Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW
  • CPE

Mercedes-Benz DevSecOps Transformation with GitLab

Gitlab
11/01/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


Mercedes is one of our customers that was able to actually transform how they think about the software development lifecycle using GitLab. They were able to see across thousands of developers the ability to actually go from what was the previous implementation all the way through to the new generation using software development lifecycle in a highly regulated company with GitLab. So to tell you more about this, I'd like to welcome on to stage Bastian from Mercedes Benz. Welcome, Bastian. Hi, Sarah. Hey, thank you for coming. All right, have a seat here. Thanks. Thanks for having me. All right, so I have a few questions for you. So you recently launched the CLA, C class, and GLC on mb.os, Mercedes' in-house vehicle operating system. What does that innovation approach look like? And how is GitLab helping your 20,000-plus engineers on that journey? Well, first of all, you're right. We launched the CLA last year, followed by the C class and the GLC, and all run our latest version of mb.os, our in-house developed operating system. Not so long ago, we had several dozens of suppliers who equipped us with control units and the software. And integrating all of them was quite difficult. But we moved towards fewer control units with more capable ECUs, where we developed a bigger part of the software. So we control the crucial parts when it comes to autonomous driving, infotainment, powertrains, et cetera. But of course, this comes with some challenges. So different to maybe web or app development, embedded software development is kind of quirky. So we have to deal with embedded tool chains, some tools when it comes to Zest and Desk, which were never meant to run in a CI, but rather on Windows. But luckily, with tools like Fleeting Runners, we can run also those tools at scale, running several million jobs regularly, moving several petabytes of data, of artifacts on the platform. Well, we run the platform in different flavors, where we have a greater degree of flexibility when it comes to our back end and web services for the connected vehicle. We can use GitLab Dedicated to use all the benefits of a SaaS product, but where privacy is key and we have the highest level of control of our data also being present in different regions of the world where required, we go with GitLab Self-Hosted to have this greater degree. Well, when we started in-house software development, it wasn't always like that. When we started, we had different instances of Jenkins, Bamboo, Bitbucket, Azure DevOps, et cetera. And over the last years, we all brought this together to GitLab because GitLab gives us this unified user experience. We can govern in one place, can share best practices across all those domains and are pretty happy now having more than 20,000 users on our platforms. Awesome. I love that and the different flexibility that you're able to bring and that consolidation over time. I think I've been there since the beginning of the journey with you all. It's been fun to see. OK, like every technology leader here, you were navigating AI for software engineering. But with automotive software, there comes a level of safety, accountability, and review burdens that most application teams don't ever face. So how are you approaching the use of agentic AI for your software delivery? Well, we're doing a lot of different approaches. I think the key is an agent can only be as good as the context and semantics which are a fact of them. Therefore, I'm also super excited about what we saw already. Context and semantics in our domain, besides the source code, of course, itself means the functional requirements, but also the non-functional ones, safety constraints, architecture patterns, et cetera. So key is that we move this data out of proprietary tool silos. But make it accessible within Git or in graphs so that the agents can operate on that to have the right input. But at the same time, also, the validation, what we do in CI, becomes even more crucial. That we tighten the loop where we see what the agents did, but also agents ideally can correct themselves. Also what we saw just a couple of minutes ago. And what we really also like is that with GitLab, we have this flexibility. We can use the GitLab Duo feature set, but we can also connect other harnesses like Cloud Code or so. Because, I mean, it is still a young thing. We're exploring a lot of options. And having this flexibility without over-committing into one locked ecosystem is a great advantage. For Duo itself, I can only echo what we also just saw. Chat and code reviews are amongst the most loved features on our end. Fantastic. Thank you. And I know we've been talking a little bit before this also on just the context that Orbit will bring and the ability to be able to make the decisions with NVMR and the time savings you'll see there. Exactly. Great. OK. You have an internal framework on AI native engineering. As we launch Orbit public beta today, how does a richer SDLC context fit into that picture? Well, I think it fits perfectly. I mean, with AI, we can get at such a high pace. But also, as we heard already, we need speed with control. And we have automotive regulatory standards like ASPICE, which require traceability and human accountability. And accountability is especially important for us. I mean, we put people in our cars who trust their life to our cars. So we, as Mercedes, have to stay accountable that the software is safe and sound. And I think mastering this human-in-the-loop approach, letting agents freely where they can run freely, but then, again, having the humans in the loop, reviewing the results, approving, giving consent to what the agent did is right. I think this is key. And there, we see GitLab is very well set up as this control plane where we integrate the software and take that accountability. Awesome. Thank you. All right, last but not least, a favorite question. How are you thinking about measuring whether or not AI is actually improving productivity? Yeah. Well, I think, first of all, all the metrics we did in the past in measuring productivity, like DORA metrics, et cetera, are more valid than ever. Because ultimately, AI is a means to an end in becoming more productive. But also, at the same time, we have to justify the spendings, of course. And I think everybody who uses this knows there are good and bad patterns how to use AI. So what we would like to see is a good integration of the DORA metrics or productivity metrics with AI consumption and insights how our users are using that, seeing best practices, where are we efficient. And I think you have also a nice guest coming up who will dive into that looking forward. Yes, yes. We'll show him in a moment, too. We're excited to have Gene here. Great. Well, Bastian, that is the last of my questions. Thank you so much for joining us today. We're thrilled to have our next guest on stage. Pleasure. Thank you. Thank you. Thank you. Thank you. Thank you.

