You don’t need to be a fortune teller to understand where enterprise IT is headed. McKinsey reported in November that 62% of global organizations were experimenting, piloting or scaling agentic AI projects. More recently, Gartner forecast that worldwide spending on AI will top $2.59 trillion in 2026 – an increase of 47% from last year. But with all the opportunity of AI comes risk.

Two thirds of organizations have suffered from a cybersecurity incident linked to AI agents over the past year, according to the Cloud Security Alliance (CSA) – highlighting that these risks are no longer hypothetical.

As they work to protect their organization by enforcing safe, governed adoption of AI, security leaders are overlooking the critical role of mature API management. Securing AI at the agent layer is only part of the solution. Without rigorous API discovery, protection and governance in place, other investments in AI security could be in vain.

Why API security matters to AI

AI is nothing without APIs. LLMs ingest and generate huge volumes of data, which is accessed via APIs, at incredible scale. APIs that once were called a hundred or so times per day receive thousands of requests every minute thanks to AI-powered workloads.

It’s easy to see why APIs have become such a key mechanism for threat actors to exploit AI systems, or to exfiltrate data in the other direction. The challenge is that APIs have a long history of posing a challenge for security teams.

Some 87% of organizations suffered API-related security incidents last year, with APIs linked to AI the most commonly cited incident type, according to one study. A separate study last year recorded 439 new AI-related CVEs over the previous 12 months, marking an annual increase of 1025%. Nearly all were directly linked to APIs; including injection flaws, misconfigurations and new memory corruption vulnerabilities.

Closing this security gap isn’t just important to mitigate the financial and reputational damage of the worst-case scenario of a data breach. It’s also increasingly important to keep regulators happy. Both NIS2 and DORA, while not AI-focused regulations, certainly make a strong case for looking at AI capabilities through the lens of resilience and security.

Not seeing is not knowing

One of the most acute challenges with API security is the proliferation of shadow and zombie APIs. Modern cloud and microservices environments are highly distributed, with APIs scattered everywhere – many of which are forgotten or have never even been recorded. That doesn’t matter to an AI agent. They’re highly resourceful at discovering APIs that are accessible, even if they’ve not been specifically asked or authorized to use that approach. If APIs offer a route to complete the task that’s been assigned to them, AI agents will invariably find and use them.

The issue is that these shadow or zombie APIs may not have been designed securely or in line with the organization’s current governance policies, leading to data loss or other unintended consequences. This was a major challenge even before Mythos changed the game for systems defenders and adversaries alike. With frontier models capable of discovering vulnerabilities and chaining exploits at a whole new speed and scale, the task of securing APIs is even more urgent.

Planning for the worst

There’s plenty of opportunities for threat actors – whether armed with the latest AI models or not, to probe for API vulnerabilities. There are also mounting real-world examples of incidents of AI agents going rogue.

One of the most widely publicized occurred when a Cursor coding agent permanently deleted a customer’s production database in just nine seconds. To do so, it found an API token stored in an unrelated file, which carried blanket permissions. No confirmation was required by the API to perform the operation.In a similar incident, Replit’s AI agent deleted a live production database despite being instructed not to.

These are useful cautionary tales. There are three key measures security leaders can implement to ensure this never happens to their organization:

1. Start with discovery – because you can’t protect what you can’t see. Security leaders need to ensure all APIs running in their environment – both internal and third-party – are automatically and continuously captured and documented so they have a complete, accurate and up to date inventory.
2. Focus on runtime protection – to mitigate the impact of zero-day exploits. There are too many vulnerabilities to patch them all. Teams are stretched and time is in short supply. Not everything can be patched at the speed of AI – for now at least. Runtime protection techniques – such as building rules and signatures into web app firewalls, are the best solution, enabling security teams to prevent flaws being exploited from outside.
3. Don’t neglect insider threats – API abuse is commonplace, so it’s also important to enforce governance around user behavior. Security leaders should implement measures that enable teams to identify anomalies that fall outside of expected behavior so they can respond faster. To do so, they need to consider what level of authentication and permissions are required for specific APIs, from both a human and agent perspective. AI tools should never have sufficient permissions to delete entire production databases.

Security at the speed of AI

What will separate the winners from the losers going forward is the ability to manage risk in a way that doesn’t constrain the business. That means agile, unintrusive, secure-by-design approaches built around runtime protection and comprehensive visibility into API posture.

The automobile sector is a great example of what’s happening in AI right now. When the industry was in its early days, the focus was on the basics – features that enabled the owner to get from A to B. As speed increased, people demanded safety – seatbelts, ABS brakes and roll bars.

Today the AI world is also accelerating. Businesses have moved beyond the stage of wanting to see that it works. Now, they want security and control – and that starts at the API layer.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

At Cisco, VP of engineering Jason Andrews deals with all the same technical issues as every other company deploying AI, including ensuring it’s governed, secure, and integrating multiple data sources, legacy systems, and AI models.

But these issues are relatively straightforward compared to the bigger challenges relating to the fast pace of change, specifically how AI can touch and transform nearly every aspect of business.

“We’re thinking about it every day,” he says. “My belief is we’ll be seeing a massive acceleration of everything.”

In coding, for example, he’s witnessing productivity increases up to 110% with AI assistants. “I can build apps or custom integrations a lot faster,” he adds.

And the real benefit of AI isn’t just in speeding up individual steps in a process, but in making AI the core of a new business process. But building it from scratch puts even more pressure on organizations trying to get employees up to speed on new ways of doing things.

“We want to move fast, train people, and get them onboarded,” he says. “But what I thought AI was going to do for my organization nine months ago is different from three months ago.” So by the time something is rolled out, it’s changed three times.

“I struggle with the change management aspect,” he says. “The legacy model of change management isn’t fast enough. How do you create that constant learning?”

One of the ways Cisco approaches it is to create communities where people can talk about these issues and share best practices and governance, and you have to keep people’s minds open that every day is going to be different than the last, Andrews adds.

Testing the AI waters

Cisco isn’t the only organization struggling with change management in the face of the AI tsunami. In a survey of 2,000 global CEOs IBM released in May, 83% of them said AI success depends more on adoption than on the technology itself, and 77% said talent and technology roles are converging.

“Thanks to Claude Code, our entire development cadence is exponentially greater than a year ago,” says Andrew Johnson, CIO at Brownstein Hyatt Farber Schreck, a Denver-based law firm with about 700 employees and clients around the US. But, as with Cisco, the biggest challenge isn’t technical.

“In our industry, with our circumstances, we’re probably less constrained by technical capability than organizational constraints, culture, aptitude, the need to bind people to technology, and what helps me and the client,” he says. “There’s a tremendous amount of cultural shift that has to happen in our organization, which is far more demanding of my attention and complexity of thought than the technical stuff.”

Companies that bill by the hour, such as law firms, may face additional challenges as attorney productivity increases because billable hours might go down. Alternatively, the total number of cases could go up as litigation becomes less expensive. Either way, firms that adapt will see competitive advantage, and the rest will fall behind, putting more pressure on the need for change management.

“If people can’t embrace technology, we won’t be able to get a lot of value out of it,” says Johnson. “I’m talking to people about adapting their way of work. There are certainly a lot of people intrigued and anxious to dive in. They recognize the connection between the potential of the technology and what we do.”

But helping everyone see that connection and then working with them to change their habits is difficult, and requires solid relationships and good communications. “That’s been far more of a bottleneck for us,” he says.

To address the issue, the firm has developed a network of technology champions who also understand the legal side of the business. “Now we need lawyers who know how to use the technology and can articulate these things to the people we’re trying to reach,” Johnson says.

But change management is only one leadership bottleneck slowing AI adoption. Companies also struggle with figuring out their vision for AI, with slow decision-making, and a tendency to focus on the past instead of the future.

Vision and strategy

In another survey, this time of 950 business leaders released by Grant Thornton in April, 51% said strategy is the biggest driver of ROI when it comes to AI adoption, but 79% of operations leaders said they don’t have a fully developed and implemented AI strategy.

“Having leadership understanding why AI is needed and what objective they’re trying to achieve is very important,” says Shivi Verma, senior manager of engineering at Docusign. “Sometimes leadership doesn’t have a strategy for their organization on how AI should be adopted. Many times it’s bottom-up, which creates a chaotic experience.”

When Docusign started adopting gen AI, different teams and organizational units wanted to go in different directions. “All were coming up with their own strategy and tooling,” he says. So Docusign brought business leaders together to understand the pain points, and decide on the technology.

“Getting requirements and placing a bet on a specific technology was important,” he says, “as well as pivoting to a different technology if needed.”

In order to adapt to changes, the company wanted to have a nimble approach, starting with smaller use cases, with power users, and problem areas.

“We try to plan for four to six months,” he adds. “We set expectations for our leadership that we place a bet with a specific technology, but want to be able to pivot.”

Today, the leadership challenge front lines have moved yet again, to agentic AI. “Folks are creating their own agents and deciding their own permissions,” Verma adds. “We’re still coming up with a governance strategy.”

Slow decision-making

When it comes to AI deployments, Dan Diasio, global AI consulting leader at EY and CTO for its US consulting business, admits he’s a bottleneck.

There’s a great deal of interest in what AI can do, and using a variety of new AI tools. But since the firm deals with sensitive client data, safety is paramount. It’s a slow process, but important to build secure infrastructure, and to have trust in the technology. “That’s a reasonable bottleneck that makes sense,” he says.

Trust in the tools they work with is essential because clients expect it. “Every tool we use has to go through a detailed security and information privacy impact assessment, as well as a whole other set of controls so they can be used appropriately and safely,” he says.

These reviews can take a lot of time, though, and in the age of AI, speed is a highly valued currency. So how do you balance the two, when safety reviews can require input from a lot of different stakeholders and be extremely time intensive?

“We’ve stood up a team to be able to quickly certify and address a variety of platforms,” Diasio says. “Instead of working with different departments in the way we used to, we’ve started identifying representatives from different departments into a cohort. Decisions we used to make in months now take weeks.”

According to a West Monroe survey of more than 1,200 leaders released earlier this year, slow decision-making is already showing up on the bottom line. Nearly three out of four leaders said their organizations lose up to 5% of annual revenue to slow decision-making and delayed execution.

And the top reasons for the delays? According to 40% of the managers surveyed, the problem was the skills gaps of overwhelmed teams, and 35% pointed to layers of management or approvals. Nearly half said they’re spending 10 to 25% of their time on rework, excessive approvals, and unnecessary meetings, and more than half say up to 50% of their projects fail or lose momentum to delays.

Focus on the future, not the past

When it comes to the decision about where to apply AI in an organization, the tendency, Diasio says, is to turn to the experts with the most expertise in the business. But these are the same people most likely to focus on improving on what they’re already doing.

“And that often blinds people to what’s possible in the future,” he says. “That becomes a significant bottleneck.” So the solution is to revamp the decision-making process around the new reality.

“What we see some advanced companies do is give people who don’t understand the process but understand the technology equal footing with people who don’t understand the technology but understand the process,” he says. “A lot of companies are disproportionately focused on just addressing their operating model right now.”

Instead of focusing on what they’re currently doing, AI-native companies will start with a focus on the customer, he says. This shift in focus isn’t likely to show up immediately on the bottom line, or result in the highest possible number of pilots going into production.

“If leaders are in a position where they’re justifying the use of a technology to the board or their CFO, they become a bottleneck when they start demonstrating their value in terms of the number of things they’re doing,” Diasio says.

But 150 or 200 use cases deployed into production may feel like progress, like things are happening in the organization. But all these use cases are a waste of time and money if they’re applied to existing processes that don’t move the needle. “We see that happen in organizations today,” he says. “Maybe we need to reinvent the processes.”

It’s no secret that companies will need to change in order to adapt to AI. Deloitte recently surveyed 660 global technology leaders and 81% said their current operating model can deploy and govern AI enterprise-wide, but 75% also said their organization must change its operating model within the next 12 to 18 months to drive greater value.

AI ROI is real, says China Widener, Deloitte vice chair and US tech, media, and telecom industry leader. But it’s currently weighted toward efficiency gains, with broader business transformation and revenue upside still developing.

Another Deloitte survey showed that the clearest results from AI were in productivity, with 66% of organizations reporting gains, and cost efficiency, with 40% saying AI reduces costs. “However, revenue impact is still emerging,” says Widener. “Only one in five companies says AI is driving top-line growth today.” But optimism prevails, with 74% expecting it to do so in the future.

Linus Torvalds has a complicated relationship with AI, seeing both its good and bad points. But his latest remarks on the usefulness of AI may have raised a few eyebrows in open-source circles.

Just a few weeks after the Linux founder complained that a “continued flood” of AI-generated vulnerability reports had made the Linux kernel security mailing list “almost entirely unmanageable”, he has come to see the advantages of the technology.

“Linux is not one of those anti-AI projects,” Torvalds wrote in an email response to Linux Kernel senior engineer Roman Gushchin, archived at Kernel.org.

“It can also be a somewhat painful tool, both for maintainer workloads and just from a ‘it keeps finding embarrassing bugs’ standpoint,” he said of the use of AI in security scanning. “The solution is to make sure those LLM tools help maintainers instead of just causing them pain.”

Developers should be free to choose whether they use AI, he said. “We’re not forcing anybody to use it, but I will very loudly ignore people who try to argue against other people from using it.”

Torvalds’ measured support for AI does not come completely out of the blue: Around the same time that he was complaining about AI distorting security maintenance, he also spoke about its usefulness, claiming that it could improve programmer productivity by a factor of 10.

Linus Torvalds has a complicated relationship with AI, seeing both its good and bad points. But his latest remarks on the usefulness of AI may have raised a few eyebrows in open-source circles.

Just a few weeks after the Linux founder complained that a “continued flood” of AI-generated vulnerability reports had made the Linux kernel security mailing list “almost entirely unmanageable”, he has come to see the advantages of the technology.

“Linux is not one of those anti-AI projects,” Torvalds wrote in an email response to Linux Kernel senior engineer Roman Gushchin, archived at Kernel.org.

“It can also be a somewhat painful tool, both for maintainer workloads and just from a ‘it keeps finding embarrassing bugs’ standpoint,” he said of the use of AI in security scanning. “The solution is to make sure those LLM tools help maintainers instead of just causing them pain.”

Developers should be free to choose whether they use AI, he said. “We’re not forcing anybody to use it, but I will very loudly ignore people who try to argue against other people from using it.”

Torvalds’ measured support for AI does not come completely out of the blue: Around the same time that he was complaining about AI distorting security maintenance, he also spoke about its usefulness, claiming that it could improve programmer productivity by a factor of 10.

This article first appeared on InfoWorld.

Threat actors are now abusing an ordinary font file to deliver low-detection malware capable of stealing credentials and establishing persistence on compromised Windows systems.

According to a new research from Fortinet’s FortiGuard Labs, a global phishing campaign is actively using heavily obfuscated JavaScript and a Lua-based loader posing as a TrueType Font (TTF) file to evade security and drop RATs and infostealers.

A TTF file is a standard font file used by operating systems and applications to display text.

The campaign has been deploying malware families such as Agent Tesla, Remcos, XWorm, and a Snake Keylogger variant known as Best Private LOGGER, since at least late March 2026. “In these attacks, the threat actor impersonates several well-known companies, using the guise of business cooperation to launch phishing attacks,” FortiGuard researchers said in a blog post.

Talking about how a new attack technique seems to still rely on conventional phishing tricks, Shane Barney, CISO at Keeper Security, said, “The most sophisticated technical evasion in the world still starts the same way: someone opens an email from what looks like a trusted company and acts on it.”

“The obfuscation layers, the Lua loader disguised as a font file, the fileless execution chain – all of it exists to survive detection after that human decision has already been made, and organizations would do well to keep that in their sightline,” he added.

Business and payment-themed phishing lures used

According to the researchers, victims receive phishing emails impersonating well-known companies and using business collaboration or payment-related themes to trick recipients into opening compressed archives. These archives contain the obfuscated JScript that establishes persistence before dropping either a legitimate Autolt executable or a LuaJIT interpreter, along with a malicious script packaged within a .ttf extension.

The fake font file functions as a Lua-based loader that runs multiple de-obfuscation steps before decrypting and executing shellcode directly in memory.

“Security controls cannot treat a file extension as proof of file type or intent,” said Jason Soroko, senior fellow at Sectigo. “Each component (of the campaign) may appear less suspicious when reviewed alone, while the combined sequence leads to in-memory execution of RATs and infostealers.”

Some of the new variants, the researchers pointed out, are getting more sophisticated by introducing segmented shellcode encryption, Vectored Exception Handler (VEH)- based runtime decryption, AMSI and ETW bypasses, API unhooking, and other anti-analysis techniques designed to evade endpoint defenses.

The final malware payload is delivered using Donut shellcode, allowing execution without writing the payload to disk.

Protection requires targeted mitigations and routine security hygiene

Fortinet’s findings confirm the attackers’ endgame to be stealing credentials and maintaining long-term access. The malware families observed, including Agent Tesla, Remcos, XWorm, and Best Private LOGGER, are all focused on credential theft, surveillance, or remote access.

Barney said organizations should resist focusing exclusively on the loader’s technical sophistication and instead strengthen the systems attackers eventually want to compromise.

In his opinion, identity and access controls are what it comes down to, as signature-based detection often fails against the loader sophistication of this grade. “Limiting what any given set of credentials can reach, enforcing least privilege, requiring re-authentication for sensitive systems, and monitoring for anomalous session behavior will not stop every phishing email from landing, but they significantly constrain what an attacker can accomplish after one succeeds,” he explained.

Soroko, on the other hand, recommends focusing controls on the technical indicators. He urged organizations to restrict Windows Script Host, Autolt, and LauJIT wherever they are not operationally required, monitor for behaviors such as process injection, remote memory allocation, and shellcode execution, and use Fortinet’s published indicators for threat hunting.

The indicators of compromise (IOCs) Fortinet shared include the command-and-control (C2) addresses, file hashes, and filenames.

Soroko warned against relying solely on hashes or C2 infrastructure because the loader has changed over time. “The stronger approach is to detect the stable behavior across versions, then test controls against the complete chain,” he said.

Nearly five decades after the launch of VisiCalc, AI is reshaping one of the world’s most familiar productivity tools — the humble spreadsheet.

While a lot of knowledge workers interact with spreadsheets on a regular basis, many lack the skills and confidence to access more advanced functions.

“For a very long time, spreadsheets forced you to learn spreadsheet syntax and spreadsheet ways of working,” said Eric Birnbaum, director of product management for Google Sheets. “But think about how many people need to use spreadsheets at work and don’t have the skill set to create the kinds of spreadsheets that can be really helpful for them.”

The addition of artificial intelligence can help handle that issue, he said, making the software more accessible to a wide range of office workers. “AI is unlocking the power of spreadsheets, taking on a lot of the difficult work that’s required to use them. That can be incredibly empowering for users,” said Birnbaum.

Google has steadily expanded generative AI (genAI) capabilities in Sheets since launching Duet AI — now Gemini — for Workspace in 2023.

Gemini in Sheets is available at no extra cost to Google Workspace subscribers, though a paid AI Expanded Access add-on – costing $30 per user each month – is required to remove certain usage limits.

Features that have rolled out in recent months include the ability for a Gemini agent in Sheets to carry out multi-step actions such as formatting, analysis and data entry, and, more recently, the ability to create entire spreadsheets from a single prompt. A Fill with Gemini feature builds on the existing AI function, enabling users to automatically populate selected cells by detecting intent from information within a spreadsheet as well as from the web.

Another feature, Sheets Canvas (currently available in alpha), lets users generate interactive apps that update in real-time based on changes to spreadsheet data. This could be a kanban board for a sales pipeline, for instance, or an analytics dashboard that uses Sheets as its back-end data source. 

Google claims users already see a range of benefits from Gemini in Sheets. According to an August 2025 survey of 200 Sheets users conducted by the company, the majority of knowledge workers (89%) said AI features in Sheets save them at least an hour a week, and 88% believe AI features have made them more confident in their data analysis skills. 

The most popular AI use cases include creating spreadsheets and charts, analyzing data, and fixing broken formulas. How widely these features are actually used is unclear; Google declined to provide weekly usage statistics for Gemini in Sheets.

As the company embeds Gemini deeper into Sheets, questions remain about just how much businesses can trust AI tools to handle important business data, as well as what increased automation means for those who spend much of their day wrangling data. 

Computerworld recently talked with Birnbaum about the potential benefits and challenges of the latest evolution of spreadsheet software. This interview has been condensed and edited for clarity.

As businesses become more focused on seeing value from AI investments, what measurable benefits are customers seeing from Gemini in Sheets – for example, time saved or other forms of return on investment? “Spreadsheets remain one of the universal languages for businesses, and we don’t anticipate that’s going to change anytime soon. But by bringing AI into the product where people work, we think it can significantly reduce the technical tax of data: the time spent understanding it, sourcing it, analyzing it, visualizing it.

“Historically, data professionals spent — let’s estimate it at 80% of their time — on the mechanical groundwork, data cleaning, crafting formulas, formatting, troubleshooting, and maybe only 20% of their time on actual strategic decision-making.

“We think that by offloading the manual, time-consuming, error-prone data work to Gemini, we can flip that ratio a bit, so humans can focus on the things that really matter: the high-value questions to ask and the judgment calls and decisions that get made from them. We’re starting to see evidence of that in our own user base and customer base.

“The second point to make is that AI can democratize data analysis to some extent, and make it available to many more users. For so many years, the spreadsheet was a gatekeeper; if you couldn’t speak the rigid language of spreadsheet formulas, you couldn’t extract the value from data. But by introducing these natural language interfaces, AI is separating the analytical capability from the technical literacy. 

“If you can ask the right questions, or describe what you want in plain language, Gemini and Sheets can help you achieve your goals in a spreadsheet, even if you have minimal spreadsheet skills yourself.

“What we’ve seen so far from users and customers is that it’s incredibly empowering for people who might have been scared off by data analysis or dreaded opening spreadsheets in the past. You don’t need to go and wait for a data analyst to help you; you can go and do this work yourself in a spreadsheet.”

The flip side is, how confident can businesses be if more junior employees can take on higher-level analysis tasks by relying on AI? Given the propensity for AI models to hallucinate, to what degree can businesses trust that these tools won’t introduce errors into important business data? “It’s something we spent a ton of time thinking about. We’ve gone to great lengths to build these AI tools to collaborate with you, to show their work, explain what they did, and make sure that you can take over where they leave off.

“Our Sheets agent, for example, lays out a really explicit, transparent plan for you to review and approve before any data manipulation happens. It’s designed to do that in plain natural language in a way that the average user could understand, and then it gives you back that final summary, so you know exactly what it did and where it did it.

“The other thing is that the model is great at explaining things. If you inherit a spreadsheet that has some complex formula that you don’t understand, for example, the model does an amazing job of explaining how it works and what it’s doing.

“In many ways AI is not only making these features more accessible, but helping users feel more confident in the output. Human error is an inherent risk in manual data management, with or without AI. One misplaced comma or broken cell reference can completely corrupt an entire financial model, and it can be completely undetected. 

“Our approach with AI in Sheets is to create this deliberate verification loop. You now have another spreadsheet expert working along with you, reducing the likelihood of these mistakes.”

Even if humans produce errors too, does it ultimately come down to accountability when AI is involved? “Our point of view here is that AI should be partnering with the knowledge worker who’s doing the work here. And everything that we’ve built is designed to be that partner. You might be able to offload tasks to the model, but we’re citing sources, we’re providing plans and explanations. We’re ultimately relying on the user to do that final verification.

“We spend a humongous amount of time focused on quality. We know that for AI to be useful in spreadsheets, it has to be reliable. When we launched Sheets Gemini Agent, for example, we were really proud that we set a state-of-the-art benchmark on the full SpreadsheetBench data set, which at the time exceeded competitors and near-human expert ability. 

“But we know quality is never ‘good enough’ or done. We’re constantly working to improve quality for our users and customers, and for the use cases where they’re relying on AI most.”

What potential do you see for more agentic functionality in Gemini Sheets — for example, bringing in data from other sources, creating recurring reports, or taking more actions independently? “We’re listening closely to customers and users and building what they’re telling us they need. The agent is already capable of doing very complex multistep workflows, and we see users discover that the agent is extremely capable of doing end-to-end spreadsheet tasks. In terms of connectors, in an alpha we have connections available to HubSpot, Salesforce, and Mailchimp. We hope to expand that over time.

“There’s no path to have AI replacing analysts. I think AI is giving analysts more time back to actually do the more valuable parts of their job. Analysts that I work with are way more productive and impactful than they ever were before, because they can push that uninteresting spreadsheet grunt work off to the model, freeing up time for more interesting and impactful work.

“A great example: the visualizations I’m getting back from analysts nowadays are canvases instead of static charts that I can explore myself. It’s way more informative and useful than what I was accustomed to before.”

Looking ahead, do you expect a larger share of spreadsheet work to be carried out by agents, with humans setting goals and reviewing results? What will be the biggest change in how people use spreadsheets with AI? “The tasks are likely to stay similar and the use cases for spreadsheets are likely to continue to be relevant. The biggest change will be the ability to push the uninteresting spreadsheet grunt work off to a model and free up time for the user to do things that are more impactful, more interesting, more meaningful to the business.

‘Spreadsheets have historically been these like static containers where data goes to rest. I think AI can turn spreadsheets into these dynamic, localized software applications. And I do actually think this sort of changes the game for how people might use spreadsheets moving forward. 

“It’s not just a passive grid full of numbers; spreadsheets are evolving to become these live, long-lived, collaborative applications. Employees can build these on the fly, like a basic CRM or supply chain dashboard in seconds. This is an area of investment for us moving forward, and we’re really excited to see how this evolves.”

AI assistants and agents, such as ChatGPT or Claude, might be able to analyze spreadsheet files and business data without users working inside a spreadsheet application. What do you think will keep Sheets central to the workflow, rather than simply making it one part of a wider AI-driven process?“We’re in constant touch with customers and users; it’s clear work is still happening in spreadsheets. I think spreadsheets remain incredibly popular tools. If we can bring the AI capabilities users need directly into the product where they already are, we’ll transform the way they work.  

“I think we can be the front-end for some of this great AI innovation and the products that users are accustomed to today. Everything we build is guided by user feedback: users are telling us right now they want AI to help them do their everyday or more complex tasks, and they’re starting in Sheets today.”

Most CIOs and other IT leaders are confident in their teams’ ability to meet the coming AI challenges, but many believe business operating models and processes need an overhaul.

More than 80% of senior IT executives surveyed for the 2026 Global Leadership Technology Study from Deloitte are confident in their organizations’ ability to deploy and govern AI capabilities at scale. However, 75% think their operating models and processes must change in the next 12 to 18 months to drive greater value.

The survey results don’t signal an overconfidence from IT leaders in their teams’ ability to roll out AI, and they don’t seem to suggest a major AI choke point within the IT organization, says Anjali Shaikh, MD of Deloitte Consulting and leader of the Deloitte global CIO and US tech executive programs.

They do, however, point to a need for major changes to operating models and processes across the organization, not just within IT, to achieve better AI results, she says. And while CIOs can’t control how business workflows are designed, they have a role to play in pushing for processes that better make use of AI tools, she adds.

“What we’re hearing now is that AI isn’t just exposing those technology limitations, but enterprise design limitations,” Shaikh says. “What’s new is that technology is no longer the bottleneck, it’s the operating model and the ways of working.”

Business workflows that need to change are the manual processes that aren’t friendly to AI integration, like using spreadsheets for some accounting, or manual data entry.

CIO as advocate

CIOs can use their expertise to champion the redesign of enterprise workflows so they better align with AI tools like agents, Shaikh adds, creating opportunities for CIOs in a changing landscape.

 “The AI era is starting to demand a new type of leader,” Shaikh says. “They’re going to have to guide the organization through this change, build AI-related teams, and figure out the skill set required for not only their team, but the overall business.”

Another conclusion from the Deloitte report is that CIOs and other IT leaders are experiencing a make-or-break moment as they face major new expectations in their roles, including the ability to lead change and build AI-ready teams.

Leadership is important, Shaikh says, in that the organizations with the most successful AI deployments tend to be those with C-suite support for operating model and process change.

“It’s an investment and a commitment from the top down —  the board, CEO, and C-suite have made a commitment to saying we’re going to invest not only time, but budget, resources, and talent into helping us fundamentally shift the way we work,” she says. “When you get that alignment and commitment from the top, that sends a signal to everyone in the organization.”

Several IT leaders agree that several operating model and process changes are needed at many organizations.

Focus on the right thing

Many organizations are embracing AI by buying ChatGPT licenses and hosting lunch-and-learn sessions on prompt engineering, but they’re solving the wrong problem, says Peter-Paul Schreuder, chief cloud officer and VP of support at enterprise asset management software vendor Ultimo.

“Teaching people to use ChatGPT takes about an hour,” he says. “Teaching an organization to fundamentally rethink how work gets done takes four to five months of hard, unglamorous process work, but delivers exponentially more value.”

A major problem is that most organizations don’t understand their own workflows well enough to determine where AI could add value, he adds.

“They don’t know where the information gets stuck,” Schreuder says. “Which tasks consume disproportionate time? Where do we repeatedly reinvent the wheel because knowledge lives in someone’s head? Until you can answer those questions with specificity, no amount of AI training will matter.”

Getting the most out of AI takes a huge reset in the way businesses think how they complete their work, he adds, and if AI initiatives lack deep involvement from business operations leaders, they’re doomed to fail.

“If you can’t diagram how your work flows from intake to completion, you’re not ready for AI augmentation,” Schreuder adds. “If your list includes ‘summarize documents’ or ‘draft emails,’ you’re thinking about AI as a fancy word processor. Transformative applications are process specific.”

So some companies are clear about how they link new AI tools with workflow redesign. When financial services firm IMA Financial Group deploys a new AI capability, the company doesn’t treat it like a technology rollout, but as a transformation for how work gets done, says Megan Cullen-Meyer, its VP of data and AI. The company examines what tasks need to change, what roles need to be realigned, and what training and reskilling is needed, for instance.

With AI, IMA is automating routine, transactional work that used to burn up a lot of human time and energy.

“We talk a lot about how applying AI to old, outdated processes isn’t how we’re going to get the value we want from AI,” she says. “We’re taking a hard look at our core tasks and workflows to determine where we automate the work, where we augment work, and where we keep humans at the center.”

Setting the right foundation

The Deloitte report suggests that the IT team can’t build AI tools in a vacuum, says Luis Mesas, VP of product engineering at IT services provider Sngular. The value of AI comes when the organization develops a good governance framework to start with, can keep learning from what’s happening in its workflows, and can adjust the system without turning every improvement into a new initiative, he adds.

“This requires IT to work much closer with the business problem from the beginning,” he says. “Engineering teams can’t build AI systems in isolation and expect adoption to follow later, because they need to understand the process, the quality of the data behind it, and the risk of getting the answer wrong before they can design something that’ll hold up in day-to-day use.”

In healthcare, the pressure to improve outcomes while reducing costs has never been greater. Yet many organizations are still applying AI to existing systems rather than using it to fundamentally change them. At Novant Health, that shift is being driven in part by establishing the chief AI officer role last year, which Vijay Sankararaman has held since then. He uses AI to reshape how care is accessed, delivered, and supported across the enterprise, all while being a catalyst to rethink how the organization operates end to end.

How is AI helping Novant Health achieve its vison?

Our cause is to provide a remarkable experience for our patients, to make it easier, more valuable, and more meaningful for them to access the healthcare we provide 24/7 across primary care, specialty, ambulatory, emergency, and pharmacy. But we live in a changing world with economic headwinds for patients and their healthcare teams, so transformation for us is about reimagining the patient experience, ease of use for clinicians, and value-add from our operations. That’s our AI lens.

The mantra is simple. AI isn’t put on top of a stack of technology and processes. It’s a vehicle that allows us to challenge the status quo and ask if there’s a better way, how would we construct a hospital if we started today, and what’s my ideal working environment as a nurse. We take the persona of the team member and patient, and reimagine their work with the power of predictive, generative, and agentic AI.

What are some examples of this strategy in action on the patient side?

We all love to ask our phones if nagging knee pain is chronic or acute, but the information we receive isn’t always valid. Novant Health created a virtual care AI agent that answers medical questions safely and clinically accurate, using your health records within secure firewalls. The agent gives the patient better information, with correct patient data, and the privacy choice not to put their personal health information into ChatGPT.

We’ve also launched a proactive outreach program for high-risk patients who don’t know they’re at risk. We use predictive AI to identify them based on their health factors, and conversational AI to reach out and encourage them to schedule diagnostic scans. Early detection, after all, saves lives.

What are you doing on the operational side with AI?

Healthcare is complex with a variety of reasons for payers to deny claims, and for providers to challenge. But in the middle are patients who are stuck. We use gen AI to draft claim appeals, which allows us to represent the patient’s interest, give clarity to the claims challenge, and raise patient satisfaction. We’re also using AI to improve patient advocacy in a very meaningful way. Whether it’s cancer outreach or patient advocacy, healthcare requires significant human capital, not just at Novant, but in any 24/7 provider environment. AI doesn’t sleep.

This CAIO role didn’t exist a year ago. How do you define it?

The mandate of the chief AI officer is to enact and orchestrate the transformation that leverages operational excellence, innovation, and technology while keeping the patient at the center. My team and I are designing the new choreography that runs across the entire organization.

Our CIO and his organization are essential partners, leading the core infrastructure across data, cyber, and ERP/EHR, while my organization complements that work by designing the system of the future. We have product leaders, AI engineers, and software and platform engineers who build homegrown AI solutions alongside the hyper-scalers and domain-specific language model partners, all of whom are positioned to leverage AI.

What is the advantage of a CAIO as a peer to IT leadership?

The peer seat allows AI leaders authentically to interrogate how the organization is functioning. What are our real success metrics? What are we doing to achieve them? How can automation and innovation get us to that North Star faster?

Every business leader is in pursuit of a goal, and every pursuit has friction. Traditionally, when a business leader brings that friction to IT, they present it as a problem, a solution, and a directive to use this technology to fix the problem. With AI, our business leaders start with a problem and an interest in consuming data differently. They want help thinking through the problem, they aren’t ordering a solution.

That shift is significant. The people-process-technology framework is now influenced by AI, which provides a level of context not available before. AI is a context creator, rather than a content creator. We haven’t had that before.

What advice would you give to healthcare CEOs right now?

Three things keep healthcare CEOs awake at night. The complexity and cost of healthcare are rising, prompting people to avoid going at all. The nurse population — arguably the most important and most populous in healthcare — is dwindling. And the cost of staying in business is a challenge, between Medicare, Medicaid, and everything else.

As a CEO, I’d start with literacy. The CEO and leadership team must understand what AI can do. Break those opportunities into two buckets of excellence and enrichment. Excellence is how you engage with patients and run your operations. Enrichment is augmentation in that AI is a companion to the clinician, noting very early-stage detection. This is happening at Novant Health now.

Then start to innovate, in both physical and digital spaces. We’re actively leveraging precision robotic surgery and launching an AI solution for diabetic retinopathy, a common high-risk condition for people who don’t get regular eye exams, or something they don’t know they have. A primary care physician, augmented by AI, can now detect it. That’s where physical meets digital.

Whether they decide to hire a chief AI officer or not isn’t the point. The most important question is are you thinking about AI with a viable lens. Do you have a purposed organization and leader fully empowered to challenge the status quo. If you don’t, that’s where to start.

When should companies hire a CAIO as a peer to the CIO?

There’s no one set formula. In some companies, the CAIO sits above the CIO and at others, below. At Novant, our organizations are healthy peers. What clicks with the DNA of your company is the right thing to do.

My CIO and his organization are true partners to our transformation team. We’re completely aligned, and we advance the mission together. If you’re not in a position where a CIO and CAIO can advance your position, then don’t hire one. It’s what makes sense right now for us, and like so much with AI, it’ll change over time.

Across the global corporations, I advise, in financial services, healthcare, retail and the public sector, the same crisis surfaces in leadership meetings. Executives approved a bold AI roadmap. Cloud spending climbed 40, 50, even 70 percent. And yet the AI workloads that made perfect sense in the boardroom presentation now stall, overshoot their budgets or collapse under production load before they reach real users.

I am writing this just after the spring 2026 conference season, and the signal from Google Cloud Next, Microsoft Build, and a run of AWS summits only sharpens the point. Over the past several weeks the industry shipped, in production form, the infrastructure to run and govern AI at scale. What most enterprises still lack is the operating model to decide how to use it.

The problem is not the AI models. The models work. The problem is that organizations built their AI ambitions on cloud strategies designed for a world that no longer exists: strategies built for SaaS applications, predictable traffic and linear cost curves. AI workloads break all three assumptions at once.

Why AI breaks traditional cloud assumptions

For a decade, cloud-first served enterprises well. It delivered elasticity, reduced capital expenditure and democratized access to compute, because enterprise workloads were predictable: web applications, ERP systems, databases and analytics pipelines that scaled smoothly and billed in ways finance could model on a spreadsheet. GenAI and agentic AI change every one of those assumptions at once.

When organizations move AI into production, real inference, retrieval pipelines, vector search and real-time decisioning, the cloud equation breaks in at least five ways:

1. Training clusters demand power densities far above standard compute.
2. Inference needs millisecond latency that network geography can defeat.
3. Vector databases generate cost spikes invisible in standard billing.
4. Agentic workloads chain hundreds of tool calls with cascading dependencies.
5. And data-sovereignty rules constrain where any of them can run.

In short, what works at the platform level fails at the workload level.

The costs are the first thing to surprise leaders, because they hide. CloudZero’s analysis and the FinOps teams I work with put it plainly: AI spend surfaces as generic compute, storage and instance line items, rarely labeled “AI.” Three layers drive most of the waste:

1. The most visible is LLM API cost, where stateless calls re-send the full conversation history on every request, so a deployment with a couple hundred users can burn many times the token budget in the business case.
2. The biggest is idle GPU: teams’ provision for peak and then run at 10 to 20 percent utilization, and most miss their AI cost forecasts by more than a quarter.
3. The most underestimated is the vector database and retrieval layer, where storage I/O, query volume and embedding refresh appear nowhere labeled AI until the bill arrives.

The dimensions leaders underweight resilience and control

Cost and latency dominate the conversation. Two dimensions rarely get the same rigor until something breaks:

1. Resilience, whether an AI-dependent system can survive failure, degrade gracefully and recover predictably.
2. Control, who can observe, halt and audit it.

AI introduces failure modes that traditional architecture never faced: GPU single points of failure under revenue-critical inference, agentic pipelines that fail mid-execution with no rollback, and models that degrade silently from drift or throttling.

I see the pattern repeated across industries. Organizations design resilience for their traditional applications, then deploy AI on top without asking whether the same guarantees hold. In one global financial services firm I advise, a real-time credit-decisioning model running on a single cloud region took a 47-minute outage during a regional availability event. The halted loan approvals cost more than the system’s entire annual infrastructure budget, and the resilience rework that followed cost several times what designing it in from the start would have. The leaders who avoid this should ask four questions before go-live:

1. What happens when the network fails?
2. What happens when the model degrades?
3. What happens when an agent executes only halfway?
4. Who holds the authority to halt and audit?

What the cloud providers signaled this spring

The major providers are on track to spend close to $700 billion on AI infrastructure in 2026, roughly three and a half times the 2024 level. Their announcements are strategic signals, not just features. Last year they converged on one message: enterprises cannot run everything in public cloud, so all three built ways to bring their infrastructure into your data center and your sovereign environment. This year the signal advanced a step. They stopped talking about where workloads run and started shipping the layer that governs what agents are allowed to do: identity, containment, auditability and rollback.

Microsoft introduced an “Agent Computer” model with execution containers and machine identity for agents. AWS built Amazon Bedrock AgentCore around runtime, memory, identity and auditability. Google shipped an agent gateway and sovereign controls for cross-cloud traffic. As Bain observed, agentic AI is now an economics and operations problem, not just a capability problem. The through-line, captured by Microsoft’s own framing, is that AI alone will not change your business; the system running it will. McKinsey’s read is consistent: workloads are becoming more distributed, specialized and operationally demanding, which forces more deliberate infrastructure decisions.

Vipin Jain

From platform choice to placement decision

The failure I document most often is not a technology failure; it is a governance failure. Most enterprises lack a clear, repeatable way to decide what runs where, under what conditions and with what tradeoffs. Platform teams make that call informally, under deadline pressure and repeat it hundreds of times as new use cases launch. Workloads then accumulate in public cloud by default, not by design and 30 to 50 percent cost overruns follow, not because public cloud was the wrong choice but because no deliberate choice was ever made.

In one global manufacturer I advise, a predictive-maintenance model went live on public cloud and performed exactly as validated in staging. But real-time inference on the factory floor ran at 80 to 120 milliseconds across the WAN, when the machine-control system needed under ten. Moving the model to edge nodes fixed the latency, but the company lost most of a quarter of the cost, rework and delayed benefits, and the line had run for weeks on stale recommendations: a control failure that could have caused a safety event. The fix was never more AI talent. It was a structured placement decision at the start, weighing six dimensions:

• Latency: real-time (under 10 ms, edge or on-prem), interactive (50 to 500 ms, cloud) or batch.
• Cost and TCO: token spend, GPU utilization, vector-database queries, egress and unit economics per workload.
• Resilience: failover architecture, degraded-mode behavior, recovery SLA and rollback policy.
• Control: observability, audit trails, governance authority and the ability to halt or reverse.
• Data sensitivity: sovereignty requirements, privacy and compliance rules, and IP protection.
• Integration: legacy system dependencies, pipeline complexity and data-residency constraints.

Run consistently, those dimensions produce a placement pattern like this:

This is no longer optional. Cloudian’s 2026 enterprise AI infrastructure survey found that 79 percent of enterprises have already moved AI workloads out of public cloud, and 93 percent are repatriating or actively evaluating it, driven by data sovereignty, cost overruns and real-time performance. Repatriation is now the norm, not the exception.

The agentic layer makes discipline urgent. An agent chains 20 to 100 tool calls, each with its own latency, cost and failure mode, so the governance model that works for a chatbot does not work for an autonomous agent approving procurement or onboarding a customer. This spring the providers shipped production infrastructure for exactly this, yet Deloitte’s 2026 survey of more than 3,000 leaders finds only about one in five companies has a mature governance model for autonomous agents. The platforms solved the mechanism. Most enterprises have not yet written the policy.

What the leaders do differently

The organizations extracting compounding value from AI, not just running experiments, share one discipline: they treat workload placement as a repeatable process, and they build resilience and control in from the start rather than after the first production incident. In practice, they do five things:

1. Classify every use case at intake across the six dimensions, before any infrastructure is provisioned.
2. Separate AI budget lines for experiments, production inference and training, so cost is governable.
3. Treat unit economics, cost per inference, per query and per agent run, as engineering KPIs, not month-end surprises.
4. Define repatriation triggers in advance, typically 12 to 18 months of stable volume.
5. Write an explicit resilience contract, and agentic observability and rollback rules, before scaling.

The gap between strategy-ready and infrastructure-ready is the remediation backlog, and most enterprises stall moving from proof of concept to production for exactly this reason. Deloitte’s tech-trends analysis frames the same shift as the move to inference economics: the bottleneck is infrastructure governance, not model capability.

Vipin Jain

For CIOs, a 90-day agenda. Five actions separate the leaders from those managing infrastructure crises:

1. Audit every AI workload in production across latency, cost, sovereignty, volume, resilience, control and integration.
2. Separate AI infrastructure budget lines so each workload type is attributable and governable.
3. Define unit economics by workload and review them as engineering KPIs.
4. Set a quantitative repatriation evaluation trigger.
5. Define observability, cost attribution and rollback policy before scaling agents.

The strategic reframe

The organizations making real progress on AI are not distinguished by the sophistication of their models or the size of their cloud contracts. One discipline sets them apart: a clear, repeatable way to decide what runs where, under what conditions, with what tradeoffs and what happens when something fails. That discipline is not an IT problem. It is a strategic capability that requires CIO ownership, CFO alignment and executive accountability.

This spring the cloud providers handed enterprises the infrastructure to run and govern AI, and agents, at every tier of the architecture. The gap is no longer supply. It is the operating model to use deliberately. The companies building that model now build the operating foundation for AI at scale. Everyone else builds a remediation backlog. The infrastructure decisions you make in the next 12 months will decide which of those two you become.

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Reading about the “revolutionary” nature of generative AI technology these days, it’s hard not to feel a little left out.

Sure, services like Google’s Gemini and its contemporaries can be useful in certain limited, specific areas for productivity purposes. But working with them can also be pretty disheartening and overwhelming — from prompt fatigue and an onslaught of AI workslop to the fear of lost jobs and even just the simple inconsistencies and inaccuracies these systems are so prone to providing. (And that’s to say nothing of the ever-increasing creepy factor that often accompanies this type of technology.)

More and more, it seems the most significant impact of these systems is in areas like coding, where AI is allowing ambitious tech-heads to create their own custom programs with limited to no programming knowledge (but a lot of time, vision, and patience) — as well as allowing accomplished coders to produce products more quickly by letting AI do the dirty work and then spending their time guiding, tweaking, and correcting its output.

That’s all well and good, but the reality is that most of us mere mortals are never gonna mess with anything that daunting. That doesn’t, however, mean we can’t enjoy a slice of the custom-coding pie and the productivity advantages it offers — on a much simpler but still supremely useful level.

The average-worker answer lies in an oft-overlooked middle-ground possibility these AI chatbots possess to help us create relatively basic but extremely high-potential custom browser extensions. As their name suggests, these simple little programs run entirely in your browser — the same exact sorts of add-ons you’d typically find and install in a marketplace like Google’s Chrome Web Store.

But with Gemini or any other similar genAI platform, you can dream up your own web-improving extension and turn it into reality in a matter of minutes — simply by describing your goal and then guiding the AI gently along the way. And given how much time most of us spend on the web these days, that opens up a tantalizing series of doors for taking total control of your work environment.

Hate all the extraneous bells and whistles gunking up the Google Docs interface? Gemini can create a Chrome extension that removes them. Annoyed by a glitchy web app? Ask Gemini for an extension that makes some under-the-hood improvements. The possibilities are endless.

Let me show you how exactly it works, how easy it is to approach and master, and how many work-enhancing possibilities are out there just waiting to be created.

The ins and outs of Gemini’s custom Chrome extensions

First things first: You don’t need any special tools or subscriptions to make this happen. For the purposes of this article, we’ll focus on Google’s Gemini for the creation and the standard desktop Chrome browser for the installation — but the same basic process would work with most any AI chatbot, if you happen to prefer ChatGPT or Claude, as well as with any extension-supporting, Chromium-compatible browser (a list that includes everything from Microsoft Edge to Brave, Vivaldi, and beyond).

Google offers a dizzying array of Gemini modes and options and an equally overwhelming series of AI subscription plans that control how much you can use those capabilities, but you don’t need to worry about any of that to create custom Chrome extensions. You might sometimes see better results if you switch your Gemini model to “Pro” or your Gemini thinking level to “Extended” — designations that even Gemini itself has trouble deciphering (believe me, I asked!) — but just using the default Gemini settings with a free Google account will generally work quite well.

Getting going with a custom Chrome extension is as simple as opening up a new Gemini chat and telling the system what you want it to cook up for you. The hardest part is deciding what you want and what’d be helpful for you — something we’ll explore more in a moment, via specific examples and suggestions. Once you’ve got that, you can just ask Gemini to create a Chrome extension that’ll accomplish what you’re envisioning, with as much specificity as possible about what it’ll do and how it’ll look.

