GitLab Inc. (GTLB) Earnings Call Transcript & Summary

Thanks for joining us, everybody. We'll save some time at the end for questions. David DeSanto, Chief Product Officer of GitLab. And as a reminder, GitLab is in their quiet period. We appreciate them coming. We're not going to be talking about financials or anything forward-looking. And so don't ask a question around that or if you do, David knows the answer. So we'll talk -- we're going to be talking about products and maybe shoes at the end.

We can talk about shoes.

So thanks again for joining us. You were here last year. I thought it was a fascinating conversation, and we've got a lot to talk about as the platform has continued to evolve.

And so maybe just for those that aren't as familiar or maybe didn't meet you last year, just a quick introduction of yourself and what are you passionate about at GitLab?

Yes. So as mentioned, CPO for GitLab. I joined GitLab in 2019. I joined to help add security and compliance into GitLab, and that became the ultimate here. Over my time at GitLab, I think the thing that's made me the most excited is the partnership with our customers. I've worked lots of places where we say, "Oh, no, we're your partner," but that partnership is really there. And so what made it unique for me to come to GitLab is my background is actually security and vulnerability research. I did that for about 10-ish years before moving into product. And when GitLab reached out, I talked to the CPO, who's no longer here, and then Sid and it was a conversation with Sid, [ ultimately. ]

Yes. And it feels like in the last 5 years, the platform has really evolved. And it's great to see the traction of Ultimate even more recently here. Let's just level set. You guys have been focused on -- well, your passion on security and governance Gen AI has been a bit of a driver here. But just talk about the evolution and importance within the developer community like of a DevSecOps platform and why that is so critical? And I think about things like the CrowdStrike outage and all of the potential risk with pushing bad code into production even. Talk about like how that's resonating amongst the developer community these days.

Yes. So maybe to kind of start with the first part. For GitLab, we are a true platform. We're a single product with a single unified data store. Why that's important is that unlike Point Solutions that can be in the market that you stitch together, there's a single source of truth that everyone is working from. And so when you look at it from that point of view, you can begin to see why customers report the efficiencies they get, especially adopting Ultimate. But for us, it's really about making sure you can plan, build, train, secure, deploy, monitor, code and AI models from GitLab. And that power of being that single platform has allowed customers to see great benefits. A good example is we recommissioned the study with Forrester. We had done well in 3 years prior. We want to see what customers are seeing with Ultimate and the shared that they were getting a 482% ROI over 3 years and a full payback in less than 6 months. And that boosted their efficiency leads to companies like Lockheed Martin talking about they now ship code 80 faster than they did before.

I think today's selling environment when it's an ROI-based sale that even -- that accelerates the conversation. Can you talk -- I mean, I guess -- let's start with Ultimate because that's what's been really standing out to me. Why do you think that's been resonating so well with customers over the last several quarters? Because the percentage of ARR continues to tick up noticeably.

Yes. I think what it is, is that GitLab might be an open core source available company but we're trusted by more than 50% of the Fortune 100 to secure their intellectual property. And so what that means is that they are choosing to use a product that can help them from beginning to end and make sure they're being secure. And so the reason why Ultimate continues to grow is that unlike bolting on a security scan or a compliance control, it's just built right into the platform. And that allows them to know that everyone is working from the same single source of truth. They're able to track things much better. Customers will use GitLab as part of getting through their audits because they can point to something in the UI and be like, "Oh yes, that's log. It's right here in the audit events or no, here's the control. You can see it's turned on." And you can't do that if you are a bunch of tools stitched together. We had our annual and it's actually the eighth year of it, DevSecOps Global Survey, and companies are sharing that they're moving to a platform for that reason. And they're also trying to deconsolidate, they get rid of more tools. They -- one customer should have about 100 tools stitched together to ship software. That's obviously going to be very fragile, whereas now they can just be on one tool and that be that platform and get that benefit.

So one of the questions that -- Kelsey, you get all the time, I'm sure you get even from customers is like, look, GitHub is great, and it could be free for a lot of folks. Can you -- and I asked you this last year but I continue to get the question. Can you level set the group on -- because a lot of organizations will use both for different purposes. But what are some of the most important primary differences when customers are looking at GitLab versus GitHub?