TL;DR

  • Mercedes-Benz consolidated Jenkins, Bamboo, Bitbucket, and Azure DevOps into a single GitLab platform, giving 20,000-plus engineers a unified governance and development experience.
  • Embedded automotive toolchains present unique CI/CD challenges; GitLab Fleeting Runners enable millions of jobs and petabyte-scale artifact pipelines for hardware-in-the-loop environments.
  • ASPICE compliance and vehicle safety accountability require strict human-in-the-loop review gates, even as agentic AI accelerates code generation and review workflows.
  • Mercedes-Benz plans to integrate DORA metrics with AI consumption telemetry to measure real productivity gains and surface best practices across engineering teams.

Summary

In this fireside chat from GitLab Transcend 2026, Bastian Stahmer, Business Owner of Vehicle Software Development Platform at Mercedes-Benz, joins GitLab Chief Customer Officer Sherrod Patching to discuss how the automaker scaled DevSecOps across more than 20,000 engineers building MB.OS — Mercedes-Benz's in-house vehicle operating system now powering the CLA, C-Class, and GLC. Stahmer explains how Mercedes-Benz consolidated a fragmented landscape of Jenkins, Bamboo, Bitbucket, and Azure DevOps instances into a single GitLab control plane, enabling unified governance, shared best practices, and a consistent developer experience at enterprise scale. The conversation covers the unique infrastructure demands of embedded automotive software — including specialized toolchains never designed for CI environments — and how GitLab Fleeting Runners enable millions of jobs and petabytes of artifact movement. Stahmer also addresses the critical role of human-in-the-loop governance under ASPICE regulatory requirements, explaining that agentic AI must operate within strict accountability boundaries when software directly affects vehicle safety. Finally, he outlines how Mercedes-Benz plans to correlate DORA metrics with AI consumption data to validate productivity gains and identify best practices across engineering teams — framing GitLab as the platform where speed and regulatory accountability converge.

Chapters

0:00 - Introduction & Welcome
0:44 - MB.OS and 20,000 Engineers
1:33 - Embedded CI/CD Challenges
2:29 - Tool Consolidation to GitLab
3:06 - Agentic AI and Safety Accountability
5:13 - ASPICE Compliance and Human Review
6:00 - Measuring AI Productivity Impact

Key Quotes

1:41 "Embedded software development is kind of quirky. So we have to deal with embedded tool chains, some tools when it comes to Zest and Desk, which were never meant to run in a CI, but rather on Windows."
2:43 "We all brought this together to GitLab because GitLab gives us this unified user experience. We can govern in one place, can share best practices across all those domains."
4:28 "Having this flexibility without over-committing into one locked ecosystem is a great advantage."
5:26 "We put people in our cars who trust their life to our cars. So we, as Mercedes, have to stay accountable that the software is safe and sound."