Gemini will spit back a series of plain-text code chunks with instructions to copy each cluster and paste it into a new plain text file with a certain specific name — things like “manifest.json,” “content.js,” and “styles.css.” All you’ll do is use the on-screen button to copy each segment, then open up any simple text editor (like Windows Notepad, macOS TextEdit, or any number of simple online text editors) and paste the text in, then save it under the name Gemini gives you.

You’ll need to put all the files into a single isolated folder on your computer, and then you can go into Chrome, type chrome:extensions into its address bar, and install your shiny new creation by:

• Flipping the toggle next to “Developer mode” in the upper-right corner of the screen into the on and active position, if it isn’t already
• Clicking the “Load unpacked” button
• And selecting the folder you just created in the pop-up that appears

JR Raphael / Foundry

And that’s pretty much it: No complicated compiling or program publishing — the extension you envisioned will be alive and working right in your browser and ready to use.

Now, odds are, it won’t be exactly what you wanted in its first iteration, and you’ll have to go back to Gemini to request several rounds of updates and corrections. Each time, Gemini will create a new set of code chunks, and you simply overwrite the text in each file with its corresponding new code chunk.

It’s still a bit of a process. But you’ll rarely spend more than an hour on something simple and maybe a few hours on something especially multifaceted and specific, and whatever you create will then work to your advantage indefinitely from that point onward, on any computer where you install it.

Before we dive into specific slivers of inspiration, let’s just note the hopefully obvious asterisk that this’ll work only if you’re either (a) using a personal computer that isn’t associated with an organization or (b) using a work-connected computer where custom Chrome extensions are permitted. In either scenario, you’ll want to use your own best judgment to ensure that whatever you’re adding into your browser won’t expose any corporate data or cause your IT comrades any alarm if they see you using it in your workday.

With most common examples, though — including all the ones we’re about to go over — you shouldn’t have any problem or cause for concern.

Capisce? Capisce. Let’s get into it.

Custom extension category #1: The interface fixer

Our first custom Chrome extension category is the one that won me over to this practice initially and has been the most shapeshifting for my own browser-based workflow — and that’s the simple-seeming but transformational ability to have AI remake any web app you rely on to remove unneeded elements and redesign the interface to your exact specifications.

The best example I can show you is what I did with my completely homemade, Gemini-created Docs Zen extension. Google Docs, to put it mildly, has devolved into a cluttered mess. There are so many on-screen elements I never use and, ironically enough, irrelevant AI elements I’d rather not have in my hair. I just want a calm, simple, minimalist environment for writing — with Google’s second-to-none syncing, universal access, and collaboration systems beneath it.

So rather than try to reinvent the wheel, I described to Gemini all the elements I wanted to remove from Docs and all the ways I wanted to rethink how its interface appeared for me.

JR Raphael / Foundry

I went back and forth with numerous iterations and kept coming up with interesting new additions to further flesh out and improve the experience — and I ended up with a delightful setup that gives me a distraction-free view of my writing space with a simple toggle to reveal the main Docs menus and a palette icon that allows me to switch from one eye-pleasing theme to another.

My setup deliberately doesn’t include comments or other collaborative elements, as I’m mostly writing by myself these days — but when I do need those elements, the eye icon in the upper-right corner of the screen disables my custom adjustments and takes me back to the standard Docs interface. I can then click the eye icon again in that environment to switch back.

JR Raphael / Foundry

I used Gemini to create something similar for Trello, with which I also have a love-hate relationship — loving the foundational functions and easy access everywhere but hating the interface that’s lost focus, gained bloat, and gotten noticeably clunky and slow over time.

With the same sort of step-by-step, plain-English guidance, I was able to transform Trello from this…

JR Raphael / Foundry

…into this:

JR Raphael / Foundry

I couldn’t even begin to recount the number of superfluous features and elements I’ve removed, along with revamping the overall interface to make it both more efficient and more visually pleasing to my eye.

Whether it’s a web app you rely on regularly or even just a website you open often, the possibilities are practically endless for the ways you can reshape it and mold it to make it work better for you.

Speaking of which…

Custom extension category #2: The feature creator

In addition to the surface-level adjustments and feature removals in my aforementioned Trello-enhancing extension, I also added in several components — such as one-click buttons for archiving or moving cards — and I managed to speed up the site by making some under-the-hood adjustments Gemini suggested when I asked about its choppy performance. The same sort of concept can apply to any web-based interface you’re using, if there are any options that are annoyingly buried within menus, shortcuts that’d make your life easier, or other improvements you’ve longed to see.

You can also consider some simple standalone extensions for giving yourself on-demand features that aren’t necessarily associated with any one specific website but could be useful in plenty of productivity scenarios. For instance:

• I do a fair amount of basic image editing and frequently find myself needing to reference a hex color code that corresponds with a particular brand color, and I always end up having to open up a new tab and look in a note somewhere to find the code I need. Well, no more: I used Gemini to create a super-simple custom color code pop-up where I can store all the colors I need and then copy any of ’em onto my clipboard with a single click. Major time-saver.

JR Raphael / Foundry

• I’m also constantly converting time zones, either for meetings with clients or colleagues or for trying to wrap my head around publishing systems that insist on using random time zones with no meaning to me. It’s infinitely easier for me to manage now, thanks to the custom Chrome extension I made that shows the current time in all the zones I need most often — as well as allowing me to put any other time into any field and have all the other zones instantly adjust to match. It also offers a brilliant plain-text conversion box where I can just type things like “1pm-3pm PT in MT” and have it cough back up an instant answer for any conversion I need.

JR Raphael / Foundry

Maybe what you want is the ability to interact with data on different websites more easily — to be able to save any table on a page in front of you as a CSV file, mayhap, or even to save any text you highlight on a page into a new Google Docs document. Whatever the case may be, Gemini can handle it — and that superpower that you’ve always wished for but never found the right tool to make possible can actually now be yours.

Custom extension category #3: The browser expander

Our final category of custom Chrome extensions to consider moves beyond the web itself and into your actual browser. The browser is essentially the modern-day desktop, after all — and for the first time now, you can expand and enhance it in all sorts of interesting ways.

Some specific examples, to get your brain-motor whirring:

• You could walk Gemini through creating a smart auto-snooze system for your open browser tabs, both to clear clutter and help with Chrome’s performance. It could save any tab that hasn’t been touched in a certain amount of time to your local storage and then give you a simple searchable “Archive Dashboard” where you can find all those auto-closed tabs and re-open ’em as needed.
• With the right guidance, Gemini could give you a custom browser research panel — where any info you highlight on a page gets beamed over into a sidebar-style panel that serves as a running scratchpad of notes from the day.
• Or, if you find yourself often needing to see two tabs together side by side, you could have Gemini cook up a custom extension that instantly detaches any tab in front of you and puts it into a new tab window in a perfectly sized and spaced pattern. One keyboard shortcut could make that move happen, while another keyboard shortcut could recombine the two tabs into a single centered window.

As with all the other ideas we’ve gone over, all you’ve gotta do is ask — and now, with the right inspiration in mind, you’re ready to get your custom extension adventures going and start bending the web to your will.

Data lakehouses have become the gold standard for enterprise data platforms since they combine a data lake’s ability to support a variety of different types of data at low cost, and the reliability, structure and governance of a traditional data warehouse.

The fact they offer a central repository of information that might come from different places at a company, together with security and auditing tools, make them a perfect fit for enterprise AI systems, too. In fact, they’ve become so popular and useful that all the major data lake and data warehouse vendors have all but converged into data lakehouse vendors. Snowflake, for example, started out as a data warehouse and over the course of several years and acquisitions, has transformed into a full data lakehouse platform.

Docusign is now using it to support its agentic AI ambitions, too. For example, data is pulled in from Salesforce and then used to train an internal AI agent for sales, says Shivi Verma, Docusign’s senior manager of engineering. The company is also training ML models in order to serve customers more accurately.

The information also goes out to LLMs using RAG embedding pipelines, and MCP connectivity is being explored as the technology matures.

One issue Docusign keeps top of mind when exposing the data in its lakehouse is security and governance.

“We’re proceeding very cautiously,” Verma says. “It goes through a stringent security review and discussion with both technical and business stakeholders to make sure we’re not doing anything that isn’t allowed from the security lens and compliance lens.”

The security checks are in place both when the data first goes into Snowflake, he says, and when it goes out again. The restrictions are particularly tight when it comes to access to anything sensitive, such as customer data.

“We’re first exposing those with a low risk profile,” he says. That can include publicly-facing information like website content or product details.

Docusign isn’t alone. “We see 65% adoption of lakehouses among Gartner’s client base,” says Gartner analyst Prasad Pore. “It’s a very strong number in a short time.”

And the future of lakehouses looks even brighter.

“Lakehouse is becoming the foundation for the future of AI,” Pore says, adding that vendors are evolving to support this use case. For example, lakehouse as a concept doesn’t support vector databases, which are a key type of data structure for AI systems that use RAG to feed data into LLMs.

“But many lakehouse vendors have added capabilities for vector indexing,” he says. “Databricks and Microsoft Fabric both have a vector capability built into their platform.” Yet smaller players might not provide the functionality, he adds.

Similarly, support for MCP, a standard that allows AI agents to connect to data and systems, varies by vendor, and isn’t traditionally a core lakehouse functionality.

A matter of choice

A data lakehouse isn’t the only option for companies looking to provide their AI system with the critical business context they need to be useful to the enterprise.

For example, companies can build vector databases or vector database pipelines manually from individual sources, or use a data fabric to make the connection.

“Fabric can directly connect to original sources, which is a good use case for quick analytics,” Pore says. “But then you’re overloading your source systems, which isn’t a good thing for those products and machines.”

Microsoft Fabric is a lakehouse platform, though, and not a data fabric platform in the way Gartner defines the term.

Another downside is that the data models used in original systems aren’t usually optimal for analytics, and can be expensive. “Connecting to direct sources isn’t efficient,” Pore says.

Finally, there are well-established processes for managing data permissions in a lakehouse.

“A lakehouse physically unifies your data, maintenance, security, and governance,” he says. “This is very critical for AI implementation. As an organizational single source of truth, a lakehouse is the modern way to create a central repository.”

Consulting firm Lemongrass originally started out with a data lake about a decade ago, and then began upgrading it to a lakehouse four years ago.

“Back then, the concept of a lakehouse wasn’t that popular,” says Kausik Chaudhuri, chief innovation officer at Lemongrass. So the firm built custom lakehouse functionality on top of its Amazon S3 data lake. Now that it’s using the data lakehouse to support AI, it’s time for another upgrade.

“Right now, we’re working on something for our incident and change management,” he says. The original data is in ServiceNow, and it’d be too expensive to pull it out directly from the lakehouse to use in an AI system. “So now we’re thinking of building an MCP server to query that data,” he adds.

And they also plan to upgrade from its own custom lakehouse add-ons to a standard solution. “Lemongrass was primarily an AWS evangelist when we started, and a lot of our tooling was on top of AWS,” Chaudhuri says. “Now we’re thinking of changing this because with AI, there’s a lot more opportunity.” Then again, AWS now offers lakehouse functionality. “The data’s already there,” he adds. “We don’t have to reinvent it.”

Plus, AWS has connectivity to Anthropic’s Claude AI and other AI models. And since the models are also running on AWS, there are no data egress fees. Lemongrass plans to start the upgrade with a POC in Q3 this year. “Everybody’s busy, so we need to pull in people and figure out when and how we implement that,” he says. For example, the company has to be careful about what data and how much is pulled in from the lakehouse and sent to the AI.

“We don’t send out customer data to an LLM,” he says. “And I’m not reading 10,000 rows and sending it to Claude, which would blow up to token usage. We figured out a couple of years ago we can go bankrupt if we’re not careful about the amount of tokens we use.”

And for some use cases, the LLM doesn’t need to see anything at all after the solution is deployed. For example, firm employees used to manually generate status reports about its customers for internal use, which was a time-consuming process. An AI model could, in theory, take over that job, but then it’d see the customer data. And since AIs aren’t deterministic, each report would look different.

Or, say, the firm needs to generate forms to fill out and then the customer would sign. Again, an LLM could create a custom form each time. “So then we asked Claude to write a program that takes this input and writes this report,” says Chaudhuri. The process of generating reports or the forms is traditional, deterministic software. The customer data is never exposed, and the reports are cheap and fast to produce.

But other companies are use AI to make better use of its data. In a recent report by Databricks based on data from 20,000 organizations, the percentage of databases created by AI agents rose from 0.1% to 80% over the past two years, and agents now create 97% of database branches.

Security and governance

One major area of struggle for enterprises is to figure out how to handle security and other related issues for when AI agents access data lakehouses.

In the past, data went out to dashboards, in which the security and access controls were programmed. Or the data went to data analysts, who worked within their own access privileges. The first use cases for AI involved RAG embeddings, which were easier to manage.

In a RAG embedding, traditional, deterministic software is used to pull in data and embed it into an LLM prompt for a particular workflow. The developers setting it up would handle the security aspects for each particular use case. With agentic AI and MCP servers, however, the AI can go and grab data autonomously, as needed.

According to Genpact’s Arellano, enterprises need to figure out how to manage the identities of AI agents, control access to data, create audit trails, and filter prompts and content.

“Agents need their own credentials,” he says. For example, AI agents might not have permissions to ever touch patient records. “And audit trails are important, with full observability of what the agent did.”

Some lakehouse vendors, including Databricks, offer this functionality, he says, and there are other tools that can be brought in like Okta, Palo Alto, or Zscaler.

The new semantic frontier

The next evolution of the lakehouse is the semantic layer, and Gartner estimates that universal semantic layers will be critical infrastructure by 2030.

“Developing a universal semantic layer is now a must‑do for data and analytics leaders either leading or supporting AI,” Gartner says. “It’s the only way to improve accuracy, manage costs, substantially cut AI debt, align multiagent systems, and stop costly inconsistencies before they spread.”

It’s one thing for an AI to have access to data, but entirely something else to understand what that data actually means to the business. The semantic layer is the business knowledge that’s not normally formalized in a structured database, such as, say, the knowledge that an order or a customer means different things in different systems.

“Before, the semantic layer was nice to have but not as necessary because data scientists know what data sources they want to query,” says Amit Kinha, board member of the FinOps Foundation and field CTO at DoiT International, a cloud consultancy.

But now, without it, an AI agent won’t know where to look for the data it needs, he says. “Or it’ll do a bad join, or do something that creates a cost explosion,” he adds. “The semantic layer is going to be critical for leveraging lakehouses effectively.”

This semantic layer can also become part of a feedback loop, where the agentic systems learn from experience, says Kevin Martelli, consulting AI solution development leader at EY Americas.

Say for example a company has a process where approvals are required for certain payments, and a CFO is required to sign off for payments over half a million. If the AI agent goes to a human for approval, he says, the human might say this is telling me to approve this invoice, but I know it’s over $500,000 and I need to get CFO approval on this. “Then it can be stored in the session and persisted back in the lakehouse as a procedural document or as a record of something that occurred,” says Martelli. “This is where it becomes more beneficial and aggregates over time with usage because you’re never going to get it perfect on day one.”

The semantic layer is still very much an evolving area, and different data lakehouse vendors handle it differently.

“There’s this great debate going on in the industry of how lakehouses converge with semantic layers and where they actually live,” says Matt Arellano, SVP of data and AI at digital transformation consultancy Genpact.

Some vendors are building semantic tools into their data lakehouse platforms, or acquiring additional firms to get the technology. In other cases, customers are using third-party tools instead.

“Clients are struggling with that,” Arellano says. “They’re all trying to figure out the different combinations and permutations of tools and processes.”

Steven Karan, VP of AI transformation for Capgemini Australia and New Zealand, says he sees the lakehouse as evolving into a central orchestration layer.

“Organizations are now less focused on analytics and reporting, and more on building AI-driven applications and agentic systems,” he says. “The most effective architectures I see today combine a lakehouse core with specialized serving layers.”

That includes vector databases for AI, streaming platforms for real-time data, and operational databases for low-latency applications. The lakehouse isn’t just for analytics anymore, he adds. It’s the foundation for enterprise data and AI. “Its role is now less about replacing all other systems, and more about unifying and governing them to accelerate innovation while maintaining control,” he says.

Nvidia and Microsoft this month touted the reinvention of computers with a new class of “agentic AI PCs” that will “reinvent the way PCs work.” 

That’s how Nvidia CEO Jensen Huang described the computers at the recent Computex trade show. At the event, Nvidia introduced its first AI-focused PC chip called N1X, which has an integrated CPU and GPU and will be used in agentic AI PCs.

Nvidia’s new RTX Spark PCs are the first in a major “PC reinvention for 40 years,” Huang said, likening them to AI phones. “You could talk to it, it could look at you. You could ask it to read files… [or] go help you do research.”

Not so fast, say analysts, who argue the computers are mostly repackaged AI PCs that shouldn’t necessarily drive enterprise upgrades.

“Agentic AI PCs is a strange term that should probably be deemphasized,” said Leonard Lee, principal analyst at neXt Curve. “Depending on use case, PCs of the last two generations are ‘agentic AI’-capable.”

Skeptical of the hype, analysts said many current PCs are already capable of running agents, such as those spun up on device by OpenClaw. Those agents don’t need to communicate with AI models in the cloud.

In fact, Lee said, Apple has already shown that Windows isn’t needed to run agentic workloads, with the Mac Mini among the most talked-about device for hosting personal AI agents and OpenClaw.

Analysts said the definition of agentic AI PCs really comes down to the hardware inside, which largely defines their capabilities. Most are really just an evolution of earlier AI PCs, which arrived a few years ago amid similar hype.

AI PCs, specifically CoPilot+ PCs, were originally designed with neural processing units (NPUs) to support the requirements of Windows Recall. “Some argue agentic AI PCs need more GPU compute, but…Qualcomm and Microsoft would counter that agentic AI PCs have been around for a while,” Lee said.

To highlight the capabilities of the RTX Spark PC, a demonstration at Computex showed how an architectural design workflow could be split between the PC and the cloud. (An MCP server managed data exchange to facilitate the cloud-PC workflow.)

Adobe has reengineered Photoshop and Premiere for RTX Spark PCs, allowing the software to communicate with AI agents on PCs and tools to run twice as fast, Huang said.

And at the company’s recent Build conference, Microsoft CEO Satya Nadella demonstrated the new Surface Laptop Ultra AI PC based on the RTX Spark design. He positioned agentic AI PCs as running a new execution layer that can act across files and devices, including generating and executing code. 

While AI PCs with agents will be capable, they still lack applications, said Jim McGregor, principal analyst at Tirias Research. “However, PCs — especially the small form factor PCs and workstations — are likely to be the home AI appliance,” he said.

For enterprises, upgrading to RTX Spark PCs at this point could pose problems. That’s because Nvidia’s N1X CPU is based on the Arm processor architecture and could run into compatibility issues with x86 applications designed for Intel and AMD chips.

“Despite Arm processors being available for a while, enterprise penetration stays small, since compatibility with all apps, drivers, and corporate systems is critical and requires extensive testing…, even though Microsoft has done a reasonably good job with Windows 11 on Arm,” said Jack Gold, principal analyst at J. Gold Associates.

Because Microsoft is moving to natively incorporate AI into Windows, those PCs will land in enterprises ultimately, Gold said.

Regardless of hype, it might be a good time for enterprises chasing an agentic AI agenda to upgrade laggard Windows 10 devices, Lee said. “Considering the considerable hype about agentic AI, early adopters will need to upgrade their fleets if they pursue a broad agentic AI agenda for their organizations,” he said.

A group of academics recently asked me, “In the technology space, how much do you need to know today to be considered not ignorant?”

Both philosophers (the folks who study knowledge) and cognitive scientists (the folks who study the acquisition and application of knowledge) agree that the base of knowledge required to remain relevant in society is expanding. Wiley, which published my book The New Know, annually adds approximately 100 new books to its 2,500-title For Dummies series.

Knowledge is a moving target. There is new knowledge. There is bad knowledge — beliefs that were always flat out erroneous. There is no longer good knowledge — things that once were true but no longer are.

Like the Central Intelligence Agency, CIOs are tasked with supporting decision-makers with analyses of the current situation, with advisories regarding when those conditions are likely to change, and warning of risks inherent to the full spectrum of technology investment choices.

Historically, the 18 federal organizations that make up the US Intelligence Community will not make policy recommendations. They just provide the analysis. CIOs have to do more. The first Director of National Intelligence, John Negroponte, once noted, “Vigilance is not enough.”

Experience tells us that there is no such thing as an “idiot proof” system. It is not enough to deploy great systems. CIOs have to ensure that the stakeholders using these systems know enough to extract full value from the technology being provided.

Knowledge pumping — providing the baseline of facts necessary to make decisions — has to be accompanied by multi-constituent executive education. CIOs have to ensure that key stakeholders understand underlying technology conditions; have to be able forecast future conditions or outcomes; and test hypotheses or theories.

Ideally, this would involve portraying and communicating results using data visualization. Vince Kellen, CIO for The Texas A&M University System, who is typically three or four standard deviations in front of the curve, refers to such illustrations as “anchor visuals.”

What anchor visuals are you using to keep your community of stakeholders moving in the right direction?

The level of satisfaction or dissatisfaction stakeholders have toward technology in general and artificial intelligence specifically are directly tied to the quality of the narrative surrounding the technology.

In Ancient Wisdom for Polarized Times: Why Humanity Needs Herodotus, the Man Who Invented History, Emily Katz Anhalt insists “stories have a profound influence on who we are and who we become.”

Does your technology and AI messaging link to mission and the ability to solve a hard problem? If that story is couched solely in terms of monetary gains, you may have a problem.

In an internal memo, OpenAI CEO Sam Altman opined that “[AI] missionaries will beat [AI] mercenaries.”

Currently an enormous amount of resource is being devoted to agentic AI with the objective of automating workflows. In Agentic Artificial Intelligence: Harnessing AI Agents to Reinvent Business, Work and Life, Pascal Bornet and Jochen Wirtz express concern that “We’re treating humans like robots and AI like creatives. It’s time to flip the equation.” It is ironic that we are spending huge amounts of money training models and very little educating the humans using these models.

Deloitte’s 2025 Connected Consumer Survey observed, “Among those surveyed who are using gen AI for work, 40% say their companies provide training.” Does this mean that 60% of the economy is simply deploying the tools and hoping for the best?

The mainstream business press tells us that the tech ecosystem has moved from a phase of “move fast and break things” to an infrastructure groundwork focused on “moving slow and building things.” Experienced CIOs know at the essence of their beings that before moving they and their stakeholders have to “know things.”

By investing in muggle tech knowledge (knowledge pumping) we are increasing human agency and expanding our capacity for innovation.

Generally, people want to understand the technology that surrounds them. This willingness to know is tempered by what Keith E. Stanovich in The Bias That Divides Us: The Science and Politics of Myside Thinking, refers to as “myside bias”: “we evaluate evidence, generate evidence, and test hypotheses in a manner biased toward our own prior beliefs, opinions, and attitudes.”

Effective knowledge pumping has to be individualized to the mental starting point of the stakeholder.

A switched-on, tech-savvy user base has been the White Whale of CIO Ahabs for decades.

Der alljährliche Penetrationstest (Pentest) stammt aus einer Zeit, die es in der IT-Welt so nicht mehr gibt. Wenn Anwendungen, Cloud-Ressourcen, Konfigurationen und Schnittstellen sich laufend ändern, ist ein einzelner Prüftermin pro Jahr wie ein Selfie von vorgestern: schön anzuschauen, aber ganz schnell überholt. Als dominanter Bestandteil der IT-Security ist der Jahres-Pentest zu statisch – und im schlechtesten Fall sogar gefährlich trügerisch. Denn getestet wurde eine Realität, die kurz darauf bereits nicht mehr existiert. Hinzu kommt die antiquierte operative Realität klassischer Pentests als kosten- und zeitintensives Einzelprojekt: Scope definieren, Dienstleister auswählen, Termine abstimmen, testen, Bericht auswerten, Maßnahmen priorisieren. Das ist fachlich durchaus sinnvoll – skaliert aber schlecht. Jeder neue Testlauf erzeugt neue Koordination, neue interne Bindung und neue Reibung. Hinzu kommt ein weiteres Problem: Der Personalmangel. Laut der European Union Agency for Cybersecurity (ENISA) haben die Unternehmen weiterhin erhebliche Schwierigkeiten, das erforderliche Cybersecurity-Personal zu finden.

Mehr erfahren und VORNAC kennenlernen

Security ist kein Projekt, sondern ein kontinuierlicher Prozess

Als Lösung gilt allgemein der Einsatz von automatisierten Tools und Prozessen. Auch aus der Engineering-Perspektive ist dieser Wandel logisch. Das DevSecOps-Konzept fordert seit Jahren, Sicherheitsprüfungen stärker in Entwicklung und Betrieb zu integrieren – also früher, häufiger und enger am realen Lebenszyklus von Anwendungen und Infrastrukturen. Eine Workshop-Arbeit von IEEE EuroS&P beschreibt DevSecOps ausdrücklich als Ansatz, der auf Continuous Security Testing setzt. Gartner fasst diesen Trend unter dem Begriff „Continuous Threat Exposure Management“ (CTEM) zusammen und meint damit ebenfalls einen systematischen Ansatz, um Angriffsfläche und Ausnutzbarkeit von Assets fortlaufend und weitgehend automatisch zu bewerten.

Neue Anbieter sind gefragt

Damit verschiebt sich der Maßstab für die Wahl eines Anbieters. Gefragt ist nicht mehr der Einzeltest, sondern ein Modell, das sich in den laufenden Betrieb einfügt: mit höherer Frequenz, weniger organisatorischer Reibung, nachvollziehbaren Ergebnissen und auditfähiger Dokumentation. Das Vertrauen in einen Anbieter entsteht in diesem Kontext nicht aus Zertifikaten oder großen Namen, sondern aus Verlässlichkeit im Alltag: klare Prozesse, reproduzierbare Ergebnisse und eine Lösung, die auch unter realen Betriebsbedingungen Bestand hat. In diesem Spannungsfeld positioniert sich der Pentest-Anbieter VORNAC. Deren Ansatz: Pentesting nicht als gelegentliches Einmalprojekt mit langen Vorläufen, sondern als kontinuierlicher automatischer Prozess mit klar aufbereiteten Ergebnissen und auditierbaren Berichten. Laut VORNAC geht damit der Koordinationsaufwand um bis zu 90 Prozent zurück und auch die Zeiteinsparung kann bis zu 90 Prozent betragen. Bei den Tests begleitet ein zertifizierter Pentester das Projekt und hilft bei der Mitigierung und Interpretation der Findings. Außerdem kann dieser Experte anhand verschiedener Grey- und Black-Box-Tests einen validen Testplan erstellen. Was die VORNAC-Infrastruktur betrifft, so ist alles in Deutschland gehostet, denn gerade in regulierten oder sensiblen Bereichen gewinnt digitale Souveränität zunehmend an Bedeutung.

Jetzt VORNAC testen

Ergebnisse, die sich einordnen, priorisieren und praktisch nutzen lassen

Wichtiger als das Versprechen von „mehr Automatisierung“ ist jedoch die Kombination aus technischer Anschlussfähigkeit und nachvollziehbarer Ergebnisqualität. “Mit unserem Ansatz haben wir eine weitaus höhere Coverage als bei den üblichen Pentests“, sagt VORNAC-Geschäftsführer Arthur Raess. „Wir liefern nicht nur Tool-Output, sondern Ergebnisse, die sich einordnen, priorisieren und praktisch nutzen lassen“, so Arthur Raess weiter. Das ist keine akademische Feinheit, sondern ganz entscheidend, denn zwischen einer Liste von Findings und einer belastbaren Sicherheitsbewertung liegt ein weiter Weg. Wer ihn verkürzen will, muss Ergebnisse so bereitstellen, dass sie direkt in den Sicherheits-, Audit- und Betriebsprozessen verwendet werden können.

Referenz-Anwendung im Gesundheitswesen

Wie das VORNAC-Modell in der Praxis funktioniert, zeigt das Beispiel des Referenzkunden mbits. Das Software-Unternehmen hat sich für VORNAC aus drei Gründen entschieden: kontinuierliche Sicherheitstests statt klassischer Einmalprojekte, klare Ergebnisse zur direkten Umsetzung und Transparenz über den eigenen Sicherheitsstatus. Gerade im Gesundheitswesen ist das mehr als ein Komfortgewinn. Es ist ein Nachweis dafür, dass Security im Alltag verlässlich, nachvollziehbar und belastbar organisiert werden kann. „Wir entwickeln Software für Krankenhäuser – da ist Sicherheit keine Option, sondern Pflicht. Unsere Partner müssen genauso hohe Ansprüche an Qualität und Verlässlichkeit haben wie wir selbst“, sagt mbits-CEO Michael Müller über die Zusammenarbeit mit VORNAC.

Fazit

Der Jahres-Pentest wird nicht von heute auf morgen verschwinden. Aber er verliert seinen Alleinanspruch. Wo die IT dynamischer, Sicherheitsressourcen knapper und Nachweise wichtiger werden, muss sich auch das Prüfmodell ändern. Aus dem jährlichen Pflichttermin wird schrittweise ein laufender Prozess moderner Sicherheitsarbeit. Neue Anbieter, wie VORNAC, die diesen Wandel in verlässliche, nachvollziehbare und betriebstaugliche Prozesse übersetzen können, positionieren sich inzwischen bei den Sicherheitsverantwortlichen als vertrauenswürdige Partner.

Alles über VORNAC

I knew the plan was in trouble when a finance partner asked me a question I couldn’t answer cleanly.

“How much of this cloud spend is experimentation, and how much is now becoming the new normal?”

That should not have been a hard question. We had a mature cloud strategy. We had standards. We had architecture reviews. We had cost controls, service patterns, reserved capacity, security gates and a decent story for the board. Nothing about it felt reckless. It felt grown-up. Ordered. Sensible.

Then AI walked in and started moving the furniture.

Silently. More like a slow shove. One use case here. One pilot there. A team testing copilots. Another team asking for more compute. Security was asking where the prompts were going. Legal is asking what data crossed which border. Finance stared at the bill like it had started speaking Latin.

Good strategies rarely die from stupidity. They die from drift. The world changes, but the logic stays parked in last year’s weather.

Our cloud strategy had been built for a world of applications, platforms, storage growth and ordinary bursts of demand. AI brought a different appetite. It wanted more power, faster decisions, looser experimentation, tighter controls and more adult supervision. It was like inviting a clever guest to dinner and discovering he’d also brought three wolves and an invoice.

The strategy was sound for the game we were playing

I want to be fair to the original plan because I helped build it, and because sneering at old decisions is one of the cheapest forms of hindsight.

The strategy solved real problems. We needed consistency across environments. We needed stronger resilience. We needed better cost discipline than the old “just move it and sort it out later” school of cloud migration. We wanted teams to build faster without having to reinvent their own religion each quarter. We wanted clearer guardrails and fewer exceptions that were hard to understand.

So, we created patterns. Standard hosting routes. Cost reviews. Architecture checkpoints. Shared controls. Approved services. Escalation paths. It worked. The business moved. The core platforms are held. We had enough orders to be useful and enough flexibility to avoid becoming the department of ceremonial no.

Underneath that plan sat a few quiet assumptions. Workloads would stay mostly familiar. Demand would rise, but in ways we could model. Costs would wobble, not convulse. Governance would keep pace with technology. Most exceptions would stay exceptional.

That set of assumptions was not foolish. It was built for a different climate.

AI broke the assumptions first

The mistake would be to say AI, “changed everything.” It didn’t. AI broke specific assumptions, and once those snapped, the strategy started falling apart.

1. The first break was compute. Traditional enterprise workloads usually behave like people with routines. They rise, fall and repeat. AI workloads behave more like teenagers with borrowed car keys. One experiment looks harmless. Then a model run chews through expensive resources. Then inference demand shows up in places nobody had forecast.
2. The second break was data. Many firms say they have data ready for AI because they have data lakes, reports or analytics platforms. That is like saying you’re ready for surgery because you own a sharp knife. AI use depends on permission, lineage, quality, context, retention and movement. Data that seemed fine for dashboards became awkward, risky, or unusable once models were introduced.
3. The third break was economics. Cloud costs had always needed watching, but AI added a new twist. You could spend real money before proving real value. Pilots looked small until they spread. A use case that seemed cheap in testing became costly when people used it. Finance hates mystery, and AI has a talent for turning cost models into abstract art.
4. The fourth break was governance. Our existing controls had been built around systems, services, vendors and access. AI introduced different questions. Which prompts are being stored? Which data is being exposed? Who approved this model? What evidence supports this use case? What happens when teams adopt tools outside the approved stack because the approved stack moves too slowly?

That was the point at which I stopped seeing AI as just another demand line on the platform roadmap. It had become a pressure test for our judgment.

The trouble showed up in symptoms before it showed up in strategy decks

Big strategy failures rarely arrive wearing a name badge. They come disguised as irritations.

First came cost surprises. Just a steady rise in bills nobody could explain with much confidence. Then came the awkward meetings. Finance wanted forecasts. Engineering wanted a room to test. Security wanted tighter control. Data teams wanted access. Everyone had a valid concern. Nobody was wrong. That almost made it worse.

Then came architecture drift.

Teams were trying to get work done. If the approved path took too long, they found another path. A hosted tool here. A side environment there. A vendor service that solved today’s problem and quietly created next quarter’s headache. You could feel the strategy starting to fragment at the edges.

Control gaps followed. Some teams knew exactly where their prompts went and what data they used. Others had a hazier picture. Logging varied. Review depth varied. Local workarounds multiplied. Policies still looked confident on paper, but paper is generous. Reality is less polite.

The hardest symptom to spot was decision fatigue. Meetings got longer. Ownership got fuzzier. People started using the same words to mean different things. “Low risk” to one group meant “good enough for a pilot.” To another, it meant “fit for regulated production.” Progress slowed. Shadow behavior grew in the dark space between demand and delay.

I remember one discussion about a simple internal assistant. The business wanted speed. The data team said the source material was manageable. Security asked a plain question about retention and auditability. Silence. Not hostile silence. The worst kind. The kind that tells you the room has just discovered it was working from several different maps.

That is when I knew we needed a reset instead of a patch.

We changed the frame before we changed the plumbing

Once you admit the plan no longer fits the conditions, pride becomes expensive.

Our first useful move was mental. We stopped asking, “How do we fit AI into the current cloud model?” That question trapped us. It assumed the existing model was the fixed point, and AI was the exception. In practice, AI was changing the operating conditions.

So, we asked a better question. What kinds of AI work are we dealing with, what do they need and what should run where, why and under which controls?

That shift saved us from one-size-fits-all thinking.

We split the workload space into clear groups. Experiments were not the same as production services. Internal assistants were not the same as high sensitivity use cases. Data-heavy model work was not the same as quick feature add-ons. Once we made those distinctions, better decisions followed. Some workloads could move fast with light review. Others needed tighter handling, clearer evidence and harder boundaries.

We also made trade-offs explicit.

Before that, teams argued in code. One side talked speed. Another talked about risk. Another cost. They were often debating values without naming them. So, we dragged the trade-offs into daylight. When do we pay more for control? When do we accept a delay for clearer evidence? When do we permit local freedom, and when do we insist on a common route?

As we couldn’t remove tension, we made it usable.

The other big shift was governance. We moved it closer to design. As working logic. Architecture, security, legal, finance and data leaders needed to shape decisions early, before file opinions after a team had already fallen in love with a tool.

What we did next

The reset became real when it changed weekly behavior.

We reclassified workloads using a few plain tests. How sensitive is the data? How heavy is the computing need? How much latency matters. How exposed is the use case to regulation, customer trust or public embarrassment? Each category had a preferred route. A clear one, before a perfect route.

We rebuilt cost visibility. Experimentation spend could no longer be hidden within general platform usage. We separated trial money from operating money. We pushed teams to tie spend to an intended outcome, beyond technical curiosity. Curiosity matters. So do receipts.

We tightened data pathways. We became stricter about what data could go where, under which terms and with what record. Less wandering. Fewer assumptions. Better memory.

We updated review thresholds. Not every use case needed a committee. Some did. The trick was to define that line before the pressure arrived. Teams need to know when they can move, when they must pause and who can break a tie.

We also created a regular decision forum across platform, security, data, finance and business leads. A place to resolve trade-offs fast and make decisions. That one change cut a lot of theatre. People no longer had to guess who owned the hard calls.

What this taught me about cloud, AI and leadership

I came out of this with less faith in neat architecture slides and more respect for decision design.

What AI did to our cloud strategy also affected leadership. It exposed paradoxes you can often keep apart in calmer times. In my CIO article, “4 leadership paradoxes that define AI adoption,” I framed four tensions leaders now face: Speed and security, innovation and stability, talent and compliance, and ethics and efficiency. The piece argues that AI leadership is about learning to lead inside contradictions instead of resolving those once and for all. That is the part that stayed with me.

That is exactly what happened here.

We wanted teams to move quickly, but not so quickly that cloud spend became guesswork and controls became folklore. We wanted experimentation, but not at the price of production stability. We wanted strong technical people to explore, test and build, but not in ways that left legal, risk and security trying to reconstruct decisions after the fact. We wanted useful AI services, but not the kind that looked cheap and clever right up until they created a trust problem. No side debates. They became the work itself. The paradoxes were no longer theory. They were operating conditions.

That is why I no longer see cloud strategy as a platform conversation with some governance attached. It is a leadership discipline. You are not just choosing hosting patterns or cost controls. You are deciding how your organisation will behave under tension. Can you move with speed and still protect trust? Can you create room for experimentation without letting the estate drift into sprawl? Can you give talented teams the freedom they need without turning compliance into an afterthought? Can you chase efficiency without losing the ethical grip that keeps the whole thing defensible? That is the real burden of AI adoption. It pulls leadership into trade-offs that used to sit in separate meetings.

Boards should care more than they sometimes do. They shape spending, resilience, accountability and the company’s ability to adopt AI without behaving like a teenager left alone with a corporate card. That was the deeper lesson for me. The cloud strategy I helped build did not fail because the architecture was weak. It failed because AI changed the tensions leaders had to manage, and the old model was not built to carry that weight.

The cloud strategy I helped build did not survive contact with AI. I’m oddly grateful for that. It forced us to admit that a good strategy is not a monument. It is a living argument with reality.

The plan that survives is rarely the prettiest one, it is the one honest enough to change before the bill, the breach or the board meeting does it for you.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

When Anthropic’s Mythos model unearthed a 27-year-old OpenBSD flaw in the time it takes to brew a coffee, the “AI Vulnerability Storm” stopped being a theoretical threat and became our new reality. For years, the security industry has debated when AI would truly disrupt the exploit market. That debate is over. We are now defending against an adversary that doesn’t sleep, doesn’t get bored, and scans code at industrialised speeds.

The death of the grace period

We used to have the luxury of time, which is easy to say in hindsight. The traditional defensive playbook was a predictable rhythm: a CVE is released, you grab a coffee, raise some tickets, and your team spends the next few weeks “prioritising” the patch. I have worked in vulnerability management, and I know that is a huge oversimplification, but in comparison, that’s how it feels. You relied on the grace period between a vulnerability being announced and a reliable exploit hitting the wild.

Mythos just set that playbook on fire. 

When a frontier model can scan your entire external attack surface and draft a working exploit in minutes, your 14-day or 30-day patching cycle isn’t a strategy, it’s a liability. The Australian Cyber Security Centre’s (ACSC) recent findings confirm this: while AI isn’t yet a “sentient hacker” capable of complex, end-to-end strategic takeovers, it is terrifyingly good at the “boring” parts of the tradecraft, such as reconnaissance, code analysis, and rapid prototyping.

Currently, the real threat isn’t an AI brain; the threat is the machine-speed collapse of the exploit window.

System design is the real vulnerability

I’ve realised a hard truth recently: If your entire security posture fails because of a single unpatched vulnerability, patching isn’t your problem. Your system design is.

Brittle systems rely on the absence of flaws. They are houses of cards waiting for the next CVE to blow them over. Resilient systems assume flaws are inevitable. We have to move past a defensive posture and start building a Modern Defensible Architecture (MDA).

This isn’t just my opinion. The Cloud Security Alliance (CSA) recently issued 11 Priority Actions for a “Mythos-ready” world, and they align perfectly with the ACSC’s direction on MDA. The message is clear: Security is no longer about fixing a bug. It is an architectural mandate to ensure that no single failure leads to a catastrophe.

The counter-move: Turning speed against the machine

If we can’t out-patch the machine, we have to out-architect it. A Modern Defensible Architecture relies on Zero Trust as the floor, but it uses Deception as the walls. This is where it gets interesting. Under CSA Priority Action #9, there is a clear push to move toward active defense (90-day clock in fact). In a traditional network, a compromised server is a foothold. In a defensible architecture, that server is surrounded by honeypots, tokens, and decoy pathways. 

When an AI-driven tool like Mythos scans your environment, it doesn’t just see your assets; it sees a hall of mirrors. Because the AI moves at machine speed, it is actually more likely to trip a deception element than a human attacker would. 

This creates what we call a “High-Fidelity Signal”. A touch on a decoy isn’t a “maybe” alert; it’s a definitive indicator of intent. This allows for Action #10: Automated Containment. When seconds count, you can’t wait for a human analyst to get to this in their queue and verify an alert. You need the architecture to recognise the threat and shut down the endpoint/segment automatically.

The shift

To move from reactive patching to a Modern Defensible Architecture, organisations must first focus on eradicating the external attack surface by moving applications behind a Zero Trust framework. By making internal assets invisible to the public internet and eliminating open “listeners,” you effectively deprive models like Mythos of the reconnaissance data they need to draft an exploit. This aligns with CSA Priority Actions #1 and #5, shifting the goal from “patching everything” to “hiding everything” so that a vulnerability cannot be reached in the first place.

Second, we must saturate the environment with active deception, deploying honeypots, tokens, and decoy pathways that turn an AI’s industrialised scanning speed into its own undoing. As outlined in CSA Action #9, a defensible architecture should function like a hall of mirrors. Because an AI probes at machine speed, it is statistically far more likely to interact with a decoy than a human attacker would. This creates the “High-Fidelity Signal” necessary to distinguish a legitimate system failure from a targeted, machine-led intrusion.

Finally, organisations must mandate automated containment to counter the total collapse of the exploit window. In a world where Mythos can weaponize a flaw in minutes, manual triage is a legacy process we can no longer afford. Following CSA Action #10, the architecture must be empowered to instantly isolate endpoints or revoke sessions the moment a high-confidence threat is detected. By moving from “Human-in-the-loop” to “Human-over-the-loop” for containment, we ensure that our defensive response finally matches the velocity of the adversary.

The clock is ticking

The Mythos era doesn’t require us to reinvent security, but it does require us to stop pretending that faster patching is a sustainable path forward. Nobody is saying patching doesn’t matter, but if it’s the foundation that the system is built on, you’re already behind.

Organisations need to get off the endless treadmill of CVE remediation and start building Modern Defensible Architectures. By combining Zero Trust with active Deception, we create systems that don’t just resist attacks, they defend against them autonomously.

The goal isn’t to build a ship that never leaks. The goal is to build a ship so well-compartmentalised that even when a hull plate fails, the mission continues. The CSA gave us the blueprint. Mythos gave us the deadline. It’s time to stop fighting the storm and start building better ships.

To learn more, visit us here.

For nearly every CIO, implementing AI is their No. 1 task — that’s the directive they’re getting from the corner office.

CEOs have pegged researching and implementing AI at the top of their priority lists for their CIOs, according to CIO.com’s 2026 State of the CIO Survey. That finding mirrors the results in multiple other surveys and echoes CIO.com’s 2025 survey, which also found AI implementations as the top CEO priority for IT.

CEOs, however, have indicated that they’re no longer interested in AI experiments and proofs of concepts. They’re looking for AI initiatives that deliver quantifiable value. The most strategic CEOs are going further, seeking to leverage AI in transforming how their organizations work and what products and services they offer. And they expect their CIOs to create those opportunities and not merely collaborate on seizing them.

“CEOs want CIOs to stand up and lead on how to unlock the real value of AI, to shift from productivity gains to different value propositions,” says Shanky Viswanathan, head of business innovation at Tata Consultancy Services. “There’s a real opportunity for CIOs to show how AI can be used in the business.”

That, though, is a tall order — one that many CIOs and C-suites more broadly aren’t yet fulfilling.

“A lot of CIOs still struggle with identifying use cases across the enterprise where AI can make them so much better, and they still struggle with identifying the workstreams and processes and the pain points and how they can reinvent how the organization operates with AI,” says Jennifer Carter, a senior principal analyst in the CIO and executive leadership practice at research firm Gartner.

She adds: “There are limitless possibilities, but many CIOs are caught doing some catch-up in understanding the full potential of AI even as CEOs are looking at them and asking, ‘What can we do with this?’”

What CEOs want from AI

The CEO mandate to capitalize on AI is not new this year. It has been a high-level goal at many organizations since generative AI muscled its way into the enterprise with the November 2022 release of ChatGPT.

What’s relatively new this year is the CEO requirement for CIOs to deliver tangible ROI for the organization’s AI investments. In fact, CEOs listed “establish AI policies and ROI metrics” as a top 10 priority for CIOs this year, according to the State of the CIO Survey.

Viswanathan says CEOs have become frustrated that “the amount of money they spend on AI is far, far bigger than the returns. Yes, they’re getting some productivity gains. but it’s been quite fragmented.”

Now, after years of AI investments, CEOs have a sense of urgency to use AI to drive revenue, he and others assert. That directive aligns with other CEO priorities for IT identified in the State of the CIO survey, including help in reaching revenue growth targets and leading innovation, at No. 6 and 7 respectively.

Daniel Saroff, group vice president of end-user research and consulting at IDC, says his firm’s research also shows chief executives pushing IT to use AI not just for productivity gains but to drive revenue growth.

IDC’s C-Suite Tech Survey found over half of CIOs and CTOs globally cite AI and automation as their primary business objective.

“Organizations are under real pressure to change how they compete, how they develop products, and how they deliver services to customers,” Saroff says.

To deliver on that priority, CIOs need to move beyond the experimentation they have been doing and instead design initiatives that can be implementated at scale.

“It’s a more deliberate effort where we link [AI initiatives] to business outcomes,” he says. Organizations “have struggled getting from experimentation and pilots to something that actually runs in production and delivers measurable value. The transition turns out to be harder than it initially looked.”

There are various reasons for those struggles, Saroff says. Problems with the data that fuels AI is one. Technical debt and legacy environments also slow innovation and make it more expensive than anticipated. Budget pressures compound the challenges.

Additionally, he says, IT still struggles to be a business strategy partner in some organizations.

Opportunities for the CIO

Gartner research has identified similar trends in what chief executives want from IT, with technology being a top 3 strategy priority for CEOs, coming in just behind growth at No. 1 and finance (e.g., expense management) at No. 2.

“When we say they’re prioritizing technology, we find according to CEOs it’s about AI,” Carter says.

Carter, like others, says CEOs aren’t yet seeing IT deliver transformative AI initiatives. She puts some of that on CEOs, though, saying that they still think about AI in terms of productivity gains and optimization. She points to research showing that nearly all CEOs use AI to save time while only 2% are using AI for tasks, such as decision support, that drive growth.

This creates an opportunity for CIOs, Carter says. By identifying where AI can remake how the organization operates and what it produces, CIOs will help their CEOs win in the market.

“CIOs should double down on the story of the technology that will fuel high-impact, high-spotlight initiatives,” she says. “As tech execs, they have the responsibility to raise awareness on what the technology will do and to build the needed tech literacy. It’s important for CIOs to remember that they’re in the biggest wave of opportunity the role has ever seen.”