I mean I'll just take us both at our marketing messaging because it's a good way to answer that question. So GitLab is a DevSecOps platform. We're focused on organizational efficiency. It's about making sure developers are effective, security teams are effective, platform engineering, operations, compliance are all effective. GitHub, by their very nature, they're a development platform for developers. And so their focus is on making the developers more important and more efficient. That is important to us, too. But we realized early on that if you made your developers, say, 100x more effective, if you didn't help everyone else around them, everything would break. And so the big differentiator there is we're focused on the entire SDLC. They're focused on developers.

Okay. And I think the reality is also, I think I still consider GitHub more of a DevOps platform, too. And I think -- because there really is no good alternative to Ultimate within the GitHub platform, correct?

Yes. The way that you would do the similar thing is you have to use the GitHub marketplace and then choose to buy tools through that to add into your environment. But now you're not using a single platform, you're using a bunch of point solutions that you're trying to stitch back into the workflow.

Okay. So there's a way around it but it's not as straightforward as just buying Ultimate.

Yes. I mean it's not straightforward. There's a lot of operational overhead then. The thing that I always find interesting when talking to customers, they'll have, say, 10,000 developers but they'll have like 500 security people, and they'll have like 20 people from engineering team. If you're going that route and through an ecosystem trying to bolt everything, those 20 people have a lot of things they need to maintain. And that just causes slowdown in development. It causes other impacts. But yes, we're probably the last 2 main running in that DevOps space. But I was very proud of is Gartner just did their second Magic Quadrant for DevOps platforms, and we were the best on execution and vision. And that's just showing that what we've been doing is now resonating and customers are getting the benefit.

Well, and I think one of the questions that I also get too is like DevOps is a complicated -- there's lots of components of DevOps, and you said one customer stitch together 100 different products. One of the questions that I get is like, well, GitLab might be good at this but not as great at that. Like how do you think about raising the bar for all aspects of sort of DevSecOps so that like you can take out a product and be considered best-of-breed here but also a platform play?

Yes. So the one thing I always like to make sure everyone understands is you can be best-of-breed, we call best-in-class and still a platform. We look at that from really 5 key pillars of what DevSecOps is. That's planning, coding, building, securing and deploying. And all of that together are areas in which GitLab is identified as a leader in the space. And so it could be our enterprise agile planning, which I think we talked about a little bit last year because we just launched the add-on for that. The security scanning, CACI, public sector customer shared that GitLab is helping them run security scans 13x faster in their environment. And that's because they're now using security tools that are meant for developers that are within the developer workflow as opposed to those stitched on, bolted on security scanners that are more for security professionals.

Okay. Okay. So what I'm hearing is that you sort of -- and like this could be with CrowdStrike or it could be with any other players that have a true platform is that you're not sacrificing functionality when you go with a consolidator in this case. And that's what you're -- from a product perspective, you're focused on?

Correct. Yes. We truly believe that those 5 key areas are best-in-class, best-in-breed. Then the other things benefit from the -- like a rising tide lifts all boats, areas that we're still developing in, whether it's monitoring and continue to improve like business-style metrics with GitLab. Those things are already better because they're near those great things but they just continue to get better and then they'll be in that same spot.

What about observability feels like it's a close cousin, and I know you guys have made some investments there. How do you think about that? Because like I always think like if you're in the business of developing and securing code, like you could certainly help with observability.

Yes. So a couple of years ago, we acquired Opstrace. They were an open source observability platform. That is now fully integrated into GitLab. But for us, it's not just about observability. It's about analytics and product analytics. We believe that you should be able to close the DevOps loop or the SDLC with feedback from your applications you deploy it using GitLab. So observability gives you the infrastructure, analytics sort of view to know the application is healthy. There's not an incident. Product analytics helps you understand the usage of that application you built using GitLab. The way I look at it is we are very data-driven. A lot of you hear are all data-driven. You need to have correct and accurate data to be able to do what you need to do. And you can't decide what you need to build next if you don't know how the thing you built and deployed is actually operating.

