---
title: "IBM Bob 2.0 Explained: Desktop, Bazaar & DevSecOps with Markus Eisele"
date: 2026-11-10T09:00:50Z
modified: 2026-11-05T16:56:18Z
permalink: "https://redmonk.com/videos/markus-eisele/"
type: video
status: publish
excerpt: ""
wpid: 10877
categories:
  - Podcast
series:
  - Conversations
channel:
  - RedMonk Video
featured_image: "https://redmonk.com/wp-content/uploads/2026/10/Markus-EiseleTxC26.jpg"
timestamp: 2026-11-05T16:56:18Z
tags:
  - Podcast
  - Conversations
  - RedMonk Video
---

Recorded at IBM TechXchange 2026, RedMonk’s Kate Holterhoff chats with Markus Eisele, AI Developer Strategist at IBM about the keynote announcements around Bob 2.0. They discuss Bob Desktop, which extends the tool beyond developers to information workers, and the Bob Bazaar, a vetted marketplace for sharing skills, plugins and connections without the risk of installing random MCP servers. Markus explains the new DevSecOps premium package, a security assistant that helps developers shift security left, and why on-prem deployment matters for regulated environments. They also discuss why Bob has no model picker, how that reduces cognitive load and cost, and how the same harness powers the IDE, desktop and Bob Shell. Markus shares how he uses the CLI for automation in GitHub Actions and containers, and why asking Bob about Bob is an underrated feature.

This RedMonk video is sponsored by IBM.

## Links

- [LinkedIn: Markus Eisele](https://www.linkedin.com/in/markuseisele/)

# Transcript

**Markus Eisele (00:06)**
Welcome to TechXchange 2026. I’m Markus, here with Kate Holterhoff from RedMonk. and we actually want to talk a little bit about today, about the big announcements from the keynote, a little bit about Bob. Kate, how are you doing? Do you like TechXchange?

**Kate Holterhoff (00:22)**
I love tech exchange. What’s really convenient for me is I live in Atlanta. It’s just right down the road here. And I’m always preaching the good word of Bob. I’m a big fan, as as you know. And so it had a huge place during the keynote, which I thought was super exciting. in fact, I I don’t even know if I recognize Bob anymore. Bob had a real glow-up. So I’m jazzed to to talk to you more about like what that looks like and what that means. I mean what was your perception of the of the the new and improved Bob?

**Markus Eisele (00:49)**
mean th things that come to mind first thing is Bob Desktop, right? that doesn’t even look like an IDE anymore. Right. That apparently is designed for information worker. So we’re pivoting Bob out of just being a developer tool into something that is helpful for pretty much all roles out there.

**Kate Holterhoff (01:09)**
Yes, yes, yes. At the keynote, we were told that the the users of Bob, the persona has expanded dramatically. Back when I met Bob last year, Bob was more of a developer tool, it looked like a lot of the different IDE experiences. And now it’s dramatically expanded, it’s it’s more accessible, and also has a lot of interesting tooling associated with it, like guardrails, things like that.

So the desktop experience, big part of the keynote. And I think what I I want to hear more about is the Bob Bazaar. So, I we’ve heard a lot about the different registries and stores, whatever marketplaces for these agents. But I mean how what sets w what makes this new Bob Bazaar special?

**Markus Eisele (01:52)**
So one of my biggest challenges that I have as a developer using Bob is to give it the right context and to basically have it use my personal workflows. Usually with these agents you start building out skills. You start building out your personalized MCP connections. So you’re you’re kind of customizing this. And to be honest, a lot of this and I think there’s been some research about hundred thousand skills and they all pivot

around like nine big brackets of functionality. And I think what we realized is that we’re running into the same. So people start rebuilding the same kind of functionality, the same kind of workflows. So the Bob Bazaar is a brilliant idea to repackage existing and working fundamentals skills, plugins, you name them into something that teams can share broadly across their implementation. Right. And

Also, I mean not everybody is a developer, not everybody wants to build their own skill. Not d not even speaking about MCP servers and sure what is below all that. So the bazaar is exactly what gives the knowledge worker access to all those connections. Think about Jira, Monday boards, you name them, right? All this is pre-packaged and can be used and shared among teams.

**Kate Holterhoff (03:17)**
That is so smart. And I suspect it comes with maybe some governance associated with it, some guardrails so that you know you’re actually getting the right package and not maybe some malicious skill parading around like it’s does one thing and potentially does something else.