Some CIOs are, indeed, delivering on this, Viswanathan says.

“There are some tech leaders who show how AI is not a means unto itself, and they’re able to unravel the opportunities,” he says. “They’re asking, ‘Can AI unlock value for me in areas where I struggled in the past, like responding to customer demands in a different way, or rethinking how supply chain management can happen, in reimagining products?’ These technology leaders are responding to those questions with AI front and center.”

Securing the enterprise

The corporate priorities handed down to Ajay Sabhlok, CIO and CDO at tech company Rubrik, reflect the findings from CIO.com’s State of the CIO Survey.

“Our CEO’s goal is to reduce and eliminate the business operations bottleneck,” Sabhlok says. And the CEO’s goal for IT is “to help Rubrik gain efficiency and productivity across all business processes.”

IT took that message to heart, says Sabhlok, explaining that the IT team itself is the first “to pivot over to an AI first organization. The pivot means that we must adopt an AI mindset in all of our IT processes and personal productivity improvement, with the goal of achieving resource optimization.”

Like some CIOs who are bringing AI to IT, Sabhlok is establishing AI-powered processes across engineering, architecture, FinOps, business self-service, DevOps, and user support. “That includes rolling out core AI platforms and enabling users to use them effectively in partnership with IT AI engineering for complex use cases,” he adds.

Another key CEO objective for Sabhlock is strengthening Rubrik’s security posture, something he’s doing in part by ensuring “efficient resolution of all identified risks and vulnerabilities” and transforming the “infrastructure across data center, cloud, and network with embedded security.”

Many CEOs share that agenda, as the State of the CIO Survey’s No. 2 CEO priority for IT is upgrading IT and data security to reduce corporate risk. CIOs, IT advisers, and other researchers aren’t surprised that cybersecurity is so high on CEOs’ lists, given the financial, legal, and reputational risk associated with a data breach or cyber incident.

“CEOs are prioritizing a strong foundation of trust, resilience, and security, especially as AI adoption increases the importance of data integrity, governance, and risk management,” says Paul Leinwand, principal of enterprise and functional strategy at PwC US.

Viswanathan likewise has seen cybersecurity remain a top priority for CEOs.

Priorities beyond AI and security

Next-wave innovations such as quantum computing are also making appearances on some CEO priority lists, particularly among chief executives in banking, life sciences, and logistics — industries where quantum computing is already making an impact, Viswanathan says. “Those CEOs are looking for IT to talk about the potential opportunities with quantum,” he notes.

And he sees CEOs asking CIOs to prioritize optimization and modernization “because that gives them a significant opportunity to funnel [savings from those moves] into emerging tech.”

Rounding out the top five CEO priorities for IT from the State of the CIO Survey are strengthening IT and business collaboration; improving customer experience, and leading digital business/digital transformation initiatives.

Leinwand says those mirror what he’s seeing.

“[CEOs] want IT to enable enterprisewide transformation of the operating model by connecting data, workflows, and decision-making across the organization rather than operating in functional silos — and doing this in core operations and processes, not just running pilots,” he says.

A fundamental shift in how companies compete is what is driving these CEO priorities, as are the challenges that CEOs face in generating sustainable growth, he notes.

“CEOs are expecting technology to be a big enabler of expanding customer engagement, better insight development, clearer innovation programs, and to open up new revenue-creating channels through technology,” Leinwand adds.

CIOs are increasingly judged in their ability to deliver on all this, according to IDC’s Saroff. He points to IDC data showing that in just one year revenue generation jumped from sixth to third place as a top CIO success metric.

“So some CIOs are starting to be measured — or measure themselves — on business outcomes rather than just operational performance,” he adds.

As Apple heads toward next month’s Worldwide Developer Conference (WWDC), cast your mind back almost 30 years. That’s when something happened that arguably put events in motion that led to Apple becoming the company it is today. That was when Apple co-founder Steve Jobs returned to the top job at WWDC 1997 — the first such event after Apple acquired NeXT.

The big debt to NS

It took until 2000 to fully realize what the NeXT purchase meant; that’s when the Mac OS X Public Beta was released. The operating system has seen many twists and turns since then, but the NeXTStep OS acquisition forms the basis on which the Apple software ecosystem has been built. Mac, iPhone, iPad – even Apple Watch and Vision Pro – all share elements of it.

You can see its traces each time you use an application that makes use of a macOS API that uses the NS — ‘NeXTStep’ prefix. That means you’re using NeXT when you work in SwiftUI, use Apple’s core frameworks, or write code for use across different platforms in the current ecosystem. Despite the many names for Apple’s platforms, they all have a little NeXT in common.

The need for a new, modern operating system was critical at the time to Apple. The company had fallen into the doldrums with its classic Mac OS operating system and competitors had forged ahead, at least in marketshare. Among others, Michael Dell, Time Magazine, and almost everyone else expected the company to collapse. NeXT was the salvation, Jobs the icon, and history the prize.

The next challenge now

Today’s Apple faces a fresh existential challenge, and while much of it feels media-driven, the company does need to introduce an intelligence layer around and upon its platforms, alongside the tools developers need to exploit AI within their applications. 

Apple knows this, too, which is why it already offers Apple Intelligence APIs to developers to use in their apps. The company also knows they need a way to market those software ideas and get them into the hands of end users; that’s what the App Store provides.

When Apple wove NeXT into its operating system, it somehow managed to provide developers with better tools, modern, enduring foundations, frameworks and everything else needed to build an ecosystem that extends across multiple product families at a range of prices and technological advancement — from the $499 MacBook Neo to the $3,499 Vision Pro. You can build applications for any or all of these platforms using components Apple provides, along with what you bring yourself. To a great extent, all of this potential was unlocked by the acquisition of NeXTStep and its use in OS X at the turn of the century. 

Telling stories

No doubt, developers are eager to discover the extent to which Apple has managed to join the circle of AI development on its platforms. They surely hope for powerful new APIs to enhance their products with a new intelligence layer, even while Apple itself needs to offer developers the same thing to keep them loyal to its platforms. 

If you squint just a little bit, the same challenges that haunted Apple in the late ‘90s echo again today. Apple wants to reinvent itself for AI without sacrificing all the benefits of its existing ecosystem. It wants to do so while making sure its developer community buys into its chosen direction. To help achieve this, it can lean heavily into its inherent hardware advantage: Not only can its products run the apps developers build, but they are also fantastic platforms to build on in the first place. All the same, it needs to convince them with a narrative that resonates, which means that while WWDC in 1997 was all about NeXTStep, WWDC 2026 is all about which steps Apple takes next. 

You can follow me on social media! Join me on BlueSky,  LinkedIn, and Mastodon.

AI에 가장 많은 투자를 하는 조직일수록 오히려 창출하는 가치는 가장 적은 경우가 많다. 이 같은 역설은 AI가 실제로 가치를 만들어내는지에 대한 논쟁을 키우고 있다. 그러나 이는 본질적인 질문이 아니다. 업무 단위에서는 이미 충분한 근거가 축적돼 있다. 코딩, 글쓰기, 분석, 고객 지원 등 다양한 영역에서 AI가 측정 가능한 생산성 향상을 만들어낸다는 사실이 반복적으로 입증되고 있다.

다만 이러한 성과가 기업 전체의 재무 성과로 이어지지 않는 것이 문제다. MIT 연구에 따르면 전체 AI 파일럿 프로젝트의 95%가 초기 단계에서 손익계산서(P&L)에 의미 있는 영향을 주지 못한 것으로 나타났다. 맥킨지 역시 전체 응답 기업 가운데 약 6%에 해당하는 고성과 기업만이 AI를 통해 EBIT의 5% 이상을 창출했다고 분석했다. 보스턴컨설팅그룹(BCG)은 AI 전환 프로젝트의 약 60%가 제한적이거나 실질적인 가치 창출에 실패했다고 분석했다.

결국 공통된 흐름은 분명하다. 파일럿 단계에서는 성과가 확인되지만, 이를 조직 전체로 확장하는 과정에서 가치가 제대로 이어지지 않는다.

한편 대기업과 중소기업 간 AI 도입 격차는 빠르게 좁혀지고 있다. 미국 중소기업청(SBA) 데이터에 따르면 2023년 11월부터 2025년 8월까지 AI 도입률은 양측 모두에서 꾸준히 증가했다. 대기업은 6% 미만에서 12% 이상으로, 중소기업은 약 4%에서 8% 이상으로 상승했다. 여전히 대기업이 높은 수준을 유지하고 있지만, 중소기업의 도입 속도가 빨라지면서 격차는 점차 축소되는 추세다.

‘엣지’에선 작동, ‘코어’에선 정체되는 AI

대기업에서 AI 도입률이 빠르게 높아지고 있음에도 불구하고, 실제 운영 환경에 들어간 AI는 쉽게 자리 잡지 못한다. 수십 년간 축적된 시스템과 규제 체계, 다층적인 거버넌스, 그리고 부서 간 복잡한 의존성이 얽혀 있기 때문이다. AI는 도입 이후 보안 검토, 구매 절차, 법률 심사, 아키텍처 위원회 검토, 레거시 시스템 연동 제약 등 다양한 관문을 통과해야 한다. 각각의 절차는 필요에 의해 존재하지만, 이들이 결합되면 변화 속도를 늦추고 효과를 분산시키는 요인이 된다.

특정 부서 단위에서는 AI 파일럿이 성과를 보일 수 있다. 그러나 이를 조직 전체로 확장하려는 순간 기존 운영 모델과 충돌한다. 데이터 소유권, 책임 구조, 의사결정 권한이 명확하지 않을 경우 확장 비용은 더욱 커진다. 결국 제한된 환경에서 효과를 보였던 AI는 조직 단위로 확장되는 과정에서 멈춰 서고, 기대했던 가치는 규모화 과정에서 사라진다.

중소기업 역시 나름의 어려움을 안고 있다. 자금 흐름 제약, 제한된 인력, 고객 리스크 등이 대표적이다. 다만 의사결정 과정에서의 ‘거부 지점’은 상대적으로 적다. 예를 들어 창업자가 AI 기반 견적 자동화나 후속 고객 응대 시스템을 실험하기 위해 별도의 범부서 위원회를 구성하는 경우는 드물다.

의사결정은 빠르게 이뤄지고, 피드백도 짧은 주기로 반복된다. 직원 한 명이 전체 생산성에서 차지하는 비중이 크기 때문에 변화의 효과도 즉각적으로 드러난다. 5명 규모 기업이 행정 업무의 20%를 자동화하면, 그 성과는 곧바로 측정 가능하다.

이들의 구조적 강점은 ‘단순함’이다. 레거시 시스템이 적고 의사결정 경로가 짧으며, 다층적인 거버넌스가 상대적으로 덜하다. SaaS 기반 솔루션도 빠르게 도입하고 큰 마찰 없이 통합할 수 있다. 이러한 특성이 더 나은 의사결정을 보장하는 것은 아니지만, 실행 속도를 높이는 데는 분명한 이점으로 작용한다.

AI ROI의 본질은 ‘조직의 준비 상태’

반대로 대기업은 높은 수준의 시스템 통합 요구와 정교한 거버넌스, 분산된 책임 구조를 갖추고 있다. 이는 운영 리스크를 줄이는 데는 효과적이지만, 새로운 기술 역량을 실제 재무 성과로 전환하는 속도를 늦추는 요인이 된다. AI 파일럿이 기술적으로는 충분한 가능성을 입증하더라도, 기업 전체의 경제적 성과를 끌어올리는 데는 실패하는 이유다.

이 때문에 경영진은 본질적인 선택에 직면하게 된다. 그러나 많은 경우 이를 회피하려 한다. AI ROI를 단순한 기술 문제로 규정하면 IT 조직이나 데이터 팀, 혁신 부서에 위임할 수 있기 때문이다. 반면 조직 설계의 문제로 접근하면 이야기가 달라진다. 이는 전사적인 변화 없이는 해결할 수 없다.

AI는 구조적 문제를 해소하기보다 오히려 증폭시키는 성격을 갖는다. 의사결정 권한이 불명확하면 그 문제가 더욱 선명해지고, 데이터 거버넌스가 취약하면 리스크는 확대된다. 보상 체계가 어긋나 있다면 그 불균형 역시 더 빠르게 심화된다. 결국 업무 단위에서의 생산성 향상이 기업 전체의 수익성 개선으로 자동 연결되지 않는 이유가 여기에 있다.

이 같은 현상은 새로운 것이 아니다. 인터넷 도입 초기에도 유사한 흐름이 나타났다. 기술 자체는 정상적으로 작동했지만, 기존 구조 위에 이를 덧붙인 기업이 아니라 조직을 재설계한 기업이 더 큰 성과를 거뒀다.

현재 AI 역시 같은 패턴을 보이고 있다. ROI를 제한하는 요인은 모델 성능이 아니라, 변화를 수용하고 확장할 수 있는 조직의 준비 상태다.

따라서 질문은 “AI가 왜 ROI를 만들지 못하는가”가 아니다. ROI는 AI가 아니라 조직이 만들어내는 것이기 때문이다. 진짜 질문은 조직이 일하는 방식과 의사결정 구조, 거버넌스, 성과 측정 방식을 재설계할 준비가 되어 있는가에 있다.

이러한 변화가 없다면 AI는 주변 업무의 생산성을 높이는 도구에 머무를 가능성이 크다. 반대로 조직이 이를 수용할 수 있다면, AI는 지속 가능한 경제적 가치를 창출하는 핵심 동력으로 자리 잡게 된다.
dl-ciokorea@foundryco.com

Apple’s Tim Cook was viewed as a worthy successor to Steve Jobs when he took over as CEO in August 2011, two months before Jobs’ death. 

Apple products became successful (and profitable) in many ways due to his success as COO, where he whipped company operations and supply chains into shape. Cook expanded the company’s product portfolio into new devices such as the Vision Pro and Apple Watch, rolled out a plethora of profitable services, and cut off failed projects like the rumored Apple car.

But Cook, who announced this week he will step down as CEO on Sept. 1 to become executive chairman, has one major blemish on his legacy. He missed perhaps one of the most important moments in computing history — the AI revolution. 

Apple could still win AI war, and it now falls on incoming CEO John Ternus, formerly Apple’s senior vice president of hardware engineering, to play catch-up with AI rivals Google, Microsoft and OpenAI. 

When ChatGPT took the world by storm in late 2022, Apple was years behind in the AI race and had to scramble to catch up. Cook’s failure is mostly attributable to Apple believing it could always go it alone when it comes to technology, said Jack Gold, principal analyst at J. Gold Associates

“They have a bias to doing everything in house,” Gold said.

The company did not believe in AI until ChatGPT emerged to take the tech industry by storm, according to a 2025 Bloomberg news report, and Cook did not provide the resources needed in-house to develop an AI-powered Siri. Apple was forced in early 2025 to look at partnering with Anthropic and OpenAI to push Siri into the AI era; in finally settled on working with Google’s Gemini.

The stumble was even more apparent since Apple was onto the AI trend early on, when it introduced neural chips for AI in iPhones as early as 2017. (Qualcomm introduced AI chips in its smartphone chips around the same time.)

At the time, the neural engine was hailed as a revolutionary development for developers to plug AI into applications. Apple wanted to use the neural chip’s matrix computing features to accelerate image and video processing, and users loved the results. 

Then in 2024, Apple introduced Apple Intelligence to much fanfare, hoping to bring AI technology across its devices and platforms. The AI layer was based on homegrown foundation models. 

Though it arrived nearly two years after ChatGPT, Apple Intelligence at the time offered truly innovative features. It had better OS and app integration and privacy features that kept user data secure — in part because of Private Cloud Compute. Other AI providers at the time were harvesting user data to improve their AI models.

Behind the scenes, however, Apple leadership and technological challenges slowed the development of Apple Intelligence. Apple in 2018 had hired former Google executive John Giannandrea to bring AI to Apple products. Giannandrea’s leadership was largely seen as ineffective and he retired last December. In early 2026, Apple turned to former Microsoft AI leader Amar Subramanya to lead the company’s AI efforts.

As a result, many of the main Apple Intelligence features were delayed, with hopes they  would finally arrive in 2026.

Then in January came the partnership with Google: “The next generation of Apple Foundation Models will be based on Google’s Gemini models and cloud technology,” the companies said in a joint statement.

Apple

Now, the work for Apple’s soon-to-be CEO Ternus is clear: bring the company fully into  the AI age. “Unlike previous market inflections and transitions, Apple can’t afford to come in late to the party this time around,” said Jim McGregor, principal analyst at Tirias Research.

With its experience in devices and talent, Apple is well equipped to build AI into a personal experience, McGregor said. “Apple has to chart a path to reinvent the personal experience, which will drastically change devices and how we use them,” he said.

To succeed, Ternus will have to look at more partnerships and drop Apple’s reliance on in-house development, analysts said.

“When AI is moving at such a fast pace, no one company like Apple can really move fast enough to keep up,” Gold said.

The Google partnership is a solid step in that direction, as finding the expertise to hire the right people is a major hurdle, given the compensation package that others are offering, Gold said.

Whether the company has finally righted the AI ship should become clear in a little over a month at its annual Worldwide Developers Conference — the last one of the Cook era.

There’s been a wake-up call for CIOs. All the talk about perceived productivity boosts that have previously dominated conversations about AI has been replaced with a demand for measurable value from investments in emerging tech.

As MIT states that project failure rates are as high as 95%, executive boards are starting to question when AI will pay dividends. PWC’s Global CEO Survey shows that more than half of companies have seen neither higher revenues nor lower costs from AI, and only one in eight have achieved positive outcomes.

While Gartner predicts significant growth in AI spending this year, John-David Lovelock, distinguished VP analyst at the research firm, says the lack of tangible returns means digital leaders are changing tack. Rather than hoping their AI explorations will produce returns, CIOs are switching to more targeted initiatives.

“The projects growing quickly are the ones doing business, and those initiatives include AI,” he says. “CIOs are starting to de-emphasize AI and re-emphasize business. These projects are about AI enhancing existing work and moving away from moonshot transformational projects.”

Lenovo’s CIO Playbook for 2026, produced with tech analyst IDC, also suggests enterprises will get serious about AI deployments this year, with explorations replaced by production-level services that drive business transformation. With boards exerting pressure for measurable returns, Ewa Zborowska, research director at IDC, says more digital leaders want to use AI to enhance, innovate, and reinvent their organizations.

“CIOs aren’t just considering AI out of curiosity, they want to see what they can get out of it to grow the business,” she says. “AI adoption is much more about doing new things or taking a fresh approach to creating value rather than becoming more efficient at cost-cutting.”

Such is the clamor for value that Richard Corbridge, CIO at property specialist Segro, suggests that returns from AI are a main digital leadership priority: “If you discover, for example, that everyone in the organization used Copilot 10 times today, that might mean they’ve been more efficient,” he says. “But what have they actually done with the time they saved? How has saving time created value?”

CIOs will grapple with these questions during the next 12 months. With CEOs and boards becoming impatient for returns, digital leaders are working more with their bosses to define value. Successful CIOs fine-tune their arguments to ensure their projects are backed, and then demonstrate the value of their AI initiatives to the board.

Defining a valuable AI project

What’s clear is CIOs can’t deliver outputs from AI projects without input from their enterprise peers. IDC’s Zborowska says tighter cooperation across project ownership and KPIs ensure emerging technology investments are targeted at the right places.

This increased interaction between digital and business leaders also changes project aims. As stakeholders work closely together to generate value from AI, Zborowska expects executives to seek KPIs that stretch across operational concerns.

“I’d bet we see more non-financial aims over the next few years,” she says. “Executives will consider things such as are employees more engaged, has their work improved in any way, are AI implementations impacting customer experiences, and are internal decisions being made more efficiently.”

Martin Hardy, cyber portfolio and architecture director at the UK’s Royal Mail, agrees that defining valuable AI projects is all about finding the right focus. Effective deployments target processes in distinct areas, and business stakeholders must be part of the value-defining process.

“If we’re making decisions about legal documentation, AI is probably not there yet,” he says. “But if we can use AI to approve holidays, for instance, that might be something because if you have rules that say no more than two people off at a time, you could use AI to check about booking holidays without having to ask everyone in the office.”

For CIOs seeking value-generating use cases, Gartner’s Lovelock suggests AI can deliver results in key business areas such as boosting revenue, supporting decision-making, engaging staff, and improving experiences. He says the right path to AI exploitation correlates with Gartner’s enterprise technology adoption profiles, which group companies into a range of categories.

“The folks who are furthest forward, what we call the agile leaders in technology, are much more likely to drive AI to change the business,” he says. “The laggards on the other side are more likely to take on the technology that’s given to them by incumbent software providers, and use it in a prescriptive manner.”

Fine-tuning the use case

The challenge now is for digital leaders to work with their business peers to determine a more refined approach to AI deployment. For some CIOs, the value of AI is clear but the potential risks must be considered.

Take Dan Keyworth, executive director of performance technology and systems at McLaren Racing, whose focus is operational stability and race-day reliability. While he says being aware of developments in generative and agentic AI is crucial, the priority is tried-and-tested technologies rather than innovations that put performance at risk.

“Formula One is grounded in traditional machine learning and simulation,” he says. “Developing models has been a big part of our performance journey, and since the engine already existed, gen AI is the turbo that’s bolted on with more investment in AI.”

For other digital leaders, like Barry Panayi, group chief data officer at insurance firm Howden, success depends on keeping the human in the loop. Yes, automation can improve customer service, but rather than replacing staff, he wants to use AI to ensure Howden’s professionals have the right insight when they interact with clients.

“There’s absolutely no desire to use data to drive productivity by automating what we do with our customers,” he says. “This is a business where people speak to people. Our brokers need information that can give them an edge, and prove to their clients they understand the risks and can give them the best deals.”

Nick Pearson, CIO at technology specialist Ricoh Europe, adds that the use case for AI at his firm is two-fold: boosting operational productivity and improving customer processes. So he’s established a tri-party AI council with the head of service operations and the commercial manager in Spain. This council explores opportunities to buy, build, and reuse emerging tech.

“We’ve got a strategy that looks at where AI matters, which means exploring the technology we already have to boost internal productivity,” he says. “We’ve got a lot of people who know how to code and build things in Copilot Studio and other platforms, so let’s use that to increase productivity.”

Showing returns to the board

For Gartner’s Lovelock, the key lesson for CIOs eager to generate value from AI is to work with their peers and set desired outcomes before investing. “Most people start with the idea that more is more, and if you do that, you won’t get to the idea of quality,” he says.

That sentiment resonates with Segro’s Corbridge, who encourages digital leaders to start conversations with other professionals by focusing on value. Ask people how investing in an AI implementation will create value for them personally, for the wider business, and the customers the organization serves.

He says CIOs shouldn’t try to prove that AI works, but rather concentrate on how emerging tech adds value. That definition is so critical to Segro’s way of working that the organization uses the phrase proof of value rather than proof of concept.

“Most things work, but they might be more expensive,” he says. “For example, you might be able to use AI to transform how the organization uses spreadsheets, but that project might cost you $300,000. And if you’re currently paying someone $40,000 to do that work, and they’re happy doing it, then you have to question the value.”

Lessons are being learned, says IDC’s Zborowska, whose firm’s research suggests that half of AI POCs now transition into production. While some people might think this success rate isn’t impressive, the quantity a year ago was 10%. After several years of AI exploration, it appears CIOs and their businesses are now firmly focused on real returns.

“These numbers speak to the fact that companies are being more mature and mindful in how they allocate budgets,” she says. “They also support the main theme that we’re on a journey to transformation and a maturing market for AI adoption.”

A widely shared Template22 graphic on why projects fail prompted this article. I am using that chart as a prompt, not as evidence. The more useful question is not whether the familiar causes of failure are real. They are. The more useful question is why they keep repeating across programs, portfolios and enterprise transformations, even after years of investment in methods, PMOs, digital tools and AI.

The answer, in many cases, is not a lack of effort. It is a lack of decision logic. Enterprises still launch, govern and defend large initiatives without a planning discipline capable of calculating trade-offs, exposing constraints, modeling dependencies and recalculating the impact of change quickly enough to support real governance.

The pattern under the pattern

Most discussions of project failure start with visible symptoms, unclear scope, weak requirements, scope creep, poor communication, resource shortages, unrealistic deadlines, weak sponsorship and poor change control. Those symptoms matter, but when they recur at scale, they usually point to a deeper problem in the planning system itself. In PMI’s 2025 research on the strategy execution gap, PMI President and CEO Pierre Le Manh argued that AI will create value only when organizations can translate bold ideas into executed initiatives. In most enterprises, the gap is not ambition. The gap is conversion. Strategy is declared, portfolios are funded, work begins, yet leaders still cannot calculate trade-offs, expose constraints, model dependencies or replan fast enough when conditions change.

The scale of the issue is hard to dismiss. BCG’s 2024 study of large-scale technology programs found that more than two-thirds are not expected to be delivered on time, within budget and within scope, and that only 30% fully meet expectations on those three dimensions. Gartner’s 2024 survey found that only 48% of digital initiatives across the enterprise meet or exceed their business outcome targets. Those are not isolated execution misses. They are signs of systemic underperformance in how organizations prioritize, fund, sequence and govern change.

Other firms sharpen the diagnosis from different directions. McKinsey’s work on successful transformations found that among companies whose transformations failed to engage line managers and frontline employees, only 3% reported success. Bain’s David Michels argues that “red is good,” meaning organizations perform better when risk is surfaced early rather than hidden behind reassuring dashboards. Deloitte’s research on digital acceleration and strategy makes the strategic requirement explicit: Digital possibilities must shape strategy, and strategy must shape digital priorities. Put together, those findings point to one conclusion. Large programs rarely fail because a single team misses a task. They fail because the enterprise cannot see the interaction of priorities, constraints, dependencies and consequences early enough to respond intelligently.

Why this is a planning problem, not just a delivery problem

At the portfolio level, failure begins when organizations select too much work, fund the wrong work or fund the right work without a realistic view of capacity, technical debt and delivery interdependencies. BCG ties poor outcomes directly to inaccurate timeline and resource planning, weak end-to-end roadmaps and ineffective management of interdependencies. That is not simply a delivery problem. It is a portfolio design problem. Forrester’s 2025 work on operating model change adds a related warning: Fewer than half of IT leaders say their organizations prioritize operating model adaptation, leaving strategy to collide with structures that are not built to absorb change.

At the governance level, failure shows up as a value problem. Traditional oversight mechanisms can collect status, enforce templates and schedule reviews, yet still fail to answer the executive question that matters most: What happens if a key dependency slips, a budget is reduced or a shared team becomes overcommitted? Bain’s “red is good” matters here because watermelon reporting, green on the outside and red underneath, is usually a sign that governance is reporting milestones instead of modeling consequences. Gartner’s survey of Digital Vanguard organizations reinforces the point. The highest performing digital organizations do better when business and technology leaders are more aligned on execution and outcome ownership.

At the execution level, the familiar problems remain, but they look different when viewed through a planning lens. PMI’s communications research found that one out of five projects is unsuccessful due to ineffective communication, and PMI’s later analysis of communication failures linked poor communication to more than half of the projects that fail to meet business goals. The important nuance is that communication is not merely a soft skill problem. It is often a failure to express the implications of planning decisions in a form that the business can act on. An unclear scope can be a weak scenario definition. Poor requirements can reflect commitments made before constraints were visible. Scope creep is often an unmanaged consequence. Weak sponsorship often reflects weak evidence. Poor change control often means the organization can log a change but cannot calculate its ripple effects.

Why algorithmic planning is now a governance requirement

This is where the conversation needs to become more precise. Continuous scenario planning is valuable, but it only becomes decision-grade when it is supported by algorithmic planning. In large programs and portfolios, governance cannot rely on static reporting, intuition or periodic review alone. It must be able to calculate the impact of change quickly, expose hard constraints clearly and place dependencies, capacity limits, sequencing conflicts and trade-off consequences where they belong, at the center of decision-making. Without that discipline, governance is mostly a matter of interpretation. With it, governance becomes evidence-based control. That conclusion follows directly from the documented failure patterns of PMI, BCG, McKinsey, Bain, Deloitte and Gartner.

AI makes this requirement even more important. Used well, AI can be a powerful interface for senior leaders, helping them interrogate scenarios, surface anomalies, summarize risks and engage more directly with the planning environment. Used badly, it can do the opposite. If AI is not tightly coupled to mathematically sound planning data, explicit constraints, dependency logic and algorithmic calculations, it can turn supposition into false confidence. That is dangerous in portfolio and program governance, where plausible-sounding answers are not the same as decision-grade answers. The sequence matters. First, the organization needs a locked down, calculation based planning model with clear borders. Then AI can sit on top of that model as an accelerator, interpreter and executive interface. Without those boundaries, AI can easily magnify weak assumptions rather than expose them. This caution is consistent with PMI’s strategy execution framing and with EY’s 2026 CEO Outlook and Accenture’s AI reinvention thesis, both of which insist that AI must be scaled with discipline and strong foundations.

Strategic intent is inherently directional. Governance must be exacting. The bridge between the two is algorithmic planning. It is the mechanism that translates ambition into modeled consequences by testing scenarios, exposing constraints, mapping dependencies and recalculating trade-offs as conditions change. Without that bridge, governance becomes subjective. With it, leadership can distinguish between what is desirable, what is feasible and what is now at risk. That is why constraints, dependencies and capacity should not be treated as soft considerations. They are the black-and-white rules of execution.

AI is most valuable when it explains a sound planning model, not when it improvises one.

Why continuous scenario planning matters

Continuous scenario planning becomes strategically important when it gives leaders a way to compare options side by side, test trade-offs before they commit, expose bottlenecks early, map dependency cascades and continuously recalculate what changes when budgets, priorities or constraints shift. That directly addresses many of the structural drivers identified above. It does not solve every reason projects fail. It does attack a large share of the root causes beneath them.

Seen this way, many of the familiar 25 reasons collapse into a smaller set of systemic failures. An unclear scope often results in a weak scenario definition. Poor requirements are often commitments made before constraints and dependencies were visible. Scope creep is often an unmanaged consequence. Poor communication often reflects fragmented planning logic, with business, finance and delivery working from different maps. Resource shortages are often hidden by overcommitment. Weak sponsorship often reflects weak evidence. Poor change control usually means the organization can record changes but cannot model impact. At the project level, teams can sometimes survive these problems through heroic effort. At the portfolio level, heroics stop working. Constraints win. Bottlenecks win. The question is whether leadership can see them early enough to respond intelligently.

PMI’s newer M.O.R.E. framework supports this shift. PMI argues that project outcomes improve materially when organizations manage perceptions, own success, relentlessly reassess and expand perspective. Two of those ideas matter especially here. Relentlessly reassess describes a discipline of continuous adjustment as conditions shift. Managing perceptions requires communicating value and risk in ways stakeholders can act on. That is remarkably close to what mature continuous scenario planning should do at scale.

Why the urgency is rising

The pressure on CIOs is increasing, not falling. EY’s 2026 CEO Outlook says leaders are pursuing growth and adaptability through bold AI transformation, with 2026 becoming a turning point as organizations move from pilots to scaled enterprise use. Accenture makes a similar point from a different angle, arguing that organizations that build strong AI foundations will be better positioned to reinvent, compete and achieve new levels of performance. Those are reasonable claims, but they do not reduce the need for disciplined planning. Faster change increases the premium on a planning system that can calculate consequences quickly and credibly. AI can accelerate analysis, summarize scenarios and improve executive access to planning insight. It cannot replace the need to govern trade offs across budgets, capacity, architecture, timing and risk. In fact, AI is only trustworthy in this context when it is tightly coupled to mathematically sound planning data, explicit constraints, dependency logic and algorithmic calculations. Otherwise, it risks producing plausible but unsupported answers.

What CIOs should demand

For CIOs, this leads to a more useful conclusion than simply restating the 25 reasons projects fail. Large programs usually fail because the enterprise cannot see and govern the interaction of those reasons in time. A modern control system for change, therefore, needs at least six capabilities: A unified planning model across priorities, budgets and capacity; side-by-side scenario comparison; interdependency mapping; early visibility into bottlenecks; continuous recalculation as conditions shift; and executive-facing summaries that turn data into decisions. Those are the capabilities that make continuous scenario planning strategically important. The question is no longer whether planning happens. It already does. The real question is whether planning remains static, fragmented and largely narrative, or whether it becomes dynamic, scenario-based and decision-grade.

That is the real fix hidden beneath the 25 symptoms.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Organizations that invest the most in AI often capture the least value from it. That paradox is driving a growing debate about whether AI delivers value. But that’s the wrong debate. At the task level, the evidence is clear with studies consistently showing measurable productivity gains in coding, writing, analysis, and customer support.

MIT researchers have found that 95% of AI pilots fail to generate measurable P&L impact at the pilot stage. McKinsey also reports only the high performers, about 6% of respondents, attribute 5% or more of EBIT to AI. And BCG estimates that roughly 60% of AI transformation efforts deliver limited or no material value. The pattern is consistent: pilots succeed locally, but value rarely scales systemically.

Meanwhile, the adoption gap between large enterprises and SMBs has narrowed sharply. US Small Business Administration data shows that between November 2023 and August 2025, AI adoption rose steadily across both, with larger firms increasing from under 6% to over 12%, and smaller ones from about 4% to over 8%, signalling that while the former still lead, the adoption gap is narrowing as the latter accelerates adoption.

AI works at the edge, but struggles at the core

Despite rising adoption rates among large enterprises, AI doesn’t simply deploy when it enters this environment, with their decades of accumulated systems, compliance layers, governance checkpoints, and cross-functional dependencies. Once in, AI must negotiate with security reviews, procurement cycles, legal assessments, architecture boards, and legacy integration constraints. And while each layer exists for a reason, together, they slow adaptation and dilute impact.

Inside a function, an AI pilot may show promise, but when it attempts to scale, it encounters the operating model. Unclear data ownership, accountability, and decision rights further increase scaling costs. So what worked in a contained environment stalls in aggregation, and the value disappears at scale.

SMBs have their own challenges. They face cash flow constraints, limited staff, and customer risk, but fewer veto points. Furthermore, a founder doesn’t convene a cross-functional steering committee to experiment with AI-assisted quoting or automated follow-ups. Decisions move faster and feedback loops are shorter. Impact is visible quickly because each employee represents a meaningful percentage of total capacity. When a five-person firm automates 20% of its administrative workload, the effect is immediate and measurable.

Simplicity is their structural advantage and with fewer legacy systems, shorter decision paths, and less layered governance, they can adopt SaaS solutions quickly and integrate them with minimal friction. While this doesn’t guarantee better decisions, it increases speed.

The bigger picture

On the flip side, large enterprises have deep integration requirements, formalized governance, and distributed accountability, which reduce operational risk but also slow the conversion of new capabilities into financial outcomes. AI pilots can demonstrate technical feasibility but still fail to move the needle on enterprise economics.

Leadership teams, therefore, face a design choice they often prefer to avoid. As long as AI ROI is framed as a tech problem, it can be delegated to IT, data teams, or innovation labs. But an organizational design problem can’t. AI, after all, amplifies structural friction rather than eliminates it. If decision rights are unclear, AI exposes it. If data governance is weak, AI magnifies it. If incentives are misaligned, AI accelerates the misalignment. Productivity gains at the task level don’t automatically translate into margin expansion at the enterprise level.

This isn’t new. Early internet investments followed a similar pattern where the technology functioned, but the internet rewarded companies that reorganized around it, not those that layered it on top of existing structures.

The evidence today suggests a similar pattern. AI ROI isn’t constrained by model capability but by organizational readiness to absorb and scale change. So the question shouldn’t be where’s the AI ROI since organizations create ROI, not AI. The real question is can we redesign how we work, and decide, govern, and measure performance to capture it. Without that transformation, AI remains a productivity tool at the margins. With it, though, AI becomes a source of durable economic return.

In 2026, enterprise developers are building and deploying the first generation of powerful, increasingly autonomous AI agents at incredible speed. Now comes the hard part: working out how to secure them.

Vendors in the space are facing multiple challenges. To begin with, traditional identity and access management (IAM) tools were never designed to secure anything as complex as agentic AI. In addition, the number of agents, both those sanctioned by the enterprise and the undocumented ‘shadow’ agents created by a new generation of powerful tools that barely existed a year ago, is increasing at unprecedented speed. And now it has started to dawn on organizations that this risks leaving yawning governance and security gaps whose weaknesses could one day return to haunt their creators.

While a growing list of companies, including large cloud platforms such as Okta, Ping Identity, and Microsoft’s Entra ID, is vying to fill the vacuum, a smaller competitor, Sweden’s Curity, argues that agents can’t be secured using traditional IAM. Instead, it is offering a different approach to the problem: This week, it announced Access Intelligence, an extension to its existing API identity and access management (IAM) platform, Identity Server.

The problem it addresses is that traditional IAM tools assume that applications are being accessed by human users or machine identities, governed by a one-time authentication process. But agents, which assume long chains of actions conducted at incredible speed, don’t work like this. Instead, access becomes ephemeral, complex, and non-deterministic, which is to say, hugely unpredictable. Lock them down too much and they stop working; let them run free, and weak security follows in their wake.

Runtime enforcement

Curity’s approach is to treat agents as a special type of application. Like applications, agents call APIs, MCP servers, and each other, and are credentialed using OAuth tokens. Through a feature called Token Intelligence, Curity extends the role of OAuth tokens to not simply permit access, but to carry information on the agent’s purpose and intent. In Curity’s scheme, an agent can only access resources based on that purpose.

Instead of using static, pre-granted permissions, agent access is granted at runtime, on-the-fly. Each requested action generates a separate token that describes the access it needs. When an agent starts a new task, it needs a new token specifying a new set of permissions. If necessary, human authorization can be required when an agent is trying to perform a high-risk action such as transferring funds.

“Curity has always been application-centric,” said Cofounder and CTO Jacob Ideskog. “Our focus has always been on how we broker access.”

Multiple approaches to agent security

Today, agent security falls into one of several camps, which include increasingly inadequate inline approaches such as API gateways and web application firewalls (WAFs), and out-of-band analysis systems that infer intent by analyzing agent behavior against a baseline.

Curity’s Access Intelligence, by contrast, is a self-hosted microservice that acts as a glorified IAM layer through which every agent request must pass. “Because we let an agent do something now doesn’t mean we should be allowing it to do this a minute later,” Ideskog explained.

Access Intelligence also uses Identity Server’s centralized token validation to ensure that developers can fire up agents or APIs without registering them. If they lack this validation, agents are isolated from real-world actions.

Nothing does the whole job

The appearance of systems such as Access Intelligence is good news for enterprises. It indicates that vendors are starting to address the problem of agent security, often by extending existing API security platforms. But that still leaves open the question of which approach to take.

Ideskog believes it would be a mistake to see the different approaches as mutually exclusive. Curity’s Access Intelligence can be used in combination with other layers of agent security, he emphasized. In short, no one solution can do the whole job.

“Up to this point, the IAM industry has focused on the identity part. But the real question is the access. Enterprises are asking their privilege access management (PAM) vendors how they’re going to deal with this [agent security] and I don’t think the PAM vendors have good answers yet,” he said.

This article originally appeared on CSOonline.

In 2026, enterprise developers are building and deploying the first generation of powerful, increasingly autonomous AI agents at incredible speed. Now comes the hard part: working out how to secure them.

Vendors in the space are facing multiple challenges. To begin with, traditional identity and access management (IAM) tools were never designed to secure anything as complex as agentic AI. In addition, the number of agents, both those sanctioned by the enterprise and the undocumented ‘shadow’ agents created by a new generation of powerful tools that barely existed a year ago, is increasing at unprecedented speed. And now it has started to dawn on organizations that this risks leaving yawning governance and security gaps whose weaknesses could one day return to haunt their creators.

While a growing list of companies, including large cloud platforms such as Okta, Ping Identity, and Microsoft’s Entra ID, is vying to fill the vacuum, a smaller competitor, Sweden’s Curity, argues that agents can’t be secured using traditional IAM. Instead, it is offering a different approach to the problem: This week, it announced Access Intelligence, an extension to its existing API identity and access management (IAM) platform, Identity Server.

The problem it addresses is that traditional IAM tools assume that applications are being accessed by human users or machine identities, governed by a one-time authentication process. But agents, which assume long chains of actions conducted at incredible speed, don’t work like this. Instead, access becomes ephemeral, complex, and non-deterministic, which is to say, hugely unpredictable. Lock them down too much and they stop working; let them run free, and weak security follows in their wake.

Runtime enforcement

Curity’s approach is to treat agents as a special type of application. Like applications, agents call APIs, MCP servers, and each other, and are credentialed using OAuth tokens. Through a feature called Token Intelligence, Curity extends the role of OAuth tokens to not simply permit access, but to carry information on the agent’s purpose and intent. In Curity’s scheme, an agent can only access resources based on that purpose.

Instead of using static, pre-granted permissions, agent access is granted at runtime, on-the-fly. Each requested action generates a separate token that describes the access it needs. When an agent starts a new task, it needs a new token specifying a new set of permissions. If necessary, human authorization can be required when an agent is trying to perform a high-risk action such as transferring funds.

“Curity has always been application-centric,” said Cofounder and CTO Jacob Ideskog. “Our focus has always been on how we broker access.”

Multiple approaches to agent security

Today, agent security falls into one of several camps, which include increasingly inadequate inline approaches such as API gateways and web application firewalls (WAFs), and out-of-band analysis systems that infer intent by analyzing agent behavior against a baseline.

Curity’s Access Intelligence, by contrast, is a self-hosted microservice that acts as a glorified IAM layer through which every agent request must pass. “Because we let an agent do something now doesn’t mean we should be allowing it to do this a minute later,” Ideskog explained.

Access Intelligence also uses Identity Server’s centralized token validation to ensure that developers can fire up agents or APIs without registering them. If they lack this validation, agents are isolated from real-world actions.

Nothing does the whole job

The appearance of systems such as Access Intelligence is good news for enterprises. It indicates that vendors are starting to address the problem of agent security, often by extending existing API security platforms. But that still leaves open the question of which approach to take.

Ideskog believes it would be a mistake to see the different approaches as mutually exclusive. Curity’s Access Intelligence can be used in combination with other layers of agent security, he emphasized. In short, no one solution can do the whole job.

“Up to this point, the IAM industry has focused on the identity part. But the real question is the access. Enterprises are asking their privilege access management (PAM) vendors how they’re going to deal with this [agent security] and I don’t think the PAM vendors have good answers yet,” he said.

In 2026, enterprise developers are building and deploying the first generation of powerful, increasingly autonomous AI agents at incredible speed. Now comes the hard part: working out how to secure them.

Vendors in the space are facing multiple challenges. To begin with, traditional identity and access management (IAM) tools were never designed to secure anything as complex as agentic AI. In addition, the number of agents, both those sanctioned by the enterprise and the undocumented ‘shadow’ agents created by a new generation of powerful tools that barely existed a year ago, is increasing at unprecedented speed. And now it has started to dawn on organizations that this risks leaving yawning governance and security gaps whose weaknesses could one day return to haunt their creators.

While a growing list of companies, including large cloud platforms such as Okta, Ping Identity, and Microsoft’s Entra ID, is vying to fill the vacuum, a smaller competitor, Sweden’s Curity, argues that agents can’t be secured using traditional IAM. Instead, it is offering a different approach to the problem: This week, it announced Access Intelligence, an extension to its existing API identity and access management (IAM) platform, Identity Server.

The problem it addresses is that traditional IAM tools assume that applications are being accessed by human users or machine identities, governed by a one-time authentication process. But agents, which assume long chains of actions conducted at incredible speed, don’t work like this. Instead, access becomes ephemeral, complex, and non-deterministic, which is to say, hugely unpredictable. Lock them down too much and they stop working; let them run free, and weak security follows in their wake.

Runtime enforcement

Curity’s approach is to treat agents as a special type of application. Like applications, agents call APIs, MCP servers, and each other, and are credentialed using OAuth tokens. Through a feature called Token Intelligence, Curity extends the role of OAuth tokens to not simply permit access, but to carry information on the agent’s purpose and intent. In Curity’s scheme, an agent can only access resources based on that purpose.

Instead of using static, pre-granted permissions, agent access is granted at runtime, on-the-fly. Each requested action generates a separate token that describes the access it needs. When an agent starts a new task, it needs a new token specifying a new set of permissions. If necessary, human authorization can be required when an agent is trying to perform a high-risk action such as transferring funds.

“Curity has always been application-centric,” said Cofounder and CTO Jacob Ideskog. “Our focus has always been on how we broker access.”

Multiple approaches to agent security

Today, agent security falls into one of several camps, which include increasingly inadequate inline approaches such as API gateways and web application firewalls (WAFs), and out-of-band analysis systems that infer intent by analyzing agent behavior against a baseline.

Curity’s Access Intelligence, by contrast, is a self-hosted microservice that acts as a glorified IAM layer through which every agent request must pass. “Because we let an agent do something now doesn’t mean we should be allowing it to do this a minute later,” Ideskog explained.

Access Intelligence also uses Identity Server’s centralized token validation to ensure that developers can fire up agents or APIs without registering them. If they lack this validation, agents are isolated from real-world actions.

Nothing does the whole job

The appearance of systems such as Access Intelligence is good news for enterprises. It indicates that vendors are starting to address the problem of agent security, often by extending existing API security platforms. But that still leaves open the question of which approach to take.

Ideskog believes it would be a mistake to see the different approaches as mutually exclusive. Curity’s Access Intelligence can be used in combination with other layers of agent security, he emphasized. In short, no one solution can do the whole job.

“Up to this point, the IAM industry has focused on the identity part. But the real question is the access. Enterprises are asking their privilege access management (PAM) vendors how they’re going to deal with this [agent security] and I don’t think the PAM vendors have good answers yet,” he said.

This article originally appeared on CSOonline.

Terraform promised us a better world. Define your infrastructure in code, version it, review it, and deploy it with confidence. For small teams running a handful of services, that promise holds up beautifully.

Then your organization grows. Teams multiply. Modules branch and fork. State files balloon. And suddenly, that clean declarative vision starts looking a lot like a sprawling monolith that nobody fully understands and everyone is afraid to touch.

If you’ve ever watched a Terraform plan run for 20 minutes, encountered a corrupted state file at 2 a.m. or inherited a Terraform codebase where half the resources are undocumented and a quarter are unmanaged, you know exactly what we’re talking about. This is the Terraform scaling problem, and it’s affecting engineering organizations of every size.

The numbers confirm it isn’t a niche concern. The 2023 State of IaC Report found that 90% of cloud users are already using infrastructure-as-code, with Terraform commanding 76% market share according to the CNCF 2024 Annual Survey. Yet the HashiCorp State of Cloud Strategy Survey 2024 showed that 64% of organizations report a shortage of skilled cloud and automation staff, creating a dangerous gap between Terraform’s adoption and the expertise required to operate it well at scale.

In this post, we break down where Terraform breaks down, why traditional solutions fall short, and how AI-assisted IaC management is offering a credible path forward.

The root causes of Terraform complexity at scale

Terraform’s design philosophy is fundamentally sound: Declarative infrastructure, idempotent operations and a provider ecosystem that covers nearly every cloud service imaginable. The problem isn’t the tool; it’s the gap between how Terraform was designed to work and how large engineering organizations actually operate.

State management becomes a full-time job

Terraform’s state file is both its greatest strength and its biggest liability at scale. State gives Terraform the ability to track what it has deployed and calculate diffs — but as infrastructure grows, that state file becomes a critical shared resource with no native support for distributed access patterns.