Yes. Okay. Okay. That makes sense. I don't remember the exact statistic but when you look at -- I don't know how many -- from a TAM perspective, what do you think about in terms of like the total number of seats out there? And I guess, ultimately, what I'm trying to get at is getting customers to get over the free-to-pay conversion, what are you doing specifically on the product side to encourage folks that like, hey, like Free is good, and there's a lot of functionality there but like it's probably the compliance and the security piece but just sort of curious on your thoughts there.

Yes. I mean -- so we do have Free, Premium and Ultimate. When we decide what features go where, it predominantly is driven by a model of like, hey, if it benefits an individual, that's probably a Free feature. That benefits the team is probably a Premium feature. And if it benefits the organization, it's an Ultimate feature. And so if you look at it from that point of view, things like just our standard issue tracker, Free. But if you now want to start using Epics and reporting, hey, now you're in premium, right? And then same thing with security, as you highlighted. We do have some security that's available in Free. You can run like our SaaS scanner and secret detection scanner. You don't get all the UI and all the controls. And so that then encourages you to go up to ultimate where you can now put all those things in place and have that auditability you need.

Do you ever -- I've asked you this before. Do you ever envision a time when there's like a platinum version out there where there's like another tier? Is the market big enough to support something like that in the future?

Yes. I would just say I think the market is more than big enough for everything that you and I have talked about before here an hour last year. It's an untapped market. It's calculated around $40 billion. If you add up GitHub, GitLab and Atlassian as another player, you don't get to half of that. And so I think what you're going to see is that as there's more tool consolidation, that same survey that we ran, and by the way, if -- and we have not seen it, you could just Google the GitLab Global DevSecOps Survey. It's well worth the read. Over 5,000 people responded to it this year. You begin to see that tool consolidation needs to happen. Over 60% of respondents want to standardize on a platform. And as that happens, sure, maybe it changes pricing and packaging. But today, we're just focused on what we have in the product.

Yes. And like from a tool consolidation perspective, how often do you see large enterprise running both GitLab and GitHub? And it feels like Atlassian with Bitbuckets kind of shrinking. But any thoughts on kind of like how you sit in the enterprise space?

Yes. So I think there's really a couple of components to that. The first is, you're correct, we continue to displace Bitbucket out of accounts. I think for Atlassian, they're very much focused on the ITSM space now. And so it becomes a natural thing for enterprises to switch off of. Our enterprise agile planning is beginning to be able to displace Jira.

Well, that -- you mentioned that last year.

I think I told you last year, I was going to make it happen. And I can tell you it's now happening.

Okay. Is there any customer examples that you'd just kind of highlight?

Yes. I mean probably the biggest one name-wise is UBS. They mentioned on their earnings call a couple of quarters ago that they've now moved all their planning into GitLab. For them, they say that's giving them an even larger ROI because now everything is all in one place. We can associate something that's being planned with the code that's actually been written, to code that's been deployed, to events that are happening, and that gives them that efficiency. But when you talk about the others around it, I think we look at the market as the individual pillars that the market sees them as planning, development and so forth. But we see them stitch together as a platform and that gives even more value. And so if you're looking at the market it's $40 billion, there's plenty of room for everyone to grow. And I think that's going to grow not just because of that tool consolidation but more companies have to build software today. When I started, Sid said to me, everyone is going to have to become a software company at our IPO, he brought that up again. It became more of a security company, and that's why Ultimate is so popular because you now need to do a lot more security and compliance. But I think it's going to drive people to need to be an AI company and all these other things that can help with and that will expand that TAM.

Yes. Well, I wanted to go back to the Agile piece or the Jira piece. Thanks for the customer example there. I mean what sort of momentum do you see in that? Because it feels like I mean that's -- obviously, it's a market that they do extremely well at and for quite some time. But how ripe for disruption could that be?

Yes. I think the people -- and I'll tell you another customer example. I always -- by the way, for everyone, I look at our success to the eyes of our customers and the individual users and the benefit they're getting. That's why I tell a lot of customer stories. The way I've looked at it is that customers have said to us, products like Jira they've had for 15, 20 years are no longer a product, they're a process. And sometimes that process is slowing down their conversion that they want to do, whether that's digital transformation, cloud migration, all the buzzwords that people say they're doing. And so when they take that step back and they look, there's not just GitLab in the market, there's other start-ups that have come up in the planning space. But they can go, I can redo my workflow now because now I'm not dependent on the tool that's been doing it. And we focused on disruption, not replacement with our planned functionality. And so it doesn't do everything Jira does but it does a lot of things that are very important, and that's helped customers make that leap.