**Markus Eisele (03:31)**
Absolutely. I mean we all know that there’s a ton of risk. we’ve seen very prominent CVEs coming out just the last couple of days. yeah. And I think that topic is becoming even more important going forward. You cannot just randomly install an MCP server from the internet.

**Kate Holterhoff (03:50)**
bad idea.

**Markus Eisele (03:51)**
Exactly. So that is the number one opportunity with the buzzaar to keep this in check, reduce the security exposure, and make sure people have a central place where they can draw from knowing that these skills and informations and plugins are actually vetted.

**Kate Holterhoff (04:10)**
Such a good idea. Okay, and that seems like a good segue I suppose to talking about the DevSecOps. can you tell me more about what that is?

**Markus Eisele (04:17)**
DevSecOps is our newest premium package. So I I struggle with the name because I always wanted to say plug-in. And and that is what it’s technically is, right? So it’s a plug-in to Bob, it’s a premium package, so you basically have to pay extra for it. Yeah. But it gives the developer all the tools they need to shift security left. So think about it as your little cockpit, your little helper, your little agent guard.

That is sitting next to you, taking a look at your code base, at your decisions, potentially even at the output of Bob, what’s coming back from the large language models to make sure that this is not insecure. And I’m trying to be a little bit vague because obviously you only can check CVE databases for malicious and known failures. Right. So

I cannot guarantee one hundred percent security like none of us can probably. But this is a your chance to shift more of the security left into development directly into the developers’ hands by knowing that there’s an ongoing thing watching over you. Yes.

**Kate Holterhoff (05:32)**
That all makes perfect sense. But Markus, I’m gonna I’m gonna tease you here a little bit. developers don’t care about security. They never have. So you’re telling me that these developers are gonna be excited about this DevSecOps Sounds like maybe it’s the CISOs or something that are saying, hey, hey developers, we’ve got this new new tool that’s gonna help all of us here in the organization.

**Markus Eisele (05:52)**
So one perk of being a developer relations guy in IBM is that I get to play with all of this very early. I bet. So even way before the announcement. So yeah, if I would pull out my laptop you would see it installed. Sure. And I can tell you it is not the security like in corporate security that developers hate. So it doesn’t come with a lot of thumbs down and pressure. It actually comes as something that is supporting you. So it’s helping you surface these insecurities and vulnerabilities. I try I try to touch on that assistant piece more. Yeah yeah that is how I perceive it. So it’s not the CIO kind of guardian that doesn’t let you do fun things. It’s more like you are a guardian angel.

**Kate Holterhoff (06:39)**
Yes, yes, yes. Okay. All right. Well, we just gotta give you a hard time. But you’re absolutely right. I mean, we’re recording this a week after the big PHP incident that basically shut down the internet. everybody was extremely concerned about that one. but there seems to be a new one every week. I spend a lot of time covering the JavaScript ecosystem, so NPM is in the news pretty much constantly with these, big big potential vulnerabilities that that are are being discovered now because of AI. So yes, so I j I joke about security being something developers don’t care about, but in fact everybody has to pay attention to this today.

**Markus Eisele (07:12)**
Yeah, I think what developers really don’t care about is how to s securely implement something. Yeah. But as soon as you start being on the consuming side of products and I there there is enough interesting materials out there that lets me think about reuse. We’ve talked about skills, right? So that’s not markdown files. That could also come with a bunch of Python scripts. So like many people just do the NPX install and

And don’t second thought this for a millisecond, right? the risk is just very invisible. And knowing that there’s something that can actually help you inspect all of this is something that gives me a better night’s sleep. And I’m a German, I really need sleep.

**Kate Holterhoff (08:00)**
I like that. Thinking about the the security issues, I mean I I I think everybody is newly cognizant of the fact that, modernization projects need to be happening now. We need to have trusted publishing. things that you could put on hold suddenly are becoming an emergency that, weren’t in the past. okay, well let’s I I want to hear more about the the glow up with Bob because I think

I think of the exciting things around Bob, and there’s so different ways that you can harness these agents today. But Bob does some really unique things. And I think that the on prem experience in particular is something that I’ve heard a little bit about. Would you talk to us about how it is that maybe some customers are using Bob in ways that are unique help these engineering teams to achieve their goals in ways that maybe i aren’t available for some other agentic experiences.