Teams running a monolithic state end up with a single point of contention. Engineers queue up to run plans and apply. Locking mechanisms in backends like S3 with DynamoDB help, but they don’t solve the underlying architectural issue: Everyone is competing for the same resource.

The HashiCorp State of Cloud Strategy Survey consistently places state management issues, corruption, drift and locking failures among the top pain points for Terraform users in organizations with more than 50 engineers. When a state file gets corrupted mid-apply, recovery can take hours and require deep expertise. The problem compounds as infrastructure grows: Organizations running more than 500 managed resources in a single workspace routinely report 15–30 minute plan times, turning what should be a fast feedback loop into a deployment bottleneck.

Module sprawl and dependency hell

Terraform modules are the right answer to code reuse. They’re also the source of some of the most painful debugging sessions in platform engineering.

As organizations scale, module libraries grow organically. Teams fork modules to meet specific requirements. Version pinning gets inconsistent. A security patch in a root module requires coordinated updates across dozens of dependent modules — a task that sounds simple until you’re dealing with circular dependencies, incompatible provider versions and module registries that weren’t designed for enterprise governance.

Adopting semantic versioning for Terraform modules has a measurable impact: According to a Moldstud IaC case study (June 2025), approximately 60% of organizations that enforce semantic versioning on module releases report a decrease in deployment failures over six months. Yet most teams don’t adopt this practice until after they’ve experienced the failure modes firsthand. The same research found that teams using peer reviews for Terraform code experience a 30% improvement in code quality but this requires process investment that most fast-moving platform teams skip in the early stages.

The pattern is consistent: What starts as a tidy module hierarchy becomes a tangled dependency graph that requires tribal knowledge to navigate.

Plan times and blast radius

At a certain scale, the Terraform plan stops being a quick feedback loop and starts being a liability. Teams managing thousands of resources in a single workspace can wait 15–30 minutes for a plan to complete. More critically, the blast radius of a single application expands proportionally.

A misconfigured security group rule in a small workspace affects a handful of resources. The same mistake in a large monolithic workspace can cascade across hundreds of resources before anyone can intervene. Terraform’s own declarative model means that configuration errors can trigger resource destruction, a risk that grows with workspace size. This reality pushes teams toward increasingly conservative change management processes, which defeats the core value proposition of IaC in the first place.

There’s a meaningful ROI case for solving this. The Moldstud IaC case study indicates that implementing automated IaC solutions can lead to a 70% reduction in deployment times. But capturing that return requires architectural decisions that prevent plan-time bottlenecks before they compound.

Drift: The silent killer

Infrastructure drift — where the actual state of your cloud environment diverges from what Terraform believes it to be — is among the most insidious challenges at scale. It accumulates slowly, through emergency console changes, partially applied runs and resources created outside of Terraform entirely.

The causes are well-documented: An on-call engineer hotfixes a security group at 3 a.m. and forgets to update the code; an autoscaling event modifies a resource configuration that Terraform manages; a third-party integration quietly changes a setting that Terraform has no visibility into. Each of these is a small divergence. Collectively, they erode the reliability of your entire IaC foundation. Terraform Drift Detection Guide documents how teams across industries are consistently caught off guard by drift accumulation in environments they believed were fully under IaC control.

By the time drift becomes visible, it’s often embedded deep enough to make remediation genuinely risky. The DORA 2023 State of DevOps Report found that teams dealing with frequent configuration drift had 2.3× higher change failure rates than teams maintaining consistent IaC hygiene. The compounding effect is significant: Drift erodes confidence in your IaC, which leads to more manual changes, which causes more drift.

Why traditional approaches fall short

The conventional responses to Terraform scaling challenges are well-documented: Workspace decomposition, remote state backends, CI/CD pipelines with policy enforcement and module registries with semantic versioning. These are all necessary practices. They’re also insufficient on their own.

• Workspace decomposition reduces blast radius but multiplies operational overhead. You’re trading one large problem for many smaller ones, each requiring its own state management, access controls and pipeline configuration. Managing 200 workspaces is a full-time engineering effort.
• CI/CD enforcement catches policy violations after the fact. By the time a plan hits your pipeline, an engineer has already spent time writing code that may get rejected. Feedback loops are slow, and the root cause — the complexity of authoring correct IaC at scale — remains unsolved.
• Manual code reviews don’t scale. Platform teams can become bottlenecks when every Terraform change requires expert review to validate correctness, security posture and compliance. The cognitive load required to review infrastructure changes accurately is substantial, and reviewers burn out. This bottleneck is only sharpened by the talent shortage: With 64% of organizations reporting a shortage of skilled cloud and automation staff, the supply of qualified reviewers isn’t growing fast enough to match Terraform’s adoption curve.

The honest assessment: These solutions manage Terraform complexity rather than resolving it. They require ongoing investment in tooling, process and expertise that many organizations struggle to maintain.

This is exactly the friction that StackGen’s Intent-to-Infrastructure Platform was designed to address. Rather than adding more manual process overhead, it introduces an intelligent layer that helps teams author, validate and govern Terraform configurations from the point of intent before complexity accumulates.

Emerging solutions: Where the industry is moving

The Terraform ecosystem is evolving rapidly in response to these challenges. The global IaC market reflects this urgency: Valued at $847 million in 2023, it’s projected to reach $3.76 billion by 2030 at a 24.4% compound annual growth rate, according to Grand View Research’s IaC Market Report. That growth isn’t just adoption — it’s investment in solving the complexity problems that widespread adoption creates.

Workspace automation and orchestration

Tools like Atlantis, Stackgen, Terraform Cloud, are moving toward intelligent workspace orchestration, automatically managing dependencies between workspaces, ordering applies correctly and providing better visibility into cross-workspace impact. This reduces the manual coordination overhead that plagues large-scale Terraform operations.

The key shift is treating your collection of workspaces as a managed system rather than a set of independent units. When a shared networking module changes, an orchestration layer should automatically identify affected workspaces, calculate the propagation order and manage the apply sequence — rather than requiring a human to track and coordinate each dependency manually.

Policy-as-code with earlier enforcement

Open Policy Agent (OPA) and HashiCorp Sentinel have matured significantly. More importantly, teams are learning to push policy enforcement left — validating Terraform plans against organizational policies before they hit a CI/CD pipeline, and ideally before they’re even submitted for review.

HashiCorp has reported that teams using Sentinel with pre-plan validation see a 45% reduction in policy violation-related build failures compared to teams running post-plan enforcement only. Earlier feedback means faster iteration and lower engineer frustration.

AI-assisted IaC management: The emerging frontier

This is where the most significant innovation is happening. AI-assisted infrastructure management addresses the problems that automation alone can’t solve: The cognitive complexity of understanding large IaC codebases, identifying drift patterns before they become critical and translating high-level intent into correct, compliant Terraform code.

Platforms like StackGen’s Intent-to-Infrastructure Platform represent a new paradigm here. Rather than requiring platform engineers to manually author and review every Terraform resource definition, StackGen interprets infrastructure intent — expressed in natural language or high-level policy- and generates compliant Terraform configurations, validates them against organizational standards and surfaces potential issues before they reach production. This directly addresses the bottleneck where expert review becomes a constraint on velocity.

The practical applications are concrete:

• Drift detection and remediation: AI models trained on infrastructure patterns can identify anomalous drift, distinguishing between expected configuration changes and unauthorized modifications, and surface remediation recommendations with context about impact and risk. This is particularly powerful for teams managing hundreds of workspaces where manual drift monitoring isn’t practical.
• Intelligent module recommendations: Rather than requiring engineers to navigate sprawling module registries manually, AI-assisted tooling can analyse an infrastructure request, identify the most appropriate existing modules and flag where new module development is needed. This reduces the “reinvent the wheel” pattern that causes module sprawl.
• Natural language to IaC: For platform teams managing self-service infrastructure portals, AI translation layers allow development teams to request infrastructure in natural language and receive validated Terraform configurations that conform to organizational standards — without requiring deep Terraform expertise from every team consuming platform services.
• Proactive complexity warnings: AI analysis of Terraform codebases can identify emerging complexity patterns before they become critical — detecting circular dependencies forming, state files approaching problematic size thresholds or module versioning patterns that suggest future compatibility issues.

Gartner predicts that by 2026, more than 40% of organizations will be using AI-augmented IaC tooling for some portion of their infrastructure management workflow — up from under 10% in 2023. The trajectory is clear, and the window for early-mover advantage is still open.

Practical guidance: Scaling terraform without losing your mind

While AI-assisted tooling continues to mature, there are concrete architectural and process changes your team can adopt today.

• Decompose by domain, not by team. Workspace boundaries should reflect infrastructure domains (networking, compute, data) rather than organizational team boundaries. Teams change; infrastructure domains are more stable. This reduces the reorganization tax you pay when teams restructure.
• Treat state as infrastructure. Your state backend deserves the same reliability engineering as production systems. Remote state with versioning, automated backup verification and clear recovery runbooks should be non-negotiable before you’re managing more than a few dozen resources. The HashiCorp State of Cloud Strategy Survey shows that over 80% of enterprises already integrate IaC into their CI/CD pipelines — but pipeline integration doesn’t substitute for state backend reliability.
• Invest in a private module registry early. Whether you use Terraform Cloud’s built-in registry, a self-hosted solution or a structured module registry with enforced semantic versioning pays compounding dividends as your module library grows. The cost of retrofitting governance onto an ungoverned module library is significantly higher than building in governance from the start.
• Automate drift detection, not just drift remediation. Drift remediation is expensive; drift detection is cheap. Scheduled Terraform plan runs in CI/CD, combined with alerting on detected drift, give you an early warning system that prevents drift from compounding silently. For teams managing large environments where manual detection becomes impractical, automated drift tooling, whether native to HCP Terraform or third-party solutions, becomes essential infrastructure in its own right.
• Build a paved road for Terraform consumers. If every application team needs to become a Terraform expert to consume platform services, your platform won’t scale. Build opinionated, simplified interfaces, whether that’s a service catalogue, a self-service portal or an AI-assisted request layer that allows development teams to get the infrastructure they need without requiring deep IaC expertise.

The strategic inflection point

We’re at an inflection point in how the industry thinks about infrastructure-as-code. The original vision of IaC infrastructure defined, versioned and managed like software was correct. The execution, for large-scale organizations, has accumulated significant complexity debt.

The next wave of IaC tooling isn’t about replacing Terraform. Terraform’s declarative model, provider ecosystem and community are genuine strengths that won’t be supplanted quickly. The opportunity is in the layer above Terraform: Intelligent orchestration, AI-assisted authoring, proactive complexity management and intent-driven infrastructure interfaces that make IaC accessible to the full organization rather than just a specialized subset of platform engineers.

Teams that invest in this layer now, whether through emerging platforms, internal tooling or AI-assisted workflows, will build a meaningful operational advantage. Teams that continue fighting Terraform complexity with more Terraform will find themselves spending an increasing proportion of engineering capacity on infrastructure maintenance rather than product development.

The IaC market’s 24.4% CAGR reflects growing awareness that the tools and processes managing this complexity need to evolve as fast as the infrastructure they govern.

Key takeaways

The Terraform scaling problem is real, but it’s solvable. The path forward involves three parallel tracks: Architectural decisions that manage blast radius and reduce state contention; process investments in policy-as-code and module governance; and tooling that uses AI to address the cognitive complexity that has always been the hardest part of IaC at scale.

Your infrastructure code should accelerate your engineering organization, not constrain it. If it’s doing the latter, the problem isn’t your engineers; it’s the layer of tooling and process sitting between intent and deployed infrastructure.

Ready to explore how AI-assisted IaC management can reduce the complexity overhead in your Terraform workflows?

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

지난 1년 사이 AI를 둘러싼 논의는 크게 달라졌다. 많은 기업이 파일럿 단계를 넘어 실제 운영 환경에 AI를 도입하는 단계로 이동했다. 그러나 AI가 실제로 어디에서, 어떤 방식으로 가치를 창출하고 있는지는 대다수 AI 도입 기업이 밝히는 것보다 훨씬 복잡하다. 현재 우리가 마주한 AI 도입의 모습은 ‘도입했다’ 혹은 ‘도입하지 않았다’로 나뉘는 이분법이 아니라, 조직 곳곳에 파편화된 양상에 가깝다.

대부분의 프로그램은 경영진 차원의 야심 찬 전략, 중간 단계의 불균등한 배포, 현장에서의 일관성 없는 성과라는 구조로 설명할 수 있다. 특히 사람을 중심으로 운영되는 HR 영역에서 이러한 불균형은 단순한 기술 문제가 아니다. 이는 결국 사람의 문제로 귀결된다.

말과 행동의 격차

이사회에서는 AI를 둘러싼 논의가 ‘도입할 것인가’에서 ‘얼마나 빠르게 도입할 것인가’로 옮겨갔다. 그러나 최근 연구는 뚜렷한 성숙도 격차를 보여준다. 미국의 HR 전문 미디어 HR 이그제큐티브 조사 결과에 따르면 HR 테크 리더의 88%가 AI 이니셔티브에서 유의미한 투자 대비 수익(ROI)을 거두지 못했다고 응답했다. 도입 지표는 긍정적이지만, 실제 구현이 아직 측정 가능한 비즈니스 성과로 이어지지 못하고 있음을 시사한다.

EY의 글로벌 조사에서도 유사한 결과가 나타났다. 직원 10명 중 약 9명이 업무에서 AI 도구를 사용하고 있지만, 이를 고부가가치 성과로 전환한 조직은 약 28%에 그쳤다.

이는 HR 조직이 AI 도구를 배포하는 데는 성공했지만, 채용 효율성, 인재 유지, 인력 계획과 같은 핵심 지표를 변화시킬 만큼 통합적인 프로세스 전환에는 아직 이르지 못했음을 의미한다. 이러한 괴리는 정렬된 운영 모델이나 성과 측정 체계 없이 빠르게 실험을 반복하는 기업 전반의 흐름과도 맞닿아 있다.

섀도 AI, 기업 전반 과제가 드러난 단면

통제된 AI 도입을 가로막는 가장 지속적인 장애물 중 하나는 섀도 AI다. 이스라엘 보안 기업 XM사이버의 조사에 따르면 기업의 80%가 업무 환경에서 섀도 AI 사용을 경험하고 있다. 특히 HR은 민감한 직원 데이터를 보안이 취약한 플랫폼에 노출할 가능성이 높은 부서로 지목된다. IBM에 따르면 AI를 관리하거나 섀도 AI를 탐지하기 위한 정책을 갖춘 기업은 37%에 불과하다.

HR에서 섀도 AI는 여러 형태로 나타난다.
• 채용 담당자가 공개 생성형 AI를 활용해 채용 공고를 수정하거나 이력서를 선별하는 경우
• 관리자가 빠른 인사이트를 얻기 위해 직원 성과 데이터를 별도의 통제되지 않은 도구에 입력하는 경우
• 팀이 컴플라이언스 검증 없이 AI 어시스턴트를 실험적으로 도입해 직원 문의를 처리하는 사례 등이 대표적이다.

섀도 AI가 본질적으로 악의적인 것은 아니다. 맹목적 신뢰가 아니라 인간의 검토를 전제로 한다면 일부 활용은 문제가 되지 않을 수 있다. 그러나 이는 공식 역량을 넘어선 현장의 수요를 보여주는 신호이기도 하다. 동시에 그에 따른 위험도 분명히 존재한다.

승인되지 않은 사용은 데이터 유출, 규정 위반, 비윤리적 의사결정으로 이어질 수 있다. 특히 공정성이 핵심 가치로 작용하는 인재 채용 분야에서는 이러한 문제가 더욱 두드러질 수 있다.

진짜 병목은 ‘변화 관리’다

2025년 들어 또 하나 분명해진 흐름은 AI 도입 속도가 교육을 앞지르고 있다는 점이다. 여러 조사에 따르면 HR 전문가 사이에서 AI 활용은 빠르게 확산되고 있다. 최근 한 조사에서는 활용 비율이 70%를 넘어선 것으로 나타났다. 그러나 실제로 직무에 특화된 AI 활용 교육을 받은 인원은 그중 일부에 그친다.

이와 관련해 워크데이(Workday)는 비교적 두드러진 사례로 꼽힌다. 워크데이는 일회성 교육이 아니라 직무에 맞춘 다단계 학습 여정에 집중 투자했다. 그 결과 직원의 약 80%가 AI 도구를 활용하도록 이끌었다고 포춘은 전했다.

이 대목은 CIO에게 중요한 시사점을 던진다. 병목은 AI 기술 자체가 아니다. 사람의 준비도다. 단계별 역량 개발과 역할별 맞춤 지원에 선제적으로 투자한 조직은, AI를 또 하나의 소프트웨어 도입 프로젝트로 취급한 조직보다 훨씬 큰 효과를 만들어내고 있다.

교육을 넘어 조직 문화의 뒷받침도 핵심 요소다. PwC의 글로벌 조사에 따르면 AI에 대한 신뢰, 명확한 방향성, 조직 구성원 간 인식 정렬이 확보될 때 도입은 지속된다. 반대로 이러한 기반이 부족하면 도입은 정체된다. 이러한 변화는 위에서 아래로, 경영진의 의지에서 출발한다.

기술 융합형 HR 직무의 부상

긍정적인 진화이자 동시에 불균형한 도입의 단면을 보여주는 변화도 나타나고 있다. HR 내부에 기술 융합형 직무가 새롭게 등장하고 있다는 점이다. 피플 애널리틱스 엔지니어, HR AI 프로덕트 매니저, 인재 테크놀로지 리드와 같은 직함이 점점 보편화되고 있다. 전통적 HR과 현대적 기술 역량 사이의 간극을 메우려는 조직의 시도가 반영된 결과다.

조직이 실험 단계를 넘어가면서, 범용 데이터 사이언스 팀이나 기존 HR 직무만으로는 AI 기반 시스템을 온전히 책임지기 어렵다는 사실을 인식하고 있다. 이제는 HR 도메인에 대한 깊은 이해와 기술적 숙련도가 동시에 요구된다. 이러한 역할은 인간의 판단과 기계 지능이 만나는 지점에 자리한다. AI가 도출한 결과를 리더가 신뢰하고 실행할 수 있는 의사결정으로 전환하는 가교 역할을 수행한다.

여기서 얻을 수 있는 중요한 교훈은 분명하다. 효과적인 AI 도입은 단순히 기술을 배포하는 데 그치지 않는다. 이를 책임감 있게, 그리고 대규모로 운영할 수 있는 새로운 전문성을 조직 안에서 발굴하고 체계화하는 데 달려 있다.

HR 리더를 위한 AI 도입 핵심 시사점

HR 영역에서의 AI 도입은 활용 사례가 비교적 명확하고 데이터도 풍부하며, ROI를 창출할 수 있는 지점 또한 분명하다. 그럼에도 불구하고 도입 수준은 여전히 고르지 않다. 이는 유사한 과제가 산업 전반에 걸쳐 존재한다는 신호이기도 하다. AI를 도입하는 기업 전반에 적용할 수 있는 시사점은 다음과 같다.

• 거버넌스는 통제와 속도의 균형을 맞춰야 한다. 섀도 AI는 충족되지 않은 현장 수요와 빠른 기술 혁신이 결합된 결과다. 거버넌스 프레임워크는 단순히 도구 사용을 제한하는 데 그쳐서는 안 된다. 안전한 실험을 가능하게 하면서도 리스크를 관리할 수 있어야 한다.

• 기술 선택보다 변화 관리가 더 중요하다. 문제의 근본 원인은 대개 도구 자체가 아니다. 사람의 학습, 프로세스 재설계, 명확한 보상 체계에 대한 투자가 가장 진보한 모델을 좇는 것보다 훨씬 큰 가치를 만들어낸다.

• 역할은 진화해야 한다. 전통적인 조직도는 인간의 복잡성과 알고리즘 논리를 동시에 이해하는 융합형 인재를 충분히 반영하지 못한다. 이러한 역량을 신속히 발굴하고 채용하며 육성하는 일이 경쟁력을 유지하는 핵심 요소다.

HR에서의 AI는 일의 미래를 실제로 바꾸고 있다. 그러나 그 영향은 조직이나 활용 사례에 따라 균등하게 나타나지 않는다. 장기적으로 경쟁에서 앞설 기업은 전략적이고 책임 있는 AI 프로그램을 실행할 수 있는 역량과 조직 문화, 그리고 거버넌스 체계를 갖춘 곳이 될 것이다.
dl-ciokorea@foundryco.com

AI conversation has shifted dramatically over the last year. In many cases, we’ve moved from AI pilots to AI that is really here in production. But how and where its truly driving value is far more complex than most AI-enabled businesses let on. Today, we face an AI adoption picture that’s not binary (did we or didn’t we), but fragmented.  

Most programs can be defined by ambitious strategy at the top, patchy deployment in the middle and inconsistent impact on the ground. In HR, where jobs revolve around people, this uneven adoption isn’t just a technical issue. It’s a people problem.  

The ‘say-do’ gap 

In boardrooms, the language around AI has shifted from if to how fast. But recent research reveals a stark maturity gap. In a 2025 industry roundup, 88% of HR tech leaders reported no significant ROI from their AI initiatives, despite positive adoption indicators — a sign that implementation isn’t delivering measurable business results yet. 

Similarly, a global workforce survey from EY found that while roughly nine out of ten employees use AI tools at work, only about 28% of organizations translated those deployments into high-value outcomes. 

What this tells us is that while HR organizations may deploy AI tools, they’re not yet achieving the integrated process change necessary to shift key outcomes such as talent acquisition efficiency, retention or workforce planning. This disconnect mirrors broader enterprise patterns that include rapid experimentation without aligned operating models or measurement frameworks. 

Shadow AI: The manifestation of a broader enterprise challenge 

One of the most persistent barriers to controlled adoption is shadow AI. Research shows that 80% of companies experience the use of shadow AI at work, with HR among the functions most likely to expose sensitive employee data to insecure platforms. According to IBM, only 37% have policies to manage AI or detect shadow AI.  

In HR, this can take shape in several ways: 

• Recruiters using public generative AI to rewrite job descriptions or screen resumes 

• Managers inputting employee performance data into ungoverned tools for quick insights 

• Teams experimenting with AI assistants to manage employee questions without compliance vetting. 

Shadow AI isn’t inherently malicious, and in many scenarios, its use (when paired with human scrutiny, not blind trust) is fine. It is, however, an indicator of a demand outpacing formal capability, and the risk is real.  

Unauthorized use opens the door to data leakage, compliance violations and unethical decision-making. This can be especially apparent in functions like talent acquisition, where fairness is deeply important.  

The real bottleneck: Change management 

Another clear pattern emerged in 2025: AI adoption is outpacing training. Multiple sources show that while adoption among HR professionals is rising (surpassing 70%, according to a recent survey), only a fraction have received job-specific training on how to use AI effectively. 

Our partner, Workday, has been one of the rare companies to excel in this area. HR leaders succeeded in getting nearly 80% of employees to use AI tools by investing deeply in tailored, multi-stage learning journeys rather than one-off sessions (Fortune).  

This insight is critical for CIOs. AI isn’t the bottleneck; human preparedness is. Organizations that invest upfront in layered skills development and role-specific support create far more impact than those that treat AI like another software rollout. 

Beyond training, cultural support matters deeply. A global PwC survey underscored that trust, clarity and workforce alignment around AI shape whether adoption sticks or stalls. This comes from the top down.  

The rise of technical HR roles 

A positive evolution, yet also a sign of uneven adoption, is the emergence of hybrid technical titles within HR. Titles like People Analytics Engineer, HR AI Product Manager and Talent Technology Lead are becoming more common. It’s a sign of the times,  as organizations try to bridge the gap between traditional and modern HR. 

As organizations move beyond experimentation, they’re realizing that neither generic data science teams nor traditional HR roles can fully own AI-enabled systems. Deep HR domain knowledge and technical fluency are now critical. These roles sit at the intersection of human judgment and machine intelligence, translating AI outputs into decisions leaders can trust and act on.  

The important lesson here is that effective AI adoption isn’t just about deploying the technology itself, but surfacing new kinds of expertise that can operationalize it responsibly and at scale. 

Key AI takeaways for HR leaders  

AI adoption is uneven in HR, even where use cases are well-defined, data is rich and ROI levers are clear. This is a sign that similar challenges exist across industries. Here are several takeaways that span across enterprises adopting AI:   

• Governance needs to balance control with speed. Shadow AI is a product of unmet need and rapid innovation. Governance frameworks must enable safe experimentation, not just restrict tools. 

• Change management trumps technology choice. The tools themselves are rarely the root of the problem. Investing in human learning, process redesign, and clear incentives leads to far more value than chasing the most advanced models. 

• Roles must evolve. Traditional org charts don’t account for hybrid thinkers who can navigate human complexity and algorithmic logic. Identifying, recruiting and developing those skills (and fast) is essential to stay competitive.  

AI in HR is shaping the future of work in real ways. But that impact isn’t evenly distributed across organizations or use cases. The companies that will win in the long run are those that built capability, culture and governance frameworks to deploy strategic, responsible AI programs.  

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Over the next few years, agentic AI is expected to bring not only rapid technological breakthroughs, but a societal transformation, redefining how we live, work and interact with the world. And this shift is happening quickly. “By 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, enabling 15% of day-to-day work decisions to be made autonomously,” according to research firm Gartner.

Unlike traditional AI, which typically follows preset rules or algorithms, agentic AI adapts to new situations, learns from experiences, and operates independently to pursue goals without human intervention. In short, agentic AI empowers systems to act autonomously, making decisions and executing tasks — even communicating directly with other AI agents — with little or no human involvement.

Agentic AI will enable machines to interact with the physical world with unprecedented intelligence, allowing them to perform complex tasks in dynamic environments, which could be especially useful for industries facing labor shortages or hazardous conditions.However, the rise of agentic AI also brings security and ethical concerns. Ensuring these autonomous systems operate safely, transparently and responsibly will require governance frameworks and testing.

Follow this page for ongoing agentic AI coverage from Computerworld and Foundry’s other publications.

Agentic AI news and insights

Cisco goes all in on agentic AI security

March 26, 2026: Cisco is rolling out identity and access management capabilities, a toolkit customers can use to embed security controls in AI agents, and automation features that will allow security operations teams to quickly see and respond to problems.

AI agents still need humans to teach them

February 20, 2026: AI agents need skills — specific procedural knowledge — to perform tasks well, but they can’t teach themselves, a new research suggests.

Why most agentic AI projects stall before they scale

February 18, 2026: As enterprises race from pilots to autonomous systems, rising costs, fragile governance, and unrealistic expectations are forcing a reckoning. So what separates agentic AI initiatives that survive from those that quietly shut down?

How agentic AI helps prospective and existing students at DeVry

February 18, 2026: DeVry is no stranger to AI. It’s used the technology in its classrooms for 10 years and started experimenting with NLP bots and gen AI use cases for internal use as soon as it became widely available. So in April 2025, Devry University deployed its first AI agent.

Task management software gets an agentic boost

February 11, 2026: Task management apps aren’t just for storing and tracking data — they act on it. Explore tools that tap AI to auto-generate workflows, balance team capacity, and eliminate administrative overhead.

OpenClaw: The AI agent that’s got humans taking orders from bots

February 6, 2026: How one man’s vibe-coding session evolved into a reckless global AI experiment where nobody’s accountable.

Forward Networks launches agentic AI system built on network digital twin

January 30, 2026: The new Forward AI capability builds on the vendor’s digital twin and is designed to allow network teams to ask complex questions, understand network behavior, validate outcomes and safely automate workflows.

Agentic AI exposes what we’re doing wrong

January 23, 2026: Agentic AI has changed cloud computing, but not in the way the hype machine wants you to believe. It hasn’t magically replaced engineering, nor has it made architecture irrelevant. 

How to get your enterprise architecture ready for agentic AI

January 22, 2026: While C-suite leaders say they’re investing in agentic AI, the complex enterprise architectures of large organizations often struggle with the tech’s demands.

IBM targets agentic AI scale-up with new Enterprise Advantage consulting service

January 20, 2026: IBM has launched a new consulting service named Enterprise Advantage, designed to help CIOs take their agentic and other AI applications from experimentation to large-scale production.

EY exec: If you think agentic AI is a challenge, you’re not ready for what’s coming

January 15, 2026: Companies struggling to keep up with the arrival of AI agents should buckle up: Even more complicated agentic AI technologies are quickly coming down the pike. That includes physical AI, which includes robots and quantum computing.

Managing agentic AI risk: Lessons from the OWASP Top 10

December 19, 2025: LLM-powered chatbots have risks that we see playing out in the headlines on a nearly daily basis. But chatbots are limited to answering questions. AI agents, however, access data and tools and carry out tasks, making them infinitely more capable – and more dangerous to enterprises.

Agentic AI in 2026: More mixed than mainstream

December 18, 2025: Agentic AI is having its everything, everywhere, all at once moment. Or is it? Data clarifies. While 39% of organizations surveyed by McKinsey say they are experimenting with agents, only 23% have begun scaling AI agents within one business function

Overcome governance and trust issues to drive agentic AI

December 18, 2025: Fully autonomous agentic AI is still way off but AI agents are making inroads within enterprise software and workflows. Gartner predicts 40% of enterprise software will feature task-specific AI agents by the end of 2026 as the current trend for embedded AI assistants evolves.

Nvidia bets on open infrastructure for the agentic AI era with Nemotron 3

Decenber 15, 2025: AI agents must be able to cooperate, coordinate, and execute across large contexts and long time periods, and this, says Nvidia, demands a new type of infrastructure, one that is open. The company says it has the answer with its new Nemotron 3 family of open models.

Microsoft drops M365 Copilot price for SMBs, upgrades free Copilot Chat

November 19, 2025: Microsoft announced that it reduce the price of Microsoft 365 Copilot for small and mid-sized firms beginning next month. Microsoft 365 Copilot for Business will cost $21 per user, per month for customers with any Microsoft 365 Business plan. That’s down from the current $30 monthly price.

Microsoft Fabric IQ adds ‘semantic intelligence’ layer to Fabric

November 19, 2025: Microsoft promises enterprises better understanding of their data for workers and autonomous agents alike, but analysts fear deployment hurdles and vendor lock-in.

Microsoft unveils Agent 365 to help IT manage AI ‘agent sprawl’

November 18, 2025: As businesses begin deploying AI agents in greater numbers, IT teams will need to manage and secure those AI systems as they connect to corporate data. That’s the idea behind Microsoft’s Agent 365 (A365), a new “control plane” that lets customers deploy and govern the use of agents. 

From chatbots to colleagues: How agentic AI is redefining enterprise automation

November 17, 2025: A new wave of agentic AI is taking shape: systems that not only converse but also reason, plan, and act within enterprise workflows. These agents are not assistants that talk; they are digital colleagues that think.

The enterprise IT overhaul: Architecting your stack for the agentic AI era

November 10, 2025: For the CIO, the conversation has officially moved past the large language model (LLM). The next critical chapter is agentic AI — autonomous systems capable of reasoning, planning and executing multi-step tasks across your enterprise. Agentic AI is here. Now, CIOs must orchestrate

October 23, 2025: Agentic AI is about to change how companies create value. Yet, most enterprises aren’t ready. The problem isn’t the technology — it’s the planning and execution. Too many pilots stall out because CIOs haven’t built the AI systems, guardrails and culture to move beyond experiments.

AI agents might smooth some of retail’s worst data problems

October 21, 2025: So many retail challenges hinge on unreliable product data. Can agentic AI clean up that data enough to make a difference? Can it do the same for other verticals?

The impact of agentic AI on SaaS and partner ecosystems

October 16, 2025: The enterprise technology landscape is entering a critical pivot point as agentic AI transforms partner ecosystems from human-mediated, application integration networks into autonomous, self-orchestrating and intelligent ecosystems.

Salesforce updates its agentic AI pitch with Agentforce 360

October 13 2025: Salesforce announced a new release of Agentforce that, it says, “gives teams the fastest path from AI prototypes to production-scale agents” — although with many of the new release’s features still to come, or yet to enter pilot phases or beta testing, some parts of that path will be much slower than others.

Gemini Enterprise is Google’s new ‘front door’ for agentic AI access at work

October 9, 2025: Google introduced an AI assistant to serve as a platform so users can access and coordinate AI agents that automate work tasks. Gemini Enterprise, which replaces the Agentspace app launched last year, also features new enterprise search functions to help customers tap into data from across an organization’s business apps. 

Oracle’s agentic AI push in Fusion Cloud CX offers embedded automation for CX leaders

October 7, 2025: Oracle is adding new pre-built agents to its Advertising and Customer Experience Cloud (Fusion Cloud CX) to help enterprises increase operational efficiency by automating sales, service, and marketing processes.

IBM touts agentic AI orchestration, cryptographic risk controls

October 7, 2025: IBM watsonx Orchestrate offers more than 500 tools and customizable, domain-specific agents from IBM and third-party contributors. Among the additions to watsonx Orchestrate are AgentOps capabilities that offer real-time monitoring and policy-based controls for observability and governance.

How self-learning AI agents will reshape operational workflows

October 6, 2025: Google’s recent whitepaper, “Welcome to the Era of Experience,” signals a shift in the way AI agents are trained. Google hypothesizes that allowing AI agents to learn from the experience of agents rather than solely from human-generated training data will enable autonomous AI to surpass its current capabilities.

Are your agentic AI projects driving toward success?

October 3, 2025: Anushree Verma, Gartner senior director analyst, says most agentic AI projects today are early-stage experiments or proofs of concept, fueled primarily by hype and often misapplied.

Microsoft unveils framework for building agentic AI apps

October 3. 2025: Microsoft has introduced the Microsoft Agent Framework, an open-source SDK and runtime for building, orchestrating, and deploying AI agents and multi-agent workflows, with full framework support for .NET and Python.

Salesforce Trusted AI Foundation seeks to power the agentic enterprise

October 2, 2025: As Salesforce pushes further into agentic AI, its aim is to evolve Salesforce Platform from an application for building AI to a foundational operating system for enterprise AI ecosystems. 

ServiceNow’s AI Experience is an agentic AI UI for the Now Platform

September 30, 2025: ServiceNow today launched the AI Experience (AIx), a contextually aware multimodal AI-driven use UI for its Now platform. Building on the ServiceNow AI Platform and with a foundation in Now Assist, the company describes it as “a unified, conversational front door to enterprise AI.”

How MCP is making AI agents actually do things in the real world

September 29, 2025: You’ve seen them: Those incredible large language models (LLMs) that can chat, write and even generate code. They’ve revolutionized how we interact with technology, but there’s a new, even more exciting chapter unfolding. Discover how MCP is turning chatbots into doers, and the future of work may never look the same.

Agentic AI in IT security: Where expectations meet reality

September 29, 2025: Agentic AI has shifted from lab demos to real-world SOC deployments. Unlike traditional automation scripts, software agents are designed to act on signals and execute security workflows intelligently, correlating logs, enriching alerts, and even take first-line containment actions.

Walmart looks to cash in on agentic AI

September 19, 2025: Walmart doesn’t intend to lose its retail crown anytime soon. And, according to US EVP and CTO Hari Vasudev, the $815B company’s artificial intelligence strategy will play a key role in preventing that from happening.

5 steps for deploying agentic AI red teaming

September 17, 2025: As more enterprises deploy agentic AI applications, the potential attack surface increases in complexity and reach. But there is still hope that AI agents can be harnessed for defensive purposes too, including using traditional red teaming and penetration testing techniques but updated for the AI world.

Google unveils payments protocol for AI agents with major financial firms

September 17. 2025: Google has introduced the Agent Payments Protocol (AP2), an open framework developed with more than 60 payments and technology companies to support secure, agent-led transactions across platforms and payment methods.

CrowdStrike bets big on agentic AI with new offerings after $290M Onum buy

September 16, 2025: At its Fal.Con conference, the cybersecurity giant launched its Agentic Security Platform and Agentic Security Workforce, aiming to outpace AI-driven adversaries with real-time intelligence, automation, and a common language for defense.

Adobe makes Agent Orchestrator and AI agents generally available

September 10, 2025: Adobe Experience Platform (AEP) Agent Orchestrator and six new AI agents are designed to build, deliver, and optimize customer experience and marketing campaigns. The company also announced Experience Platform Agent Composer for customizing and configuring AI agents based on brand guidelines and organizational policy.

Rethinking the IT organization for the agentic AI era

September 2, 2025: With the advent of agentic AI, CIOs must be poised to adjust strategic IT priorities, mitigate new security risks, and reskill staff for a new era.

How to build a production-grade agentic AI platform

September 2, 2025: Modular orchestration, fail-safe design, hybrid memory management, and LLM integration with domain knowledge are essential to agentic AI systems that reason, act, and adapt at scale.

Agentic AI: A CISO’s security nightmare in the making?

September 2, 2025: Enterprises will no doubt be using agentic AI for a growing number of workflows and processes, including software development, customer support automation, and more. But what are the cybersecurity risks of agentic AI, and how much more work will it take for them to support their organizations’ agentic AI dreams?

Microsoft researchers develop new tech for video AI agents

September 2, 2025: Microsoft researchers are developing technologies for a new class of video AI agents to explore three-dimensional spaces before making decisions.The technology framework, called MindJourney, uses a range of AI technologies to understand and analyze 3D spaces, reason about the surroundings, and predict movement

Salesforce AI Research unveils new tools for AI agents

August 27, 2025: Salesforce announced a simulated enterprise environment, benchmark, and account data unification tool that are designed to help customers transform into agentic AI enterprises.

Agentic AI promises a cybersecurity revolution — with asterisks

August 18, 2025: The hottest topic at this year’s Black Hat conference was the meteoric emergence of AI tools for both cyber adversaries and defenders, particularly the use of agentic AI to strengthen cybersecurity programs.

4 thoughts on who should manage AI agents

August 11, 2025: As AI agents proliferate, we need to turn our attention beyond AI agent builder platforms to AI orchestration and AI GRC platforms. It also raises questions about which groups within the enterprise should manage AI agents and how they should be treated.

How bright are AI agents? Not very, recent reports suggest

July 31, 2025: Security researchers are adding more weight to a truth that infosec pros had already grasped: AI agents are not very bright, and are easily tricked into doing stupid or dangerous things

Will AI agents eat the SaaS market? Experts are split

July 31,2025: As hype about AI agents reaches new heights, an emerging theory suggests that the groundbreaking AI tools will kill the SaaS business model. The claim isn’t particularly new, but is resurfacing, with people like Microsoft CEO Satya Nadella voicing this position. 

How agentic AI will change database management

July 28, 2025: Generative AI has already had a profound impact on the world of database management. And now, thanks to AI’s knack for pattern-recognition, teams can use generative AI to analyze data sets, detect anomalies, and access invaluable insights with record speed and precision. 

As AI agents go mainstream, companies lean into confidential computing for data security

July 21, 2025: Companies need to stop ignoring data security as AI agents take over internal data movement in IT environments, analysts and IT execs warn. To address that issue, some tech players are embracing the concept of “confidential computing.” While it’s existed for years, it;s now finding new life with the rise of genAI.

How agentic AI will transform mobile apps and field operations

July 15, 2015: Agentic AI will usher in new mobile AI experiences. Construction, manufacturing, healthcare, and other industries with significant field operations will benefit from mobile AI agents and the resulting operational agility. 

MCP is fueling agentic AI — and introducing new security risks

July 10, 2025: Model Context Protocol (MCP) has caught fire, with several thousand MCP servers now available from a wide range of vendors enabling AI assistants to connect to their data and services. And with agentic AI increasingly seen as the future of IT, MCP will only grow in use in the enterprise. But innovations like MCP also come with significant security risks.

3 industries where agentic AI is poised to make its mark

July 4, 2024:  IT leaders from finance, retail, and healthcare lend insights into what organizations are doing with AI agents today — and where they see the technology taking their organizations and industries in the future.

IFS rolls TheLoops agentic AI into industrial ERP

June 27, 2025: IFS is adding AI agent development and management capabilities to its ERP platform with the acquisition of software startup The acquisition brings TheLoops’ full Agent Development life cycle (ADLC) platform into IFS, enabling enterprises to design, test, deploy, monitor, and fine-tune AI agents with built-in support for versioning, compliance, and performance optimization.

How AI agents and agentic AI differ from each other

June 12, 2025: With agentic AI in its infancy and organizations rushing to adopt AI agents, there seems to be confusion about the difference between “agentic AI” and “AI agents” technologies, but experts say there’s growing understanding that the two are separate, but related, tools.

The future of RPA ties to AI agents

June 10, 2025: RPA is accelerating toward a crossroads, with IT leaders and experts debating its future. Some IT leaders say that more powerful and autonomous AI agents will replace the two-decade-old AI precursor technology, while others predict that AI agents and RPA will work hand-in-hand.

MCP is enabling agentic AI, but how secure is it?

June 2, 2025: Model context protocol (MCP) is becoming the plug-and-play standard for agentic AI apps to pull in data in real time from multiple sources. However, this also makes it more attractive for malicious actors looking to exploit weaknesses in how MCP has been deployed. 

The agentic AI assist Stanford University cancer care staff needed

May 30, 2025: At Microsoft Build 2025 earlier this month, Nigam Shah, CDO for Stanford Health Care, discussed agentic AI’s ability to redefine healthcare, especially in oncology, as physicians get overloaded with the administrative tasks of medicine, he said, which lead to burnout.

Agentic AI, LLMs and standards big focus of Red Hat Summit

May 26, 2025: Red Hat, announced a number of improvements in its core enterprise Linux product, including better security, better support for containers, better support for edge devices. But the one topic that dominated the conversation was AI.

Putting agentic AI to work in Firebase Studio

May 21, 2025: Putting agentic AI to work in software engineering can be done in a variety of ways. Some agents work independently of the developer’s environment, working essentially like a remote developer. Other agents directly within a developer’s own environment. Google’s Firebase Studio is an example of the latter, drawing on Google’s Gemini LLM o help developers prototype and build applications .

Why is Microsoft offering to turn websites into AI apps with NLWeb?

May 20. 2025: NLWeb, short for Natural Language Web, is designed to help enterprises build a natural language interface for their websites using the model of their choice and data to answer user queries about the contents of the website. Microsoft hopes to stake its claim on the agentic web before rivals Google and Amazon do.

Databricks to acquire open-source database startup Neon to build the next wave of AI agents

May 14, 2025: Agentic AI requires a new type of architecture because traditional workflows create gridlock, dragging down speed and performance. To get ahead in this next generation of app building, Databricks announced it will purchase Neon, an open-source serverless Postgres company.

Agentic mesh: The future of enterprise agent ecosystems

May 13, 2025: Nvidia CEO Jensen Huang predicts we’ll soon see “a couple of hundred million digital agents” inside the enterprise. Microsoft CEO Satya Nadella takes it even further: “Agents will replace all software.”

Google to unveil AI agent for developers at I/O, expand Gemini integration

May 13, 2025: Google is expected to unveil a new AI agent aimed at helping software developers manage tasks across the coding lifecycle, including task execution and documentation. The tool has reportedly been demonstrated to employees and select external developers ahead of the company’s annual I/O conference.

Nvidia, ServiceNow engineer open-source model to create AI agents

May 6, 2025: Nvidia and ServiceNow have created an AI model that can help companies create learning AI agents to automate corporate workloads. The open-source Apriel model, available generally in the second quarter on HuggingFace, will help create AI agents that can make decisions around IT, human resources and customer-service functions.

How IT leaders use agentic AI for business workflows

April 30, 2025: Jay Upchurch, CIO at SAS, backs agentic AI to enhance sales, marketing, IT, and HR motions. “Agentic AI can make sales more effective by handling lead scoring, assisting with customer segmentation, and optimizing targeted outreach,” he says.

Microsoft sees AI agents shaking up org charts, eliminating traditional functions

April 28, 2025: As companies increasingly automate work processes using agents, traditional functions such as finance, marketing, and engineering may fall away, giving rise to an ‘agent boss’ era of delegation and orchestration of myriad bots.

Cisco automates AI-driven security across enterprise networks

April 28, 2025: Cisco announced a range of AI-driven security enhancements, including improved threat detection and response capabilities in Cisco XDR and Splunk Security, new AI agents, and integration between Cisco’s AI Defense platform and ServiceNow SecOps.

Hype versus execution in agentic AI

April 25, 2025: Agentic AI promises autonomous systems capable of reasoning, making decisions, and dynamically adapting to changing conditions. The allure lies in machines operating independently, free of human intervention, streamlining processes and enhancing efficiency at unprecedented scales. But David Linthicum writes, don’t be swept up by ambitious promises. 

Agents are here — but can you see what they’re doing?

April 23, 2025: As the agentic AI models powering individual agents get smarter, the use cases for agentic AI systems get more ambitious — and the risks posed by these systems increase exponentially.A multicloud experiment in agentic AI: Lessons learned

Agentic AI might soon get into cryptocurrency trading — what could possibly go wron

April 15, 2025: Agentic AI promises to simplify complex tasks such as crypto trading or managing digital assets by automating decisions, enhancing accessibility, and masking technical complexity.

Agentic AI is both boon and bane for security pros

April 15, 2025: Cybersecurity is at a crossroads with agentic AI. It’s a powerful tool that can create reams of code in a blink of an eye, find and defuse threats, and be used so decisively and defensively. This has proved to be a huge force multiplier and productivity boon. But while powerful, agentic AI isn’t dependable, and that is the conundrum. 

AI agents vs. agentic AI: What do enterprises want?

April 15, 2025:  Now that this AI agent story has morphed into “agentic AI,” it seems to have taken on the same big-cloud-AI flavor that enteriprise already rejected. What do they want from AI agents, why is “agentic” thinking wrong, and where is this all headed?

A multicloud experiment in agentic AI: Lessons learned

April 11, 2025: Turns out you really can build a decentralized AI system that operates successfully across multiple public cloud providers. It’s both challenging and costly.

Google adds open source framework for building agents to Vertex AI

April 9, 2025: Google is adding a new open source framework for building agents to its AI and machine learning platform Vertex AI, along with other updates to help deploy and maintain these agents. The open source Agent Development Kit (ADK) will make it possible to build an AI agent in under 100 lines of Python code. It expects to add support for more languages later this year.

Google’s Agent2Agent open protocol aims to connect disparate agents

April 9, 2025: Google has taken the covers off a new open protocol — Agent2Agent (A2A) — that aims to connect agents across disparate ecosystems.. At its annual Cloud Next conference, Google said that the A2A protocol will enable enterprises to adopt agents more readily as it bypasses the challenge of agents that are built on different vendor ecosystems not being able to communicate with each other.

Riverbed bolsters AIOps platform with predictive and agentic AI

April 8, 2025: Riverbed unveiled updates to its AIOps and observability platform that the company says will transform how IT organizations manage complex distributed infrastructure and data more efficiently. Expanded AI capabilities are aimed at making it easier to manage AIOps and enabling IT organizations to transition from reactive to predictive IT operations.

Microsoft’s newest AI agents can detail how they reason

March 26, 2025: If you’re wondering how AI agents work, Microsoft’s new Copilot AI agents provide real-time answers on how data is being analyzed and sourced to reach results. The Researcher and Analyst agents take a deeper look at data sources such as email, chat or databases within an organization to produce research reports, analyze strategies, or convert raw information into meaningful data.

Microsoft launches AI agents to automate cybersecurity amid rising threats

March 26, 2025: Microsoft has introduced a new set of AI agents for its Security Copilot platform, designed to automate key cybersecurity functions as organizations face increasingly complex and fast-moving digital threats. The new tools focus on tasks such as phishing detection, data protection, and identity management.

