated on the number of those engineers and more gated on the cost of compute and the speed of compute as those agents start to accelerate innovation. So like and every engineering team has a different set of things they struggle with. almost every team struggles with, you know, innovation velocity, bug backlogs, um, you know, code reviews, pipeline failures, security issues. Um, and what's cool about domain platform is we let you start to apply agentic approaches to every one of those problems. Mhm. [clears throat] And as you we've said this a few times now, it's still very early days in this this game and would often you know that means there's a lot of startups that try to get into the same space that are offering point solutions. What does what's that discussion like with your customers right now? because your approach has always been to offer one complete platform versus maybe best of breed solutions um that are out there that they want to try and play with be that different agents or different idees or different tooling like what's that like for you right now that discussion >> you know honestly it's no different than the world before uh GitLab and it's no different than the world that gitlab has existed in for 10 years because in many ways What GitLab has done is look at the industry, look at the engineering patterns that are successful and design those into the platform. Look at the point solutions, the best of breed solutions, whether those are open- source or commercial, and then incorporate that learning into an opinionated end-to-end platform for software engineering. And so in many ways I'm actually really excited by the innovation happening um in the startup community and in the open source community you know with projects like open code >> um to explore approaches to agentic AI because >> uh that's just more ideas more exploration that ultimately helps inform our opinionated approach to building software uh in a in a platform-based way. And so, you know, it's exciting to see that for customers. They're also pretty clear, you know, when they adopt best of breed open source or, you know, best of breed commercial solutions, they may get um additional features for a you know point in time, but then they start to incur additional costs, additional vendor relationships, fragmented you know tooling experiences for developers. And I think with Agentic AI, it becomes even more serious because as we talked about earlier, context is king, right? So for every AI tool you adopt, you're creating more context silos and those mean enough context for driving high quality outcomes. you also incur with AI additional privacy and compliance and security and governance um requirements because you're having to try to reason in and control those things across multiple vendors, multiple tools. And so, you know, for all those same fragmentation um challenges that companies have faced for a while, I think they get even more serious with AI. And it's one of the reasons again that I love our platform approach because we can provide that allin-one solution with one security boundary, one audit log, you know, one set of compliance um requirements that you can apply to all of your engineers and all of your software and all of your agents, >> right? And meanwhile the engineers can go and play with open claw or moldbot or whatever it's called today and you know figure out what what's interesting there and what can we bring into these systems over time maybe. >> Yeah exactly. >> What is it that you are using yourself right now? What kind of tools are you using personally as you're running the company when it comes AI tools obviously but what are you using there? >> Hey I love to experiment. Um, I don't write any production code anymore. Um, I I did write code at one point in my career. Uh, but now it's all for fun. And I like to explore almost everything honestly. Like I any new tools and startups that happen. Um, I like to explore at least once just to get a feel for what what what they're doing and what problems they're solving and how they do it. Um, I just spent not this not this week. Oh, maybe it was this weekend. Um this last weekend [laughter] we're almost at the I'm getting my dates confused, but I spent all weekend um actually uh inside Duo Agent platform, our our new uh Agentic AI platform uh just creating a bunch of different projects from start to finish and exploring different ways of because one of the cool things we also do is we let you create your own agents inside GitLab now. So you can create an agent, customize it, system prompt, give it access to tools, and then start to use it anywhere within GitLab. And so there's super cool things to do there. But personally, like for my own job, I'll say I use AI every day now. And I use it in way I kind of think of it as like it's in a way it's it's almost become my chief of staff, if you will. Uh, for example, I >> chief of staff. That's I I will um ask it hard problems like go go go research this problem for me. Go research this market. Go research this business. Go research this pro pro problem set and and bring back kind of deep research reports. I'll take those and um you know have it ask me questions. Interestingly enough, like we often I started using AI by asking, you know, agents questions and now I find um just as much value in having a a data set and then an agent ask me and kind of get a two-way conversation going there because it's unlocks things I hadn't realized before. >> Interesting. I iterate anything that I now write that's kind of long form memos um blogs those kinds of things I use AI to help iterate and ideulate and uh you know in some in some ways it's it I feel like it's making me a better leader because I'm able to explore so much more information faster and synthesize it collaboratively um than I would just on my Awesome. Well, thank you, Bill. Really appreciate the time. >> Thanks for being here. >> Hey, thank you for having me. It was great. >> Absolutely. Absolutely. Thank you.