Okay. Helpful. I wanted to touch on the Premium price increase. It wasn't just a price increase just because you added a lot of functionality that warranted that. What's been the customer feedback? Because I think there's been probably a little bit of churn at the low end, but you've obviously seen some good conversion too. What's been your perspective on the receptivity of that?

Yes. So this probably comes no surprise. We run pricing studies to make sure we're making the right call and both talking to customers and some of the blind cohorts we worked with, we identified that there was a lot more value in Premium than there was obviously when it started, and people actually thought it was worth more than what the price was. So what we ended up doing is, to your point, roll it out, when we announced it -- I actually went back last night and look, so I can give you the right number, when I announced it, we had already released 400-plus improvements to Premium and it's 4 years of life. And so that right there makes it a whole different product than it was when we launched it. And so reception has been good from everyone we've talked about it. And yes, there might be some pricing pressure while we're on. Brian talks about on earnings calls. But realistically, the value is all there, and it's worth the price.

Have you seen people just say, like I'm -- this is going to be an incentive to move to Ultimate? I know you kind of just sell to what the customer is sort of asking you for. But have you seen some customers do that and just say like I'll just move to sort of that tier?

Yes. Part of the reason why that number is growing that you highlighted is because of that. When I started, people land on source code management and then maybe eventually adopt CI and then a year or so after I started, we had security they could adopt. And now customers are just actually starting on Ultimate. And there's really 2 reasons for that. The first is the capability that's in there, the benefits they see. If they're going to make a change, they want to do it all at once. The other thing is that things like GitLab Dedicated is only Ultimate, and that's our single-tenant SaaS offering. And that allows customers who are self-managed to now have a cloud offering that meets their regulatory compliance without having to trade off and go to a multi-tenant environment like Gitlab.com. And so those 2 things are really driving people going to Ultimate to start. And if you're an existing customer, we shared that Southwest just moved from self-managed to dedicated, and that was for those controls that are in Ultimate and the ability to be data -- have data residency, data isolation, all the things they needed for compliance purposes.

So dedicated -- I forgot, so dedicated is -- there's a hosting cost as well but there -- is that Ultimate tier from a pricing perspective?

Yes, it is. So for everyone who's not as familiar with GitLab as I am, work there, right? There's really 3 deployment options. There is self-managed, Gitlab.com, it's multi-tenant SaaS and then GitLab Dedicated single-tenant SaaS. And the thing that's allowed us to do that and be successful with it and help customers like that migrate between them, it's all the same code base. So Gitlab.com is running the same code base some would download and self-host. Obviously, we've increased memory, disk space, all the things you need to do to run that large of a multi-tenant environment but it allows us to ship the same feature to all 3 simultaneously. And it gives customers the benefit of like if you're self-managed, you're getting this like weird stuck point where you don't always upgrade when you should. Now you're just getting automatically upgraded transparently.

Yes. I'm going to ask one more -- it's a big crowd. So I'm going to ask one question, and then we'll see if there's any from the audience. Duo has been a real talker for the last -- I don't remember when it was named or when we started talking about it.

We announced it in June of last year, released it in December and been improving it ever since.

So I know at the time, I think you and I talked because there's a lot of questions about like code efficacy coming out of GitLab versus GitHub and Copilot. And I believe you guys worked with some commission some studies to try to show that like the efficacy coming out of GitLab was superior. Could you talk a little bit about that code suggestion module and how it relates competitively?