How AI agents work

March 24, 2025: By leveraging technologies such as machine learning, natural language processing (NLP), and contextual understanding, AI agents can operate independently, even partnering with other agents to perform complex tasks.

5 top business use cases for AI agents

March 19, 2025: AI agents are poised to transform the enterprise, from automating mundane tasks to driving customer service and innovation. But having strong guardrails in place will be key to success.

Nvidia launches AgentIQ toolkit to connect disparate AI agents

March 21, 2025: As enterprises look to adopt agents and agentic AI to boost the efficiency of their applications, Nvidia this week introduced a new open-source software library — AgentIQ toolkit — to help developers connect disparate agents and agent frameworks..

Deloitte unveils agentic AI platform

March 18, 2025: At Nvidia GTC 2025 in San Jose, Deloitte announced Zora AI, a new agentic AI platform that offers a portfolio of AI agents for finance, human capital, supply chain, procurement, sales and marketing, and customer service.The platform draws on Deloitte’s experience from its technology, risk, tax, and audit businesses, and is integrated with all major enterprise software platforms. 

The dawn of agentic AI: Are we ready for autonomous technology?

March 15, 2025: Much of the AI work prior has focused on large language models (LLMs) with a goal to give prompts to get knowledge out of the unstructured data. So it’s a question-and-answer process. Agentic AI goes beyond that. You can give it a task that might involve a complex set of steps that can change each time.

How to know a business process is ripe for agentic AI

March 11, 2025: Deloitte predicts that in 2025, 25% of companies that use generative AI will launch agentic AI pilots or proofs of concept, growing to 50% in 2027. The firm says some agentic AI applications, in some industries and for some use cases, could see actual adoption into existing workflows this year.

With new division, AWS bets big on agentic AI automation

March 6, 2025: Amazon Web Services customers can expect to hear a lot more about agentic AI from AWS in future with the news that the company is setting up a dedicated unit to promote the technology on its platform.

How agentic AI makes decisions and solves problems

March 6, 2025: GenAI’s latest big step forward has been the arrival of autonomous AI agents. Agentic AI is based on AI-enabled applications capable of perceiving their environment, making decisions, and taking actions to achieve specific goals. 

CIOs are bullish on AI agents. IT employees? Not so much

Feb. 4, 2025: Most CIOs and CTOs are bullish on agentic AI, believing the emerging technology will soon become essential to their enterprises, but lower-level IT pros who will be tasked with implementing agents have serious doubts.

The next AI wave — agents — should come with warning labels. Is now the right time to invest in them?

Jan.13, 2025: The next wave of artificial intelligence (AI) adoption is already under way, as AI agents — AI applications that can function independently and execute complex workflows with minimal or limited direct human oversight — are being rolled out across the tech industry.

AI agents are unlike any technology ever

Dec. 1, 2024: The agents are coming, and they represent a fundamental shift in the role artificial intelligence plays in businesses, governments, and our lives.

AI agents are coming to work — here’s what businesses need to know

Nov. 21, 2024: AI agents will soon be everywhere, automating complex business processes and taking care of mundane tasks for workers — at least that’s the claim of various software vendors that are quickly adding intelligent bots to a wide range of work apps.

Agentic AI swarms are headed your way

November 1, 2024: OpenAI launched an experimental framework called Swarm. It’s a “lightweight” system for the development of agentic AI swarms, which are networks of autonomous AI agents able to work together to handle complex tasks without human intervention, according to OpenAI. 

Is now the right time to invest in implementing agentic AI?

October 31, 2024: While software vendors say their current agentic AI-based offerings are easy to implement, analysts say that’s far from the truth.

When Amazon Web Services launched its Simple Storage Service (S3) in March 2006, it sparked the imagination of IT leaders worldwide. I remember that era well. It was a time when the enterprise was feverishly searching for a way out of restrictive, on-premises silos. S3 and the emerging concept of public cloud promised almost unlimited scalability, pay-as-you-go economics, and the freeing of IT departments from the shackles of hardware, data centers, and routine maintenance. The vision was that enterprises could offload their IT headaches and focus on business outcomes, letting cloud providers do the heavy lifting.

Twenty years later, S3 has ballooned into a monster-scale system of more than 500 trillion objects stored, hundreds of exabytes under management, and operations spanning every corner of the planet. Netflix, Spotify, and other companies have used S3 and the wider AWS ecosystem to reinvent whole industries, scaling to dimensions that would have seemed impossible in the pre-cloud era.

But as we light the candles on S3’s birthday cake, the reality for most enterprises does not match the sleek simplicity once promised. Far from outsourcing all their IT to the cloud, most organizations today find themselves facing greater complexity, reduced transparency, and spiraling costs. Cloud hasn’t eliminated traditional IT problems; it has merely shifted and, in many cases, compounded them.

The failed promise of savings

It turns out, in the vast majority of cases, that moving workloads to the cloud does not inherently reduce costs or complexity. Many enterprises naively expected a simple equation: Moving infrastructure to the cloud equals lower costs plus greater agility. Instead, organizations gradually discovered that the pay-as-you-go model could quickly balloon budgets when left unchecked.

Cloud spending often began as a tiny line item within IT budgets, but two decades on, it’s frequently one of the highest and fastest-growing costs, sometimes eclipsing the very expenses it was meant to replace. Enterprises face a jungle of service tiers, intricate pricing metrics, unexpected data egress fees, licensing quirks, and rapid consumption of compute and storage. The quest for scale and innovation, fueled by cloud computing, often leads to sprawl: hundreds or thousands of workloads distributed across multiple cloud accounts and regions, each adding yet another layer of expense.

The real concern for CIOs isn’t just surprise costs but the struggle to implement cloud discipline. Even for organizations that embrace finops (the emerging practice of cloud financial operations), the speed of innovation outpaces their ability to govern usage. Business units spin up workloads on a whim only to forget or abandon them. Cloud cost visibility is confounded by opaque billing dashboards, and the containerization trend has made it even harder to pin down exactly where money is going.

This runaway spending is not the result of malfeasance, but rather the product of the cloud’s core attribute: enabling rapid, frictionless innovation in exchange for complex, often unpredictable billing. In recent years, the pendulum has begun to swing back, with many organizations repatriating some workloads to on-premises infrastructure just to regain cost control and predictability.

The cloud giveth and taketh away

Early cloud pioneers believed that entrusting security to hyperscale providers would mean fewer headaches. After all, who better to patch, monitor, and defend IT infrastructure than the companies running the largest, most sophisticated data centers on earth? To an extent, this is true. Cloud providers have invested untold billions in every flavor of physical and software security.

But the paradox is that by its very flexibility and openness, cloud introduces enormous security and operational complexity. The infamous rash of open S3 buckets left exposed to the world due to default configurations or simple oversight testified to the challenges of managing distributed, cloud-native architectures. Enterprises must now invest in new skills, new tools, and new processes just to manage the endless stream of updates, permissions, encryption keys, and access policies. Instead of outsourcing pain points, many organizations just replaced one set of hassles with another.

Moreover, the notion of “set it and forget it” in the cloud has proven dangerously outdated. The constant drumbeat of threats, from ransomware to nation-state actors, combined with the proliferation of APIs and services, makes the cloud a shifting, ever-expanding attack surface. Enterprises are forced not only to upskill but also to adopt whole new mindsets around zero trust, observability, and resilience engineering.

The future: more of the same

The original fantasy of cloud was that it would be a single pane of glass: one provider (often AWS), powering an enterprise’s every workload, integrated from edge to core to SaaS. In reality, as we reach this 20-year milestone, we’re in a multicloud reality whether by design, accident, or necessity. Enterprises are now managing portfolios that span AWS, Microsoft Azure, Google Cloud, and sometimes dozens of SaaS or niche providers and their own private clouds.

This shift actually magnifies all previous challenges. Not only do organizations have to master the idiosyncrasies of each provider’s architectures, costs, and security models, but they must also contend with interoperability, data movement, compliance, and the talent gap across every platform in use. The modern IT estate is a patchwork, not a seamless fabric.

As the next chapter of the cloud era unfolds, three trends are set to dominate. First, finops will become inseparable from devops and IT operations as enterprises seek to assert financial discipline over their cloud estates. Second, continuous investment in security will be essential: not just tools, but human capital and process change, with automation serving as a key enabler. Third, complexity won’t disappear; the goal will be to manage and mitigate it, not magically eliminate it.

The 20th anniversary of S3 isn’t just a celebration of a technological achievement; it’s a sobering reminder that the journey to the cloud, for most enterprises, is more marathon than sprint. The dream of outsourced, seamless IT has, for most, become managed, governed, orchestrated complexity. The next 20 years will see continued investments in cost control, security, and managing the multicloud labyrinth. Cloud may have transformed technology forever, but for the enterprise, the work—and the surprises—is just beginning.

The newspaper of tomorrow costs a million dollars, but yesterday’s newspaper cost less than a dollar. It is always a human endeavor to know or predict the future as accurately as possible, but it remains elusive due to technological limitations, static models, outdated data or gut feeling. In the world, torn by wars, tariffs, political fragmentation, geopolitical risk, rapid AI adaptation and weather catastrophes, uncertainty is just the norm rather than an exception.

During COVID-19, the world was exposed to huge supply chain disruption, essential commodities became scarce, and the world started understanding the challenge of the long supply chain. You will be surprised to know the iPhone travels 240k miles, the distance between Earth and the Moon, before you turn it on. Apple depends on suppliers from 50 countries to manufacture the iPhone; any small disruption has huge implications for the iPhone supply chain.

As a supply chain expert, I have seen how C-suite executives of every company struggled during the tariff war introduced last year by the US. Today, most supply chains are global, meaning raw materials are produced in one country, manufacturing in another and products are used in another. To increase efficiency and cost reduction, the chain of the supply chain has only been elongated. With technological advancement and communication improvement in land, sea and water, dependencies of one country on another have only increased. It is non-negotiable that the critical supply chain must continue in the face of any uncertainty. No company ever considered the tariff in the landed cost (total cost to bring in an item from outside), which increased the price of the final product that consumers pay. Companies are planning to move their manufacturing to the Friend Shore rather than onshore or offshore.

Launching a first-of-its-kind product is a forecasting nightmare. Without a historical roadmap, executives often fly blind, making it nearly impossible to scale production or manage suppliers accurately. The stakes are high: One wrong guess can lead to a mountain of unsold stock or — just as bad — turning away eager customers.   

In manufacturing, the failure of a single critical machine can stall operations for weeks. When repairs are delayed by long lead times for parts or specialized expertise, the resulting production bottlenecks lead to significant revenue loss and damaged customer relationships.

In a traditional product design approach, designers and engineers wait for customer feedback to be incorporated in the next iteration. Frequent changes in product safety regulations could derail the entire design.   

In an era where decision speed is the ultimate currency, volatility has become the new norm. Moving from annual to monthly product development cycles provides a vital competitive edge. By shifting from reactive to proactive strategies, AI-powered digital twins act as a “crystal ball,” providing the accurate forecasts needed to unlock new operational possibilities.

Digital twins in the supply chain

What is a digital twin in the context of the supply chain? Generally speaking, a digital twin is a digital replica of a physical object. It could be anything from an electric iron to a multistory building. Having a digital twin helps organizations simulate real-life applications and user-friendliness. Similarly, organizations using digital twins in their supply chain are better suited to deploy AI technology to drive and extract the best possible operational outcomes.

Digital twins in the supply chain allow an organization to extract its own captive data from manufacturing, inventory, suppliers, ESG, compliance and more into a single point of truth so proactive decisions can be made from real-time visibility. In this way, digital twins can speed decision-making by up to 90%, according to a McKinsey study.

Real-life use cases

According to a study by SPARQ360, a supply chain optimization, sustainability and compliance firm, some of the most effective digital twins in supply chain are:

• Unilever: Uses digital twin technology to model factory operations, optimize production schedules and enhance sustainability initiatives, leading to greater efficiency and cost savings.
• Boeing: Employs digital twins to improve supply chain transparency, reducing delays in aircraft production by modeling real-time supply constraints.
• DHL: Leverages digital twins in logistics operations to simulate and optimize warehouse efficiency, improving order fulfillment speed and reducing downtime. (
• Siemens: Uses digital twin simulations to design and manage supply chains for its industrial manufacturing clients, ensuring optimized production and distribution. (https://www.siemens.com/global/en/company/stories/industry/2025/digital-twin-for-industry.html)

From personal experience, the Kion Group partnered with Accenture and NVIDIA to leverage this innovation to address inefficiencies in warehouse operations. We enhanced supply chain efficiency through AI-driven solutions and digital twins, which were created to simulate warehouse dynamics. The digital twins facilitated real-time testing and optimization of layouts, robotic fleet management and operational processes.

This collaboration led to more autonomous and efficient warehouse operations, reducing manual interventions and allowing quicker adaptations to operational changes, thereby streamlining warehouse management and increasing overall efficiency.

Overcoming implementation challenges

Digital twins can be a part of the overall digital transformation strategies of an organization’s supply chain. However, as in all digital transformations, the following challenges will need to be considered:

Data integration and accuracy issues

One of the biggest challenges of digital supply chain twins is the mismatch of data. Often, inaccurate or conflicting data is sourced from logistics management software, ERP systems, inventory management systems and IoT sensors. This makes coordination with multiple stakeholders extremely difficult.

One approach we’ve often implemented to fix this issue is to first understand the data maturity model of the architecture you’re implementing the digital twin in, which includes mapping all the data sources and calling out the potential data silos. Secondly, we look at employing a myriad of different additional data strategies, like a data mesh or data fabric, to essentially call some of the data, as opposed to simply leveraging data lakes and data warehouses. 

When building a data lake or migrating data to a centralized source, leveraging a solution like Snowflake or AWS can be effective. With regards to data mesh and data fabrics, there are some commercial off-the-shelf (COTS) software solutions that install within existing topologies to map all data points into a meshed architecture. Conversely, we have also developed custom mesh solutions for digital twins in the supply chain by partnering with firms like Palantir or Amazon to achieve similar results.  

High upfront and maintenance costs

Digital Transformation initiatives are seldom easy or without high costs. Integrating supply chain digital twins requires investing in hardware, software, AI-driven analytics tools and cloud infrastructures, along with ongoing maintenance costs. Here are some tips as platitudes we have tried in the past that seem to help: 

• Don’t boil the ocean. Digital transformation in the supply chain is about showing value as quickly as possible. Nothing gets to value quicker than starting with a small pilot project the scale up. The team needs to focus on the most critical constraint, deliver value quickly and build momentum.
• Don’t reinvent the wheel. Utilize existing data sources and integrate with current infrastructure to reduce the need for new data collection and technology and collaborate with industry partners. Collaborative models can spread financial risk and leverage shared expertise, leading to cost savings and enhanced capabilities.

By employing these strategies, organizations can effectively manage the financial burdens associated with building and maintaining Digital Twins by minimizing upfront investment while continuously improving the system’s value, allowing organizations to allocate resources based on proven benefits.

These steps also allow organizations to test the Digital Twin concept, refine strategies and demonstrate value without significant investment.

Resistance to change

In many ways, we have noticed that the best approach towards removing resistance to change starts by implementing a culture of change. Employee resistance is very common when it comes to the implementation of digital twins, especially in supply chain management. This often stems from inadequate training in the Internet of Things (IoT), data analytics, artificial intelligence (AI) and working with the digital twins themselves.

From our own experiences, the best approach is to implement such changes in a phased manner and then scale up. This includes the following steps:

• Ensuring leadership buy-in. It starts at the top with strategies where leadership champions experimentation, setting the tone and providing necessary resources.
• Creating a safe space for failure. Communicate and champion a message that resonates with how users are in a safe environment where failures are seen as learning opportunities.
• Measuring success beyond traditional metrics. Leverage alternative metrics to promote experimentation and innovation.

By taking these steps, integration and adoption of digital twins become seamless and focused on value, not mandates.  

The future of digital twins in the supply chain

Once you’ve implemented digital twins in your supply chain and successfully garnered employee confidence, the story doesn’t just end there. Scaling up your supply chain digital twins is the next logical step forward. And this is where AI integration with digital twin applications comes into the picture.

Imagine the possibilities a well-integrated supply chain digital twin system with AI can bring to the table. With AI enabling the processing, analyzing and interpreting of massive multidimensional datasets, your supply chain can remain agile and resilient while navigating the turbulence of geopolitical or macroeconomic disruptions.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

If you want to see the immediate future of enterprise org planning, don’t look at NVIDIA’s stock price. Look at the severance packages at Chegg.

In late 2025, the education giant cut 45% of its workforce, leaving it with fewer than 500 employees, down from nearly 2,000 just two years prior. The reason? They were selling “rented intelligence” for homework answers. When AI made that intelligence free, their fixed-cost business model collapsed. They had built a massive permanent workforce to deliver a commodity that suddenly cost zero.

Chegg is the extreme case, but it’s a canary in the coal mine for every CIO.

Walk into most Fortune 500 boardrooms today, and you’ll see executives misreading the landscape. They’re obsessed with the idea of the “hardware hangover”. This is the staggering $400 billion spent in 2025 alone on GPUs and data centers. They think “CapEx” (capital expenditure) means buying servers, but the real war isn’t over silicon; it’s over software sovereignty.

Most companies are currently drowning in a rental trap. You pay monthly subscriptions for SaaS tools, you pay per-token for API calls and you hire full-time employees to stitch them together. If you stop paying the bills, the intelligence turns off. You own nothing.

In 2026, the smart CIOs are flipping this model, moving from renting capability (OpEx) to owning IP (CapEx). They aren’t doing this by hiring 500 new data scientists, they’re doing it with a modular, elastic workforce that builds the asset and then leaves.

What can we learn from Intuit about the trauma of skill swapping?

The fundamental problem with the 2023-2024 AI hiring boom was that it treated AI skills as static. In the AI-era, skills depreciate faster than hardware.

We saw this play out at Intuit. In mid-2024, they laid off 1,800 people (roughly 10% of their workforce) while simultaneously announcing plans to hire 1,800 new roles to support their AI transformation. Despite the symmetry, this wasn’t a swap; it was a painful structural reset. They had to shed legacy roles to make room for “customer-facing” and product roles that could leverage AI. To add insult to injury, now Intuit’s stock is in freefall because AI is “eating” their software.

So what’s the main takeaway? If you lock your strategy into full-time headcount, the only way to pivot is through trauma: layoffs, severance and cultural destruction.

Why fire and rehire when you can just bolt on?

I learned the hard way that adding headcount doesn’t solve all staffing issues during my time as a talent acquisition leader in the technology sector. Having a core team with augmented contract support for high-flux hiring always served our budgets better than a monolithic team of full-time staff. The same now rings true across all teams, but most acutely for software engineering and AI/ML departments.

Think of it as Gig 2.0 economics, where we define contractors as “capital expenditure catalysts” rather than temporary labor.

To explain it simply:

• The old way: You pay a salary forever to maintain a system.
• The new way: You pay a specialized pod to build a proprietary system in 90 days. When they finish, the headcount cost goes to zero, but the asset stays on your balance sheet.

The accounting reality: Why uncertainty demands modularity

For years, CIOs hoped accounting rules would make it easier to capitalize their AI experiments. The reality of 2026 is exactly the opposite and that makes the modular model even more critical.

In late 2025, the Financial Accounting Standards Board (FASB) issued ASU 2025-06. While it simplified some aspects of software accounting, it introduced a “significant development uncertainty” hurdle. Put simply: If your project is “novel” or “unproven” (which almost all innovative AI is), you likely have to expense the costs until that uncertainty is resolved. You can’t capitalize it.

This is a dangerous trap for CIOs looking to hire.

If you hire 50 full-time engineers to build a novel AI agent, and FASB says the project is uncertain, you are forced to treat their entire payroll as an expense (OpEx). You are loading your P&L with fixed costs for an experiment. If the project fails, you destroy your EBITDA and you’re stuck with the headcount. The board won’t like that.

The new way avoids this trap. By using contingent pods for the uncertainty phase, you treat the innovation phase as a sandbox:

• Scenario A (failure): The novel AI doesn’t work. You disband the pod. The expense stops instantly. No layoffs.
• Scenario B (success): The pod proves the concept. The uncertainty is resolved. Now you can bring it in-house or capitalize the remaining build, knowing the asset is viable.

Understanding the elastic talent capacity ratio

To execute this, you need a new headcount architecture. I call it the elastic talent capacity ratio, and it involves a 70/30 split:

• 70% the core team: These are your full-time employees. They are the product owners, the data governors, the strategists. They ensure the AI aligns with your company values. Their job is not to write every line of code; their job is to set the strategic direction and be stewards of existing infrastructure.
• 30% the bolt-on team: These are high-performance pods who enter with a specific mission to build a specific asset.

This structure protects you from the market. When the economy dips, you dial down the 30% without touching your core. When the economy booms (or a new model drops), you dial it up without waiting six months for HR to recruit.

Crucially, this also solves the “shelf-life” problem of AI talent. The innovation cycle in our industry has compressed to roughly six months. Today, you might need a pod specializing in ultra-low latency voice AI for a customer service overhaul. Next quarter, the priority might shift to predictive maintenance for your logistics fleet, or perhaps a completely new reasoning model that hasn’t even been released yet.

If you try to hire full-time employees for every new wave, you end up with a team built for the last war. A modular approach allows you to swap in experts who live on the bleeding edge of that specific niche. You don’t need to own the skill forever; you just need to rent the expertise long enough to build the capability, capitalize it and then pivot to the next breakthrough.

Get ready to be nimble, things will only accelerate into 2027

The companies that win in 2026 won’t be the ones with the largest payrolls OR the most layoffs. They will be the ones who can assemble the best talent for the specific problem, solve it and scale.

The accounting rules, the market volatility and the pace of technology all point to the same conclusion: agility is the only asset that will appreciate.

Stop renting your future from big tech. Stop loading your balance sheet with permanent risk for temporary problems. Start using the Gig 2.0 approach to build an asset economy.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Over the past decade, digital transformation has focused on converting manual processes to digital ones, migrating infrastructure to the cloud, updating applications and creating new channels for customer and employee engagement. These efforts have resulted in tangible benefits such as accelerated cycle times, increased transparency and reduced costs. However, these initiatives have also revealed limitations: Simply digitizing a flawed process does not resolve its underlying issues; it only makes the inefficiencies operate at a faster pace.

The shift to intelligent transformation

A new shift is underway. The next phase moves beyond digital — it is intelligent. Intelligent transformation is about evolving enterprises into systems that can sense, reason, make decisions and take action with minimal friction. This evolution is driven by the emergence of AI agents: Autonomous software systems capable of achieving goals by orchestrating workflows and leveraging tools such as APIs, applications, databases and automation technologies.

From apps and dashboards to agents and actions

In the digital era, organizational value was derived from systems of record like ERP and CRM, as well as systems of insight such as business intelligence and analytics. In the intelligent era, a new dimension is added: Systems of action, defined by agentic capabilities that execute tasks across diverse functions.

AI agents don’t merely answer questions; they are capable of planning steps, invoking tools, retrieving relevant information and completing end-to-end workflows. Modern agent architectures employ tool calling or function calling, where a model determines the next action, the application executes it and the model continues based on the outcome. This approach effectively bridges language models and enterprise systems, transforming agents into practical operational levers rather than mere demonstrations.

Cross-industry value: Where agents compound outcomes

Manufacturing: From connected factories to learning factories

Industry 4.0 connected machines and visualised data through dashboards. Intelligent transformation advances this by converting signals into actions: Agents detect abnormal patterns, recommend parameter adjustments, initiate maintenance requests and coordinate the availability of parts. The cumulative benefits extend beyond uptime to faster root-cause analysis, reduced quality deviations and more predictable throughput. Even minor improvements in planning stability can lead to significant gains in service and inventory management across complex networks.

Healthcare & life sciences: From documentation burden to decision support

Clinicians and scientists often navigate context overload due to guidelines, patient histories, research literature, protocols and regulatory requirements. Agents can collate relevant context, draft structured notes, suggest trial eligibility matches or summarise evidence, all while ensuring human oversight in decision-making. Responsible implementations integrate retrieval from trusted sources, audit trails and strict permissions, as accuracy, privacy and traceability remain essential.

Retail & consumer: From personaliziation to orchestration

Personalised recommendations marked the initial stage. Now, agents can orchestrate the entire customer journey — resolving issues, amending orders, offering suitable alternatives and updating inventory systems. Internally, agents produce assortment insights, conduct promotion analyses and automate supplier communication, reducing turnaround times from weeks to hours.

The new enterprise stack: Agentic workflows built on trust

As agents advance in capability, the critical question will shift from “Can the model write?” to “Can the enterprise operate safely with agentic systems?”

A pragmatic stack is emerging:

• Experience layer: Copilots within work tools (email, CRM, service desk) and role-based agent interfaces.
• Reasoning & orchestration: Policies, routing, human-in-the-loop approvals and monitoring.
• Knowledge layer: Retrieval from curated internal content with permissions and provenance.
• Tool layer: APIs, RPA, workflow engines and systems of record enabling agent actions.
• Governance & risk: Evaluation, security, compliance and auditability by design.

Consequently, AI risk management has become a board-level concern. Frameworks such as NIST’s AI Risk Management Framework stress the importance of embedding trustworthiness across the AI lifecycle and managing risks to individuals, organizations and society.

The uncomfortable truth: Agents amplify both productivity and risk

Agents have the potential to deliver substantial productivity gains, but they also introduce new vulnerabilities: Prompt injection, data leakage, unsafe actions and excessive reliance on generated outputs. Leading platforms are continuously enhancing agent safety and implementing robust controls.

Enterprises that succeed will treat agents like other critical systems — establishing guardrails, enforcing least-privilege access, mandating approvals for sensitive actions, continually evaluating performance and maintaining traceability of data and actions.

The operating model shift: Product thinking, not project thinking

Intelligent transformation does not succeed as a one-time rollout. Agents are never static; they learn, adapt and evolve as business needs and risks change. This calls for a shift from project-based delivery to a product-oriented operating model:

• Business-led outcomes: Each agent is linked to a measurable business KPI (cycle time, NPS, yield, cash conversion).
• Fusion teams: Domain experts, engineers, data specialists and risk/compliance professionals collaborate as a unified team.
• Evaluation as a discipline: Ongoing test suites for accuracy, safety, robustness and cost.
• Change management at the edge: Successful adoption is achieved through daily workflow integration, not just on launch day.

Measuring value: 3 horizons that executives can govern

To effectively scale enterprise value, leaders should consider three horizons:

1. Horizon 1: Assist. Copilots that draft, summarise, search and explain, delivering rapid adoption and immediate time savings.
2. Horizon 2: Augment. Agents that complete defined workflows with approvals, offering greater ROI and governance.
3. Horizon 3: Automate. New operating models that reinvent customer and enterprise value chains, presenting the largest opportunities but requiring significant change.

The common mistake is attempting to leap directly to Horizon 3. The most effective strategy is to build progressively: Use Horizon 1 to establish fluency and trust, Horizon 2 to standardise platforms and guardrails and Horizon 3 to transform the enterprise after developing confidence and capability.

Conclusion: Intelligent transformation is a leadership agenda

Digital transformation modernised technology, while intelligent transformation modernises the enterprise itself — how work is discovered, decided and delivered. AI agents serve as force multipliers, converting knowledge into action and action into learning.

Ultimately, success will not be determined by who can showcase the most impressive agent, but by who can develop the most trustworthy agentic ecosystem — one that is secure by design, outcome-oriented and embraced by employees who feel empowered rather than displaced.

In the age of AI agents, scaling enterprise value transcends traditional transformation. It requires building an organization capable of continuous self-transformation, with intelligence embedded in every decision and action.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The economic pivot: From creation to execution

The enterprise is currently undergoing a seismic pivot from generative AI, which focuses on content creation, to agentic AI, which focuses on goal execution. Unlike their predecessors, these agents possess “structured autonomy”: the ability to perceive contexts, plan actions and execute across systems without constant human intervention.

For the CIO and the enterprise architect, this is not merely an upgrade in automation speed; it is a fundamental shift in the firm’s economic equation. We are moving from labor-centric workflows to digital labor capable of disassembling and reassembling entire value chains.

In my experience, this autonomy introduces non-deterministic behaviors that traditional IT governance cannot contain. According to an article by Shivom Aggarwal, Shourya Mehra and Safeer Sathar, the rise in persistent cyber threats and advancements in technology require organizations to move toward adaptive and zero-trust security frameworks, making it essential to rethink and repurpose core architectural models like value streams and business capability models, rather than relying solely on new tools.

The governance gap: Why agents break traditional IT

Agents operating without defined boundaries create significant operational capacity. Because they can make decisions dynamically, it becomes difficult to trace decision paths or audit outcomes. Furthermore, in multi-agent systems, a single error or hallucination can propagate downstream, creating “chained vulnerabilities” that compromise entire workflows — a risk distinct from the static failures of traditional software.

To govern this complexity, enterprise architecture must elevate its artifacts from static documentation to active governance instruments.

Value stream engineering: The new control plane

In an agentic enterprise, the value stream map is no longer just a diagram; it is the control plane. It must explicitly define the handoff protocols between human and digital agents.  In my opinion, Value stream maps must move from static documents stored in a repository to context documents used to drive agentic automation.

Hardening the legacy estate

Most existing value streams were designed for human judgment. To introduce agents, we must harden these streams to tolerate non-deterministic actors.

• Define autonomy zones: Architects must audit streams to identify contiguous blocks of high-volume, low-ambiguity tasks. These become autonomy zones where agents cycle freely.
• Implement halt-on-exception: To prevent cascading errors, streams must include explicit logic that triggers an immediate routing change to a human actor when an agent’s confidence score drops (e.g., below 90%).
• The flight recorder: Agents are inherently opaque. Value streams must be augmented with mandatory logging steps — observability checkpoints — where an agent must cryptographically sign a log entry before proceeding to the next stage.

Case study: The over-the-air (OTA) software update stream

Consider the value stream for vehicle software patch deployment. This process is high-risk; an error can incapacitate a fleet of vehicles.

• Current state (fragile): Steps include code commit > automated test > regional deployment. The risk is that an agent tasked with optimizing deployment speed might bypass a slow testing gate to meet a goal, resulting in a flawed update.
• Architected state (governed):
  • Step 1: Ingest (autonomy zone): An agent acts as the release coordinator, autonomously packaging the build and triggering 5,000 simulation tests.
  • Step 2: The observability checkpoint: The value stream enforces a hard gate requiring the agent to sign a log entry detailing the simulation results cryptographically.
  • Step 3: The halt-on-exception logic: If >0.5% of simulations show latency spikes, the agent is technically blocked from accessing the deployment API. The stream automatically creates a Jira ticket for a human safety engineer.
  • Step 4: Execution: Only if the threshold is met does the stream permit the agent to schedule the OTA rollout.

The greenfield approach: Agent-first mapping

If a value stream does not exist, you cannot automate it. For new agentic workflows, do not map the current human process. Instead, use an outcome-backwards approach. Work backward from the concrete deliverable (e.g., customer onboarded) to identify the minimum viable API calls required. Before granting write access, run the new agentic stream in shadow mode to validate agent decisions against human outcomes.

Capability models: The readiness heatmap

According to Enterprise Strategy Group (ESG) research, 38% of organizations cite unclear business goals as the primary blocker to AI value realization. In the era of agentic AI, this lack of clarity is dangerous and I see this leading to agentic AI sprawl.

As chief architect at Ford, I learned that the business capability model is the most effective tool for preventing the deployment of toy pilots that fail to scale. It serves as a readiness heatmap, identifying which business functions possess the structural maturity to host autonomous agents.

Assessing agent readiness

Do not deploy agents based on use case popularity. Deploy based on capability maturity.

• Data integrity: Is the lineage within this capability clean enough for machine consumption?
• Boundary isolation: Are the APIs defined? If a capability relies on spaghetti code, an agent will likely break it or cause unintended side effects.
• Action: Block deployments in capabilities that do not meet these structural standards.

The digital insider strategy

We must treat agents not as software, but as digital insiders mapped to specific capabilities.

• Containment via capability: Assign agents role-based access control (RBAC) strictly tied to the resources of their parent capability. This prevents a compromised agent from moving laterally across the enterprise.
• Budgeting as governance: Bind compute and token budgets to the capability. If an agent enters a loop of rapid-fire, low-value transactions, the capability’s budget cap acts as a circuit breaker, preventing runaway costs.

Case study: R&D vs. aftermarket sales

An automotive OEM evaluates two potential pilots. The capability map determines viability based on boundary isolation and data integrity.

• Capability A: Autonomous drive research (high maturity)
  • Assessment: Data integrity is high (petabytes of structured driving data). Boundary isolation is strict (air-gapped simulation environment).
  • Decision: Go. The agent is deployed to generate synthetic training scenarios and is bound to the R&D compute budget.
• Capability B: Aftermarket parts supply chain (low maturity)
  • Assessment: Data integrity is low (reliance on legacy mainframes and manual spreadsheets). Boundary isolation is poor (tightly coupled systems).
  • Decision: No go. Deploying an agent here creates identity sprawl and high risk. The recommendation is to remediate the data architecture before piloting the agent.

The cost of inaction

The trade-offs of ignoring these architectural primitives are severe.

• Financial: Without capability-tied controls, organizations risk unmanaged operational spikes from inefficient agent loops.
• Security: A lack of value stream definitions leads to unmanaged agent-to-agent interactions, allowing threats to exploit undefined trust boundaries.
• Strategic: Fragmented pilots result in identity explosion — thousands of non-human identities that cannot be audited, rotated or governed.

In the age of agentic AI, architecture is no longer an ivory tower discipline. It is the prerequisite for safety, scalability and value.

From gatekeeper to market maker

For the past decade, EA has often been mischaracterized as a department of no — a friction layer that slows agile delivery. In the agentic era, this dynamic inverts. Because agents are non-deterministic, governance is no longer a constraint on speed; it is the mathematical prerequisite for it.

Without the structural guardrails of value streams and capability maps, the CIO cannot scale agentic fleets beyond the prototype stage. The risk of hallucinations cascading into production databases forces the organization to keep human-in-the-loop ubiquitously, negating the economic benefits of the labor substitution.

By implementing these architectural primitives, the chief architect transforms from a gatekeeper into a market maker for digital labor.

The new economic equation: Cost of verification vs. cost of execution

The value of an agent is not defined by how fast it runs, but by how little it needs to be watched.

• The ungoverned state: The cost of execution is low, but the cost of verification is infinite. Every output requires human review because trust boundaries are undefined.
• The architected state: By hardening the value stream with observability checkpoints and halting logic, the cost of verification drops to near zero for all transactions within the defined autonomy zone.

The recommendation: Shift the ROI metric. Do not measure AI adoption (a vanity metric). Measure autonomous throughput — the volume of transactions an agent executes without human intervention, enabled strictly by architectural confidence.

The technical implementation: The dynamic control plane

To operationalize this, EA must partner with platform engineering to embed these concepts into the runtime environment. The capability map must evolve from a static PowerPoint into a policy engine residing within your API gateway or service mesh.

• Policy-as-code: When an agent attempts an API call, the gateway checks the readiness heatmap.
• Runtime logic:
  • Does the calling agent possess the cryptographic signature required for this value stream stage?
  • Is the target capability rated “mature” for write-access?
  • Is the request within the capability’s token budget?

If the answer is no, the transaction is rejected at the network layer. This allows the chief architect to govern 10,000 agents without reviewing a single line of code.

The architect’s moment

We are witnessing the industrialization of cognition. Just as the assembly line required industrial engineers to organize labor into efficient physical streams, the agentic enterprise requires enterprise architects to organize digital labor into efficient logical streams.

The organizations that treat this transition as a software upgrade will drown in operational opacity. The organizations that treat it as an architectural restructuring — using value streams to direct flow and capabilities to secure boundaries — will capture the market.

Architecture is no longer an ivory tower discipline. I believe it is the only way to build a firm that is both safe and fast.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

In 2018, Google released the AI model BERT, forever changing how machines understood context in a language. BERT, short for Bidirectional Encoder Representations from Transformers, solved a long-standing problem in natural language understanding. Before BERT, researchers needed multiple bespoke models (and datasets) to understand the different contextual meanings of human languages. BERT demonstrated that one model could process contextual meaning across multiple languages (via mBERT).

While BERT became a fundamental building block in natural language processing (NLP), its impact on how we interact with computers came from its application. That change did not come from shoehorning the technology into existing solutions. It stemmed from an applied understanding of how BERT functioned, would evolve and could solve domain-specific challenges. I know because my team at Google used BERT to create responsive search ads. Our work transformed online text advertising.

Our success in applying BERT wasn’t simply because we had TPUs or more resources than our competitors. (Those things helped, undoubtedly.) Our advantage was my team’s domain expertise and close collaboration with the Google Research team, who created the model. Collectively, we could envision how to apply BERT to fundamentally reshape advertising because we understood:

1. How the model operates, including its strengths, weaknesses and dependencies.
2. The specific industry problems and operational challenges we were solving for.
3. The way we’d tune the model and create a system around it, at scale.

This framework remains pertinent today, as business leaders seek to understand how to build and deliver scaled impact with large language models (LLMs).

Weighing the pros and cons of models

As critics and pundits debate the efficacy of generative AI, numerous studies underscore a similar finding: people are unsure of how to use LLMs. To address these uncertainties, leaders need to ensure that their organization’s decision-makers understand, at a high level, how these models function and can be applied.

That technical understanding mattered when we applied BERT. It matters even more now. Because while BERT required domain expertise to deploy effectively, today’s LLMs make it dangerously easy to deploy them poorly and unknowingly. It’s likely the reason so many AI projects never proceed past pilots, as McKinsey reported.

BERT’s success underscored the power of pre-training and fine-tuning a model on a large dataset to enhance token-level semantic context within NLP. But where BERT zigged, OpenAI’s Generative Pre-trained Transformer (GPT) zagged. Unlike BERT’s encoder-only architecture, GPTs use a decoder-only architecture to generate outputs, trained to predict the next token in a sequence. BERT was trained on billions of tokens, while today’s GPTs are trained on trillions. The more tokens these LLMs were trained upon, the more capabilities they gained.

Early applications of these LLMs have centered on their ability to generate creative, fluent and coherent writing, coding and imagery. This “creativity” reflects the probabilistic patterns that these models have learnt from their massive training datasets. But this same predictive output can be disadvantageous when these models need to be deployed in factual, deterministic environments.

Deep learning researchers have long argued that setting any rules, following the historical method of symbolic reasoning, would inhibit the model’s abilities. Structured to predict an output, even when the model is uncertain, LLMs have demonstrated a tendency to hallucinate. Hallucinations are not a bug, but a feature. They’re inherent to how these models operate and should limit your applications without guardrails. After all, mistakes in consequential industries like healthcare, finance and legal can be catastrophic.

This historical comparison, while surface-level, still illustrates how the model’s underlying functions impact its outputs and applications. Understanding these architectures solves half the problem. The other half is building a strategy to collect and scale data within your specific domain.

AI’s scaling problem is a domain problem

Healthcare, finance and legal are all industries with ample data and capital to spend. While each sector presents distinct challenges, they all have found success with AI.

Hospitals epitomize the opportunities and obstacles within the healthcare industry. The average hospital generates 50 petabytes of data annually, enough tokens to train a sophisticated model. But 97 percent of this data isn’t used: it consists of unstructured clinical notes and radiology reports, redacted documents following HIPAA compliance, and data siloed or managed under regulatory scrutiny. When you can access it cleanly, as illustrated by AI detections of tumors in radiology images, a measurable impact is possible. When you can’t, your pilot stalls.

Finance presents different tradeoffs. Transaction data is generally well-structured and high-volume, enabling novel applications in fraud detection and customer service automation. But limiting these applications is LLMs’ high error rates on multi-step numerical reasoning, creating fundamental misalignment for calculation-intensive applications.

The pervasiveness of hallucinations spotted in trial briefs and documents has sown distrust in AI within the legal industry. The ABA’s 2024 Legal Technology Survey found 75% of attorneys cite accuracy concerns as a primary barrier to their AI adoption. But outside the courtroom, there are many applications of AI to radically reshape legal work, including managing contracts, conducting compliance and risk assessments, protecting intellectual property, etc. These instances lend themselves to LLMs’ strengths: ability to handle unstructured data, pattern recognition, information extraction and data structure analysis.

Your development framework to scale data

The distinction between courtroom risk and contract is exactly the advantage that we identified at Ironclad. Every business function generates contracts that include information on renewal dates, payment terms, obligations and counterparty details. Training models on this data is a strategy that leverages LLMs’ strengths with minimal risk.

Compared to legal briefs and documents, where incorrect AI summaries have massive implications, the risk of applying AI to contracts is lower. Our approach at Ironclad is modeled after the automotive industry’s safety framework for deploying autonomous vehicles, the SAE J3016. This standard distinguishes between systems in which humans retain responsibility (Levels 1-2, driver assistance) and those in which machines become accountable (Levels 3-5, automated driving).

Applied to enterprise AI, this risk-based framework clarifies deployment roadmaps and boundaries. We chose to develop our Intake Agent, which extracts contract data from third-party papers, and our Conversational Search Agents, which enable natural language querying of documents, because we saw them as “Level 1-2” applications with low adoption barriers and associated risks. Verifying a contract autonomously, while plausible with today’s LLMs, might seem innocuous, but unsupervised verification could be very risky. There’s a plausible scenario in which an agent could overlook litigation between the two engaged parties and autonomously renew a contract because it can’t access the tort proceedings data.

Using a risk-based framework can help determine where and how to build your AI applications by answering the question: what’s the likelihood we’ll get this right, and what happens if we’re wrong? This calculation, not competitive pressure, should then determine your deployment sequencing.

Build a foundation, create transformation

During my twenty-plus years of working with AI, I’ve found that the most significant determinant of a technology’s impact on a business is the organization’s fluency with it.

As planning ensues, organizations trying to determine how and where to apply generative AI to their business need first to have an introspective look and ask themselves:

1. Do you understand the technology’s actual mechanisms? Not marketing promises, but fundamental architecture. LLMs perform statistical pattern matching, not logical reasoning. They require extensive general training followed by domain-specific fine-tuning. Without this understanding, you’ll deploy for impossible tasks.
2. How does the industry you’re serving share, collect and store data? What data will you use to tune and fine-tune your models, if at all? LLMs are foundational because they require sophisticated pre-training, followed by fine-tuning to generate meaningful, domain-specific outputs.
3. Do you have a framework, such as a risk-based model, to prioritize, deploy and assess which products to develop? Start with low-risk, human-supervised applications. Conduct evaluations and build feedback loops. Expand systematically as reliability proves out.

Over my career, I’ve watched people overestimate what AI can do this quarter while underestimating what it will do this decade. Technology evolves. Industries are reshaped. But transformations are created by businesses that do the foundational work.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

“Such an embarrassment of a flag carrier. I will never fly AC unless I absolutely have to.”

“This is absolutely outrageous.”

These were some of the nicer social media reactions on carrier Air Canada following November 2022, when a well-intended chatbot on the airline’s website confidently invented a refund policy, triggering lawsuits and a reputational crisis far outweighing the chatbot’s original cost-saving ambition. Not unlike Duolingo, Klarna and McDonald’s, Air Canada had not failed because it used AI — but because it failed to align AI with business priorities.

Under huge pressure from boards and markets, organizations now declare themselves AI-first before answering a far more fundamental question: AI for what and what not, exactly? For CIOs, this is no longer a technological question but a strategic one. Organizations too often rush ahead without first properly aligning AI with their business model, established value creation approaches and the risks their company can handle.

We propose a fix: 4 AI strategy archetypes, as we call them. These blueprint-like AI approaches were distilled from our yearslong AI strategy work and help CIOs delineate valuable AI playing fields while balancing both hype (risk blindness) and overcaution (missed opportunities).

By forcing critical appraisal of these extremes, strategy archetypes foster a productive strategy dialogue within the top management team and help organizations avoid their own Air Canada moment.

Incorporating AI strategically

This is important as, despite prominent cautionary tales, too many leadership teams still talk about AI as if there was a single “right” strategy. But this ignores two ways in which organizations profoundly differ: their key levers to create value and the risk degree they can tolerate.

Some firms place bold bets on AI moonshots (as now observable in the chemical industry), accepting failure risks in exchange for potential market-redefining advantages. Others build on industry-proven, incremental AI optimizations of existing processes with predictable returns.

Even more importantly, AI is still too often unaligned with organizations’ competitive strategies. A luxury goods provider such as Hermès focuses on protecting its craftsmanship, brand image and product scarcity. A retailer like Walmart, on the other hand, has built its business model on operational excellence, scale and exceptional cost efficiency. Clearly, it’s strategic nonsense to expect both to leverage AI in the same way. And yet, such crucial differences are precisely what we see AI discussions miss out on too often.

Why do we still lack more established strategy tools helping the C-suite fit AI strategy to their distinctive business models and value creation logics? The answer, our professional practice shows, is not another AI maturity model.

Throughout years of AI advisory, we started to notice something striking. In our and others’ AI strategy work across industries, geographies and organizational maturities, as well as countless conversations with CIOs, CEOs, CFOs and heads of AI and data, we saw some distinctive strategic patterns around AI emerge.

With each month in the trenches of AI strategy, we further realized it was one differentiator putting a few leading AI organizations ahead of the pack: a decisive clarity and explicitness about where to focus AI efforts in value creation while saying no to disproportionate risk.

Observing this choice across organizations, we distilled four distinct AI strategy archetypes that can help leadership teams position AI very deliberately, have a more productive AI strategy dialogue and make smarter bets — before an Air Canada moment forces this conversation.

AI strategy archetypes: How they simplify the AI strategy dialogue

To bring clarity into a company’s AI strategy dialogue, it’s critical to take a step back and recall two fundamental dimensions of business strategy:

The first is the value creation focus: Is AI primarily focused on improving internal processes — i.e., to increase efficiency, productivity and employee capabilities — or is it more externally focused on improving products, services and customer value propositions?

The second dimension is risk tolerance: Does the company deliberately pursue bold, experimental AI bets while accepting uncertainty and failure along the way or does it favor proven AI practices and applications that can be implemented with rather predictable outcomes?

From these two dimensions’ intersection spring four distinct AI strategy archetypes — each with typical strategic measures, each legitimate, each powerful in its own context when aligned with a firm’s business model (see figure 1). It is these two dimensions that anchor the AI strategy dialogue between hype and overcaution.

Archetype 1: Pioneers

Pioneers operate in the high-risk, externally focused value creation quadrant of the 2 x 2 matrix. They view AI as a vehicle for breakthrough innovation and are willing to place moonshot bets on untested technologies, novel data sources or entirely new AI-enabled products and markets.

Pioneers accept that many initiatives will fail — and budget for that reality — because they know that few successes can redefine industries or create new ones altogether.

Archetype 2: Innovators

Innovators also embrace risk, but they focus on internal AI activities. Their goal is not to disrupt markets, but rather to radically reinvent the way their company works. Innovators use AI to challenge long-established processes, automate complex decision-making processes and fundamentally rethink operating models. They are the cultural antithesis of “but we’ve always done it this way”-organizations.

Going forward, this will often imply exploring agentic AI as a completely new approach to rethinking the operating model.

Archetype 3: Performers

Performers sit at the opposite end of the risk spectrum, with an internal focus on value creation. They pursue AI pragmatically, using a test-and-scale mindset to incrementally improve efficiency, quality and speed.

Performers rely on comparably mature, well-understood AI use cases — some more frequent topics are financial forecasting, predictive maintenance and rule-based process automation — and embed these cases deeply into existing processes to gradually increase performance.

