GitLab Inc. appointed Thomas Lloyd as Chief Business and Legal Officer to drive ecosystem partnerships, corporate development, and governance strategy. Lloyd will oversee business functions including product and cloud partnerships, corporate development and strategy, as well as legal functions. He will serve as the leader of the broader legal and corporate affairs organization and as counsel to GitLab's board of directors.

The appointment comes as GitLab expands its partner ecosystem and platform capabilities to meet growing enterprise demand for agentic software delivery. Bill Staples, chief executive officer at GitLab, said organizations need partners who can build the right ecosystem, invest in strategic opportunities, and govern AI responsibly as AI is introduced into every stage of the software lifecycle.

Lloyd joins GitLab from New Relic, Inc., where he served as Chief Business and Operations Officer and Chief Legal Officer and Corporate Secretary. At New Relic, he oversaw company strategy, partnerships, corporate development, security, legal, privacy, information technology, and compliance. Before New Relic, Lloyd advised high-growth technology companies at Latham & Watkins.

Leadership Background

Lloyd holds a Bachelor of Arts in Political Science and Psychology from the University of California, Davis, and a Juris Doctor from the University of California, Berkeley. GitLab's board member Godfrey Sullivan said Lloyd's experience across business operations, law, and partnerships makes him a strong addition to the leadership team.

GitLab is the intelligent orchestration platform for DevSecOps. The platform enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and approximately 50% of the Fortune 100 trust GitLab to ship software.

GitLab Inc. today released GitLab 19.2, introducing governed agentic automation to address the backlog of code, dependencies, and changes created by AI. The update allows developers to fix vulnerable dependencies automatically, catch logic flaws missed by scanners, and create custom agentic workflows while maintaining organizational controls. A Forrester Consulting study commissioned by GitLab found that organizations using the GitLab Duo Agent Platform can achieve a 400% return on investment with payback in under six months.

Dependency Scanning Auto-Remediation

Dependency Scanning Auto-Remediation is now available in public beta. This feature addresses security risks from transitive dependencies, which a study of the Maven ecosystem found reach roughly 63% of latest releases. When a scan identifies a vulnerable package, GitLab opens a merge request with a suggested fix. If an upgrade breaks the build, agents iterate to resolve the issue within the same merge request. New configuration controls allow developers to set severity thresholds and version scopes. All changes stop at existing approval gates and generate a full audit trail.

Security Review Flow

Security Review Flow, now in public beta, detects vulnerabilities that pattern-based scanners cannot identify, such as business logic errors and race conditions. The feature analyzes code intent rather than matching known patterns to find flaws like broken object-level authorization, missing authorization on state-changing operations, and information disclosure. Findings include severity ratings and suggested fixes where available. The flow does not approve changes automatically; a person must make the final decision.

GitLab Duo CLI and Custom Flows

GitLab Duo CLI is now generally available across GitLab.com, Self-Managed, and Dedicated deployments. This tool brings GitLab Duo Agent Platform's agents to the developer's terminal with full project context, allowing users to diagnose failed pipelines or propose fixes without leaving the command line. Custom Flows are also generally available, enabling teams to replace manual multi-step workflows with agentic automations triggered by GitLab events. These flows authenticate to external services using short-lived, job-scoped tokens.

Controls and Governance

GitLab 19.2 introduces controls to ensure automation remains trustworthy at scale. The AI Audit Event Report, now in beta, records AI-assisted actions as dedicated audit events for compliance and security teams. Group-level custom instructions for GitLab Duo Code Review allow administrators to set review behavior across projects simultaneously. New MCP access controls govern which agents can run and what resources they can access.