Navigating DevSecOps Concerns and AI Productivity with GitLab’s Ashley Kramer | AWS re:Invent 2023

This is Textron tv. Hey everyone, welcome back to our coverage here of, uh, at AWS Reinvent. We're in the win at our, uh, video suite, and I'm really happy to be joined by our friend Ashley Kramer.

For those of you who don't know Ashley, she, well, she appears on our tech strong stuff whenever I can beg her to come on and appear. But Ashley is the, uh, chief strategy officer, chief marketing officer, and a whole bunch of other hats from our friends at GitLab. And, um, of course, GitLab needs no introduction to our audience.

But look, maybe there are some people, Ashley, who don't know GitLab, I'm gonna ask you to explain it to them. Yeah. But first of all, welcome and thanks for joining us.

Good having you. Yeah, thanks for having me. It's good to see you both.

Absolutely. We've got Mitchell and, and and I joining us. Actually, I, I really do think our whole audience knows GitLab, but maybe some, perhaps there's one or two that Don't.

I mean, that means my team is Doing it, job, doing their job. It's so awesome. Yeah.

Or I've been talking about that for 10 years. That helps. That helps too.

Doesn't help. But for people who maybe, maybe they've heard of GitLab, but they're not sure. They say, oh, I know it's Git something.

Yeah, Talk GitLab. So GitLab is the most comprehensive AI powered DevSecOps platform. And what we strive to do is help companies across the world deliver secure software faster.

Absolutely. Plain and simple. Absolutely.

I I love that someone's been working on that. I see. Mm-Hmm.

You got it nailed down. It's, it's really my team to the point. Credit good stuff.

And look that it was a very succinct description of what GitLab is, but for me, what GitLab is, is it's just a really special sort of story. As a student of startups, as a student of the tech industry, and Mitchell and I had been doing startups for 25 years, GitLab is a really unique story in that, you know, Sid Sids Ramji, who, who started the company, white Combinator company. Really?

The company's an open book. Mm-Hmm mm-Hmm. Right.

There's the GitLab book that has every single thing in there. The company was remote first from day one. Correct.

Right. It didn't wait for Covid to happen to become remote. Um, that open book has everybody's title, who they report to, what salary structures are in there, everything plans, and where it's all heading.

Right? Yep. The 22nd of every single month for what, 150 months running?

Or some crazy number like that. Right. We just changed that, by the way, you haven't read the updated handbook?

Oh, It's the Third Thursday now of every month. It's now the Thursday. So we don't have to disrupt weekend.

That sounds like Thanksgiving. That makes sense. That's, that's a good mix.

That was a good thing to do. Yeah. But it's about 150 months or some crazy IT number.

It's over at this point. Yeah. Yeah.

Every month on the month is A new release. Yep. It's truly an open source.

Absolutely. Open core product. It's like an open project.

I mean, it's, it really is. It's an it. So I always thought of this as an experiment, much as they say that the US and our constitutional system is, is an experiment in democracy.

GitLab is sort of an experiment in open source and, and modern tech company, open company. I hope now a successful Experiment as a public company. Well, so far so good.

You've you've been pretty successful. I mean, I would would say. I Would say so.

Absolutely. So for those who don't know, I mean, it's a really, it's, it's almost like a, it's a unique approach. You don't see, it's a really nice case.

Um, interestingly, you said a DevSecOps company. Of course it was DevOps and, and about two years ago now. Yeah.

Right. We, yep. DevOps is DevSecOps.

Now, today, there's a whole new cool kid on the block. ai, you can't, you walk down to that show floor. You can't, you trip over it everywhere.

Everywhere. Well make it that far. I wouldn't Yeah.

But the kid can't go out the door. And so I am sure it's had its effect on GitLab and, and what you guys are doing. Announcements.

Yeah. Right. You know, no one's watching share with you.

Just between us. Just between us. Well, the Good news is we're a transparent company, so It's all I'm out there anyway, you can put stuff anywhere, but yeah.

So, so you, you've mentioned a bunch of the unique, um, the uniqueness around GitLab and since we've been a platform since day one. You know, we started as of course SCM and they made the decision over 10 years ago, integrate CICD as part of the platform, integrate security as part of the platform. So now we're in the age of ai, and that makes it really, really, that's set us up for success.

Makes it really, really easy to integrate ai, not just for one capability, like the big buzz of writing code for you, code suggestions. We have that, by the way, it's coming out in our December release. It's in beta right now.