**Markus Eisele (08:52)**
One of the biggest questions I get asked all the time is how secure is it if I shove data into an LLM endpoint? How trustworthy can I be sure that none of this is being used by anybody else? We are talking about highly regulated environments, we’re talking about very innovative customers that are very risk aware.

and they have a very strong interest in running Bob on-prem in their own data center on their own infrastructure in the most secure and controlled environment you can even think of. this is something that no other coding agent can actually deliver today because we give customers the opportunity to choose the runtime environment. We continue to support Bob as a software as a service offering.

That’s kind of the public version, if you like so. But if you really want to have your back end, your models, the complete Bob stack on the server side in your own data center, you can now do this. We do support a couple of models that we actually recommend for running on-prem, but you can also bring your own hosted versions of large language models. So there’s a ton of flexibility and adaptability on the Bob.

backend that gives you the same developer experience and now even more with Bob Desktop all based on the same on-premises models. So you don’t have to worry because it’s not gonna leave your data center.

**Kate Holterhoff (10:33)**
and talk to me about how that relates to model selection. Because I’ll tell you, I I’m not alone in the in the experience of, you know, I I have some development task and I’m not entirely sure how challenging it’s gonna be for the model. I can’t read its mind, right? So I I t I typically will pick a very, performant model and

it’s just not unlikely that I’m I’m exceeding what I need. and of course the worst experience, I’m a Claude user, among other harness experiences, I’ll pick Fable or something very expensive to ask a stupid question like about the weather or something. And because I forgot, you know, I didn’t realize I had it set to something expensive that I

I I just didn’t need to use. So I I I think what’s exciting about Bob is I never have that problem. So why is it that Bob is able to save me from myself typically or just the fact that I don’t know what sort of model I actually need.

**Markus Eisele (11:29)**
You’re talking about the elephant in the room, right? Bob does not give you a model picker.

**Kate Holterhoff (11:34)**
Absolutely.

**Markus Eisele (11:35)**
That is brilliant on the one side because you don’t have to choose, right? So I see this as a lot of mental loads being taken away from me as a developer. Because I don’t have to care. Is that something that a model would need to think about more deeply? Or could I just give this to the model to implement, right? Right. So to very different cost structure ultimately. And Bob is intelligent enough. Bob’s back end is designed with a very

intelligent model picker. Yes. So at the end of the day you don’t have to choose a specific model version. Bob’s backend is introspecting your requests that come in and is making that decision for you. And this is also ideal in the on-premises situation because ultimately it takes away all the specifics for the of the individual models that developers usually need to understand.

stand. So you’ve meant you’ve mentioned a couple of our competitors. There’s also a ton of open source models out there. Smaller ones, bigger context windows, 40 billion, even more context windows of various sizes, right? Right. You don’t have to worry about any of this anymore. And Bob is taking this over. And I have to admit, I’m starting to enjoy this.

I also fall into the trap of thinking that I could outsmart models. Like I know that I don’t have to pay for this, right? This is a stupid simple question. Right, right. But ultimately it turns out I forgot half of it, right? And yeah, the solution that the model came up with was not exactly brilliant. so that should not happen to a developer, right? The developer should focus on What is important? What’s the business domain? What’s the business problem I have to solve? Right. And the models underneath should just support that question as best as possible.

**Kate Holterhoff (13:32)**
Yes, absolutely. I love that model choice is becoming the new cognitive load. Like I I have to think about it every time before I hit submit, like, what model am I actually using and what should I be using? And then, suddenly I’m not thinking about the thing that’s important, which is like writing business logic or something. all of these things are part of the new SDLC, I I would say. but yeah, cognitive load, something that platform engineers have been talking about forever. Suddenly we’re importing it as as like

part of the way that we now code. but Bob doesn’t do that. That particular little problem is is just off the table. And the other thing that I was hoping we could talk about is the the CLI versus the UI experience. Because lot of these model providers, and and frankly, folks who have plugins, MCP, all of these, they want to interact with the agents via the CLI. And that could be kind of off putting,

Especially if you’re trying to widen the aperture of potential developers, which we heard about during the keynote. What’s Bob’s approach to that? are you seeing that customers and that these developers who use it do want to interact via the UI experience, the sort of dashboard, the desktop, or do they want to do it through the terminal, through the shell?