Yes. I mean I think first just to make sure everyone just because we do stuff so quickly. There's some things that have been approved. So there's GitLab Duo Pro, that's where code suggestions, which is AI code creation, chat, which can let them explain code, fix code, refactor code generate test cases. And when we talked last year, that was a couple of weeks from going live. Since then, and this is back in August, we launched GitLab Duo Enterprise, and that includes AI across the entire SDLC. So software development life cycle helping and planning. The 2 most popular features are root cause analysis. It will analyze why the AI pipeline failed, give you a recommendation to fix it and then vulnerability resolution, where you can actually go in and ask Duo to resolve the vulnerability for you on your behalf. And so the studies you're referring to and the things we talk about are because it's across the entire software development life cycle, everyone is getting a boost from AI. Our customers are sharing they're getting a large improvement in efficiency. And sometimes efficiency can just be the quality of the code. It could be fixing a failed pipeline faster. But it's also the collaboration it drives. The story that Ally just told at their own event a couple of weeks ago was that vulnerability resolution brought their security team members and the developers back together and talking to each other, whereas before, and I can speak of this as being a former developer and security person, like there's a lot like pointing fingers between the 2 groups, like, no, this is your fault. But because they're getting better quality code, less vulnerabilities, they're now collaborating really closely together. So it's both the technology and then what the technology unlocks from a team perspective.

Can you remind us about the pricing then for that? Like there's Tiers?

Tier. Yes, Duo Pro add-on is $19 a user a month, GitLab, Duo enterprise is $39 a month.

Yes, in addition to. And there's been some varying discussions about how productive reps like developers can be. The number that everybody throws out is 30%. And that's obviously probably true for maybe some entry-level developers versus more seasoned professionals. What are you seeing? Like can you talk through some of the efficiencies?

Yes, absolutely. This is actually the most fascinating part, I think of Duo is like what it's done for people. And so to your point, we've seen trends at our customers if they're an associate or intermediate level developer, they're going to prefer code completion and everyone just like in a Word app, you've got your cursor recommends a couple of lines after it. And they spend some time looking at it, but then they start to learn why it chose it and what it does for them, and then they become a better developer and they start operating more like a senior level developer. But then the more experienced developers, I say, the staff or principal level, they find code completion very noisy because they know exactly what they want to do. And they're gravitating towards code generation. And for us, that is writing a comment and describing what you want, letting you generate the code. And the best way to think about it is that the thing that's really nice about it, you can be very specific. You can write multiline comments. I did this for a customer as a demo. We built a REST API application in Python in 6 prompts into it in comments. So we ended up with it connected to a database, responding to requests. And that was just comments, right? And our customers are now saying that's allowing those principal level, senior -- most senior level developers focus on the more strategic harder problems. A customer who adopted GitLab early around this time last year when it was in beta shared that a project was going to take 3 of their principal engineers a full week to complete. They did it with 1 developer in 2 days. And like if you talk about that impact, you're now helping people upskill and you're having your most experienced senior developers focusing on the harder problems and not doing a lot of like code refactoring.

Yes. Have you seen it also if a customer had 1,000 seats saying like, wow, like this -- I can actually buy -- maybe buy some more seats because I'm opening up this technology to sort of folks that I wouldn't even consider a developer level.

Yes. So there's 3 things that are happening that's around that. The first is like when you buy Duo, you don't have to buy for every user like you do with Premium and Ultimate. That's allowing them to be very specific. They'll buy Duo Pro maybe for developers working on internal apps and Duo Enterprise for those that are focused external, applications that will be exposed to the world. We did the same thing with enterprise agile planning, and that's also bringing in team members who wouldn't traditionally be a GitLab user because now they can buy just the planning functionality and get access to like the tracker, the reports, the Wiki, and that's allowing them to accelerate their development as well. A customer, which I think we'll be referencing on the earnings call, so that's my plug to go listen to the customer stories. I just shared that they -- net new customer went to 1,000 Ultimate seats but that was driven by plan and they bought 2,000 plan seats. And so that then unlocked Duo Enterprise for them. And so that slight change we talked about last year at this event is really helping customers continue to mature what they're doing.

Interesting. I'm going to pause here for a second to see if there's a question from the group. Your chance to ask David your burning tech question.

Even about Matt sneakers, you can ask about, too.

I got a pair of Travis Scott Canary Yellows. Does that do anything for you?

No, but I wanted the Philly. No, they were dunk closed designed by a local shop in Philadelphia. They were gone in 5 minutes, and they're now going for 5x the price.

All right. Well, there's a market for that.

Yes. Any questions?

If not, we can keep rolling, code scanning, code scanning, nothing. All right. Well...