But our viewpoint is weave it throughout the platform, make every step of the SDLC easier, more efficient, because AI is part of that story. And help companies really have faster cycle time, deliver software faster in a secure way. And just because of how we're built at our core, we have a really, really powerful way that we can deliver AI to the world securely.

Absolutely. So it sounds very holistic. My problem with a lot of the AI stories out here is where does the rubber meet the road?

Where is it real? Right? When can we see it in action?

So, hard question, when where is rubber meeting the road here with GitLab? What's available out there right now? What, what do we have?

We've Already had capabilities, um, in the platform. Things like suggested reviewers, which which we've had in prior to this whole AI craze. Yes.

We were already working on code suggestions, which of course it does exactly what it sounds like. Mm-Hmm. Um, but what we're really working on is the rest of that story.

So we branded it, I'm a brander, so I have to brand things. We branded it GitLab Duo. And what GitLab Duo is, is it's not just one capability or one feature.

It is the suite of capabilities across the entire workflow. And so what we announced a few weeks ago, was that what I just said, that code suggestions will now come out in this December release, uh, which, which will happen 'cause it's happened for over 150 months now. And we're also starting to lean into what we call our duo chat beta.

And so what the product team found was there's different ways people work throughout their, their day and throughout their workflow. And often the chat experience is what they want. You know, maybe some of the more junior developers do want that code completion, but probably more senior ones just wanna be able to highlight and say, Hey, can you explain this code for me?

And they probably wanna do it in, in a consistent way. So that's what Duo Chat will be about. We have other things, um, to make the entire team more successful around summarize this issue.

Issues can become up to 40 pages long. So how do you understand, how do you onboard to a project or to a company quicker? Um, how do you not just have GitLab catch the vulnerabilities, which we already did in the product, but explain this vulnerability.

We actually announced that a while back. And so from my perspective, again, it's not about a capability or one task, it's about how to make people successful and how do you measure that? To us it's productivity.

And in the past, I think productivity was really focused on one thing, which was like the task that is the developer. We're hearing this downstairs, right? Right.

We're hearing this on the floor. Yeah. We're gonna make developers more productive.

And what they mean is we're gonna help them write more code. Right. Is that effective?

We don't know because is more code what the world really needs? Or do you need more quality, more secure code that's going out to the market faster? Mm-Hmm.

And getting innovation to end customers faster. So we think about productivity as not just the task at hand. The team is the team becoming more successful and the time.

So GitLab already produces, um, seven x faster cycle time for companies that implement us and use our platform. Mm-Hmm. We have a, um, a very ambitious goal to get that to 10 x and be beyond using ai.

You know, I'm curious that, um, a a lot of the developer productivity, as you mentioned, I think the right approach is focused on how do you take away the distracting destructive elements, right? So you're in, you're in the mind frame, you're in the mindset of being able to create code, build whatever you're doing. Mm-Hmm.

How, how do you look at AI as part of an entire platform? Do you think it'll be visible, present, like, this is an AI thing, you see this in products, now click here to get the AI version of what you're writing or something? Or is it just gonna be there and you don't really, it doesn't kind of pop up and getting in the way to know you notice it?

Are you taking a particular approach to it, or how do you think about It? I think it'll be both. So I think there will be instances like I just, um, mentioned before with, there's a chunk of code and I want it explained to me quickly or I want the comments summarized.

And so that's sort of the proactive. I have to go in there Mm-Hmm. And I have to make the request.

But the trend we kinda see in the future is not just the direct interaction, but more of the next best action. So now start suggesting to me, so don't just explain this vulnerability, tell me how to mitigate it, and then also help me fix everything I need to do in the code base so it doesn't happen again. And so from that perspective, I think it becomes removed, but, um, I think it will be a mixture of both in the future, particularly speaking around DevSecOps.

Mm-Hmm. Um, we can go into all the other use cases where it might make sense to be Yeah. Security sales is a little bit special because Right.

We don't wanna automate too much of it. We need absolutely not human in the loop. You need the compliance around it.

You need the, the ability to audit. You need to make sure that if I'm delivering my code, my proprietary code into some kind of AI bot or experience, it's not being shared with the rest of the world. We sell it a highly Related enterprise.

So I think that that is, uh, it's interesting. We had, uh, we had an interview with Salesforce. Okay.

I think yesterday. Yesterday, the day before it runs, but they're all one day It was it in Vegas? We're not sure it was in Vegas.

That for, we're still in Vegas, by the way, gentlemen. Good. Okay.