**Markus Eisele (14:40)**
I think I have a confession to make. So I’m a developer and I’m pretty proud that I’m a developer. And I don’t like the CLI. So I I personally I don’t really have a connection to CLI tools. Yes. I prefer my IDE. Wow. And there’s been all IDEs, like I had them all pretty much. And I am very comfortable with a VS Code like interaction interface, right? Yeah. But also if I look at the way I

work not only with Bob but in general reviewing more code than I actually write myself. I feel the interface need is changing a lot. I need a different exposure to the decisions that I as a developer now need to make. And these are rarely line by line source code decisions. These might be architectural discussions that contain mermaid diagrams. This might be deployment diagrams

That I’m looking at, right? So I need a much larger surface that I can interact with the agent with. On the other hand, I also want to look at source code or at configuration files. So I think switching back and forth between the ideal IDE experience or the user interface for the sake of is exactly what I use. And I do use Bob Shell, so the CLI version. But for completely different purposes. I use it for

For automation, for example. So I I shove it into GitHub. I use it as GitHub Actions Runner. So I can I can basically have pull requests being inspected by Bob. I also use it in containers. So Bob Shell has a secret feature that I love, a very dangerous one though. You can run Bob Shell with all trust. So it it’s never gonna ask you for a single approval. And in these situations you really want to like long running

Tasks where you run exploratory kind of research on your machine, right? So it’s an agent, we need to make sure nothing bad happens. We all know that’s always just a step away from a normal work process. So I shove Bob Shell into a container and give it the correct rights and access rights, have my separate mounds for that container. Yeah. And I let Bob Shell just run and crack on a problem. So that’s three completely different surfaces.

for the same person, the same developer with three completely different needs. And I think that is another thing that I really like with Bob because it bas it’s based on the same harness. So it’s not that we bake the harness into the IDE or into the shell or into any other client experience like ACP that is also exposed via the shell, right? But it’s all part of the same experience and it becomes part of the Bob client. So how can I make that more more transparent and picturesque? Think about somebody using the shell, even the TUI for that sake, working in in the terminal on a task and

need to switch over to the IDE because they now need to navigate a couple of more complex files, they can open the same session that they started in the shell and continue in the IDE. And that is possible because the harness is completely transparent underneath and we just treat these different surfaces as individual surfaces for Bob in general.

**Kate Holterhoff (18:17)**
Yeah, and that gets back to the context idea, right? That it’s able to save that information and you can access it in whatever way makes the most sense. Okay. Yeah, that’s a really good example. I’m interested in some of your own perceptions in terms of Bob 2.0. what other features have have we not discussed yet that really are setting Bob apart these days?

**Markus Eisele (18:39)**
I’m I’m probably most excited about the Bob Bazaar. Okay. because that is addressing a real problem. Sure is. So little secret, I’m w we I think it was shared in the keynote today. We have 170,000 users inside of IBM onboarded to Bob. So they are using it on a daily basis. And we have a little self-help group internally, which is basically a big Slack channel where I’m trying to convey my knowledge and help out. And one of the biggest

questions I see is actually how do I do X and having a mechanism, a marketplace, a bazaar where I can point people to if you need to integrate with system Y grab that and just install and Bob knows what to do, right? Yeah that is probably the most simplistic answer. Another thing that I think is is heavily undervalued is the ability to ask Bob questions about itself. So Bob became self-aware just very recently. And

**Kate Holterhoff (19:45)**
AGI. It’s it’s happening with Bob.

**Markus Eisele (19:47)**
it’s it’s I don’t I don’t want to take it that far, but at least if you run into a problem with Bob. If you don’t know how to configure an MCP server, if you have a question about an IBM product, you can actually ask Bob. That is awesome. And Bob is going to answer you. So a lot of the questions I see in in my little self-help group is So my first answer is, have you asked Bob? No, why should I?

Because Bob is there to help you, right? So I think what we’re witnessing right now and what gets me super excited is exactly that fact that the work is changing so much that we have an intelligent partner, somebody who’s assisting us across the software development lifecycle with all of this. And and this is my biggest takeaway from Bob’s development over the last couple of months even.

**Kate Holterhoff (20:37)**
Amazing. Well, it you’ve answered a lot of the questions that I had after the keynote.

**Markus Eisele (20:42)**
I can thank you so much for actually being here, taking the time, rambling with the German and answering a couple of my questions too.

**Kate Holterhoff (20:52)**
Anytime. Alright. Well, you know, at RedMonk. we do enjoy talking about anything developer facing and and I’m one of the OG Bob users. so it was it’s great to hear how it’s evolving. the roadmap laid out, it’s exciting stuff and it it addresses a lot of the I think the issues that are top of mind with the developers that I’m I’m speaking with right now. So thank you, Markus.

**Markus Eisele (21:09)**
Perfect. Thank you so much, Kate.