They're a lot quieter than last year.

Yes. I know you sort of -- I think you preempted some of the questions around. Atlassian was a question that we had last year that prompted some discussion. Can -- so I guess from a Gen AI adoption -- like because that's the question that we get is like where are we in the adoption of Gen AI-based apps. From your perspective, how -- it feels like this is a 10-year trend. Where are -- I mean, it feels like we're in like the top of the first one out. I mean where are we in that evolution?

Yes. So I think if you look at like the chasm that was about in the business, you've got like the trough of disillusionment. I think that's kind of where we've fallen into with AI. The reason why I say that is initially, it was like, "Oh my god, I'm never going to trust AI. I'm not going to touch my code." Then all of a sudden, there were boards and C-suite saying, if you're not using AI, like we're going to fall behind, a bunch of people bought it, right? And then now it's kind of come back and said, like, well, what is it actually doing for me? And is it safe? And for everyone who's not aware, GitLab actually started with AI in 2021 before Duo was even a thing yet. And that's because we saw that you could help people get through code review faster if you could help them find the right code reviewer. And when we did that, we set 3 principles, which are still true today, and it's helping customers get out of that disillusionment. The first was we want AI across the SDLC, talked about that with Duo Enterprise. We also wanted to be privacy and transparency forward. GitLab is very known for that, and we wanted to continue that. So we list every model we use and how it was trained in our docs and links out to a provider if it's not a model that GitLab has created. And the last one was choosing the right model for the right use case. When I hear a lot about things like hallucinations or confabulations, I think, is the word they're trying to get to catch on, that's because you're trying to get an AI model to do something that wasn't designed to do. And so that code completion I mentioned has its own model. There's models that are built to just do that. There's a model that we use for chat, a model we use for vulnerability resolution. And that allows us to test like over 100,000 prompts across many models every week to make sure we have the right model for each use case, and we can swap them out transparently. And so as we come out of that Trough of Disillusionment, I really see AI moving from reactive to proactive. And what I mean by that is today, Duo and all the solutions that are out there, you have to give it a prompt. You have to type something, you got to click a button. That's great, and it's helping with efficiency but we see it becoming proactive where it can take decisions, make them on your behalf. And so our GitLab 17 event, which again would be, if everyone wants to kind of see where we're going next year, it's a great event. I actually get to meet the Hillary from my team, who's an incredible security leader as part of the event. But we announced GitLab Duo Workflow at that event back in June. And again, it's available for replay. And the Duo workflow solution is really focused on being an autonomous AI agent for DevSecOps and allowing you to give it guardrails and let make decisions on your behalf. And we're still in the proof-of-concept phase. We have a couple of customers trying out and giving us feedback. But the goal with it is to do things like, hey, don't have low-hanging fruit bugs be fixed by a developer. They can work on something more difficult, let Duo resolve that bug for you. Let Duo help you prioritize your backlog based on inputs that it's seeing. Going back to the beginning of our conversation and GitLab being a single data store, that's what Duo can see. So it can make a lot of really smart, educated decisions based on what it knows about your project. And that's that uniqueness of the platform and then it allows things like Duo workflow that you want.

I just wanted to -- this last question, and it's a little bit of going back. I mentioned it before but with the CrowdStrike outage, back in July, did you -- did that raise awareness amongst like the broader developer community that, like, if it happens to CrowdStrike, it could certainly happen to anybody. Like did that help from a marketing perspective?

Yes. I wouldn't say that we necessarily wanted to market off a painful event for people. But what I'll say is there's -- it's not just CrowdStrike. There's events like that all year round. Every year, there's more data breaches happening. There's more data leakage happening. And I think that that's another reason why people come to GitLab. We can help them secure that. I mentioned CACI scanning 13x faster. CARFAX said they're detecting 30% of their vulnerabilities earlier. That's going to prevent something like a CrowdStrike incident or other incidents where people have deployed in secure code or there's a bug in the code and it was just missed because we're all humans, right? So I would say that we benefit from all that from a marketing and positioning standpoint but it's not about a single event. It's about awareness, education and how GitLab can help.

Cool. We're out of time. But thanks again, David and Kelsey for coming and best of luck.

Absolutely.