IBM this week unveiled a bevy of updates to both the Terraform infrastructure-as-code (IaC) platform it gained with the acquisition of HashiCorp and its Bob artificial intelligence (AI) coding tool that promise to streamline DevSecOps workflows.
Announced at the IBM TechXchange 2026 conference, the updates include a framework based on the HashiCorp Configuration Language (HCL) that is designed to be simpler to invoke than existing policy-as-code frameworks. IBM is also making available a public preview of the Terraform Developer Portal that ensures developers and AI agents are only allowed to invoke approved infrastructure patterns. There is also a private preview of an ability to apply Terraform workflows to IBM Z and LinuxONE mainframes and an IBM Pipeline Automation for Z offering for the IBM Bob Premium Package for Z to accelerate mainframe application delivery.
Additionally, IBM launched HCP Terraform powered by Infragraph, a context engine that makes it possible for both human developers and AI agents to continuously consume infrastructure intelligence in near real time and is also previewing a remote instance of a Model Context Protocol (MCP) server for the HCP Terraform platform.
IBM has added an IBM Bob Premium Package for DevSecOps offering that includes a SafeWrite that intercepts AI-proposed file edits and package-install commands in memory. It then replaces newly introduced vulnerable dependency versions with the nearest fixed version when one is known, blocks installations when no known fix is available, and rejects direct edits to lockfiles. It also invokes a static application security testing (SAST) tool to prioritize which code vulnerabilities, misconfigurations, exposed secrets and dependencies can be remediated using a one-click Fix with Bob capability or using a guided workflow that upgrades vulnerable dependencies and re-runs tests.
In November, IBM will add an ability to review code changes when a developer adds a comment or reviews a pull request to surface changes that should be made before code is merged.
Finally, IBM is bringing watsonx.governance directly into the developer workflow via an application programming interface (API) that is accessible via the IBM Bob coding tool.
Tyler Lynch, Outbound CTO for automation at IBM, told conference attendees that the goal is to make it provide AI agent with the context needed to consume IT infrastructure at scale. Platform teams and site reliability engineers need to be able to discover and interrogate infrastructure no matter where it is, he added.
For example, DevSecOps teams can use Terraform policies to evaluate resource relationships, incorporate data source lookups, govern provider and module downloads, and evaluate policies before and after deployment. There is also a tfpolicy agent skill that IBM is exposing to AI coding tools to make it simpler to write and test policy files. DevSecOps teams can also browse and select HashiCorp-managed pre-written policies directly in HCP Terraform.
IBM has also developed an AI agent that converts code created using alternative policy-as-code frameworks, such as Sentinel or the Open Policy Agent (OPA), into HCL code and has extended the search capabilities of its Terraform platform to make it possible to discover unmanaged infrastructure.
It’s not clear at what rate DevSecOps teams are moving to revamp their workflows in the AI era, but the one certain thing is that, as the pace at which applications are built and deployed increases, there is a clear need to find a way to remediate security issues at a new level of scale.
Frequently Asked Questions
1. How is IBM making Terraform more accessible to AI agents?
2. What security capabilities does IBM Bob bring to DevSecOps?
3. . Why do these updates matter for DevSecOps teams?
Mike Vizard is a veteran IT journalist with more than 25 years of experience covering the technology industry, having previously served as Editor-in-Chief of both CRN and InfoWorld and as editorial director for Ziff-Davis Enterprise, where he oversaw titles including eWEEK, CIO Insight and Baseline. Over his career he has also edited or contributed to a wide range of enterprise technology publications, including IT Business Edge, Channel Insider, ComputerWorld, TMCNet and Digital Review, and he later led editorial for CTOEdge.com. His reporting and analysis span software development, cloud computing, cybersecurity, IT channel strategy and, more recently, artificial intelligence and DevOps practices. A recognized voice in enterprise IT journalism, Vizard is known for tracking emerging technology trends as they move from early adoption into mainstream enterprise use. He now serves as Chief Content Officer for Techstrong Group, where he oversees editorial strategy across the full network — DevOps.com, Security Boulevard, Cloud Native Now, Digital CxO, Techstrong.ai, TechStrong.IT, Techstrong Semi and PlatformEngineering.com — in addition to writing and hosting content for Techstrong TV and the Techstrong Gang podcast.