Archetype 4: Pathfinders

Pathfinders combine low risk tolerance with an external focus. Rather than betting on bold invention, they systematically scan their industry and competitors for AI use cases that have already proven their value elsewhere. They prefer learning from the mistakes that others have made first.

Their strength lies in adapting best-practice AI solutions to their own context in small, controlled steps. For pathfinders, AI strategy is less about being first — and more about arriving with minimal bruises.

But how do AI strategy archetypes really look in action?

Case study: Western Rail — strategic repositioning for AI value creation

Imagine a regional public transport provider, Western Rail, being under pressure back in 2024. Ticket vending machines and travel agencies as non-digital sales channels were no longer what travelers wanted, burdening the P&L with idle costs.

Western Rail also faced margin pressures in public tenders from emerging, low-overhead local competitors. AI initiatives (such as an AI customer support chatbot) had been launched here and there, but as lighthouses rather than measures rigorously focused on actual business needs. Money was being burnt and initial AI enthusiasm among staff started to turn into frustration.

When a new CIO entered the firm, he tasked a small team of AI specialists to radically refocus Western Rail’s AI approach. In initial strategy workshops with channel leadership, the specialists introduced AI strategy archetypes as a navigation system for the firm’s AI strategy dialogue. Performer, pathfinder and the other archetypes provided an intuitive language to talk about AI for the mostly non-technical leadership team.

To establish a common departure point, the team probed leadership on Western Rail’s current AI value creation: They asked: “Are we pursuing results with AI more in our internal processes and costs or around traveler satisfaction and product innovation? Did last year’s AI project ideas spring primarily from operational bottlenecks or from transportation market requirements?”

The specialists also made leadership reflect on the firm’s current AI risk tolerance, asking: “How much budget and time for experimentation do we give teams today before demanding tangible business outcomes? Do staff and competitors view our AI project approvals overall as conservative or bold?”

Being pushed on such questions made a diffuse feeling concrete for leadership: Investments in AI had not produced desired results precisely because the firm had been trying to run in many directions simultaneously. Industry-novel, high-risk cases resembling the innovator archetype were being explored (such as AI travel agents on terminals in travel agencies). Simultaneously, customer support teams were dabbling with process automation tools to cut manual ticket routing and processing — a typical performance measure.

This spread resources thin, preventing the focus and learning curves the firm’s AI initiatives would have needed to truly transform Western Rail’s business — either via differentiating digital innovation of traditional ticket sales channels or radical automation, allowing it to compete with lean emerging players based on cost efficiency.

Archetype-driven questioning in the workshops, deepened by follow-up interviews with operational staff, eventually led the leadership team to one shared problem understanding: With its current AI activities, Western Rail was strategically in a classical stuck-in-the-middle situation.

To refocus Western Rail’s AI activities on business priorities, the AI specialists set up another workshop, this time starting with a slide showing the AI strategy archetype matrix. A red dot in the middle marked Western Rail’s current all-rounder (non)position.

The specialists explained each archetype, asking: “What archetype best aligns with our business priorities and should we move toward over the next 2 to 5 years?” With the archetypes right in front of them, leadership had the concrete blueprints to set a direction for the very first time. To some, the performer archetype had an immediate appeal as it seemed to fit well with Western Rail’s need to control costs.

To explore this target position, the AI specialists challenged the group with follow-up questions such as: “Does our future competitiveness really hinge on internal efficiency and incremental process improvements? Or rather, on a differentiating traveler experience? Will expected shifts in market conditions and traveler behavior require bold mobility innovations from us or rather re-emphasize consumers’ price sensitivity and thus affordable tickets?

Gerlinde Zimmermann, Marc Feldmann

During the following discussions, a consensus emerged: a performer approach to AI became seen as a North Star for best leading Western Rail into the future (see Figure 2). The reasons were the performer archetype’s cautiousness and focus on internal process efficiency. Achieving such focus became seen as particularly desirable in the customer service team, due to a recently exploding request volume following government ticket subsidies.

In the following weeks, a roadmap with strategic measures to reposition from all-rounder to performer was developed, focusing on adaptation of industry-proven AI use cases, elimination of high-stakes use cases and experimental research cooperations and declaring automation of labor-intensive travel agency and customer support processes as high-leverage AI application areas.

At Western Rail, which was lacking clarity and focus of AI efforts, the performer archetype became not only a powerful template for sponsors to assess upcoming project ideas (“Will this investment make us more or less of a performer?”), it also became a vivid and practical rationale for helping leaders explain to staff why some projects were started and others postponed, giving orientation in everyday project work (“Would this AI assistant’s proposed functionality scope make agency shift planning cheaper and faster or introduce unjustified complexity?”).

Where AI strategy archetypes help most

AI strategy archetypes — as experience-grounded strategic blueprints — help those firms most that struggle with the early question: “Which AI approach is right for us?” At the same time, AI strategy archetypes are not AI strategy lite and certainly not AI strategy replacement. Instead, AI strategy archetypes help set a fruitful destination early on. In doing so, they can kickstart the development of a fleshed-out AI strategy that spells out how to get there.

While designed with the development of an AI stance for one business unit in mind, the AI strategy archetype framework is also applicable to business unit portfolios. Where different business units have different value creation approaches and risk tolerances, one unit may adapt the performer archetype, while another might need to become an innovator. In any case, each business unit will best be served by having its own dedicated strategy dialogue.

AI strategy archetypes act as a navigation system for AI starters, telling CIOs and other leaders where to look first for AI use cases in their firms and how to clarify the level of acceptable risk. With that, archetypes are a powerful tool that can disentangle organizations’ emerging AI strategy dialogue.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

You wouldn’t judge the value professional chefs bring to Michelin-starred restaurants by how quickly they chop onions. So why is there such a focus on time saving at work through AI usage?

AI tools, from copilots to agentic systems, have the potential to reinvent entire business workflows, impacting business models and changing how enterprises deliver value. Time savings, on the other hand, are easy to measure through employee surveys and analytics collected from heavily monitored activities such as customer care.

So taking this easier approach and just trying to do the same activities in less time is not the way to look at this. Longer-term strategic thinking is required, and businesses that examine what they do from the ground up, and consider how AI could allow them to reconfigure these activities to create value for customers, will be the winners in these turbulent times.

Cutting headcount is not a strategy

No company ever shrank to greatness. Sure, laying off staff in downturns may sometimes be necessary, and deploying AI as a way to do this may bring a short-term bump to the bottom line. But it’s missing the real opportunities AI presents and could actually do longer term damage to a business. Gartner predicts half of companies cutting customer service staff due to AI will rehire by 2027. They reason AI is just not mature enough to replace the subtleties and empathy that humans bring to customer interactions. The danger, Gartner argues, is that while immediate cost savings may be attractive, there’s a danger of unintended consequences further down the line.

This sentiment is echoed by Ronnie Sheth, CEO of SENEN, a strategic consultancy focused on data and AI. She warns against taking a technology-first approach such as deploying copilots and self-service chatbots without thinking about customer needs and preferences. It’s counterproductive, as a growing number of companies are finding, to handle more customer queries if customer satisfaction levels go down. “To truly realize value, AI initiatives should map directly to strategic business objectives by a defined percentage, not just internal soft metrics such as time saved,” Sheth says.

Focus on quality not quantity

In a world starting to drown in AI-generated slop, the quality of outputs and customer interactions will become ever-more important. Copilots and other AI tools can play a key role in driving quality up, but choosing the right metrics to measure this is key. Founder of technology advisory firm Deep Analysis, Alan Pelz-Sharpe sees the focus on deploying copilots primarily to raise employee outputs as a mistake. “Somebody might write more code, but is it good code and does it actually deliver measurable business value,” he asks. “So if your measurement is tasks completed per hour or headcount, you can argue that you did more, but did you do better, did you deliver enough value to justify the cost and change.”

On top of this, he warns of not monitoring for possible negative consequences further down the line. This is particularly true with coding assistants capable of producing code at speed but which, without skilled human oversight, can cause problems weeks or months later as systems become exposed to the harsh realities of business environments.

A 2025 survey by Harness of 500 software engineers found that while just over 80% felt AI was useful in their jobs, they were also struggling with a blast radius effect where bad code was going into production faster and with a greater impact. This included debugging with 67% of developers spending more time cleaning up code generated by AI, and 68% spending more time dealing with security vulnerabilities from such code.

Not business as usual

Despite justified talk of AI bubbles fuelled by some ridiculous investments and valuations of companies unlikely to ever live up to their promises, a revolution is underway. Seeing AI as a bolt-on that can help businesses perform a bit more efficiently is missing a key point. How data is gathered, processed, shared, and used is being transformed in terms of speed and quantity but, more importantly, AI is changing how decisions are made on the basis of that data.

As agentic solutions evolve, many roles currently performed by humans will either radically change or disappear altogether. When word processing systems emerged in the 1970s and 1980s, a key measure of their value was how much quicker secretaries and admin assistants could produce written documents. However, the real impact of word processors and the PCs that replaced them has been the transfer of much of this work to executive staff, who now manage their own admin tasks.

The impact of AI will be far greater. Enterprises need to rethink how useful their current business processes and, by extension, their business models will be when AI is able to automate or even make current practices redundant. Simply performing current activities quicker is not the way to think about this.

Not long ago, prompt writing felt like a personal skill. Something you refined quietly, stored in a notes app or copied between chat windows when something worked particularly well.

That model no longer holds.

Across organizations, Generative AI (GenAI) prompting is now shaping executive summaries, policy drafts, operational dashboards, clinical documentation and production user interfaces. Yet, in many environments, prompts remain scattered across chat histories, documents and inboxes—unowned, unversioned and largely invisible.

What we’re seeing is a pattern familiar to anyone who has lived through the early—and still persistent—days of shadow IT, as described by David Talby in his article Shedding light on shadow AI. In practice, prompts are quietly becoming enterprise interfaces, but without the governance structures we instinctively apply to data, code or systems.

And like data sprawl before it prompt sprawl creates reliability issues, inefficiency and risk long before leadership realizes what’s happening.

As Talby notes, “People use shadow AI because it’s easy…”

Prompt sprawl as shadow IT operations

In conversations with technology leaders and in recent industry reporting, the issue of prompt sprawl mirrors earlier patterns of data sprawl.

As pointed out in Deloitte’s AI Dossier, teams are using GenAI daily, often productively but prompts live everywhere: personal chat threads, shared documents, Slack messages, wiki pages. There is no single source of truth and no clear owner. Two people ask the same question and receive meaningfully different answers. Outputs get reworked quietly because the user phrased the prompt just a bit differently. But no one fixes the underlying cause – they simply place a Band-Aid on the issue and move on. Drift unobtrusively enters the equation, and no one notices until outputs no longer align.

This matters for three reasons CIOs care deeply about: reliability, efficiency and risk.

1. Reliability. When the same prompt yields different outputs depending on who runs it or how it’s phrased, decision variance creeps in. Leadership starts questioning not just the AI, but the systems that depend on it.
2. Efficiency. As teams duplicate effort, reinvent prompts and rework outputs there is no shared definition of what “good” looks like. Efficiency erodes at the edges and tribal knowledge replaces institutional process and accepted best practice.
3. Risk. Ungoverned prompts can leak sensitive inputs, hallucinate policy or create inconsistent external messaging. In regulated or high-stakes environments, that is not theoretical risk, it is operational exposure, as Sofia will expand on later.

What I’m seeing isn’t an ephemeral tooling problem. Nor is it a training gap that can be solved by teaching people to write better prompts. The issue is structural. Prompts have crossed a threshold where they influence institutional outcomes, and anything that does that needs governance.

Towards a prompt governance framework

To make prompt governance actionable, my co-author Sofia Penna Elneser and I use a prompt governance framework that borrows intentionally from data governance and software delivery disciplines and adapts them to the realities of GenAI.

Our framework rests on five pillars.

1. Purpose and alignment: Every governed prompt must have a clear intent, approved use case and owner. The goal is not to limit experimentation, but to distinguish exploratory prompts from those that shape decisions, systems or records of truth.
2. Quality and consistency: Prompts define expected output shape, tone and structure. Acceptance criteria are explicit. This reduces variance and makes outputs predictable without requiring identical wording every time.
3. Lifecycle management: Prompts are versioned, reviewed, refined and eventually retired as obsolescence becomes obvious. Changes are intentional, not accidental. Mature organizations maintain a prompt library just as they maintain shared code or templates.
4. Risk and compliance: This aligns closely with the National Institute of Standards and Technology’s AI Risk Management Framework (A.1.2. Organizational Governance), which emphasizes that AI systems embedded in operational workflows require explicit governance, accountability and ongoing risk assessment. When designing and surfacing our prompts, we set a tiered risk system. Low-risk prompts require light governance. High-risk prompts, those touching policy, finance or patient care, require formal review, testing and escalation paths. We actively document use cases, inputs, outputs and known risks associated with each deployment.
5. Measurement and enablement: Adoption, rework and incident rates are tracked. Teams are enabled through templates, examples and direct access to subject matter experts rather than constrained by heavy process.

To make this practical, we map these pillars onto a maturity ladder:

• Risk Level 1: Ad hoc experimentation
• Risk Level 2: Emerging structure
• Risk Level 3: Standardization
• Risk Level 4: Enterprise governance
• Risk Level 5: Regulated, safety-critical operations

Low-risk AI use cases tolerate stylistic variance; high-risk use cases cannot. Prompt governance is what allows organizations to move between those levels intentionally rather than reactively.

What this looks like in practice becomes clear when you examine real systems. In the first two case studies below, I break down how my prompts were created and versioned for production at Levels 3 and 4. Sofia then writes about the Level 5 clinical-grade digital assets she employs in a medical technology setting.

What prompt governance looks like in practice

Governing consistency in a creative AI workflow (Risk Level 3)

At the urging of our creative director, I first applied prompt governance principles in a creative context: generating illustration concepts for the American Mathematical Society (AMS) textbook Analytic Number Theory Revealed: A First Guide to Prime Numbers by Andrew Granville.

My role was not creative per se, that responsibility belonged to the creative team, but to improve consistency and efficiency across iterations. The author communicated an intuitive, experience-driven set of visual preferences. The project required multiple illustrations translating advanced mathematical ideas into symbolic imagery. Maintaining a coherent visual language across those illustrations was essential, as iteration cycles with the author were time-consuming and costly. From the outset, the author’s “I’ll know it when I see it” sensibility shaped the process.

Early experimentation with generative AI exposed predictable failure modes. Small changes to prompts produced noticeable stylistic drift, overly literal mathematical representations or inconsistent composition. While creativity was present, it lacked stability. Outputs varied in ways that undermined visual cohesion rather than supporting it.

Tim McMahon

I addressed this by treating the prompt as a versioned production asset rather than an ad hoc creative input. The creative director and I collaborated on a baseline specification, which I formalized into a structured style guide for use with the GenAI tool. This specification defined constraints such as symbolic density, phased execution and an embedded self-check to validate alignment with the agreed visual language before producing final output.

The result was a set of tarot-style illustrations that differed meaningfully in subject matter but clearly belonged to the same visual system. The author’s creativity was not constrained; production variability was. Once my role was complete, the creative team resumed control of the assets, refining them as needed and preparing them for publication in the final work.

The image shown in this section is an example of the prompt in action. This was not used in the author’s book, rather I used the master prompt and GenAI to create a new JSON file and then output a card explicitly for this article.

If a follow-on volume to the author’s work were to require continuation of this motif, the organization would avoid several thousand dollars in additional production effort. The system would be reused rather than built from scratch.

This reflects Level 3 prompt governance maturity: standardized quality, scalability and repeatability without the overhead of enterprise-wide controls.

Governing correctness and reuse in a production system (Risk Level 4)

I applied the same governance principles in a far less forgiving environment: a production workflow supporting the AMS Annual Meeting, also known as the Joint Mathematics Meetings. This is the largest mathematical conference in the world, where the daily schedule is a mission-critical asset rather than a creative deliverable.

In this case, GenAI supported the creation of scripts that consume a live pipeline of conference data normalized into JSON. This was then rendered to accessible, Bootstrap-based user interfaces. Inconsistency here is not solely an aesthetic concern. It breaks pages, confuses users and creates long-term maintenance risk.

As in Use Case 1, early experimentation exposed familiar failure modes: hallucinated fields, inconsistent keys, partial outputs and subtle divergence between environments. These failures were unacceptable at this scale. Compounding the challenge was organizational inertia, stakeholders accustomed to improvisational change were now being asked to operate within explicit, rules-based constraints.

The solution was not a better prompt and prompt chain, but a governed system boundary that can be reused year after year. I introduced a constrained, pipeline-aware specification that encoded an authoritative data source, schema validation, complete-file output and accessibility requirements.

Once those constraints were in place, outputs became predictable. Debugging shifted from “why did the model do this?” to “which rule was violated?” This workflow now moved from an experimental helper to a reliable, bounded participant in production workflows, one whose behavior could be reasoned about, validated and trusted.

In the interest of full disclosure, I will state that the system is still evolving. I do not doubt that next year the system will be better defined and further refined.

This process reflects Level 4 maturity: governed systems where the workflow is subordinate to explicit authority, validation and human accountability.

Up to this point, the failures encountered were costly but recoverable. In creative and operational systems, inconsistency wastes time, undermines trust and creates technical debt. When GenAI begins feeding systems of record and affecting human outcomes, that margin disappears. In healthcare, prompts no longer function as flexible instructions; they operate as regulated components.

Treating prompts as clinical-grade digital assets in medical technology (Risk Level 5)

Our highest-risk example comes from the medical technologyindustry.

In this setting, the stakes change. While a stylistic variance is fine in a creative workflow, even a slight deviation from the source text in a clinical environment is a liability as these outputs become part of the patient’s permanent health record.

At Meditech, Sofia works on use cases that assist providers and nurses in the transition of care. While traditional clinical summaries are notoriously time-consuming, Generative AI provides Hospital Courses and Hand-Off notes in seconds instead of hours.

For example, there is a clinical difference between saying a patient “is experiencing” a symptom versus saying a patient “has a history of” that same symptom. If an ungoverned model interprets a past condition as an acute, present emergency, it’s a clinical error with consequences, not just a creative flourish or a “model inference.”

At this level of risk, treating prompts as clinical-grade assets becomes a fundamental requirement, elevating them from simple instructions to the strategic center of context engineering. By implementing a pipeline that prioritizes specifications, versioning and rigorous evaluation, raw AI potential is turned into a reliable enterprise-grade engine.

From “vibe check” to version control: The production pipeline

When a prompt influences a patient’s permanent record or a mission-critical schedule, it can no longer live in a black box of unversioned GChat histories.

The shift from creative flexibility of Use Case 1 to the clinical precision of Meditech’s clinical-grade assets in Use Case 3 illustrates a hard truth: the tolerance for prompting by intuition drops to zero.

To move from ad-hoc experimentation to enterprise-grade reliability, prompt writing is replaced by a prompt production pipeline: a structural, repeatable discipline that mirrors software delivery. And it starts with simple questions: What and Why?

The functional spec

Just as data governance requires a schema, prompt governance requires a definition of what “good” looks like. We identify the problem before the AI solution by establishing exactly what we are trying to accomplish and why.

The functional spec determines our expected shape, tone and structure. It also identifies the sections of the prompt that shouldn’t vary. These are called “prompt partials,” and they can include the core role, the brand voice, safety wrappers, etc. In other words, the mission and vision of the prompt are an asset.

The design

With the spec as our blueprint, the full set of instructions follows. This is where ownership is assigned. To prevent unowned and invisible sprawl, every prompt needs a person or team responsible for its logic, ensuring the design meets the goals laid out in the spec.

The prompt bundle

Once designed, we lock the prompt together with the specific model version and configuration parameters (like Temperature or Top-P). This bundle belongs in a shared repository, not a private folder or a DM. This creates an audit trail that turns a black box into a transparent history of who changed what and why. It also allows for decoupling—the ability to update the AI “brain” without having to redeploy our entire application’s code.

Testing

Once we have our what and why (spec), the who (ownership) and the where (Bundle), we move on to testing.

Testing shouldn’t and can’t be a one-time event. It must happen with every iteration. This is why we determine model configurations early. By locking in the Seed, Top P, Top K, Temperature, etc., we drastically reduce the random “AI magic” factor. When these configurations are set correctly, any variation in results can be attributed to prompt changes, not just the model having a “creative” day.

The evaluation loop

Keeping our Functional Spec in mind, we develop an evaluation threshold. We ask the hard questions: What is a non-negotiable requirement in the output? Is it a specific length? A strict JSON format? A grounding in clinical truth?

Once these standards are set, we evaluate a reasonable number of high-variance test cases and document the results. It isn’t enough to just see if V5 “looks good.” We must track how prompts behave in relation to themselves and previous versions to identify drift before it enters production. Custom AI agents can assist in evaluating generated outputs as well by creating a continuous automated loop.

Review & deployment

This is a fundamental step to ensure prompt governance. Just like code, no prompt hits production without a dual-check, where a third, unbiased, human-in-the-loop audits and approves the proposed changes that will eventually become the new prompt version.

Prompts are infrastructure now

Across creative publishing, production systems and clinical documentation, we have seen the same pattern repeat. As GenAI moves closer to decision-making, prompts stop being experiments and start being infrastructure.

What changes is not the need for governance but the cost of getting it wrong.

The sooner prompts are treated as governed digital assets — owned, versioned, tested and measured — the easier it becomes to scale safely. Not because governance slows innovation, but because it makes trust possible.

For CIOs, the practical shift is simple: any prompt that is reused, shared or relied upon should be treated as a governed digital asset, not an improvisation.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

In an era defined by AI, automation, cloud scale, and rising customer expectations, today’s CIOs are navigating a once-in-a-generation strategic inflection point. The pressure to modernize legacy environments has never been higher. The demand for speed, innovation, and business value has never been greater. And the challenge of getting it all right at the same time has never been more complex.

Shelia Anderson, chief information and digital officer at Unum Group, describes this moment as “managing the dance”: the dance between stabilizing and modernizing the core while accelerating new digital capabilities; between protecting the enterprise and empowering it; and between delivering for customers today and architecting a future where AI and automation fundamentally reshape how work gets done.

In a recent episode of the Tech Whisperers podcast, Anderson shared what CIOs must get right architecturally, operationally, culturally, and strategically to lead effectively in this AI-powered era. Afterwards, she expanded on the essential questions shaping the CIO agenda as enterprises reinvent themselves for the future.

As Anderson makes clear, this moment requires more than technical strategy. It demands leaders who can architect for the future while modernizing the past, who can move fast without breaking trust, and who can balance innovation with empathy. What follows is our conversation, edited for length and clarity.

Dan Roberts: When you think about the architecture of the future, what are the non-negotiables CIOs must get right to support AI, automation, cloud scale, security, and faster innovation?  

Shelia Anderson: You have to get a vision of where you are today and where you’re going. You have to get that foundationally right. It’s about establishing a future target and making sure that you have an understanding of your current state as well — that’s table stakes for me.

You’ll often hear me talk about multi-year planning. I am a big believer in a three-year plan. It’s tough right now to have a three-year plan. Still, establishing a solid outlook for even the next 12 months is important. We have to find balance between the legacy technology that we have — and we’re all still dealing with it — and the new emerging technology and disruption that’s coming.

There has to be enough rigor and focus on how to get from where we are today to the new. That’s one of the things that’s going to challenge most of us: How do we think about the blocking and tackling, the modernizing, and the reality that “modernizing” may look very different with all the new capabilities we have coming? A multi-year plan is the tool that can help us balance priorities and get from here to there.

Also table stakes for me is the talent approach to all of this as you think about the future. You have a roadmap based upon a rigorous architecture discipline. How are you thinking about aligning your talent to that? Because it all anchors back to your vision of the future, the timing of that transformation, and a multi-year plan and roadmap. And layered on top of that are your organization’s constraints — capacity for change, investment strategy, whatever they are — all these things come together.

Modern architecture works only if the operating model evolves with it. How do you think about designing the operating model of the future to move at the speed the business now demands?

We’ve got to learn how to put a little jet fuel beneath what’s called agile today to drive it forward at yet another level of speed, particularly when it comes to speed to value and speed to outcomes. More teams are going to ask for that. It’s a clear ask from our CEO, so it’s always top of mind for me.

We’re working in close partnership with our business to reimagine how to solve for an end-to-end view of our business while enabling speed, agility, and adaptability. For example, we’re exploring how to design our operating model of the future around end‑to‑end value streams rather than the core capabilities we use today. It’s about organizing around the customer lifecycle, putting the customer front and center, while creating clear accountability and clear ownership around decision‑making as well.

Then, focus on the governance aspect: How do you make sure you are prioritizing the work and making sure it’s aligned to those priorities? Next, look at the constraints you have. As much as things are changing, the familiar constraints still exist: people, process, and technology. If you have a constraint around your investment processes, for example, then you have to address how to balance those across the others.

Ultimately, I think success depends on collaboration, continuous learning, an integrated approach, and process, process, process. With AI and the pace of innovation, we have to totally rethink our business processes, and it’s not always going to be about iterative or evolutionary change. It’s going to be revolutionary in many situations.

Every CIO I talk with is trying to find that Goldilocks zone where the balance between modernization, innovation, speed, value, and risk is not too much, not too little, but just right. How do you approach that balancing act? And how do you help your organization understand the choreography behind the decisions you make?

First, you have to have a foundational understanding of the current situation within your business. I always follow the dollars in the beginning, because that tells you a lot about where the business sees the opportunity to get value and whether your investments are really achieving that. Then, I look at the balance of investment between run‑the‑business and change‑the‑business activities. It’s a balancing act to reduce run costs to free up funds for value creation on the change-the-business side.

Getting that foundational view of what that situation is first will help you make better investment decisions around everything — for example, how you source work for everything from tier 1, mission-critical capabilities to commodity services. Those are the things that we have to make very intentional decisions around. I’m going to put my best, most innovative, probably higher-dollar and skilled people on that mission-critical piece of work, and maybe I’m going to source that commodity service differently so I can free up those dollars to drive them more towards value creation.

Transparency in the decision‑making is key. You have to explain the choreography behind the dance and the trade‑offs. That’s not a science; it’s a muscle that allows you to navigate through stop, start, continue decisions. If we want to start shifting investment dollars to higher value creation, then that also implies that you’re actively making choices to deprioritize other things. That’s where those relationships and the ability to adapt and trade off are going to matter, so you can get alignment around the decisions.

And then I always like to say, use the data to help you to make informed decisions. Use your governance, use your metrics, to help you in making your decision so you can get into that Goldilocks zone. As long as you’re aligned with your business — if your business is saying, “We’re at a point where we want to invest more for this period of time in this one capability, and we’re going to minimize investment in another” — that’s fine. You can support the decision and align to that if that’s where your business wants to take it.

What does workforce transformation look like in this AI-driven era, and how are you helping your 2,000 technologists navigate disruption, build confidence, and develop the skills needed to thrive in the future of work?

There’s a massive amount of change and expectations coming at all people, especially those of us in technology. There’s all this new emerging technology, a lot coming with AI, that brings expectations around how you shift from ways of working today to a level of productivity expectation tomorrow from leveraging these new capabilities.

One thing I’m doing to take fear out of the equation is to help teams see a path forward. I do that by setting goals for the organization and having a vision around those goals. That gives you confidence — as an individual sitting in a chair — that there’s a vision not to replace me here but to help me be prepared with the skills needed for the future. Jobs will change a bit, and in the engineering space, definitely, you’re going to see a higher dependency upon leveraging these capabilities to help you get more work done. That’s the expectation. We’ll have the capacity to say “yes” more often. We’ve already proven that out in some early pilots and tests. So, I’m excited about the future opportunity, and I think when the success comes, we’ll all be celebrating that.

At the same time, I think about the broader AI‑ready workforce. Regardless of where you’re at in the organization, all people are going to have to learn how to leverage these new tools effectively. To do that, identifying things like skill gaps and targeting future growth skills is going to be important. Creating learning pathways and, more than anything, reinforcing that culture of continuous learning, change, and adaptability is going to be key. Offering targeted training and upskilling to help people learn the new tools, plus transparency about how those capabilities will change and, ultimately, augment or enhance their jobs, will build confidence for the future.

You’ve been recognized with some of the most prestigious awards in our profession, including the CIO Hall of Fame and Constellation’s BT150, which highlights the world’s most influential business technology leaders. What do they represent to you about your career and leadership journey?

I feel like I’ve gone viral in the last quarter of my career. I haven’t necessarily changed, but there’s an awareness factor that has come through — maybe through my network, through participating in some of these organizations, for getting out there and sharing the stories of my companies.

As a female leader in technology, I feel a tremendous opportunity and commitment to set a precedence so other leaders can see this as a role that they could aspire to be in as well. That’s what it really means to me, and I don’t take the responsibility lightly. It’s representing a future path for other women, and other technology leaders as well. Sharing my story is important, and I think these recognitions definitely do that. The awards also help to highlight some of the wins across the whole industry and the great teams that I’ve had the opportunity to be a part of. It represents all that work across all the years.

What advice would you offer the next generation of leaders stepping into this AI-driven future?

You won’t always know how developing new skills and early experiences will pay off later.

The role I probably disliked the most was when I was running a global network for American Airlines. I was an applications leader, and my leader asked me to take on the network responsibility. I didn’t enjoy it; it was painful. But I learned how to optimize business. Then 9/11 happened and I learned how to reimagine how I work with every supplier, renegotiate contracts, things I never imagined I’d do and that I use today. I am a shrewd contract negotiator, and I credit that skill all the way back to when I was a senior director in that role.

You never know what will happen. Take those opportunities, the stretch roles, raise your hand, and pivot when you can. Don’t focus on going up; focus on horizontal expansion. That’s where you’re going to build the toolkit you will carry for your whole career. It’ll help you be successful in the later years, when you are moving up into senior roles.

There’s also the power of context, which I relate to that broader view of strategy and vision and understanding larger opportunities and outcomes. When you’re early in your career, if you laser focus on the thing in front of you, you’re going to miss what I call the fringe opportunities. So, from a career perspective, broaden your horizons. Think of the broader view of whatever it is, whether you’re solving a problem or seeking advice. Context gives you a perspective of situational details, and all of those things come together to help you see if something is really significant, or how much weight you should give it. Context helps you pick your battles.

Finally, make business fluency a big part of what you focus on. Don’t focus just on the technology of the moment. Technology comes and goes, which means you need to be continually learning new technical skills. Be a continuous learner, have curiosity, ask great questions, and focus the early part of your career on skill-building and building a great breadth of experience.

As organizations confront the realities of AI, shifting operating models, and rising expectations, Anderson offers a blueprint for leading with clarity, courage, and a deep commitment to people, the true engine of every transformation. For more insights from her leadership playbook, tune in to the Tech Whisperers podcast.

See also:

• Rethinking IT leadership to unlock the agility of ‘teamship’
• TIAA’s Sastry Durvasula offers CIOs a blueprint for engineering what’s next
• Decision intelligence: The new currency of IT leadership

Electronic components distributor Avnet oversees supply chains for major corporations, but more importantly, the Phoenix-based multinational leverages intelligence insight from its data to help understand what’s important for customers to move product for maximum profitability.

“Everything we do from an AI standpoint helps to fulfil that philosophy,” says CIO Max Chan. “Leveraging AI means cleansing data so customers can make the right decisions.”

With over 100 years of history to look back on, Avnet has always been able to prioritize technological investment as its ecosystem has grown more complex. Fundamentally important is adhering to what’s most important to the business. “Instead of having my own technology or approach to digital AI, the strategy is how do we enable the business,” he says. “So every capability we have, we look at technology, digital enablement, and AI transformation to help accelerate, redesign, or reimagine them. It’s all about helping to transform the business.”

Of course, ROI from AI can be elusive, but Chan sees missteps or flawed strategies as evidence oflooking at the wrong place. “Some people look for ROI from an investment in AI itself,” he says. “It’s like the traditional ways of looking at FinOps, for instance, to look at how much you’re spending, improving, and making out of it. We look at it differently. To us, AI is transformational, so when we implement something with AI in mind, we look at what business outcome are we hoping to drive. We get the right pricing and a more complete quote to the customer to help them learn what that converts to in terms of top and bottom line.”

But just like everything else regarding technology investment or digital enablement, success comes down to change management and governance. “Change management is key, but the overall governance of going back to whether something is contributing to a business outcome, or is directly supporting a business strategy, is essential,” he adds. “Otherwise, people will look at different POCs and use cases. We’re only looking for what directly links to strategic capabilities and the business outcome we’re looking for.”

Chan also details modernizing legacy systems with greenfield architectures, and partnerships that build resilience and customer value across industries. Watch the full video below for more insights, and be sure to subscribe to the monthly Center Stage newsletter by clicking here.

How AI helps distribution: We see very strong leverage in the sales enablement site, engineering design, managing inventory and forecasting, and orchestrating the supply chain. The common thread across all these areas is the actionable insight and data we have. So from a sales enablement perspective, what comes to mind is quoting, which is the most important thing as a distributor in terms of being informed and passing that on as quickly as we can to customers. For them, they’re able to get their products at the point they need. For us, we’re able to win the business and improve conversion. AI has helped us with pricing, getting the right information on end of life and country of origins, and putting it all together so the customer can make the best decision for what they do. It’s also about how we can help our customer service agents have readily available information to advise people. So we use it internally and externally.

On the heavy lift of legacy systems: This has been a long journey we’ve been on. Avnet continues to reinvent and apply the same mentality to modernize with technology. Over 30 years ago, we decided we wanted to go to a major ERP to run everything, but within the last 10 years, we realized that such a monolithic environment isn’t good enough. So we started building, just like everyone else, to get benefit from cloud transformations and build on top of it. But what my team and I quickly learned was that wasn’t going to cut it. We had support from the organization to start from scratch, and build a modern architecture that’s digital and AI first, which allows us to leverage different capabilities. The mentality of continuous improvement, and not to get hung up on what we’ve built over the last 30 years, has helped us with that success in driving AI and the transformation we see today.

On the changes AI brings: It comes back to the culture and learning agility we want everyone in the organization to have. Interestingly, AI is probably a lot easier than most other technologies that came before it because of ChatGPT, gen AI, and the many different tools that suddenly came up in the last few years. Everyone got excited. Trying to create that learning pathway, and getting people systematically upskilled to be able to approach and leverage AI the right way, is what we’re doing across the organization. We see it like there are three different types of AI to grapple with. One is productivity tools like ChatGPT that we give people to do what they need to do. The second is what comes with all the software you have, since all major software comes with AI components. Then last are the things my team would develop and build in accordance with what we want in order to drive the company forward, and how we transform. So we have more than enough tools that we allow the organization to leverage, and we have a governance process to request what people can use, or we give them an alternative. If it comes with the software we own, if we already have the license, then go for it since it’s embedded and will help us better leverage the software. The focus we have on AI is what we’re doing to transform the way we work, the workforce, the work itself, and in some cases, the business and how we can better serve our customers and employees. One way is reimagining some end-to-end processes to see if they can be fully autonomous. If so, what would it look like? Once that’s done, we bring people back in the loop to augment it and make it even more powerful for our business.

On AI impacting workflows: As far as disruption and resiliency from a supply chain standpoint, focus is on relationships with customers, both upstream and downstream, and understanding what they are, what they have, what they need to do, and what they want to do. And the signals we send around the industry help strengthen that resiliency. We get asked how can we help avoid the next supply chain debacle, and it comes down to partnerships, availability of data, and connectivity. In order for us to do that internally, from a tech stack standpoint, we need to target the modern architecture that drives microservices and allows us to have strong API connections. We created a platform called the Partner Digital Exchange, which helps bring data downstream, and combines it with what we have to drive orchestration. And that allows us to bring AI into the mix and help customers with the information they need. It also helps Avnet create that stickiness in the ecosystem.

After spending a decade helping shape talent strategy as a business professor and now working inside an AI-first organization, I see hiring very differently than I did even a few years ago. Managing people, evaluating fit and understanding how teams evolve have always been central to my work, but the pace at which expectations have shifted in the age of AI has been unlike anything I have seen before.

Across the past years, I have interviewed candidates in product, analytics, engineering, operations and strategy. One thing is clear: hiring the right people today is more challenging than it was even two years ago. And it is not because there are fewer applicants. It is because there is less alignment between what modern AI-driven organizations actually need and what traditional education, resumes and interviews were designed to evaluate. What follows is my firsthand perspective on why hiring has become more complex and how leaders can rethink their approach.

The talent mismatch: Plenty of applicants, not enough readiness

A major shift I continue to observe is the growing gap between traditional training and what AI-era roles expect. Many candidates come with strong conceptual knowledge but limited exposure to working with AI tools or navigating environments where systems evolve faster than processes can catch up.

The McKinsey State of AI report supports this shift, noting that AI adoption is advancing faster than most organizations can reskill their workforce.

I see the same thing in interviews. Candidates understand concepts, but applying them in fast-changing, ambiguous environments is where the gap reveals itself.

This is where mindset becomes a decisive factor. In AI-influenced settings, adaptability and curiosity matter as much as domain expertise. The professionals who thrive are the ones who experiment, explore and stay hands-on with new tools even when the roadmap is unclear. One question I often ask is simple but revealing: When technology shifts, how do you keep up? The strongest candidates talk about tinkering, testing and learning by doing.

The AI polish effect: Why evaluating true capability is harder

Generative AI has made it incredibly easy for people to present themselves as polished and prepared. With AI-drafted resumes, refined stories and rehearsed interview answers, candidates can sound more impressive than ever before. This creates what I call the AI polish effect. It blurs the boundary between genuine capability and AI-assisted presentation.

I have met candidates who articulate AI concepts eloquently yet struggle when asked to break down an unfamiliar problem independently. Because of this, the way I evaluate talent has evolved. I listen less for confidence and more for thinking patterns. I look for willingness to take things apart to understand them, comfort in admitting what they do not know, the ability to reason through new situations and initiative in exploring emerging tools.

This aligns strongly with insights from BCG’s “AI Is Outpacing Your Workforce Strategy”, which highlights that adaptive learning and experimentation are becoming key differentiators among high-performing talent. BCG’s broader perspective in “AI Is Changing Recruitment” reinforces the growing mismatch between traditional hiring practices and the realities of AI-powered organizations.

A revealing insight: Many professionals still misunderstand AI

Another theme that shows up consistently is how often candidates underestimate the influence AI will have on their roles. Many still view AI as an optional enhancement rather than a core part of future workflows.

Gallup’s “Manager Support Drives Employee Adoption” illustrates this gap clearly, showing that many employees who do not use AI believe it simply would not help their work, while only a small minority cite lack of access as the real barrier. Discomfort with change and uncertainty about how to use AI safely remain common.

This shows up clearly in interviews. Some candidates imagine AI will sit on the sidelines, while in reality it is reshaping speed, expectations and decision-making across every function. For CIOs and technology leaders, this insight matters. Hiring now involves evaluating not just technical fluency, but a candidate’s awareness of how AI will shape their daily work and their willingness to grow with it.

Why interview coherence matters more than ever

As roles evolve, alignment among interviewers has become essential. When one interviewer expects deep AI expertise and another values learning potential, feedback becomes misaligned and promising talent can slip through the cracks. A shared hiring philosophy is no longer a nice-to-have. It is becoming a significant competitive advantage.

Evolving expectations: What strong candidates want today

Across roles, high-performing candidates increasingly look for autonomy, clarity, speed and meaningful work. They want to contribute to something that matters and see results quickly.

Culture also plays a major role. Skilled talent hesitates when an organization feels rigid or unclear. Many candidates now ask more about decision-making, ways of working and team dynamics than they do about day-to-day tasks. They want to understand how work gets done, not just what the job description says.

This is consistent with Deloitte’s insights on AI’s impact on careers, which emphasize the growing importance of helping workers continually reinvent themselves to keep pace with technological change.

What CIOs can do next

As AI shifts the definition of talent readiness, CIOs are uniquely positioned to reshape hiring strategy. Three actions stand out:

1. Redefine what “qualified” means

Instead of filtering for exact tool proficiency, evaluate candidates on reasoning, adaptability and their ability to learn at the pace AI evolves. The most future-ready hires are often those who lean into ambiguity rather than avoid it.

2. Build interview teams that reflect the skills you want to hire

Ensure that interviewers understand the organization’s AI maturity level and the differentiators that matter most. When interview panels are aligned, candidates receive clearer signals and hiring decisions become more consistent.

3. Treat AI literacy as a cultural expectation, not a niche capability

Hiring candidates who acknowledge AI’s inevitability and who are willing to expand their workflows with it accelerates organizational readiness and reduces friction during transformation.

These actions help CIOs avoid the misalignment that slows down hiring and creates onboarding challenges later.

Looking ahead: Hiring for adaptability, not perfection

AI is evolving so quickly that nobody can be fully prepared for every tool or workflow. This makes adaptability one of the most valuable traits to evaluate. The candidates who stand out are the ones who say, “I haven’t done this yet, but I can figure it out.”

Ambiguity is now part of most modern job descriptions. Some people thrive in it. Others find it destabilizing. Identifying this early helps build teams that are naturally suited to AI-driven environments. Hiring well in this era means prioritizing adaptability, curiosity, experimentation, cultural clarity and coherent evaluation. Problem-solving now matters more than polish. Learning speed matters more than perfect experience.

Evolving how we hire

Hiring in the age of AI is more complex, not because talent is lacking, but because what organizations need has fundamentally changed. The professionals who succeed today are curious, adaptable and comfortable navigating ambiguity. They value culture, clarity and purpose. They flourish under leaders who understand the pace at which technology is reshaping work.

Adaptability is now as important as skill. Curiosity is just as valuable as capability.

If we want to build teams ready for the future, we must evolve how we hire in the present.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Enterprise resource planning (ERP) systems are poised for major disruption in 2026, with AI taking over some capabilities and modular, best-of-breed apps replacing some functionality in all-in-one ERP solutions, IT leaders and industry observers say.

The biggest impact will be AI, with more functionality within ERP systems becoming automated and less dependent on human interaction. Some experts see AI increasingly taking over several ERP functions, including invoicing, employee onboarding, and balancing books, as well as ERP systems using AI to drive better data insights.

“The ERP market in general is shifting from being a purely transactional system to an intelligent, data-driven platform,” says Steve Bronson, CIO at beverage distributor Southern Glazer’s Wine & Spirits. “We’re seeing AI and predictive analytics embedded into core processes, tighter integration with data lakes for real-time insights, and a strong push toward flexible and modular architectures that allow businesses to adapt quickly without full-scale replacements as in the past.”

AI will increasingly become an intelligence layer in ERP systems, Bronson adds, with agentic AI allowing more automation of workflows in finance, procurement, and supply chain management. AI will also allow users to plan for scenarios using risk profiles in real-time, he predicts.

“AI will shift from transactional systems of record to autonomous, insight-driven engines, which will propose levers for optimization to business leaders that will empower them to make faster, smarter decisions in more real-time,” he adds.

Deep AI integration

The coming year will see deep integration of AI into core ERP systems, adds Kirk Teal, a partner at IT analyst firm Information Services Group. “Embedded AI and machine learning are moving beyond analytics to actively automate routine processes, detect anomalies in real-time, forecast outcomes, and increasingly recommend — or even execute — decisions within defined guardrails,” he says.

AI agents will stop being a novelty within ERP systems in 2026, adds Lasse Kalkar, CEO and co-founder of AI-powered accounting software provider LiveFlow. At the same time, finance teams are skeptical of AI and will demand human-in-the-loop workflows, he adds.

“Finance and accounting teams are done with manual data entry, reconciliations, invoice processing, and transactional busywork,” he says.  “The shift we’re now seeing is from finance teams doing everything themselves to delegating repetitive work to AI agents and acting as the final reviewers and decision-makers.”

More modular systems

While many experts see an AI takeover of ERP systems, there’s some disagreement about the potential for ERP users to embrace modular, best-of-breed apps to squeeze out parts of standalone, all-in-one solutions.

Some observers see a move away from monolithic ERP solutions that cover financial management, supply chain management, human resources management, customer relationship management, business intelligence, and myriad other functions, and toward modular apps that may work better for specific functionality.

Other IT leaders believe all-in-one ERP systems will remain popular because of the relative ease of purchasing and deploying them.

While there’s still a market for all-in-one ERP solutions, AI has made it easier for organizations to build their own ERP-related apps, says Andy Sen, CIO and CTO at B2B software marketplace provider AppDirect. He sees a trend toward using AI-assisted vibe coding to quickly build ERP apps that meet specific needs.

AppDirect has built several ERP apps itself, he says. “We are not planning to replace any of our ERPs, but we already have successful in-house implementations of some functions that used to be either done by an ERP or were modules that ERP vendors were advertising,” he adds.

While Sen doesn’t expect an end to all-in-one ERP solutions, he does believe vendors need to rethink their pricing models.

“There are going to be more and more companies that just don’t require a monolithic ERP with thousands of functions, 90% of which my company will never use,” he says. “If that’s the way they want to build software, great, but you just can’t price software that way.”

ERP users seem to be moving toward hybrid ecosystems, with core ERP platforms paired with integrated, best-in-class solutions for specialized compliance needs, adds Chris Zangrilli, vice president of technology strategy at tax technology company Vertex. ERP vendors are responding by emphasizing ecosystem interoperability and partnerships, he adds.

“The ERPs will provide the foundation for these solutions to connect into and user experiences that help to blend the flow of work,” he says. “This approach provides the ability for innovation to be delivered faster to customers and provide deep expertise in their solutions, especially those backed by specialized data feeds.”

The convenience of all-in-one

But ISG’s Teal sees all-in-one ERP platforms to remain the primary choice for most organizations, due to the value of vendor-maintained, end-to-end integration across core functions.

“That said, organizations with specialized or differentiating requirements will continue to complement core ERP with best-of-breed solutions, particularly where functionality needs exceed core ERP capabilities,” he adds.

Southern Glazer’s Bronson also sees room for both all-in-one solutions and specialized modular add-ons. All-in-one systems will appeal to smaller organizations, while flexibility and speed matter most at scale, he says.

The momentum at large retailers and direct-to-consumer companies is shifting toward modular, best-of-breed solutions, and his organization values the ability to add tools on top of a core ERP system.

“A flexible ecosystem surrounding a core ERP lets us integrate specialized capabilities and customize close to our customers without having to reinvent standard ERP processes,” he says.

The question many enterprises are asking themselves in 2026 is whether they are transforming their businesses fast enough to see the benefits of new technologies, most notably AI.

The answer, according to PwC’s 29th Global CEO Survey: Not really — at least, not yet.

In fact, the majority of enterprises aren’t seeing any real revenue increase or cost reduction as the result of AI deployments; only about one-third have seen any tangible benefits from AI in the last 12 months.

“CEOs are forging ahead with investment in AI even though immediate returns are often elusive,” PwC said in its report based on a survey of 4,450 CEOs across 95 countries and territories.

CEOs eager, but approaching AI tentatively

AI is advancing at an unparalleled pace, causing “excitement and anxiety in equal measure,” PwC noted.

The majority (69%) of CEOs surveyed agreed or strongly agreed that their organizational culture and technical environment enable AI adoption, and 51% agreed or strongly agreed that they had a clearly-defined roadmap for AI initiatives. However, “there is a gap emerging between leadership, aspiration, and execution,” PwC’s global chairman, Mohamed Kande, observed in a video accompanying the survey.