FAQ

How does Mercedes-Benz handle ASPICE compliance when using AI-generated code?

Mercedes-Benz enforces human-in-the-loop review gates within GitLab, requiring engineers to review, approve, and give explicit consent to AI-generated changes before they are merged. This ensures traceability and human accountability as required by Automotive SPICE regulatory standards.

Why did Mercedes-Benz choose GitLab over maintaining its existing multi-tool environment?

The fragmented landscape of Jenkins, Bamboo, Bitbucket, and Azure DevOps made cross-domain governance and knowledge sharing difficult. GitLab provided a unified user experience, centralized governance, and the flexibility to run in both Dedicated SaaS and Self-Hosted configurations depending on data privacy requirements.


Categories:
  • » Cybersecurity » Application Security
  • » Data Protection
Channels:
News:
Events:
Tags:
  • DevSecOps
  • Customer Story
  • AI & Machine Learning
  • Compliance & Governance
  • Security Operations
  • Technical Deep Dive
  • DevSecOps transformation
  • Automotive software development
  • Embedded systems CI
  • CD
  • Tool consolidation
  • Agentic AI governance
  • ASPICE compliance
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: Mercedes-Benz DevSecOps Transformation with GitLab

              View CPE Certificates

              Upcoming 360 View Events

              • Nov
                19

                Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection

                11/19/202601:00 PM ET
                More events

                XStreaminars (watch here)

                • Nov
                  10

                  Zendesk: From AI Readiness to Results: A Framework for Transforming IT Service

                  11/10/202601:00 PM ET
                  • Nov
                    12

                    Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision

                    11/12/202601:00 PM ET
                    More events

                    Industry Events (Sponsor Hosted)

                    • Nov
                      04

                      Aligning Agentic Intent: Understanding Your Agents' True Potential and Performance

                      11/04/202611:00 AM ET
                      • Nov
                        05

                        Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption

                        11/05/202602:00 PM ET
                        • Nov
                          10

                          Agentic Shopping Trends: Insights on Muse and the 2026 Holiday Season

                          11/10/202601:00 PM ET
                          • Nov
                            19

                            Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents

                            11/19/202601:00 PM ET
                            • Jan
                              19

                              HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.

                              01/19/202702:00 PM ET
                              More events

                              Upcoming Webinar Calendar

                              • 11/04/2026
                                11:00 AM
                                11/04/2026
                                Aligning Agentic Intent: Understanding Your Agents' True Potential and Performance
                                https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-true-potential-and-performance/
                              • 11/05/2026
                                02:00 PM
                                11/05/2026
                                Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption
                                https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
                              • 11/10/2026
                                01:00 PM
                                11/10/2026
                                Zendesk: From AI Readiness to Results: A Framework for Transforming IT Service
                                https://www.truthinit.com/index.php/channel/2191/zendesk-from-ai-readiness-to-results-a-framework-for-transforming-it-service/
                              • 11/10/2026
                                01:00 PM
                                11/10/2026
                                Agentic Shopping Trends: Insights on Muse and the 2026 Holiday Season
                                https://www.truthinit.com/index.php/channel/2219/agentic-shopping-trends-insights-on-muse-and-the-2026-holiday-season/
                              • 11/12/2026
                                01:00 PM
                                11/12/2026
                                Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision
                                https://www.truthinit.com/index.php/channel/2192/leaving-vmware-means-leaving-vsan-your-vmware-exit-is-really-a-storage-decision/
                              • 11/19/2026
                                01:00 PM
                                11/19/2026
                                Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection
                                https://www.truthinit.com/index.php/channel/2076/securing-the-microsoft-enterprise-strengthening-configuration-management-identity-security-and-data-protection/
                              • 11/19/2026
                                01:00 PM
                                11/19/2026
                                Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents
                                https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/
                              • 01/19/2027
                                02:00 PM
                                01/19/2027
                                HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.
                                https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-empowered-ai-consumer/
                              Truth in IT
                              • Sponsor
                              • About Us
                              • Terms of Service
                              • Privacy Policy
                              • Contact Us
                              • Preference Management
                              Desktop version
                              Standard version