ATO in Security program plan

Overview

The AI Transformation Owner (ATO) program in Security helps the Security Division adopt AI under one shared strategy, rather than each team taking a separate approach.

Security is one spoke in GitLab’s Hub & Spoke & Hub model for scaling AI. Responsibilities are split as follows:

• Enterprise AI owns the platform and how solutions are built.
• The ATO facilitates Security’s AI roadmap, which defines what the division works on and why.
• AI Champions are a peer group within Security who shape the roadmap.

Use-case ideas go to the ATO through the AI Champions. Bugs, security issues, and platform feedback go directly to Enterprise AI.

What the program includes

• AI Champions: a cross-team group of up to 10 people who develop Security’s AI strategy and deliver outcomes.
• AI office hours: sessions every two weeks, open to anyone in Security.
• AI patterns library: standard AI tooling patterns, developed with input from each team (link to come).
• Reporting: a weekly update to the ATO Council and regular summaries for Security leadership.

The program is led by Bryan Lokey (ATO) and coordinated by Destiny Jenkins (Program Coordinator). See Roles and owners for all roles and responsibilities.

Getting help

• Questions: ask in AI office hours, post in #enterprise-ai-collab, or contact your team’s AI Champion. You do not need to contact your AI Champion first.
• Use-case ideas and requests: share them with an AI Champion or in AI office hours. All requests are routed to the ATO.
• Bugs, security issues, and platform feedback: report them directly to Enterprise AI in #ent-ai-champions or through Serval.

Guiding principles

• Core security practices come before AI-specific defenses.
• AI Champions are responsible for delivering outcomes, in addition to reporting status.
• Expectations are set realistically at the start of each effort.
• Patterns are developed jointly with the teams that use them.
• The ATO works through collaboration and does not direct teams.
• Before building something new, check what Enterprise AI and other teams have already delivered.

Strategy

The AI Champions develop Security’s AI strategy, and the ATO facilitates the process. The AI Champions set priorities, define practices, and choose which outcomes to pursue. The ATO convenes the group, removes blockers, and connects the work to Enterprise AI and the ATO Council.

The pillars below are a proposed starting point. The AI Champions can keep, change, or replace them at kickoff.

Proposed guiding pillars

Success is measured against Security’s business metrics, and the ATO is accountable for them. Enterprise AI combines results across functions.

Working practices

• The AI Champions agree on which outcomes to pursue before work begins.
• Security brings at least one update to each weekly ATO Council meeting.
• Teams redesign processes where appropriate, rather than adding AI to existing steps. See the Guiding Principles.

Still to define

• Whether the AI Champions confirm, change, or replace the pillars
• Which Security business metrics each pillar affects, and the targets for each
• A shared definition of toil
• How progress is reported to the Security Division

Roles and owners

Operating rhythm

The program follows a recurring cycle. AI Champions meet weekly to work on the roadmap, the ATO reports weekly to the ATO Council, office hours run every two weeks for all of Security, and results are shared with the division. Questions raised in office hours can become topics for the AI Champions meeting.

Recurring meetings

Days and times are to be confirmed.

Update process

1. AI Champions report progress at the weekly AI Champions meeting.
2. The Program Coordinator compiles the updates for the ATO Council.
3. The ATO presents the updates at the weekly ATO Council meeting.
4. Highlights are shared with the Security Division.

AI Champions

AI Champions are a small group from across Security who develop the division’s AI strategy, with the ATO as facilitator.

Responsibilities

• Identify and qualify AI use cases within their team
• Pilot agents and workflows
• Coach teammates
• Report friction and feedback to the ATO
• Contribute to the shared AI patterns library
• Take turns leading the AI Champions meeting

AI Champions are expected to deliver outcomes, not only attend meetings.

AI Champions do not report to the ATO. The ATO connects them with Enterprise AI. Anyone in Security can bring questions to AI office hours without first contacting their AI Champion.

Time commitment

AI Champions spend 5 to 10% of their time on the program. Each AI Champion agrees on this commitment with their manager.

Selection process

1. The ATO shares the program goals with Security leaders.
2. Each leader nominates up to three people.
3. The final group is selected from the nominees and from known frequent AI users, balanced across teams. Each AI Champion’s manager approves their participation.
4. The group has no more than 10 members.

Backups and rotation

• Each team names a backup who attends when the team’s AI Champion is unavailable.
• AI Champions take turns leading the weekly meeting. If the scheduled lead is unavailable, the next person in the rotation leads.
• If an AI Champion’s availability changes, their leader confirms whether they continue or nominates a replacement.

Timeline and roadmap

All dates are proposed.

October covers setup: selecting the AI Champions, sending communications, and holding the kickoff the week of 2026-10-19, followed by a first 30-day cycle. During FY27-Q4 (2026-11-01 to 2027-01-31), the regular schedule begins, with the first AI office hours the week of 2026-11-02 and every two weeks after that.

October setup

FY27-Q4 regular schedule

FY27-Q4 office hours schedule

View page source - Edit this page - please contribute.