Some examples:

• More than half (56%) of CEOs have not realized either revenue or cost benefits from AI. Roughly one-third (30%) have measured tangible revenue increases, and just one-quarter (26%) are seeing lower costs thanks to AI;
• Only 40% say their level of investment is sufficient to meet their AI goals;
• Just over half have formal responsible AI and risk processes;
• Only about 30% grant their main AI tool access to all their documents and data;
• Just 42% believe they have the ability to attract high-quality technical AI talent;

PwC identified just one in eight companies as being in the “vanguard,” meaning they are achieving both additional revenues and lower costs as they apply AI extensively across their business. A “relatively small portion” of CEOs are applying AI to a significant extent to demand generation (22%); support services (20%); products, services, and experiences (19%); direction-setting (15%); or demand fulfilment (13%).

Guard against ‘innovation theater’

“Isolated, tactical AI projects often don’t deliver measurable value,” PwC noted. Measurable returns come from enterprise-scale deployment consistent with corporate strategy, and CEOs need to guard against what’s known as “innovation theater:” activities that “resemble innovation but produce no tangible value.”

To gauge innovation maturity, PwC asked CEOs about six “innovation-friendly practices.”

Do they:

• View innovation as a critical component of their overall business strategy?
• Collaborate with external partners to accelerate innovation?
• Test new ideas rapidly with customers or end-users?
• Tolerate high risk in innovation projects?
• Have routine processes to stop underperforming R&D projects?
• Have a defined innovation center, incubator, or corporate venturing division

Alarmingly, less than one in ten (8%) said their company had adopted at least five of those six practices to a large or very large extent.

“If innovation is part of your strategy, put real structure behind it, from how you test new ideas to how you scale what works,” said Kande. “Don’t do it alone: Partnerships and new forms of collaboration can speed up what you are able to bring to market.”

Issues with trust, concerns around cybersecurity

Trust is a cornerstone of business, but it can be increasingly difficult to come by due to a multitude of factors. Two-thirds (66%) of CEOs surveyed by PwC dealt with trust concerns in the last year around topics such as data use and privacy (38%), transparency (38%), and responsible AI and AI safety (37%).

At the same time, CEOs have become increasingly concerned about a range of near-term threats, notably technology disruption and cyber risk. About one third (31%) see their company as highly or extremely exposed to significant financial loss from cybersecurity threats. This is up 10% from just two years ago. As a result, about eight in 10 say they plan to improve their enterprise’s cybersecurity practices.

“Trust isn’t an intangible soft topic,” PwC emphasized. “Value is at stake.” Therefore, it should be prioritized as a boardroom topic and built and preserved through investments in data, processes, and controls.

CEOs need to rethink their calendars

There’s no doubt that CEOs have a lot to think about, and they must divide their time between short, medium, and long-term issues. But, according to PwC, they may not be using their time all that wisely.

CEOs surveyed said they spend almost half (47%) of their time on issues with horizons of less than a year. They then focus about a third of their time on activities with one to less than five year horizons, and just 16% on those with longer-term horizons of five years or more.

“Are they striking the right balance? It’s a question CEOs should ask themselves as they strive to build organizations to thrive both today and tomorrow,” PwC advised.

Dovetailing with this, just 30% of CEOs are confident about their company’s revenue growth over the next 12 months. That’s down from 38% last year and almost half of the peak of 56% in 2022.

Many leaders struggle with what PwC calls “the tyranny of the urgent,” leading them to spend too much time looking through a microscope, rather than through a telescope centered on long-term business goals.

It’s impossible to generalize how CEOs should focus their time, PwC conceded, and crisis situations are inevitable. But leaders are counterintuitively focusing on short-term activities even as they clearly identify that mid- to long-term enterprise viability is one of their most pressing issues.

“If these leaders are serious about reinvention, they may need to reinvent how they invest their time,” PwC noted. “The challenge facing CEOs at this critical moment is to decide, in conjunction with their top team and board, how the company’s value-creation recipe needs to change for the decade of innovation and industry reconfiguration ahead.”

A CIO’s wish list is typically long and costly. Fortunately, by establishing reasonable priorities, it’s possible to keep pace with emerging demands without draining your team or budget.

As 2026 arrives, CIOs need to take a step back and consider how they can use technology to help reinvent their wider business while running their IT capabilities with a profit and loss mindset, advises Koenraad Schelfaut, technology strategy and advisory global lead at business advisory firm Accenture. “The focus should shift from ‘keeping the lights on’ at the lowest cost to using technology … to drive topline growth, create new digital products, and bring new business models faster to market.”

Here’s an overview of what should be at the top of your 2026 priorities list.

1. Strengthening cybersecurity resilience and data privacy

Enterprises are increasingly integrating generative and agentic AI deep into their business workflows, spanning all critical customer interactions and transactions, says Yogesh Joshi, senior vice president of global product platforms at consumer credit reporting firm TransUnion. “As a result, CIOs and CISOs must expect bad actors will use these same AI technologies to disrupt these workflows to compromise intellectual property, including customer sensitive data and competitively differentiated information and assets.”

Cybersecurity resilience and data privacy must be top priorities in 2026, Joshi says. He believes that as enterprises accelerate their digital transformation and increasingly integrate AI, the risk landscape will expand dramatically. “Protecting sensitive data and ensuring compliance with global regulations is non-negotiable,” Joshi states.

2. Consolidating security tools

CIOs should prioritize re-baselining their foundations to capitalize on the promise of AI, says Arun Perinkolam, Deloitte’s US cyber platforms and technology, media, and telecommunications industry leader. “One of the prerequisites is consolidating fragmented security tools into unified, integrated, cyber technology platforms — also known as platformization.”

Perinkolam says a consolidation shift will move security from a patchwork of isolated solutions to an agile, extensible foundation fit for rapid innovation and scalable AI-driven operations. “As cyber threats become increasingly sophisticated, and the technology landscape evolves, integrating cybersecurity solutions into unified platforms will be crucial,” he says.

“Enterprises now face a growing array of threats, resulting in a sprawling set of tools to manage them,” Perinkolam notes. “As adversaries exploit fractured security postures, delaying platformization only amplifies these risks.”

3. Ensuring data protection

To take advantage of enhanced efficiency, speed, and innovation, organizations of all types and sizes are now racing to adopt new AI models, says Parker Pearson, chief strategy officer at data privacy and preservation firm Donoma Software.

“Unfortunately, many organizations are failing to take the basic steps necessary to protect their sensitive data before unleashing new AI technologies that could potentially be left exposed,” she warns, adding that in 2026 “data privacy should be viewed as an urgent priority.”

Implementing new AI models can raise significant concerns around how data is collected, used, and protected, Pearson notes. These issues arise across the entire AI lifecycle, from how the data used for initial training to ongoing interactions with the model. “Until now, the choices for most enterprises are between two bad options: either ignore AI and face the consequences in an increasingly competitive marketplace; or implement an LLM that could potentially expose sensitive data,” she says. Both options, she adds, can result in an enormous amount of damage.

The question for CIOs is not whether to implement AI, but how to derive optimal value from AI without placing sensitive data at risk, Pearson says. “Many CIOs confidently report that their organization’s data is either ‘fully’ or ‘end to end’ encrypted.” Yet Pearson believes that true data protection requires continuous encryption that keeps information secure during all states, including when it’s being used. “Until organizations address this fundamental gap, they will continue to be blindsided by breaches that bypass all their traditional security measures.”

Organizations that implement privacy-enhancing technology today will have a distinct advantage in implementing future AI models, Pearson says. “Their data will be structured and secured correctly, and their AI training will be more efficient right from the start, rather than continually incurring the expense, and risk of retraining their models.”

4. Focusing on team identity and experience

A top priority for CIOs in 2026 should be resetting their enterprise identity and employee experience, says Michael Wetzel, CIO at IT security software company Netwrix. “Identity is the foundation of how people show up, collaborate, and contribute,” he states. “When you get identity and experience right, everything else, including security, productivity, and adoption, follows naturally.”

Employees expect a consumer-grade experience at work, Wetzel says. “If your internal technology is clunky, they simply won’t use it.” When people work around IT, the organization loses both security and speed, he warns. “Enterprises that build a seamless, identity-rooted experience will innovate faster while organizations that don’t will fall behind.”

5. Navigating increasingly costly ERP migrations

Effectively navigating costly ERP migrations should be at the top of the CIO agenda in 2026, says Barrett Schiwitz, CIO at invoice lifecycle management software firm Basware. “SAP S/4HANA migrations, for instance, are complex and often take longer than planned, leading to rising costs.” He notes that upgrades can cost enterprises upwards of $100 million, rising to as much as $500 million depending on the ERP’s size and complexity.

The problem is that while ERPs try to do everything, they rarely perform specific tasks, such as invoice processing, really well, Schiwitz says. “Many businesses overcomplicate their ERP systems, customizing them with lots of add-ons that further increase risk.” The answer, he suggests, is adopting a “clean core” strategy that lets SAP do what it does best and then supplement it with best-in-class tools to drive additional value.

6. Doubling-down on innovation — and data governance

One of the most important priorities for CIOs in 2026 is architecting a foundation that makes innovation scalable, sustainable, and secure, says Stephen Franchetti, CIO at compliance platform provider Samsara.

Franchetti says he’s currently building a loosely coupled, API-first architecture that’s designed to be modular, composable, and extensible. “This allows us to move faster, adapt to change more easily, and avoid vendor or platform lock-in.” Franchetti adds that in an era where workflows, tools, and even AI agents are increasingly dynamic, a tightly bound stack simply won’t scale.

Franchetti is also continuing to evolve his enterprise data strategy. “For us, data is a long-term strategic asset — not just for AI, but also for business insight, regulatory readiness, and customer trust,” he says. “This means doubling down on data quality, lineage, governance, and accessibility across all functions.”

7. Facilitating workforce transformation

CIOs must prioritize workforce transformation in 2026, says Scott Thompson, a partner in executive search and management consulting company Heidrick & Struggles. “Upskilling and reskilling teams will help develop the next generation of leaders,” he predicts. “The technology leader of 2026 needs to be a product-centric tech leader, ensuring that product, technology, and the business are all one and the same.”

CIOs can’t hire their way out of the talent gap, so they must build talent internally, not simply buy it on the market, Thompson says. “The most effective strategy is creating a digital talent factory with structured skills taxonomies, role-based learning paths, and hands-on project rotations.”

Thompson also believes that CIOs should redesign job roles for an AI-enabled environment and use automation to reduce the amount of specialized labor required. “Forming fusion teams will help spread scarce expertise across the organization, while strong career mobility and a modern engineering culture will improve retention,” he states. “Together, these approaches will let CIOs grow, multiply, and retain the talent they need at scale.”

8. Improving team communication

A CIO’s top priority should be developing sophisticated and nuanced approaches to communication, says James Stanger, chief technology evangelist at IT certification firm CompTIA. “The primary effect of uncertainty in tech departments is anxiety,” he observes. “Anxiety takes different forms, depending upon the individual worker.”

Stanger suggests working closer with team members as well as managing anxiety through more effective and relevant training.

9. Strengthening drive agility, trust, and scale

Beyond AI, the priority for CIOs in 2026 should be strengthening the enabling capabilities that drive agility, trust, and scale, says Mike Anderson, chief digital and information officer at security firm Netskope.

Anderson feels that the product operating model will be central to this shift, expanding beyond traditional software teams to include foundational enterprise capabilities, such as identity and access management, data platforms, and integration services.

“These capabilities must support both human and non-human identities — employees, partners, customers, third parties, and AI agents — through secure, adaptive frameworks built on least-privileged access and zero trust principles,” he says, noting that CIOs who invest in these enabling capabilities now will be positioned to move faster and innovate more confidently throughout 2026 and beyond.

10. Addressing an evolving IT architecture

In 2026, today’s IT architecture will become a legacy model, unable to support the autonomous power of AI agents, predicts Emin Gerba, chief architect at Salesforce. He believes that in order to effectively scale, enterprises will have to pivot to a new agentic enterprise blueprint with four new architectural layers: a shared semantic layer to unify data meaning, an integrated AI/ML layer for centralized intelligence, an agentic layer to manage the full lifecycle of a scalable agent workforce, and an enterprise orchestration layer to securely manage complex, cross-silo agent workflows.

“This architectural shift will be the defining competitive wedge, separating companies that achieve end-to-end automation from those whose agents remain trapped in application silos,” Gerba says.

Accenture has announced that it has agreed to acquire UK AI startup Faculty for an undisclosed sum, a potentially significant move in a consultancy sector currently scrambling to add greater artificial intelligence expertise.

According to Accenture, Faculty’s UK-based workforce of 400 “AI native professionals” will be integrated with its consulting teams, allowing the company to offer its customer base “world‑class AI capabilities.” The company will also integrate Faculty’s AI decision intelligence platform, Frontier, into its services.

“With Faculty, we will further accelerate our strategy to bring trusted, advanced AI to the heart of our clients’ businesses,” commented Accenture chair and CEO, Julie Sweet.

One detail that marks the acquisition as unusual is that Faculty’s current CEO, Marc Warner, will reportedly join Accenture’s Global Management Committee as chief technology officer (CTO). If confirmed, this means that a company employing a few hundred people will take a key board position in a huge consulting outfit with nearly 800,000 employees worldwide.

Accenture still lists its CTO as Rajendra Prasad, who will presumably step back from this role to focus on his other day job as the company’s Group Chief Executive – Technology. CIO.com contacted Accenture and Faculty to confirm the new roles, but had no response by publication time.

AI reinvention

Traditional tech acquisitions are usually motivated by the value offered by a company’s patents, products and customers. With AI companies, just as important right now is human expertise.

Faculty offers all of these. Co-founded in 2014 as ASI Data Science by then Harvard quantum physics research fellow Warner, it was renamed Faculty in 2019. This might have been an attempt to disassociate it from allegations, which it strenuously denied, that it was part of the same internship program as scandal-hit company Cambridge Analytica, through the latter’s parent company, SCL Group.

Since then, Faculty has established a solid reputation through its work with the UK government, including the creation of an NHS Early Warning System (EWS) system used to predict hospital admissions and ventilator requirements during the Covid pandemic.

This dovetails well with Accenture’s direction; it has spent the last year undergoing an AI makeover. In June, the company folded five business units into a single division, Reinvention Services, as part of a plan to “re-invent Itself for the Age of AI.” At the same time, it started calling its employees “reinventors”.

The company has also formed alliances with OpenAI and Anthropic which will see tens of thousands of its employees trained to use and promote both companies’ chatbot and agentic technologies.

“We are writing the playbook for how to be the most AI-enabled, client-focused professional services company in the world,” said Accenture CEO Sweet in this week’s announcement of the acquisition.

It all started with a sewing machine. Ramón Álvarez de Arriba was one of the many Asturian immigrants who sought their fortunes in America in the 19th century. When he returned to Spain, he was the official distributor of Singer sewing machines, and upon his death in 1920, he dedicated his great wealth to creating a foundation in the nearby Peón Valley to strengthen agricultural education and innovation.

Fast forward to 2019 and the foundation developed the CTIC RuralTech innovation center, a branch of the Information and Communication Technology Center Foundation (CTIC). 

The CTIC’s headquarters in Gijón now include a quantum simulator, data hub, and an expanded reality experience generator. “We’ve been around for 22 years, and from the beginning, we’ve had a very close connection with rural areas,” says Fidel Díaz, CTIC’s R&D director. When the opportunity came up a few years ago to take over assets of the Ramón Álvarez de Arriba Foundation, they embraced it and opened a center that explores cutting-edge technologies, and shares space with the school that opened a century ago.

RuralTech remains focused on the enduring ideal to revitalize rural areas, and applies cutting-edge tools to address major challenges facing these territories, like climate change, which greatly impacts agriculture. “Many crops will no longer be able to be grown in the regions where they’re currently cultivated,” says Díaz. So it’s necessary to discover which varieties are most resistant to change, and to gather data to understand the new context. “We can control that,” he adds, emphasizing that technology makes it possible to perform analyses, better understand the soil, and differentiate what is and isn’t more resilient.

A time machine for the countryside

Cutting-edge IT tools now available include climate simulation systems and land-use intelligence, so crops can be monitored, and changes in the landscape can be understood. And thanks to the collected data, models are created that are applicable to other regions. As Díaz points out, the problems of the Asturian countryside aren’t unique and are repeated in other parts of Spain and throughout Europe. So applied to specific elements, these tools help improve the sustainability and efficiency of agricultural and livestock operations.

It’s like a time machine, says Fernando Ruenes, who, along with Ángela Campo, runs strawberry production company Asturiana de Fresas, and uses the CTIC simulator. They divide it into different planting zones and apply varying conditions to each. This way, they can predict outcomes in different contexts, and anticipate the effects of potential diseases, climate change, and water stress. “With the simulator, we have an advantage,” says Ruenes. “It’s about anticipating real-life situations.”

Thanks to these tests, you can even determine the optimal planting date or identify which species and crops not yet grown in the area might thrive, like olives or pistachios. A better understanding of the impact of different conditions also helps reduce pesticide use and increase crop profitability. Without AI and other emerging technology, these types of tests and simulations would take years, but with it, they can be completed in just one.

AI ​​and the big cheese

Enrique López, CEO of Spanish cheese producer Industrias Lácteas Monteverde, was once asked why they weren’t using the data generated by their cheese tastings and production. “We might have the data, but who’s going to develop this?” he recalls thinking. The solution lay with the technology center. They were the ones who could do the development. They started in 2020 when the pandemic upended the market and forced cheesemakers to reinvent production to adapt to different consumption habits. After the disruption, things got back on track, and now AI understands cheese, and which milk is best suited for which type of cheese.

“We knew the ideal cheese that had to be produced,” López says. But the milk isn’t always the same. Many variables affect it, from truck routes through different farms to cow diets. The quality is always high but different nuances impact the final result. Also, the way the product is presented or consumed requires changes to the maturation process. But now AI takes that entire pool of incoming milk and determines which is suitable for which purpose.

The AI ​​provides a recommendation, and López says more variables need to be included, such as registered orders and estimated working time. “This is a continuous learning process,” he says. The order book, stock levels, and estimates of milk and cheese price fluctuations would also allow for even greater efficiency. 

So the overall result is positive. They’ve already seen return rates approach zero and achieved collateral benefits, such as lowering the costs of comparative analyses.

Tech potential for the field

Although people often associate large urban environments with innovation, the rural world has always been in contention. “We’ve been innovating for many years,” López says. Industrias Lácteas Monteverde, in fact, is currently in the middle of a project with the University of Oviedo to convert whey from cheese production into plastic, and to use technology to help them reduce water consumption in the cleaning process.

It’s just one example of how tech potential in agriculture is limitless, especially for addressing crucial challenges of the future that already shape the present. “It’s very important to combine agricultural expertise with technological expertise,” adds Asturiana de Fresas’ Ruenes. They contribute their knowledge of the land, plants, and agricultural cycles, and the technology center provides the IT tools to overcome boundaries.

But adding tech for the sake of it is pointless. ICT tools can’t be superfluous and must offer solutions that add business value. “There’s no better way to innovate rural areas than from within rural areas,” Díaz says. “You have to endure it. Being in the countryside allows you to understand the real problems of those areas in real time, the context, and be in direct contact with key decision-makers.”

AI pilot projects are often executed quickly and successfully. But the real challenge is scaling the solution across the entire enterprise, says Mauro Macchi, Accenture’s EMEA CEO. And for AI to contribute genuine added value, a company-wide redesign, including processes, systems, skills, and ways of working, is often necessary.

Macchi adds that AI implementation should start with the problem that needs solving, not the technology. Use cases here from London-based beauty startup Noli, Spanish energy company Repsol, and supply chain specialist Kion illustrate the diverse challenges companies can face, whether it’s the data, processes, or regulations.

Using AI to combat beauty burnout

Noli, a personalized beauty platform backed by the L’Oréal Group, uses AI to reinvent the beauty industry with the help of an app to address the growing problem of skin anxiety and beauty burnout.

The aim is to end the feeling of being overwhelmed by beauty products. As a result, in the UK alone, such products worth over £1 billion ($1.35 billion) are wasted annually because they don’t deliver desired results.

So Noli aims to combat this with a vertical expert AI deeply rooted in beauty science, and based on a robust, multi-layered architecture that encompasses scientific research and multimodal consumer signals, including one million anonymized facial scan data points.

The biggest challenge for Noli wasn’t the AI but the data. Beauty data is so fragmented, with scientific research data, formulation information, insights from facial scans, user behavior, and sensory attributes all coming in different formats from various sources.

This complex mix needed to be transformed into something structured, trustworthy, and scalable. So the proprietary Beauty Knowledge Graph was developed, which structures raw data, validates outputs to prevent hallucinations, and matches products to the right needs in real time.

The name Noli, “No one like I,” is also the mission statement. Users can determine their personal beauty DNA profile by answering a questionnaire, undergoing an expert facial scan, or contacting Noli directly.

The company then creates personalized recommendations for trusted, scientifically sound beauty brands. To achieve this, Noli uses continuous learning loops as every match, review, purchase, or return improves the system.

The conversion rate seems to confirm the success of this approach. According to Noli CEO and co-founder Amos Susskind, website visitors are nearly four times more likely to make a purchase, and also buy more than usual. And the number of repeat customers has doubled in five months.

A multi-energy approach to AI

Repsol’s approach to AI is quite different. The gen AI journey for the multi-energy multinational, with over 25,000 employees, began as part of a broader digital transformation initiated in 2018.

The strategy comprises three main areas: personal productivity, improving current processes, and Gold Mine, considered key to redesign and reinvent projects and processes.

To achieve everything laid out, the company uses multi-agent systems designed to solve complex processes or workflows by enabling specialized agents to collaborate. Agents require skills such as knowledge, planning, reasoning, coordination, and execution, all supported by a shared short- and long-term memory.

The system also operates via an orchestrator that receives requests. It identifies the appropriate planner, who in turn defines the plan and selects suitable, highly specialized agents from a catalog. The system is currently operational and comprises 34 agents, with whom over 100 employees collaborate in a hybrid work environment.

Besides data quality, Repsol CIO Juanma García faced the key challenge of recognizing that AI is not a standard technology. Company executives had to learn that AI initiatives can fail if they’re implemented haphazardly, and their experience considered cognitive infrastructure.

Another ongoing priority is change management and helping users adapt to a new way of working, driven by AI. In order to be more effective and avoid problems, Repsol also defines agents with limited scope for specialized tasks instead of creating large agents that cover too much.

Repsol’s advice for other companies trying to get value from AI investments is to define a clear strategy. While increasing personal productivity, like through Copilot, is difficult to demonstrate in a profit and loss statement, completely redesigning processes is key to achieving significant added value.

Using physical AI to create new supply chains

As a provider of supply chain solutions, Kion aims to bring physical AI to the warehousing and distribution market. Given the significant pressure on global supply chains due to geopolitical tensions and disruptions, Kion is forced to rethink its approach to warehouse automation. The goal is to make them more real-time capable and resilient, replacing rigid structures with flexible, adaptable, and intelligent solutions.

Kion has Mega, an Omniverse blueprint from Nvidia, for this purpose, enabling large-scale development, testing, and optimization of physical AI and robot fleets using a digital twin. To quickly transfer physical locations into the digital system, Kion uses a scanner that captures a distribution or fulfillment center, and feeds the data into the Nvidia Omniverse. Subsequently, replicas of all AMRs, AGVs, and bots are integrated into the digital system.

The digital twin then allows Kion to simulate an unlimited number of scenarios and measure operational KPIs, such as throughput and utilization, before making changes to the physical warehouse. From there, the digital twin can instruct the physical twin on optimal steps to take.

While Kion CEO Rob Smith sees the company as technologically well-positioned, the regulatory environment in the EU is a headache as he feels it stifles innovation. This, he says, is one reason why the pace of AI adoption is significantly faster in North America and China, so he advocates allowing innovation first and regulating it later, rather than the other way around.

When the AWS US East 1 region went dark in October, it created a ripple effect that reached far beyond cloud workloads. Atlassian tools, home monitoring systems, communication platforms and even school websites became unavailable within minutes. None of these failures resulted from an attack nor reflected a lack of backup architecture. They represented a growing challenge for CIOs stemming from the unseen dependencies that now sit underneath critical business functions.

For many organizations, the event felt like a cyber incident even though it wasn’t, but it raised a difficult question for CIOs about how to prepare for a disruption that lives outside your infrastructure, yet carries the same operational and reputational consequences as a security breach.

That has been top of mind for Yogs Jayaprakasam, the chief information, technology and digital officer at business payments and financial tech services provider Deluxe. The 110-year-old company relies on a mix of cloud platforms, SaaS products, and enterprise systems, and Jayaprakasam says the AWS outage reinforced something he’s been observing for years. Following the event, he traced more than a dozen public cloud outages across the three major hyperscalers in the past 12 months, each lasting six hours or more.

Beyond strong cloud architecture, “Preparedness is the real differentiator,” he says. “Even the best technology teams can’t compensate for gaps in scenario planning, coordination, and governance.”

The convergence of operational and cyber failures

Jayaprakasam’s perspective began to shift as he studied recent incidents, from the Meta BGP misconfiguration in 2021 to last year’s widespread CrowdStrike update failure. He explained that although these events weren’t cyber attacks, the customer impact, communication challenges, and recovery complexity mirrored major security breaches. “We treated disaster recovery and cyber response like two different problems,” he says. “But when something like a bad update takes down millions of machines, it behaves exactly like a ransomware event.”

Within Deluxe, disaster recovery tests historically focused on applications the company controlled, while cyber tabletops focused on simulated intrusions. The AWS outage exposed the gap between those exercises and real-world conditions. Shifting its applications from AWS East to AWS West was swift, and the technology team considered the recovery a success. Yet it was far from business as usual, as developers still couldn’t access critical tools like GitHub or Jira. “We thought we’d recovered, but the day-to-day work couldn’t continue because the tools we depend on were down,” he says. That experience reshaped how his team defines resilience.

Seeing the full dependency chain

In response, Deluxe began mapping system dependencies in far greater detail. One of the simplest but most important changes, Jayaprakasam says, was adding a question to every SaaS intake process about where the application actually runs, since knowing whether a tool operates on AWS West, Azure East, or another region allows the team to simulate real failure scenarios, and plan coordinated recovery steps with vendors.

“It’s a shift in data collection that makes you better prepared,” he says. “Once you see which SaaS platforms share the same cloud region, you start to think very differently about how the business comes back online during an outage.”

This visibility allows Deluxe to extend tabletop scenarios beyond the boundaries of owned infrastructure. The company now includes operational failures, cloud region outages, and third-party disruptions in its joint cyber and DR exercises, rather than running them in separate tracks. This unified approach, called ResilienceONE, delivers a more realistic understanding of how failures propagate across the ecosystem, strengthening both resilience and preparedness.

Coordination over investment

Spending more money on additional infrastructure or redundant cloud providers isn’t the answer. After all, following every major outage, Jayaprakasam says sales pitches arrive promising zero downtime if organizations spend more on new platforms. He pushes back on those claims. In a well-architected hybrid cloud setup, he says resilience is more often a coordination problem than a spending problem, and distributing workloads across two cloud providers doesn’t guarantee better outcomes if the clouds rely on the same power grid, or experience the same regional failure event.

He argues that the more effective approach is strengthening coordination between IT, cybersecurity, business continuity, and third-party vendors. “The real question is whether you have the right contacts, process, and response patterns in place,” he says. That coordination includes creating a single view of dependencies, practicing joint response exercises, and ensuring that vendors can be reached and escalated during an incident. You can gradually develop advanced dependency mapping of your assets across boundaries to simulate potential impact radius scenarios.

In addition, Jayaprakasam believes that many organizations already have strong response processes but they simply apply them too narrowly. Legal and compliance teams, for example, have well established playbooks for cyber incidents, and those playbooks can also apply to operational disruptions.

“You don’t need to reinvent the wheel,” he says. “You need to make the process holistic and complementary instead of creating separate paths.” So when advising peers, Jayaprakasam recommends starting with the scenarios used in tabletop exercises. He encourages CIOs to ask whether they’re testing for operational disruptions and third party outages in addition to cyber attacks, and whether those exercises reflect the actual dependencies that keep the business running. Plus, he suggests reviewing where existing playbooks can be unified rather than creating new ones, focusing on coordination across teams and partners instead of new investments.

The leadership challenge: motivating the work no one sees

Jayaprakasam is candid about the cultural challenge that comes with resilience work. He says that in an era dominated by AI initiatives and digital strategy, the toughest part of leadership is motivating teams to focus on the routines that seem unexciting but are critical to a company’s ability to recover during a crisis. “Most of the work that prepares you for these moments is boring,” he says. “But that boring work is what changes the business outcome.”

He believes CIOs must reward that discipline, not just the innovation work that receives more headlines. And he’s clear about the stakes. AI may define the long-term value of a technology organization, but reliability defines its credibility in the present. “Your ability to be seen as a strategic partner can be taken away in a second if the systems aren’t available,” he says. “Striking the balance is what matters.”

BCG research has found that over 70% of digital transformations fail to meet their goals. While digital transformation leaders outperform their competitors to reap the rewards, the typical digital transformation effort flounders on the sheer complexity of using technology to increase a company’s speed and learning at scale.   As initiatives become increasingly complex, the likelihood of a successful outcome goes down.

The reason lies in a growing paradox: technology is advancing exponentially, but the enterprise’s ability to change remains largely fixed. Each new wave of innovation accelerates faster than organizational structures, governance and culture can adapt, creating a widening gap between the speed of technological progress and the pace of enterprise evolution.

Each new wave of innovation demands faster decisions, deeper integration and tighter alignment across silos.  Yet, most organizations are still structured for linear, project-based change. As complexity compounds, the gap between what’s possible and what’s operationally sustainable continues to widen.

The result is a growing adaptation gap — the widening distance between the speed of innovation and the enterprise’s capacity to absorb it. CIOs now sit at the fault line of this imbalance, confronting not only relentless technological disruption but also the limits of their organizations’ ability to evolve at the same pace. The underlying challenge isn’t adopting new technology; it’s architecting enterprises capable of continuous adaptation.

The innovation paradox

Ray Kurzweil’s Law of Accelerating Returns tells us that innovation compounds. Each breakthrough accelerates the next, shrinking the interval between waves of disruption. Where the move from client–server to cloud once took years, AI and automation now reinvent business models in months. Yet most enterprises remain structured around quarterly cycles, annual plans and five-year strategies — linear rhythms in an exponential world.

This mismatch between accelerating innovation and a slow organizational metabolism is the Transformation Trap. It emerges when the enterprise’s capacity to adapt is constrained by a legacy architecture, culture and governance designed for control rather than learning, and accumulated debt that slows down reinvention.

3 structural fault lines

1. Outpaced architecture

Most enterprises were built around periodic reboots aligned to the renewal of new technology, not continuous renewal. Legacy systems and delivery models offer stability but are not resilient to change.  When architecture is treated as documentation rather than a living capability, agility decays. Each new wave of innovation arrives before the last one stabilizes, creating fatigue rather than resilience.

2. Compounding debt

Technical debt has been rapidly amassing in three areas: accumulated (legacy systems, brittle integrations and semantic inconsistencies that have been layered through mergers and upgrades), acquired (trade-offs leaders make in the name of speed such as mergers, platform swaps or modernization sprints that prioritize short-term delivery over long-term coherence.), and emergent (AI, automation and advanced analytics without the suitable frameworks or governance to integrate them sustainably). The result destabilizes transformation efforts. Without a coherent architectural foundation, every modernization effort simply layers new fragility atop the old.

3. Governance built for yesterday

Traditional governance models reward completion, not adaptation. They measure compliance with the plan, not readiness for change. As innovation cycles shorten, this rigidity creates blind spots, slowing reinvention even as investment increases.

Why reboots keep failing

Most modernization programs change the surface, not the supporting systems. New digital interfaces and analytics layers often sit atop legacy data logic and brittle integration models. Without rearchitecting the semantic and process foundations, the shared meaning behind data and decisions, enterprises modernize their appearance without improving their fitness.

As companies struggle to keep up with technology innovation, emergent debt will become an increasingly significant challenge: the cost of speed without an underlying architecture. Agile teams move fast but in isolation, creating redundant APIs, divergent data models and inconsistent semantics. Activity replaces alignment. Over time, delivery accelerates, but enterprise coherence erodes as new technologies are adopted on brittle systems.

Governance, meanwhile, remains static. Review boards and compliance gates were built for predictability, not velocity. They create the illusion of control but operate on a delay that makes true adaptation increasingly impossible in our accelerating world.

The CIO’s dilemma

CIOs today stand between two diverging curves: the exponential rise of technology and the linear pace of enterprise adaptation. This gap defines the Transformation Trap. It’s not about delivering more change.  It’s about building systems and structures that can evolve continuously without the start and stop of a project mindset.

The new question is not, ‘How do we transform again?’ but ‘How do we build so we never need to?’ That requires architectures capable of sustaining and sharing meaning across every system and process, which technologists refer to as semantic interoperability. For CIOs, it’s the ability to ensure data, workflows and AI models all speak the same language — enabling trust, agility and decision‑ready intelligence.

CIO insight: Semantic interoperability

The next era of transformation depends on shared meaning across systems. Without it, AI and analytics amplify noise instead of insight. Building semantic interoperability is not just a technical exercise.  It’s the foundation of decision trust, adaptive automation and continuous reinvention.

Leaders like Palantir have unlocked the power of the Palantir Foundry platform to demonstrate what’s possible when data from thousands of systems is unified through a shared ontology. In platforms like Foundry, meaning becomes the connective tissue that links operational reality to executive insight, enabling enterprises to reason, predict and act with confidence.

For CIOs, this is the next frontier: not just integrating systems but integrating understanding.

5 imperatives for continuous change

1. Make governance a living system. Governance must evolve from control to continuity. Instrument your enterprise with telemetry and policy‑as‑code guardrails that guide rather than gate. Governance should act like a gyroscope, stabilizing the course while enabling movement.
2. Treat architecture as the enterprise’s metabolism. Architecture is not a static blueprint; it’s a living system that must refresh continuously. Embed architects directly in delivery teams. Evolve models and ontologies alongside code. A healthy enterprise architecture metabolizes change rather than resists it.
3. Measure system fitness, not project velocity. Stop measuring completion speed and start measuring adaptability. Track how quickly your organization can absorb new technologies without needing a reboot. Key indicators include shorter time‑to‑adapt, fewer redundant integrations and higher semantic interoperability across systems.
4. Cultivate a bold learning culture. Continuous change requires continuous learning. Foster a culture that rewards curiosity, experimentation and the courage to retire what no longer works. Encourage teams to test, learn and share insights quickly, turning every iteration into institutional wisdom. Boldness in adopting what works, and humility in letting go of what doesn’t, is the human engine of transformation.  Don’t neglect architectural understanding in the race to learn new technologies.
5. Orchestrate intent through continuous feedback. Today’s enterprise requires constant calibration between intent and impact.  Build a feedback architecture that senses, interprets and responds in real-time — linking business objectives to operational signals and system behavior. This creates a dynamic enterprise that doesn’t just execute plans but continuously evolves its direction through insight. Feedback becomes the compass that turns movement into momentum.

A closing reflection

Kurzweil’s law tells us the future accelerates exponentially, but enterprises still plan in straight lines. Transformation cannot remain episodic; it must become a living process of continuous design. CIOs are now the custodians of continuity, tasked with building architectures that learn, evolve and adapt at the speed of change.

In a world where technology doubles, only architecture that evolves continuously both semantically and operationally can endure. 

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

AWS kicked off re:Invent 2025 with a defensive urgency that is unusual for the cloud leader, arriving in Las Vegas under pressure to prove it can still set the agenda for enterprise AI.

With Microsoft and Google tightening their grip on CIOs’ mindshare through integrated AI stacks and workflow-ready agent platforms, AWS CEO Matt Garman and his lieutenants rolled out new chips, models, and platform enhancements, trying to knit the updates into a tighter pitch that AWS can still offer CIOs the broadest and most production-ready AI foundation.

Analysts remain unconvinced that AWS succeeded.

“We are closer, but not done,” said David Linthicum, independent consultant and retired chief cloud strategy officer at Deloitte.

Big swing but off target

Garman’s biggest swing, at least the one that got it “closer”, came in the form of Nova Forge,  a new service with which AWS is attempting to confront one of its strategic weaknesses: the absence of a unified narrative that ties data, analytics, AI, and agents into a single, coherent pathway for enterprises to adopt.

It’s this cohesion that Microsoft has been selling aggressively to CIOs with its recently launched IQ set of offerings.

Unlike Microsoft’s IQ stack, which ties agents to a unified semantic data layer, governance, and ready-made business-context tools, Nova Forge aims to provide enterprises raw frontier-model training power in the form of a toolkit to build custom models with proprietary data, rather than a pre-wired, workflow-ready AI platform.

But it still requires too much engineering lift to adopt, analysts say.

AWS is finally positioning agentic AI, Bedrock, and the data layer as a unified stack instead of disconnected services, but according to Linthicum, “It’s still a collection of parts that enterprises must assemble.”

There’ll still be a lot of work for enterprises wanting to make use of the new services AWS introduced, said Phil Fersht, CEO of HFS Research.

“Enterprise customers still need strong architecture discipline to bring the parts together. If you want flexibility and depth, AWS is now a solid choice. If you want a fully packaged, single-pane experience, the integration still feels heavier than what some competitors offer,” he said.

Powerful tools instead of turnkey solutions

The engineering effort needed to make use of new features and services echoed across other AWS announcements, with the risk that they will confuse CIOs rather than simplify their AI roadmap.

On day two of the event, Swami Sivasubramanian’s announced new features across Bedrock AgentCore, Bedrock, and SageMaker AI to help enterprises move their agentic AI pilots to production, but still focused on providing tools that accelerate tasks for developers rather than offering “plug-and-play agents” by default, Linthicum said.

The story didn’t change when it came to AWS’s update to vibe-coding tool Kiro or the new developer-focused agents it introduced to simplify devops, said Paul Nashawaty, principal analyst at The Cube Research.

“AWS clearly wants to line up against Copilot Studio and Gemini Agents. Functionally, the gap is closing,” said Nashawaty. “The difference is still the engineering lift. Microsoft and Google simply have tighter productivity integrations. AWS is getting there, but teams may still spend a bit more time wiring things together depending on their app landscape.”

Similarly, AWS made very little progress toward delivering a more unified AI platform strategy. Analysts had looked to the hyperscaler to address complexity around the fragmentation of its tools and services by offering more opinionated MLops paths, deeper integration between Bedrock and SageMaker, and ready-to-use patterns that help enterprises progress from building models to deploying real agents at scale.

Linthicum was dissatisfied with efforts by AWS to better document and support the connective tissue between Bedrock, SageMaker, and the data plane. “The fragmentation hasn’t vanished,” he said. “There are still multiple ways to do almost everything.”

The approach taken by AWS contrasts sharply with those of Microsoft and Google to present more opinionated end-to-end stories, Linthicum said, calling out Azure’s tight integration around Fabric and Google’s around its data and Vertex AI stack.

Build or buy?

For CIOs who were waiting to see what AWS delivered before finalizing their enterprise AI roadmap, they are back at a familiar fork: powerful primitives versus turnkey platforms.

They will need to assess whether their teams have the architectural discipline, MLops depth, and data governance foundation to fully capitalize on AWS’s latest additions to its growing modular stack, said Jim Hare, VP analyst at Gartner.

“For CIOs prioritizing long-term control and customization, AWS offers unmatched flexibility; for those seeking speed, simplicity, and seamless integration, Microsoft or Google may remain the more pragmatic choice in 2026,” Hare said.

The decision, as so often, comes down to whether the enterprise wants to build its AI platform or just buy one.

The Arm micro-architecture has enjoyed fabulous gains over the past few decades as its range expanded from embedded systems and mobile devices to cloud service providers deploying instances powered by their own brands of Arm-based chips. But enterprise use and acceptance haven’t materialized.

The Arm architecture was developed in 1985 by a team at Acorn Computers, a developer of microcomputers in the UK that released the first Arm chip, which was originally called the Acorn RISC Machine. Over time, Acorn’s computer business faded away, and rather than sell the processor, Arm — which was officially founded as a company in November 1990 as Advanced RISC Machines — sold processor designs that licensees could modify to create a unique design.

For the longest time, Arm was an also-ran that barely registered in any computing capacity except for mobile and embedded. Then came the fateful decision in 2007 by Intel to decline to design a custom chip for Apple for its planned smartphone. Apple instead went with Arm for the iPhone, and the rest is history.

Since then, Arm has become standard issue in every smartphone and tablet on the market. It has also found some success in low-end notebooks, particularly Chromebooks. But outside of SmartNICs, the enterprise remains elusive. It’s not from a lack of trying. There have been multiple efforts to sell Arm-based server chips, all of which have failed. These include:

• Calxeda EnergyCore: Launched in 2011, Calxeda was an early pioneer in Arm servers but failed because it was a 32-bit design, not 64-bit.
• Nvidia Project Denver: A rare flop for Nvidia, it gained no traction.
• Unnamed Samsung Arm server chips: Canceled before any public release.
• AMD Seattle (Opteron A1100) and K12: Both were ultimately abandoned as AMD shifted its strategy back to x86.
• Qualcomm Centriq: Qualcomm released the Centriq 2400, a 48-core Arm server processor, but ended production shortly after launch.
• Broadcom Vulcan: Broadcom developed a competitive chip but dropped it as part of a restructuring. The IP was later picked up by Cavium and later acquired by Marvell.
• HPE Project Moonshot: These servers made it to market, but HPE has since discontinued sales of them.

For its part, Arm has made significant effort to develop its Neoverse architecture. The Neoverse is a 64-bit design specifically for the server market. The N-series, now in its third generation, is targeted at enterprise servers doing general compute workloads, and the V-series, also in its third generation, is optimized and tuned for high-performance computing and advanced analytics.

The AMD effect

A key reason so many vendors tried to succeed with Arm is because at the time, in the mid-2010s, AMD was not a viable alternative to Intel. It was struggling and had serious performance lag. OEMs and customers generally don’t like to be locked into one vendor, and there was a desire for an alternative to Intel. That led many to turn their gaze to Arm.

But in 2017, AMD released the Zen architecture, which was equal if not superior to the Intel architecture. Zen made AMD competitive, and it fueled an explosive rebirth for a company that was near death a few years prior.

AMD now has about 30% market share, while Intel suffers from a loss of technology as well as corporate leadership. Now, customers have a choice of Intel or AMD, and they don’t have to worry about porting their applications to a new platform like they would have to do if they switched to Arm.

Analysts weigh in on Arm

Tim Crawford sees no demand for Arm in the data center. Crawford is president of AVOA, a CIO consultancy. In his role, he talks to IT professionals all the time, but he’s not hearing much interest in Arm.

“I don’t see Arm really making a dent, ever, into the general-purpose processor space,” Crawford said. “I think the opportunity for Arm is special applications and special silicon. If you look at the major cloud providers, their custom silicon is specifically built to do training or optimized to do inference. Arm is kind of in the same situation in the sense that it has to be optimized.”

“The problem [for Arm] is that there’s not necessarily a need to fulfill at this point in time,” said Rob Enderle, principal analyst with The Enderle Group. “Obviously, there’s always room for other solutions, but Arm is still going to face the challenge of software compatibility.”

And therein lies what may be Arm’s greatest challenge: software compatibility. Software doesn’t care (usually) if it’s on Intel or AMD, because both use the x86 architecture, with some differences in extensions. But Arm is a whole new platform, and that requires porting and testing. Enterprises generally don’t like disruption — which an architecture change would necessitate.

Arm’s cloud success

Where Arm has been successful is among hyperscale cloud service providers. Every significant player has made its own Arm-based custom CPU as a cheaper alternative to x86 CPUs. For example:

• Graviton series from AWS is used in a broad range of AWS EC2 instances and is based on Neoverse V2 cores, offering up to 96 cores, enhanced networking, and improved price-performance for enterprise workloads.
• Microsoft Azure Cobaltis based on Ampere Altra and Neoverse designs. It’s optimized for Microsoft cloud VMs, enterprise integration, Microsoft ecosystem workloads, and hybrid scenarios.
• Google Cloud Tau T2A instances are powered by Ampere Altra (Arm Neoverse) processors, optimized for cloud-native performance.
• Alibaba Cloud ECS g8y offers Arm instances based on Neoverse, targeted at web hosting, database workloads, and more.

That’s not to say that Arm has not had a victory or two. For the first time this past November, there were 18 Arm-based supercomputers on the top 500 list of supercomputers in the world. All 18 rely on the Grace CPU designed by Nvidia, which is built for high performance computing.

For standalone chipmakers, there are two options: Ampere Computing, which makes the Altra and Altra Max Processor specifically designed for cloud service providers; and Nvidia with the Grace processor, designed for use in tandem with its GPUs, which include the Hopper and Blackwell generations. Qualcomm is rumored to be trying yet again at a server chip, but nothing has been announced.

Arm’s strategy isn’t to try to take business away from the x86 market. Rather, it seeks to capture share in the cloud and eventually leverage that to get into the enterprise. It’s not trying to displace x86 where it lives; it’s trying to capture new computing areas that are mostly in the cloud where x86 has no dominance. From there, Arm hopes to work its way back into the enterprise, says Mohamed Awad, senior vice president and general manager of the infrastructure line of business at Arm.

“We think that our adoption, both in the cloud and on prem, continues to accelerate as their workloads advance and become more and more modernized,” Awad says. “Our focus has been about enabling [enterprises] for hybrid-type environments, and it’s really about as they move more and more of their software stack over to a cloud-based software stack- it becomes much more attractive to them on-prem.”

Arm’s efforts to capture share in the cloud through cloud service providers like Amazon and Microsoft has some runway. Awad says 80% of the Fortune 500 are on AWS infrastructure, and there are more than 70,000 customers using AWS Graviton. And at AWS:reInvent last December, AWS said 50% of all EC2 instances in the last few years were on Graviton.

But Enderle doesn’t think it will translate into Arm in the enterprise, mostly because Amazon has no incentive to sell hardware with its Graviton chip in it. “The whole point of hybrid is people who want to move workloads seamlessly between the environments, and you can’t do that with the separate processors,” he said. “Typically, you require the same platform on premise as you do in the cloud, so the migrations don’t result in breakage.”

Crawford said he has heard no interest from server vendors like HP, Dell, and Lenovo for a multitude of reasons. For starters, the customers aren’t asking for it. So, if the big server vendors aren’t building Arm-based servers, where do customers get them?

“I don’t think Arm has a place directly in the enterprise, or a product to sell specifically to the enterprise, because the enterprise is not going to create a custom platform themselves. They’re not going to build their own servers and then the operating system that sits on top of it,” Crawford said.

Awad said Arm is building the ecosystem around the processor similar to the way Nvidia has built a significant software ecosystem around its GPUs.

“If you look at what we’re doing is, our focus is on aspects of the software stack which allow developers to very quickly access whatever the underlying computer acceleration technology is that stuff like cloud AI,” he said.

And Arm may have been tossed a lifeline by Broadcom’s VMware, of all companies, which just announced plans to port its hypervisor to the Arm platform. However, this is targeted more at edge networking than data centers. Still, it’s a start.

In the end, Arm’s greatest challenge may be the reticence of enterprises to disrupt their servers and systems. Once you have a system operating smoothly, you don’t want to change things around without a very good reason, and while the price/performance argument that Arm has over x86 is considerable, enterprises may still be reluctant to completely turn over their data centers to a new architecture.

Today, the conversation in every boardroom is most likely centered on a single, transformative force: artificial intelligence (AI). Many see it as the engine for unprecedented growth, efficiency, and innovation. And, while this belief is justifiable, the entire revolution is being built on a fragile foundation of trust — an already fragile ground that is about to shift even further.

As AI systems begin to manage supply chains, deploy code, and execute financial transactions, the nature of risk changes entirely. The primary threat becomes the catastrophic cost of disruption to the intelligent systems that form the central nervous system of modern business.

