Cochlear unifies hearing-care technology development on GitLab, serving more than 800,000 patients worldwide

A platform that grew with momentum, not a mandate

Cochlear first adopted GitLab's free tier in 2012, when a small cloud engineering team was looking for a better way to manage source code. On-premises control mattered to Cochlear from the start, and GitLab's usability made it stick. “Different teams had adopted different tools over time, including Bitbucket, TeamCity, Codacy, GitHub, Jira and several other systems. But when you look across our portfolio, there are advantages to having a more consistent approach with related activities all in one platform,” Rodrigues explains.

By 2020 use of GitLab had grown steadily, and Cochlear's software application development group moved off Bitbucket entirely. Around the same time, Cochlear's CI/CD needs pulled GitLab into the firmware organization as well, and IT adopted it in earnest. "I've always said that GitLab’s CI/CD capabilities are more powerful than any other tool out there," notes Rodrigues.

As a medical device manufacturer building mobile, desktop, and embedded software all at once, Cochlear needed vulnerability scanning and dependency checking embedded throughout the software development lifecycle. That’s why in 2023, security was the driving factor in Cochlear’s expansion to GitLab Ultimate.

Today, Cochlear builds all its software and most of its firmware on GitLab, and is exploring GitLab Duo Agent Platform as an additional layer of control and standardization as use of AI grows across the organization. “GitLab is the place where all our work comes together, and the experience of operating the platform ourselves has been very positive,” Rodrigues says.

Looking ahead, Cochlear is also exploring agile planning with GitLab. A longtime Jira user, Rodrigues has found GitLab's simpler approach to be a better fit for how his teams actually want to work. "Jira is quite powerful, but you end up with custom fields galore, and the complexity increases substantially and requires a lot of maintenance," he says. "What I love about GitLab is that it simplifies agile workflows." One unexpected favorite has been GitLab Pages: teams have started building internal dashboards — some replacing reporting previously done in Tableau — and publishing them through GitLab Pages, often generated with AI assistance.

Security built in from the start, not bolted on at the end

As a highly regulated medical device company, Cochlear treats security as inseparable from the engineering process itself. Its software connects to implants and sound processors over Bluetooth, and to web services that face the same threats as any internet-facing system. According to Rodrigues, the team takes immense care in threat modeling and shifting security left — and GitLab helps create a culture and a workflow where developers are thinking about security from the very beginning of the software development lifecycle.

"In a regulated medical device company, you can't treat security as a separate step bolted onto the end of development,” explains Rodrigues. “GitLab lets us build vulnerability management and SBOM tracking directly into our pipelines, so compliance isn't something we scramble for — it's already there." Some of Cochlear’s firmware updates actually affect devices that live inside patients’ bodies permanently, which means every change has to be traceable, auditable, and airtight. “GitLab’s security capabilities help ensure that what we’re building is safe for our patients.”

As AI changes who writes code inside the organization and how it's regulated, Cochlear expects its GitLab footprint to expand to address evolving security requirements. Rodrigues explains there's a growing need to make security an integral part of how software is developed and maintained, and AI amplifies that need because it makes it easier to produce exponentially more code as employees well beyond the traditional developer population are now building internal tools with AI assistance. "AI is giving people a superpower to be creative and build things with code — dashboards, automation, and other software — but we still need to chaperone it and ensure it's up to date and secure. GitLab is an important part of creating governance; it gives us an edge in standardizing quality as more people come into the fold of building software."

Predictable, contextual autonomy: GitLab Duo Agent Platform and Orbit

Cochlear's use of GitLab Duo Agent Platform sits alongside a broader AI landscape the company is exploring. What those other tools have in common, in Rodrigues's view, is that a human still has to start every task.

What sets GitLab Duo Agent Platform apart is the ability to build agentic workflows into the existing CI/CD workflows systematically, without requiring as much human input. According to Rodrigues, GitLab Duo Agent Platform provides predictable autonomy, and as adoption matures, he expects some tasks that used to require two weeks to set up and test will take as little as 30 minutes. “GitLab Duo Agent Platform lets us explore automation like code review and dependency remediation without giving up the oversight we need," he says.

Rodrigues is especially eager for GitLab Orbit, a context graph capability that works across large, interconnected codebases, helping engineers or agents bring relevant relationships into view. "For large codebases like ours, governance with context is everything. GitLab Orbit is going to help with a lot of the challenges we have with AI today, related to context windows. I'm particularly interested in the connections that are difficult to keep track of manually — better context could help us investigate those more effectively," Rodrigues explains, noting the potential for GitLab Orbit to help with change analysis, understanding dependencies, and supporting architecture and design decisions.

A platform and a partnership that just works

Cochlear is not only using GitLab to produce secure software — it’s helping shape what regulated-industry security tooling in GitLab looks like more broadly. "What I appreciate about the GitLab team is their openness to talk about our needs and challenges in certain areas, and help build solutions for our use cases," Rodrigues says. For example, Cochlear needed vulnerability tracking that could follow a product across multiple actively supported versions in different geographic jurisdictions, since a regulated device may run an older software version in one market and a newer one in another. That capability was recently launched in beta, developed in close collaboration between Cochlear and GitLab's product team.

For Rodrigues, GitLab's value is as much about the relationship as the product. "We get to interact with both the commercial and the technical sides of the organization, and that's what I absolutely love about GitLab and what makes the partnership feel so easy," he says.

That ease shows up operationally, too. Cochlear's entire self-managed GitLab instance supports roughly 500 users across a regulated, multi-platform engineering organization, and is run by just two people. "Our GitLab instance updates automatically — which is rare for an on-prem solution — and makes maintaining the platform very manageable," Rodrigues says.

Asked how he'd explain GitLab's value to Cochlear’s leadership, Rodrigues keeps it simple. Everything Cochlear builds on GitLab serves the purpose the company started with: helping more people hear and be heard. “It’s hard to imagine where we’d be without GitLab — its value is inherent to everything we’re building.”