Um, yeah, we are. Um, but anyway, you know, and that was an important part to them and their AI story is they're adding what they call this trust layer Mm-Hmm. Which will supposedly, well, they, they contractually contracted with, with, you know, AIOps or Open ai, open ai, excuse me.

That what their customers are putting in can't make its way into the general thing. Yeah. The base model.

Um, is this something you think that's the right way to, because my question was how do I believe them? How do I trust you? Right.

Yeah. And that's certainly the approach we're taking because we're very big and highly regulated. So, um, we, we are aiming and striving to not take proprietary code or text or whatever and use it to train or Mm-Hmm.

Or retune other models you have. You can't. You can't.

And, and we actually just did a, a really great blog post for, for the world in a transparent way, and it came from our chief legal officer, which is, um, seven questions to ask your DevSecOps provider. And it's all around those things. So sure you can say it, but what are, what are the next questions you should ask?

What are you doing with the output? Mm-Hmm. What are you doing with the refactored code?

What happens if something does, will you protect me? Will you, yeah. And, and so obviously we have the questions and then the responses, but GitLab has to and will continue to take a transparent approach and a privacy first approach the way you do.

And when we think about the vendors, which is not the one that you just mentioned that we will partner with, um, they're taking that exact same viewpoint that's really important to us. I, I think it has to be, but I also think, look, we're in a bit of the wild, wild west For sure, You know, error right now with this. I think over time people are gonna get smart about it and demand, of course that has to be, it's my, it's my ip.

I can't, you can't suck my IP in to go make someone else's stuff better. Right. I, you know, and, and that's kind of, I mean, we'll probably in three years look back and say, what were we thinking?

That's crazy that we even thought about that. That should be like Everybody, everybody was blinded. So earlier this year, I, I took a trip to Europe and met with a bunch of CTOs across all of Europe, and it was at the hype cycle, so Yeah.

Mm-Hmm. The competitive code suggestion product had had come out and all the CTOs wanted to talk about was, my developers wanna know what you have. And, and I would ask the question, are you worried about privacy, security?

Nobody wanted to talk about it yet. So then David DeSanto, our product officer and I took another trip about two quarters later. That's all they wanna talk about, talk about.

Mm-Hmm. That's top of mind. Well, that's couldn't, that's, that means the Hype is Yeah.

The shininess of the, well, the real, the reality starts biting Setting in. Yeah. It's, and you're starting to see those, those few examples of like, oh, I didn't realize at a public company, if I put my notes into chat GBT that it's actually sharing it with what That was a real Case.

Well, what company? Yeah. There was, or Samsung, Samsung guy.

There was article articles everywhere. I, I think this is what you're going to, we, we are learning the ground rules now and I think over time it'll, it'll definitely get better. Um, so this is available, some of these things are available right now.

We have features available now in the latest thing. Absolutely. Third's Thursday of every month.

You could get the latest one. Sorry. Um, what else are you seeing here with a, I mean, you guys have a huge relationship with AWS.

Yep. Uh, but you have good relationships with all of the cloud vendors to be fair. Mm-Hmm.

We do. And that's, that's a really big competitive advantage for us. And so we can stay up to date on the latest and greatest of what they're doing.

Uh, we were talking earlier, um, about what we announced this week. We announced something a few weeks ago, which was all of the AI capabilities that are, that are coming, whether in beta or ga. We did announce last year here though, our GitLab dedicated Products.

I remember that. Yeah. And that is, um, today single tenant Exclusively On AWS and that's single tenant SaaS.

So we've always had the multi-tenant SaaS. We have the self-managed. Um, and we saw a need from customers of saying, leave, you know, we still need it, we still need our own Yeah.

Great single tenant instance, but we want you to manage and maintain that so we can put our team, um, on, you know, our innovation. Sure. And so, and that's been taking off really great.

And so we've been having a lot of conversations about this year. Obviously there were a bunch of AWS announcements, um, lots of them in the keynote yesterday. And so we'll integrate in whatever makes sense.

Whatever comes out with bedrock next, whatever. Yeah. Q ends up Becoming what I inspect inspector and detect, I don't know if you're following the, the AWS announcements on that inspector and detective, one of 'em was suggesting like pre-deployment Mm-Hmm.

Code improvements. And one was even post-deployment. To me it was vulnerability scanning, but Right.

I'm not going to quibble. Um, but, but you know, with an AI twist, 'cause everything has to have an AI twist. Uh, I don't know.

To me, well I have nothing against AWS what a great company, but a lot of the stuff that they introduce, I always feel is sort of a poor man's version of what a company that's doing that or is what they do does. And but that's the model. That's The model keynote.

It's the keynote. Right. So, Yeah.

No, I get It. I, I've been talking to customers all day. I've been talking to media all day and, and what we've been talking about is it's one thing to announce it, it's one thing to have the vision or the prototype or you know, no.

And then you go use it and find out it, you know. That's right. It's 80% of the functionality at 20% of the price.

A lot of times there's also the announce that it comes out in the continual over long time period time Yeah. Refining it until it really becomes what was announced. Which could be a year.

It could be many, many years. That's right. It just depends.

It happens. But that's the but that a model we know. And, and other vendors as well.

Well, unfortunately, Mitchell in the world, you and I started in technology, that was the model. Right. Remember those roadmap?

We used to you did this too actually. The roadmap, uh, discussions. Right.

Lemme me show you my slides and my roadmap heading out three years switch roadmap. Yeah. This week's roadmap Should show you my 10 year vision.

Yeah. My tenure year because I have a great tenure. Oh yeah.

You know, it's gonna be here in five. I'll only be out by two degrees. I actually, as a former product leader, I won't throw the company under the bus.

It was not GitLab. I actually got on stage in front of many, many, like god, 20,000 people and announced something in 2016 and they delivered it exactly Four years later. Oh, so you had get slapped.

You were right. Get Clap. You know what I Well, but that, that's the nature of the beast.

Anyway. What else is happening with GitLab you can share with our audience? Yeah, I mean, We're, we're continuing to lean into how can AI help make the entire end-to-end lifecycle, um, more secure, more efficient, obviously integrated security has always been a big piece of that.

Yeah. Uh, flexibility and deployment now with things like, uh, GitLab dedicated, which is taking off and yeah. We're just, we're really excited to, to keep bringing this value to our customers.

Um, myself is, I'm here obviously at this conference, so is our CRO talking to customers, seeing how things are going, what more do they need? And it feels like everything's on the right track and we're just really, really excited to get some of this stuff in general availability and start not giving the dream in the vision. Right.

But rubber meeting the road, getting The stat, the rubber meeting the road, and that 10 x faster cycle time is what we're gonna strive for. I'm really, I'm really glad you mentioned the kind of the, the, the entire process, right? Mm-Hmm.

'cause it seems like that being an OA transparent but an interconnected flow across entire, uh, software life cycle, you're in a unique position to not just AI tasks, right. Or AI features, but look at the entire process and what's happening and how to improve that, whether it's generative or it's machine learning or both. Right.

And we have single repository, we have a single end-to-end platform application. Exactly. With a single POSITORY data was posted, you know, you can anonymize with customers about what, what people do and how they use it.

We're set up perfectly and we're, we're kind of going with a, not kind of, we're definitely going with the best of class model approach. So some obviously LLMs, like suggested reviewers would be hosted. And, and on our side and others, Google Anthropic, whomever Mm-Hmm.

Has the best models we're able to plug and play and, and make sure by use case we're, we're picking the best. But that's the GitLab way too, right? Put that back in.

Needs to be malleable, right? Yeah. It needs to be, uh, depending what you want and what you, who you want to deal with.

I, I just quick plug, I want to mention some of the, uh, announcements and functionality that actually mentioned that were announced at CubeCon. Uh, I did an interview with Dave, David DeSanto at CubeCon, and of course that was streamed live, but it is available on text trunk tv. If you do a quick search of either CubeCon or, or GitLab or David DeSanto for that matter.

It'll pop up and you can check that out. And then we have another upcoming part two interview with David. I think I wanna say scheduled for December 11th.

But, um, and, and we'll be continuing the conversation with put him to work. Keep Yeah. Keep them to, I keep him busy.

I'm proxying as him. I told him I'm, I'm representing product this week. He told Beard, he said, that's what He said.

He said, are you bringing your beard? And I said, he Has the beard. And I, you have a lot more hair.

Even with the beard or without the beard. You have a lot more hair than V and Himm. True, true.

But um, anyway, thank you so much for hanging me out. Yeah. Thanks for having.

It's, you're good. It's always great. Say hello to all of our friends at GitLab.

Yeah. We're gonna to take a break here. We're live in Vegas and we have our next, uh, people in the green room waiting.

We're gonna our next guest. So standby. This is Alan Hummel at A-D-A-W-S Reinvent.