To harness AI’s promise while mitigating its existential risks, we already know that leaders must move beyond a defensive security posture. To be effective, leaders must also fundamentally shift how they view security as a whole. They must view it as the foundation that innovation is built on, not as a barrier to progress. To do this, we, as a collective, must build a proactive strategy based on three core pillars of trust.

1. Engineering for trust

Trust cannot be an afterthought; it must be an engineering outcome. In the past, security was often a gate that slowed progress. Today, that model is inverted. A modern, unified security platform with trust built in by design now serves as a powerful strategic accelerator.

Automated security, when treated as a native component of the AI development lifecycle, eliminates the traditional brakes on progress. This enables our teams to innovate and deploy new models with the speed and confidence that delivers a direct, quantifiable competitive advantage. This transition from a reactive posture to one that ensures innovation velocity is key.

The “engineering for trust” approach also allows us to address a silent liability plaguing many organizations: decades of accumulated security debt. A patchwork of disconnected point products creates a complex and vulnerable attack surface, a problem now amplified by the cloud. Our exclusive internal research found that a majority of cloud databases related to AI development are not properly secured, lacking basic encryption or access controls.

Moving to a unified, trustworthy platform is akin to refinancing this debt — a solution that any board member would be amenable to. This type of platform simplifies operations, reduces long-term risk, and frees up our most valuable resources to focus on growth instead of just defense.

2. Cultivating cultures of trust

A single human error can undermine even the most perfectly engineered system. While technology provides the foundation, a vigilant and security-conscious culture forms the crucial human layer of the trust stack.

In an era of AI-powered phishing and sophisticated social engineering, every employee must become a steward of their organization’s security. This challenge is magnified by the rise of shadow AI. Our latest research on SaaS risks reveals that the use of unsanctioned third-party AI tools in the enterprise has skyrocketed, creating a massive blind spot where sensitive corporate data is regularly fed into untrusted models. That is why this pillar demands more than annual training videos. It requires a deep-seated culture of awareness where people are empowered to question anomalies and act as the first line of defense.

The value of this culture extends far beyond risk mitigation. A strong culture provides the ethical guardrails that ensure AI is used responsibly, protecting the brand and maintaining customer confidence that is so difficult to earn and so easy to lose. Its essential, human-driven process protects the organization from the inside out.

3. Governing for trust

The speed and scale of modern AI demand a new governance model built on two key principles: unwavering human control and radical industry-wide cooperation.

First, we must design systems that guarantee human oversight. Robust, human-in-the-loop governance is the ultimate safeguard against the catastrophic business disruption that autonomous systems could otherwise trigger. It is the board-level guarantee that our most valuable tools remain under our command, operating as intended.

Second, we must recognize that we cannot face this new threat landscape alone. AI-powered attacks are an ecosystem-wide problem that demands an ecosystem-wide defense. Sharing threat intelligence and best practices across companies and industries is a core business necessity for our collective survival and stability.

Trust as the ultimate ROI

To lead in the age of AI, our strategy must be clear. We need well-engineered systems that accelerate the business, a vigilant culture that protects it, and a robust governance that ensures its resilience. The goal of a modern security strategy has fundamentally changed, shifting from merely preventing incidents to actively creating and protecting value.

In the AI-first world, thriving organizations will understand that trust is the most valuable asset on their balance sheet and the ultimate driver of their success.

Curious what else Ben has to say? Check out his other articles on Perspectives.

With the end of the year around the corner, I’ve been hearing a common refrain from enterprise IT and transformation leaders: “What budget should I allocate for AI agents in 2026?” The question comes as no surprise. While the rest of their organization might be winding down for the holidays, CIOs are gearing up for one of the most high-stakes planning cycles of the last decade.

AI agents are line items in almost every boardroom agenda. CIOs and CTOs are fielding a barrage of requests from their leadership cohort around “Where are our agents? What outcomes are we expecting? What’s the plan for next year?” According to Forrester, CIOs are set to receive more budget for AI in 2026, but it’s a case of more money, more problems. Next year, IT and tech leaders can expect continued business volatility and intensified pressure to justify every AI dollar is well spent.

As CIOs set their AI budgets, it’s worth taking a reality check: many AI projects are still struggling to make it from pilot to production, or if they do make it to production, they quickly find their use case cannot deliver the ROI they had hoped. That’s why I believe 2026 is a defining budget cycle. The organizations that select the right projects, invest in talent and capabilities and carefully consider the architecture needed to support agents at scale will build sustainable competitive advantages. As for the others? They’ll burn time and money on doomed pilots and incremental tools that offer no real business impact. To make smart bets for a critical year ahead, CIOs must start with understanding how AI agents can deliver real business outcomes instead of just excitement.

What do customers and employees actually want from AI agents? 

The reason AI agents are getting board-level attention is the promise to bridge the gap between human intent and business effect through automation. Over the course of the year, I’ve consulted with hundreds of enterprise leaders seeking to transform their business with AI agents. The ones able to turn those aspirations into transformations all possessed a similar ingredient – they identified the right use cases to start with. Any CIO and any organization can get this part right.

So what do customers and employees actually want from AI agents? Almost every high-impact AI agent project I’ve seen this year boils down to the same simple concept: a user expresses an intention, and an agent takes action on their behalf to deliver an outcome. This is the paradigm that separates agentic AI from chatbots. Agents promise to go beyond just information retrieval or recommendations. That capability is valuable, no doubt, but it’s table stakes in today’s AI world. Customers and employees don’t just want responses or insights; they want assistants that can take tangible actions. They don’t just want AI to help them navigate their supply chain orders across SAP modules; they want to say “order 10 tons of product” and have their agent deliver that outcome end to end.

The majority of successful AI agent projects I’ve seen look just like this. Agents for internal teams focus on meaningful ways to improve productivity by empowering workers to turn complex processes into simple requests. No one, especially anyone under 30, wants to spend time learning how to point-and-click their way through a needlessly complex user interface on a SaaS platform. Forward-thinkers are building their agents to ride a layer above core products to turn intention into outcomes. The ROI in these cases is driven by cost and time savings for the business, at scale.

As agentic capabilities evolve, I’m increasingly seeing this same concept also being applied to AI agents that reinvent the customer experience. Look at the mortgage industry for an example. These lenders report a high drop-off rate in online mortgage applications. The reality is that mortgage applications can be quite complicated. The average applicant is often overwhelmed by financial jargon or documents they may not have readily available. If the user gets confused and steps away, odds are they won’t come back. Now, imagine replacing that with an AI agent that interacts with the core service. It can answer questions, translate complex financial terms into plain terms in real-time, save the session if needed and securely reach out for bank documents. Just a 1-2% increase in completed applications from this represents a material impact on the bottom line. That’s high-impact for the business.

Don’t swing for the fences, just get on base 

As you’re allocating your budget for AI in 2026, here’s my advice: stop chasing moonshots. These vaguely scoped, overgeneralized agent dreams are often expensive, they rarely ship and they burn resources faster than they can create value. Instead, look for opportunities to hit singles and doubles. Keep your eye out for specific, high-value and outcome-driven projects that can deliver wins in months, not years. I’ll walk you through the coaching that I use with enterprise leaders planning AI projects.

Start with this question: What are 10 processes that are repetitive, well-documented and still being manually performed by humans? Score each one on a 1-10 scale across these three dimensions: the impact if you automated it, the risk if the project fails (where 10 is catastrophic) and the complexity to build and deploy it. The winning formula is high impact, low risk and low complexity. That’s your AI sweet spot. Aim your swings there.

One pharmaceutical company used this exact framework and landed on a sleeper hit: agent-based adverse event report processing. That’s not glamorous, but it freed up 40% of the team’s time that went back into actual drug discovery. In sales, I’m seeing teams use agents to create content production pipelines for outbounds, proposals and follow-ups, which helps speed up cycle times and frees reps to focus on closing deals. In financial services, agents are automating tedious back-office processes that are expensive and labor-intensive, cutting costs and reducing turnaround times by days.

Nailing the ROI formula for AI Agents 

So you’ve honed in on the right projects for 2026 AI agents, now comes the hard part: the investment. This is not free; you’ve got to make tough decisions about how to appropriate the budget and how to beef up the teams that will actually go build them. But first, you need to understand something critical about the ROI formula. Return and investment mean widely different things from company to company. 

At the enterprise scale, the value proposition for AI rests much more on increasing the bottom line. Enterprises have many more customers, opportunities for efficiency and additional sources of revenue. So even a one to two percent upside on a critical workflow, such as customer acquisition or cost reduction, can yield a material improvement to the bottom line. The scale at which enterprises operate changes the calculus for what automation flows should look like, due to the impact on their core business.

CIOs across the board must assemble the right team and ensure it is properly budgeted and staffed (I wrote on this topic earlier this year). On top of that, organizations must ensure they’re building AI agents the right way. Your ROI is fundamentally dependent on your ability to scale AI agents across all different teams in your business. Without security, compliance and governance built in from the start, you can’t scale at all. You need to solve for thousands of users, each with their own permissions, and be able to trace every action the agent takes on their behalf. Build these guardrails in from day one, and your agents can become force multipliers. Otherwise, they will drown under token costs to LLMs while the projects never go beyond a prototype.

If 2025 was the introduction to AI agents, then 2026 will be when the winners start to emerge. The companies that break away from the pack won’t be those that talked the loudest about agents or ran the most proof-of-cycle concepts. It will be the ones who shipped them to production and saved time, made money or created new customer experiences that resonate.  The difference won’t be luck; it will come down to those who approach agents with smart design, the right use case selection and informed bets on the teams and technology to bring automation to life. The right plan could change your company’s entire trajectory.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Artificial intelligence is the most transformative technology shift since the birth of cloud computing.

Two decades ago, cloud platforms changed how enterprises thought about infrastructure. Right now, as you’re reading this, AI platforms are changing how enterprises think about intelligence.

The parallels between the two are well worth highlighting. In the early 2000s, CIOs debated whether to build their own data centers or trust a shared platform like AWS. Now, 20 years on, they’re asking a similar question: should we build our own large language models, or build on them?

I believe that the lesson from the cloud era still applies. Competitive advantage comes from leveraging the platforms that already exist and innovating on top of them rather than owning the infrastructure. Let’s get into why that’s the case.

The cloud’s first lesson: Leverage, don’t reinvent

When the first generation of cloud services appeared, their broadest appeal was speed. Developers could launch applications in minutes instead of months.

However, while speed was the most obvious appeal here, the cloud’s real breakthrough was strategic. By handing off infrastructure management, companies could redirect their energy toward experience and innovation.

The enterprises that tried to replicate the “hyperscalers” by building their own clouds from scratch discovered how hard it was to keep up with the pace of platform evolution. Costs ballooned at the same time that velocity disappeared. Those who embraced the leverage model (using shared platforms as a foundation) moved faster and spent less.

AI is now at the same crossroads. The instinct to build proprietary models from the ground up feels familiar, but it’s no more the right move than it was with cloud. Large language models have become a new layer of digital infrastructure that is analogous to compute and storage in the cloud era. They are utilities that are powerful, scalable and continuously improving through collective use.

I believe that owning the plumbing no longer differentiates you, and that it never did. The question for leaders isn’t “Can we build our own model?” It’s “What unique value can we deliver by building upon one?”

The power of open ecosystems

The rise of cloud was never about one product. It was about an ecosystem that invited participation. I worked at AWS, and I can tell you that its greatest innovation was an architecture that encouraged others to build on top of it. Every API call became a building block for something new.

AI platforms are following the same pattern. Tools like OpenAI, Anthropic and others are offering open interfaces and SDKs that turn intelligence into an accessible service. This openness fuels compounding innovation in the form of an ecosystem that every developer, data scientist and business analyst can contribute to.

Enterprises that align with open ecosystems benefit from shared progress. They can experiment without owning the entire stack and move faster as the underlying technology improves. Closed systems, though, tend to stagnate. When innovation depends solely on internal capacity, growth slows, costs rise and talent disperses.

From what I’ve seen across my career, the future belongs to platforms that treat users as co-creators. Products and ecosystems scale exponentially because every user is also a contributor!

The feedback flywheel

Feedback is one of technology’s most underappreciated engines of progress. I remember AWS famously saying that 90% of its roadmap came directly from customer requests. When I was there, I saw firsthand how each improvement drove more usage, which generated more feedback, which drove more innovation.

AI systems are built on the same dynamic. Reinforcement learning, fine-tuning and user telemetry all feed the model’s evolution. Every query, correction or prompt becomes a signal that refines the next response.

This feedback flywheel is now extending into enterprise AI adoption. Each workflow, chat interaction and model output is an opportunity to learn. The organizations that intentionally design feedback loops to flow between users, data and developers evolve their systems faster than those treating AI as a static tool. The former will become industry leaders while the latter lags behind.

What does this look like it practice? Teams must instrument AI use cases with metrics, monitor accuracy and context, and close the loop quickly when things go wrong. Feedback is a strategy for continuous learning, not some trivial support function.

The most advanced AI organizations are the ones with the tightest feedback loops, not the biggest models.

Platform thinking inside the enterprise

What does all of this mean for CIOs and technology leaders? It means applying the principles of platform thinking within your own walls.

I tell my clients to start by viewing their enterprise not as a collection of systems, but as a platform others can build upon. Create reusable AI capabilities like data pipelines, governance frameworks and integration patterns that different business units can safely leverage. Encourage decentralized innovation by giving teams the guardrails and APIs to experiment.

In the cloud era, self-service infrastructure changed how developers worked. In the AI era, self-service intelligence is doing the same. Marketing teams generate insights from unstructured data, HR automates knowledge discovery for onboarding, finance uses AI-powered forecasting to model business outcomes, and so on and so forth. Each function builds on a shared foundation while adding its own flavor of domain expertise.

CIOs play the critical role of orchestrator. Their job is to ensure interoperability, security and ethical use while enabling freedom at the edge. That balance between control and creativity will define the next generation of enterprise leaders.

Avoiding the reinvention trap

There’s a natural temptation to build everything in-house, especially in technology-driven organizations. It feels safer and more controllable, but history shows how easily that instinct can slow progress.

I’ve seen enterprises that tried to build their own private clouds fail to match the scale or speed of public ones. The same is true of AI. Training proprietary models consumes extraordinary compute and talent, while the underlying platforms advance faster than any single company can replicate.

The smarter move is to differentiate at the application layer through data strategy, user experience and domain-specific integration. Build the intelligence that understands your business while also relying on established platforms for the generic cognition that everyone needs.

The organizations that thrive will be those that orchestrate AI across their ecosystems, not those that try to reinvent it in isolation.

The leadership imperative

AI represents a once-in-a-generation shift. However, like every major shift before it, the winners will be those who learn the right lessons from history.

The cloud taught us that leverage beats ownership, ecosystems beat silos and feedback beats static roadmaps. AI simply brings those lessons into a new domain.

For CIOs and senior technology leaders, the mandate is clear: build architectures that learn and that use open ecosystems to accelerate progress. Make feedback a cultural habit instead of an afterthought. Focus your talent on solving unique business problems instead of replicating what the platforms already provide.

The question isn’t whether AI will transform your enterprise; it already is. The question is whether you’ll build on the right platform to make that transformation sustainable, ethical and fast.

I believe that the future belongs to leaders who understand that innovation is about what you enable, not ‘just’ about what you own.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The increasing hype around AI has exceeded any other technology shift, perhaps ever. This has been met with a corresponding amount of investment. Gartner estimates worldwide spending on AI through 2025 will be nearly $1.5 trillion. Despite the staggering amount, most organizations continue to grapple with a chronic gap between promise and realized value.

The most widely recognized data point to support this comes from an MIT report from earlier this year that reveals 95% of gen AI pilots fail. A McKinsey study also found that nearly 80% of companies use gen AI, yet almost as many report no significant impact to the bottom line.

But there’s proof AI is working, if modestly. The 2025 Cisco AI Readiness Index shows 13% of all companies get consistently measurable returns from AI. So while this is a minority, leading organizations are starting to see value. But the origins of that value increasingly stem from leadership clarity, strategic alignment, and execution, not the technology itself. The Cisco AI Readiness Index measured this and found 99% of companies that have realized value from AI have a well-defined strategy that embraces change, and includes formal programs to help employees get comfortable with the new technology.

Today’s CEOs and CIOs face a generational inflection point. They must redefine success for AI not as a means of cost-cutting, but as a driver for capacity creation, innovation, and human-centric outcomes. The path forward requires breaking down work, reassessing where automation helps, and empowering talent to focus on growth and transformation.

Setting the stage: AI promise vs. reality

Among many CIOs, the biggest challenge is the C-Suite and board know they need AI but aren’t sure what for. This creates unrealistic expectations that AI will be a panacea to all problems and send productivity skyrocketing. When the outcomes are unrealistic, a successful project may be deemed unsuccessful because the initial goals were incorrect. A contributing factor to this problem is that many business units don’t have the KPIs to create the business metrics to measure.

An example of this is with contact centers where AI agents could be used for agent coaching, virtual agents, scheduling, scoring calls, note taking and more. Measuring the value of these can be difficult, so many businesses have defaulted to cutting costs by reducing agents. This can backfire if not done in a measured way. Klarna, for instance, eliminated about 700 agents, saw customer service scores tank, and then hired people back. This wasn’t a technology problem but rather leadership didn’t put the right plan in place to understand the impact.

Diagnosing the problem: Tech limitations or leadership gaps?

Issues with achieving ROI on AI and automation technology efforts are often confused with the diagnosis of the issue at hand. A lack of tech readiness concerning integrating complex data and scaling automation remains a challenge. More often than not, however, the issue that gets acted upon may be less with the technology itself and more with the way technology efforts are governed and led. This would indicate the obstacles that exist to technology’s successful implementation lie more with the board than the code and cloud setup. Failures happen because business leaders prioritize expediency driven by market hype instead of thinking about genuine business transformation.

It’s also important that prior to AI projects being kicked off, there’s clear business alignment and an understanding of the metrics being measured to calculate ROI. Projects launched as isolated technology experiments without a well-defined business case tied to a strategic priority are hard to measure and often vague in value, leading to projects that are easy to cut.

The leadership inflection point: Beyond cost cutting

The business world sits at a leadership inflection point where for the first time, workforce transformation will be more than just human. With the rapid adoption of AI and autonomous agents, leaders now face complex decisions about how value is derived and maintained within their organizations. This shift requires cutting costs but also reimagining the relationship between human skills and the technical capabilities of AI, which ensures organizational cultures and processes can adapt to this new era of hybrid workforces.

“Everyone’s been racing to build more AI models, compute, and agents, but the real bottleneck to enterprise AI adoption isn’t supply, it’s that enterprises don’t know where or how to use AI to do real work,” says Greg Shewmaker, CEO of enterprise intelligence company r.Potential. “We believe the missing piece is the coordination layer between human and digital work, where you can capture actual workforce demand, generate realistic and deployable configurations of human and AI capabilities, and tie them to real business outcomes. If we don’t get this right, the next wave of automation won’t just reshape companies, it’ll destabilize work itself.” 

His point underscores what many executives miss: AI’s promise isn’t just a technological or operational challenge, it’s an existential leadership one. As the boundaries blur between tasks suited for humans and those automated by machines, IT and business leaders will need to focus on maximizing value creation through deep integration of people, technology, and culture.​

So it becomes critical for the C-suite to reconsider timelines related to investments and expand capacity in accordance with tech and market needs. This shift in human capital management involves being able to forecast the future workforce and deploy human resources in sync with machine-based intelligence. Innovation should take precedence that’s less about adding to current performance and more about ensuring organizations can remain agile and ready to facilitate innovation in terms of related infrastructure and preparedness to reinvent themselves.

Breaking down work and value creation

Understanding the key components of work is essential to developing understandable ROI from AI. Any returns must consider the adoption of technology and the transformation of processes. The goal should be to leverage AI to amplify human effort in areas that require human judgment, empathy, and creativity rather than in areas where there’s only repetition of tasks, thereby assigning human resources to higher-value supervisory and human roles where they can be most productive and valuable.

The key to success is to refocus on enabling talent to drive revenue growth and innovation through AI. So the goal is to apply AI strategically to liberate highly-skilled people from working on the 80% of any job that can, should, and must be automated so they can focus on the last 20%, which drives new revenue growth, customer loyalty, and innovation breakthroughs.

The AI era will reshape every industry, and if CIOs and CEOs aren’t evolving, the AI investment will be wasted. The key to realizing real value in AI is to ensure leadership is future-ready and embraces new skills and change. It’s not about being the best coder in the room but instilling the right leadership structure. This involves a leadership mentality that uses AI to further human-centric goals and not simply fill an operational spreadsheet with AI data. This requires strict ethics and governance modeled in every aspect of decision-making, and firm alignment on the business side where every AI project has a defined purpose for the organization.

There are a growing number of networking startups working to tackle the challenges of AI networking. Aria Networks is hoping that its differentiated approach based on rich network telemetry will actually solve real-world problems for network operators.

Mansour Karam, founder and CEO of Aria Networks, is no stranger to the world of creating networking startups that disrupt the existing market. Karam spent nearly two decades building his networking credentials. He joined Arista in 2006 during the company’s early days and later spent several years at Big Switch Networks during the initial SDN wave. Karam also founded intent-driven networking vendor Apstra to reinvent the management and operational layer for networks; Apstra was acquired by Juniper Networks in 2020.

While SDN and intent-driven networking represented disruptive innovations in their time, AI is reshaping how networking architectures are designed and deployed today. AI networking represents more than an incremental shift. The backend Ethernet networks connecting GPU clusters have different requirements than traditional cloud infrastructure. 

“If the network isn’t performing optimally, then you can’t utilize your GPUs optimally,” Karam told Network World. “The GPUs are extremely expensive, and they’re the ones that are generating your revenue.”

From switch-centric to path-centric architecture

Market opportunity and AI requirements are the key reasons why Karam decided to start Aria Networks. 

He noted that overall data center networking has been growing at single-digit percentages for the past decade or two. AI networking is changing that trajectory dramatically. “When you have explosive growth like that, gaps for customers feel underserved, and really opportunities like this provide an opportunity for new entrants,” Karam said.

Aria’s technical approach differs from incumbent vendors in its focus on end-to-end path optimization rather than individual switch performance. Karam argues that traditional networking vendors think of themselves primarily as switch companies, with software efforts concentrated on switch operating systems rather than cluster-wide operational models.

“It’s no longer just about the switch itself. It’s really about the end-to-end path,” Karam explained. “When you look at these jobs being scheduled, it’s about the paths the traffic are going to take through the network, end-to-end that really matter.”

Telemetry at microsecond resolution

The company is targeting the backend Ethernet network that connects GPUs in AI clusters. It’s building with merchant silicon from Broadcom and using the open-source SONiC network operating system.

Aria’s core differentiation centers on extracting and acting on network telemetry that already exists in modern switching silicon but remains largely untapped outside of hyperscale environments. “In order to deliver on this performance, you need the data, you need telemetry, and this telemetry today exists,” Karam explained. “If you look at these ASICs from chips like Broadcom, they have tons of telemetry at the microsecond resolution.”

The challenge, according to Karam, is figuring out how to effectively extract, store, process and act on the telemetry data at scale, which is something that Aria is working on delivering as part of its platform.

Deterministic versus probabilistic network optimization

Aria is not only building networking gear for AI networks but also using AI to help improve networking.

Karam draws a clear distinction between rule-based deterministic approaches that have been used in the past and AI-driven probabilistic methods for network optimization. “When we built my previous company with Apstra, we didn’t have AI, and so we did everything very deterministically. Everything was rule based,” Karam said. 

That deterministic approach worked well in controlled environments but had limitations. Probabilistic AI-driven methods offer advantages for intuitive performance detection and dynamic reaction in complex scenarios. “When you’re trying to be more intuitive about detecting performance issues or reacting on the fly, then probabilistic approaches, AI, bring a unique advantage,” Karam explained.

But Karam emphasized that simply adding AI capabilities to existing architectures won’t deliver meaningful results. He’s critical of vendors that layer AI chatbots on top of legacy systems.

“A lot of what you see from a lot of vendors, when they say ‘we bring AI,’ what they’re going to do is kind of slap an AI chatbot on top of existing architecture,” Karam said. “But with AI, what we’ve seen again and again across every domain, is that in order for AI to become effective, you really need to specialize it for this domain, meaning building an architecture from the ground up that is optimized for AI.”

More to come as the company peels back the onion

Aria is taking a staged approach to revealing technical details about its platform as it continues to develop technology. The company has disclosed some of the foundational technologies it’s building on, including SONiC and microsecond telemetry, but is only incrementally revealing more details as it continues to build out.

“The power of AI is tremendous,” Karam said. “And having AI as a tool to bring to bear, combined with the data to really go and solve these problems and deliver on this performance optimization, the opportunity there is immense.”

If your inbox looks anything like mine, AI has gone from “my group wants to explore this interesting pilot” to “red alert, board-level priority.” Nearly 70% of Fortune 500 companies use Microsoft Copilot. Of those that partner with Integreon, many are still primarily using the browser-based version. What that tells me is the interest is real, but the comfort level isn’t there yet.

Here’s the reality, my IT friends — generative AI is a strategic imperative and one we as guardians of the data and infrastructure need to be front and center. The impediment is certainly not a lack of vision; rather, it is risk-based. How IT and our partners in InfoSec choose to support, or conversely restrict, AI now will have a direct impact on the company’s ability to compete at a variety of levels and within various corporate disciplines.

Let’s take a collective deep breath and explore ways in which IT can be that strategic enabler, while still maintaining integrity and security. You with me?

See AI’s value in the larger strategic context

Corporate data (including legal, HR and marketing documents) has been growing at an exponential rate. Historically, these documents required heavy manual work — drafting, reviewing, summarizing, classifying and archiving. Human capacity scales linearly, while unstructured data grows exponentially. The result? Vast amounts of untapped corporate knowledge and an increased reliance on outsourcing, which only widens the cyber and third-party risk surface.

AI changes this dynamic. It offers automation at scale for drafting, summarizing and classifying unstructured data — creating a generational opportunity to rearchitect enterprise data governance. We now have the potential to evolve from fragmented, federated data silos into next-generation semi-centralized architectures (data lakes, data rivers) that serve both structured and unstructured needs.

For IT, this is an invitation to extend capabilities into areas traditionally underserved — legal, procurement, HR, marketing — while also reducing attack surfaces and improving data quality.

See risk in the business context

Risk management should never be reduced to simply saying “no” to AI. Instead, IT has an opportunity — and a responsibility — to partner with business leaders in evaluating risk in proportion to the value AI delivers.

Generative AI and AI agents, in many ways, mirror human performance characteristics. And just as businesses have long relied on human-driven processes for critical workflows, they have also developed robust detective, corrective and compensating controls to manage risks inherent in human operations. The difference now is scale and automation — but the principles of governance remain familiar.

This means organizations don’t need to reinvent the wheel. Many established procedures, policies and guidelines can be modernized and extended to cover AI-driven workflows. By adapting existing governance frameworks, businesses can integrate AI more confidently without stalling innovation.

Equally important, when IT takes the time to understand the risk appetite of the business, it often helps streamline end-to-end processes rather than complicate them. And when IT brings in its toolkit — such as privileged access management, single sign-on, identity governance, endpoint protection and other enterprise-grade controls — the result is not just safe adoption, but a stronger overall security posture for the organization.

In short: AI risk isn’t a reason to say no. It’s an invitation for IT and business to align more closely — modernizing existing controls, adapting governance and ensuring innovation happens securely and responsibly.

Build and unify AI security and risk management infrastructure

Just as we would not build security architecture one employee at a time, we should not approach AI piecemeal. IT needs to establish a holistic AI security and risk infrastructure, ready for a world where AI agents become a core part of enterprise workflows.

A baseline architecture should include at least these seven layers:

1. Security operations center (SOC): 24/7 threat monitoring, detection and response, including penetration testing and dark web monitoring, to provide real-time visibility and actionable insights.
2. Security policy & awareness: Regular, engaging training and simulations to reduce human risk and build a culture of vigilance.
3. Endpoint managed detection and response (MDR): Next-gen antivirus, continuous monitoring and active remediation of endpoint threats.
4. Identity protection & privileged access management (PAM): Continuous monitoring of user behavior, MFA enforcement and protection against credential misuse. Enforcing least privilege, securing privileged accounts and providing auditable, monitored remote sessions.
5. Vulnerability management: Ongoing asset discovery, scanning, penetration testing and prioritized remediation.
6. Advanced email threat protection: AI-powered detection of phishing, ransomware and targeted attacks across inbound, outbound and internal traffic.
7. Audit & compliance: Alignment with globally recognized standards (ISO 27001, ISO 27701, SOC 2 Type II) to maintain transparency, governance and client trust.

By combining these layers, IT can build resilience into the enterprise by design — ensuring AI adoption strengthens rather than weakens security posture.

A strategic imperative

AI isn’t just another wave of technology — it’s a shift in how we work, secure and create value. As IT leaders, we get to choose whether we slow things down or step up to help our businesses move forward with confidence.

If we embrace the enabler role, we don’t just keep the lights on — we shape the future. By balancing risk with strategy, modernizing our controls and building a strong foundation, we can make AI both safe and transformative.

At the end of the day, the future of AI in the enterprise will be written by the technologists. We have the opportunity at hand to be the ones holding the pen.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Software is learning to act. Not merely to respond or execute commands, but to perceive context, reason through complexity and pursue outcomes on its own behalf. Agentic AI is the buzzword of the moment, but beneath the hype lies a meaningful shift in how organizations will work, support their teams and make decisions in the years ahead.

More than a passing phase, agentic AI represents the next stage in automation’s evolution — one that moves from efficiency toward adaptability, and from static workflows toward systems that can interpret intention, collaborate with human teams and actually think and act on their own behalf. With the promise of significant increases in productivity and efficiency, it’s easy to see why.

Gartner predicts that at least 15% of day-to-day work decisions will be made autonomously through agentic AI by 2028, up from 0% in 2024. Additionally, 33% of enterprise software applications are expected to include agentic AI by 2028, up from less than 1% in 2024. While this is exciting, it’s also not a one-size-fits-all solution. And before jumping in head-first, it’s a good time to weigh the benefits and challenges adopting agentic workflows will have on your own business.

The journey from automation to agency

The early days of automation were about repetition and consistency. Robotic process automation tools replaced manual data entry, basic scheduling and other repetitive tasks with rule-based scripts. This was revolutionary for its time, but it was rigid in its approach. When an input didn’t match the script, human intervention was required.

Over time, businesses layered intelligence onto these workflows. Machine learning allowed software to make predictions or classifications, nudging automation toward greater sophistication. Yet even then, systems remained reactive. They could respond, but they couldn’t initiate. For example, AI could flag an anomaly, but couldn’t decide whether it was significant or what to do about it.

Then came the generative AI era, where models could create language, images and code. Generative AI expanded what machines could produce, but not what they could decide. It generated possibilities, not priorities. The intelligence was expressive, but not yet agentic.

With agentic AI, we’re moving toward a phase where systems are not just reactive, but proactive. These AI agents are capable of perceiving changing conditions, reasoning through alternatives and taking action autonomously. They don’t just follow instructions, but move the needle in pursuing real business objectives. In other words, software now acts with purpose, albeit within the boundaries of human oversight.

What agentic AI is…and isn’t

Agentic AI blends intelligence and automation into a single operational layer that can manage outcomes rather than just execute steps. Instead of relying on humans to define every possible rule, agentic systems understand goals and context. They can reason through multiple inputs, choose the best path forward and adapt as conditions change.

For any kind of AI, data is critical, and this level of reasoning requires memory or a data source. For agentic AI workflows to be effective for a business, the AI solution must be anchored to a deep, unified system of record that is the one source of truth reflecting what’s happening across the organization in real time. Without that data substrate, an agent is just guessing. The system of record is what gives both the AI and business operations continuity. And understanding not only what to do next, but why that action aligns with the larger mission, and keeping every teammate up to speed on what’s going on, is imperative.

While traditional automation in customer support might categorize a service ticket and route it to the right queue. An agentic system can triage the issue, draft a response, update records and even resolve the problem if it falls within defined guardrails. In a sales environment, it can evaluate lead quality, tailor outreach based on behavioral data and move prospects through the funnel without waiting for manual triggers.

The distinction is subtle but powerful. Traditional automation executes rules, whereas by contrast, agentic AI executes judgment. It doesn’t just know what to do, but actually decides how to do it, based on context and evolving information. That capacity for self-direction is what makes the technology so transformative.

Make no mistake, though, this is not an argument in favor of cutting staff or quitting our 9-5s in favor of agentic replacements. Human oversight is still necessary — arguably more than ever before. While tech is advancing, so are end-users’ and consumers’ awareness and scrutiny of it.

As such, the most responsible use of agentic AI isn’t replacement, it’s reinforcement. It’s about freeing people from procedural work so they can focus on the complex, empathetic problems that require a human touch. This is especially important in industries like real estate or healthcare, where decisions are deeply personal.

Preparing for the age of agentic AI

Optimizing for agentic AI isn’t just about adding smarter tools; it begins re-architecting the environment those tools inhabit. Organizations that thrive will have integrated, high-quality data foundations and unified workflows. Fragmented systems or poor data hygiene can cripple an AI agent’s ability to reason effectively. For many enterprises, this means modernizing their systems of record — CRMs, ERPs and HR platforms — that make up digital operations.

Equally important is the need for well-defined guardrails. Businesses must define what good decisions look like, the limits of an agent’s autonomy and the ethical or compliance constraints that must be followed. This balance between freedom and control is critical. Too many restrictions, and the AI can’t act usefully, but too few and it risks acting outside the organization’s intentions.  

Recent Deloitte survey findings reflect this. Nearly 60% of AI leaders report their organization’s primary challenges in adopting agentic AI are integrating with legacy systems and addressing risk and compliance concerns. On the flip side, unclear use cases/business value was the top answer for other respondents. While both groups cited risk and compliance concerns as a top challenge, it’s clear there’s a divide on where employees fit into the agentic AI puzzle.

But if history has taught us anything, it’s that the best results are realized when people, processes and tech operate together, as one collaborative network. Organizations that excel in this next era of AI will be the ones that take this into account when deploying their AI agents.

Why humans are a value add

While much of the conversation around agentic AI centers on automation, the deeper story is about augmentation. As intelligence shifts deeper into systems, the human role moves higher in purpose. Instead of being the operators inside every workflow, people become the designers of intent. This includes defining objectives, setting ethical and operational boundaries and interpreting outcomes through the lens of business strategy.

This evolution will inevitably reshape roles and organizational design. Teams will shift from micromanaging workflows to supervising AI agents, curating data and optimizing performance across systems. This will require new skill sets in technical fluency and delegating meaningful work to intelligent systems. In fact, recent research from PwC found that 67% of executives agree that AI agents will drastically transform existing roles within the next 12 months. In fact, 48% reported they will likely increase headcount due to change brought on by AI agents.

The leaders who embrace this shift early will gain more than efficiency. As agentic AI learns and improves, organizations can scale decision-making without scaling headcount. They can respond to customer needs in real time, anticipate and insulate their business from market shifts, and allocate human creativity and innovation where it matters most.

Building agentic workflows

Before organizations can fully realize the value of agentic AI, they need to lay the groundwork, much like systems and data had to be centralized before reaping the benefits of automation. Deploying agentic systems without the right operational and technological foundations will only amplify inefficiencies, not eliminate them. Companies must first align people, processes and technology by ensuring that their data infrastructure is unified, their processes are standardized and their governance frameworks are mature enough to support decision-making at scale.

To make that transition effectively, organizations should focus on a few key steps:

• Establish a deep system of record. Agentic AI depends on consistent, real-time access to information. Consolidating fragmented data across departments, systems and platforms ensures agents have the visibility and context to act intelligently.
• Create and enforce clear governance and ethical guardrails. Define the boundaries of agent autonomy, specifying where human oversight is required and how decisions should be audited. This builds trust and prevents rogue automation.
• Adopt orchestration layers for multi-agent collaboration. As AI systems grow, businesses will need orchestration tools that coordinate how AI agents communicate, hand off tasks to human teams and align on objectives.
• Reskill teams for AI collaboration. In agentic workflows, humans and AI don’t work in isolation, but as a team. Employees must learn how to supervise, interpret and refine agentic behavior, shifting from process execution to performance management and continuous improvement. Just as importantly, teams need to work alongside AI and pick up where it leaves off, handling the human moments that require empathy or judgment.
• Centralization first for the biggest impact. Agentic AI delivers its greatest value in organizations that have already centralized their operations — leaving behind same-store models in favor of specialized teams and shared systems. Centralization aligns people, processes and data around consistent, scalable workflows, giving AI the clarity and context it needs to act intelligently.

The alignment between data clarity, centralization, governance, orchestration and human oversight is the differentiator between experimentation and transformation. And for those willing to reimagine their workflows and take the right steps, the reward can be significant — an organization that doesn’t just run efficiently, but learns and evolves continuously.

Agentic AI isn’t a far-off concept; it’s here. The companies optimizing for it today will be the ones with a competitive advantage in the future.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

보험사 히스콕스(Hiscox)가 중소기업 1,000여 곳을 대상으로 실시한 ‘사이버 준비 보고서(Cyber Readiness Report)’에 따르면, 랜섬웨어 복구를 위해 사이버범죄자에게 몸값을 지불한 기업 중 5곳 중 2곳(약 40%)은 결국 데이터를 복구하지 못한 것으로 나타났다.

조사 결과, 랜섬웨어는 여전히 기업에 심각한 위협으로 남아있었다. 전체 응답 기업 중 27%가 지난 1년 동안 랜섬웨어 공격을 경험했으며, 이 중 보험 가입 여부와 관계없이 80%가 핵심 데이터를 복구하거나 보호하기 위해 몸값을 지불했다고 응답했다. 몸값을 지불한 기업 가운데 데이터를 전부 혹은 일부 복구하는 데 성공한 곳은 60%에 불과했다.

한편 보험사 QBE가 최근 발표한 ‘사이버 범죄 및 클라우드 기반 위협 보고서’에서는 랜섬웨어 사고가 2025년 1분기에 전년 동기 대비 약 3배 증가했다고 밝혔다. 2024년 1분기 572건였던 공격 건수가 올해 같은 기간 1,537건으로 급증했다. 또한 크라우드스트라이크(CrowdStrike)가 이달 발표한 ‘2025 랜섬웨어 현황 보고서’에서도 몸값을 지불한 피해자의 93%가 결국 데이터를 도난당한 것으로 나타났다.

결함 있는 랜섬웨어 암호화 구조, 복구 과정의 최대 걸림돌

전문가들은 히스콕스의 랜섬웨어 피해 통계가 기업이 복구를 시도할 때 직면하는 수많은 문제를 단적으로 드러낸다고 설명했다.

사이버보안 기업 브라이드웰(Bridewell)의 사고 대응 매니저 제임스 존은 “60%의 복구율은 실제 사고 대응 현장에서 반복적으로 나타나는 기술적·운영적 문제를 보여준다”라고 말했다. 그는 “랜섬웨어 운영자 간의 기술 수준에는 큰 차이가 있다. 락빗(LockBit), ALPHV 같이 정착된 그룹은 ‘평판’을 유지하기 위해 정상 작동하는 복호화 도구를 제공하는 반면, 규모가 작은 공격 그룹은 암호화 구현이 불완전하거나, 몸값을 받은 뒤 연락을 끊는 경우도 많다”라고 분석했다. 또한 그는 복구 도구 자체가 느리고 신뢰성이 떨어지는 경우가 많다고 덧붙였다.

존은 이어 “기업 전반의 데이터를 복구하는 과정은 수주가 걸릴 수 있으며, 손상된 파일이나 복잡한 데이터베이스 시스템은 복구에 실패하는 경우도 많다. 복호화 과정 자체가 추가적인 데이터 손상을 일으킨 사례도 있다”라고 말했다.

복구 도구가 제공되더라도 오류가 포함돼 있거나, 복호화 후에 파일이 손상되거나 접근이 불가능한 경우가 적지 않다. 게다가 많은 기업이 평소 검증되지 않은 백업에 의존하고 있으며, 일부 피해 기업은 공격 이후 백업 데이터마저 함께 암호화됐다는 사실을 뒤늦게 발견하고 있다.

영국 보안관리 서비스 기업 아벨라시큐리티(Avella Security)의 파트너이자 영국 정부 사이버보안 자문 위원인 대릴 플랙은 “범죄자들은 종종 불완전하거나 호환되지 않는 암호화 도구를 사용하며, 많은 기업이 데이터 복구를 안정적으로 수행할 인프라를 갖추지 못한 상황이다. 백업이 불완전하거나 시스템이 여전히 침해된 상태라면 복구는 더욱 어렵다”라고 설명했다.

복구를 위협하는 또 다른 요소

최근 랜섬웨어 공격은 단순히 데이터를 암호화하는 수준을 넘어섰다. 공격자는 몸값을 지불한 이후에도 탈취한 데이터를 공개하겠다고 협박하거나, 추가로 분산서비스거부(DDoS) 공격을 가하겠다고 위협하는 이중, 삼중 갈취 방식을 점점 더 자주 사용하고 있다.

이 같은 변화는 피해 기업이 몸값을 지불할 경우 무엇을 기대할 수 있는지에 대한 판단 자체를 근본적으로 바꾸고 있다. 결국 비용을 지불한다고 해서 랜섬웨어로 인해 발생한 문제가 해결되지 않을 수 있다는 의미다.

존은 “몸값을 지불하면 암호화 문제는 해결될 수 있지만, 시스템 전체의 침해 문제는 그대로 남을 수 있다”라고 지적했다.

더욱이 랜섬웨어 공격은 법적, 운영 문제뿐만 아니라 기업 평판까지도 위협할 수 있다. 이런 문제가 몇 시간 내에 연달아 발생하기 때문에 기업은 극심한 압박을 받을 수 있다.

또한 범죄자와 거래해야 하는 불확실성까지 겹치면서, 몸값을 지불하더라도 완전한 데이터 복구로 이어지지 않는 경우가 많아진다.

영국 법무법인 하퍼제임스(Harper James)의 데이터 보호·프라이버시 팀 선임 변호사 릴리언 창은 복구 키를 받더라도 일부 데이터는 이미 손상 및 변경됐거나 유출됐을 수 있다고 경고했다.

그는 “이런 상황은 운영상 큰 혼란을 초래할 뿐 아니라, 특히 개인정보가 포함된 경우에는 심각한 데이터 보호 문제로 이어질 수 있다. 기록이 손실되거나 유출되면 영국 일반개인정보보호법(GDPR)상 개인정보 침해로 간주돼, 보고 의무와 규제 조사를 받을 가능성이 생긴다”라고 진단했다.

창은 또 “몸값을 지불해도 해커가 약속을 지키지 않을 경우 법적 대응 수단이 없으며, 더 나쁜 경우에는 자금이 제재 대상 단체로 흘러들어가 추가적인 법적 위험을 초래할 수도 있다”라고 말했다.

재정적 및 법적 대응 과제

일본 물류기업 칸츠(Kantsu)의 사례는 랜섬웨어 공격이 실제로 어떤 방식으로 전개되는지를 잘 보여준다. 칸츠의 타츠조 히사히로 대표는 인터뷰에서 공격을 겪은 이후 운영을 복구한 과정에 대해 설명했다.

당시 랜섬웨어에 몸값을 지불하지 않은 칸츠는 운영 복구 비용을 충당하기 위해 금융 기관에 자금 지원을 요청해야 했다. 보험에 가입돼 있었지만, 보험금이 지급되려면 청구 절차를 거쳐야 했기 때문이다. 이 사례는 기업이 랜섬웨어 공격으로부터 완전히 회복하려면 기술적 대응뿐 아니라 재정적 대비책까지 마련해야 한다는 점을 보여준다.

또한 랜섬웨어 공격으로 시스템이 중단되고 개인정보가 침해됐다면 기업은 즉시 규제 당국과 피해자에게 이를 통보해야 하는 법적 의무를 지게 된다.

하퍼제임스의 창은 “불완전한 정보만으로 신속하고 중대한 결정을 내려야 한다는 점이 핵심 과제다. 몸값을 지불할 때의 법적 위험, 비즈니스 연속성에 미치는 영향, 그리고 개인에게 발생할 수 있는 피해를 기술적 상황이 완전히 파악되지 않은 상태에서 경영진은 판단을 내려야 한다”라고 설명했다.

대비가 곧 최선의 방어

일부 전문가는 랜섬웨어 공격이 언제든 현실화될 수 있다는 점을 고려해, 재난 복구 계획의 일환으로 사고 대응 전문업체와 사전 계약을 유지할 것을 권장하고 있다.

직접 위협 인텔리전스에 특화된 사이버보안 기업 블랙와이어드(Blackwired)의 최고경영자 제레미 새마이드는 “암호화폐 거래를 안전하게 처리할 역량을 갖춘 신뢰할 만한 사고 대응 또는 협상 전문업체와 사전 계약을 맺는 것이 매우 중요하다”라고 말했다. 그는 “전문업체는 협상 과정을 관리하고 비트코인·모네로·제트캐시 등 다양한 암호화폐를 다룰 수 있으며, 복구를 위한 최후의 수단으로 몸값을 지불해야 하는 상황에서도 안전하게 거래를 수행할 수 있다”라고 설명했다.

새마이드는 “준비는 항복이 아니다. 어떤 상황에서도 대응할 수 있도록 대비하는 것”이라고 강조했다.

다만 창은 랜섬웨어 공격에 대비해 범죄자에게 지불할 자금을 미리 마련해 두는 행동을 지양해야 한다고 조언했다.

그는 “몸값 지급을 위한 자금을 따로 확보해 두는 것은 점점 더 문제적인 방식으로 인식되고 있다. 지불 행위 자체가 불법은 아니지만, 제재 위반으로 이어질 수 있고 범죄 행위를 조장할 위험이 있으며, 무엇보다 긍정적인 결과를 보장하지 않는다”라고 말했다.

창은 강력한 보안 조치, 충분히 검증된 복구 계획, 명확한 보고 절차, 사이버 보험을 통한 회복력 강화에 투자해야 보다 안전한 법적, 전략적 입지를 확보할 수 있다고 진단했다.

그는 “사이버 보험은 단순히 재정적 보호를 제공하는 것을 넘어, 전문적인 대응 지원을 통해 피해 규모와 시스템 중단 시간을 크게 줄일 수 있다는 점에서 랜섬웨어 대응에 매우 중요하다”라고 설명했다.

사이버 보험은 일반적으로 능동적인 위기 대응 관리를 지원하며, 다음과 같은 사항을 보장한다.

• 사고 발생 직후 즉각적인 대응 및 포렌식 조사
• 감염된 시스템의 격리 및 복구 조치
• 해커와의 협상 및 법률적 조율 지원
• 데이터 복원 및 비즈니스 연속성 확보 지원

새마이드는 “보험이 공격 자체를 막을 수는 없지만, 피해를 완화하고 혼란스러운 상황에 질서를 부여하며 기업이 랜섬웨어 위기를 홀로 감당하지 않도록 돕는다”라고 말했다.

그러나 일부 전문가는 사이버 보험에도 주의할 점이 있다고 지적했다.

플랙은 “보험료가 계속 오르고 있으며, 보험사는 다단계 인증(MFA), 패치 관리, 정기적인 백업 검증 등 기본적인 보안 요건을 충족해야만 보장을 제공하거나 갱신을 허용하고 있다”라고 설명했다. 다만 그는 “이런 변화는 기업이 보안 수준을 높이고, 리스크 관리의 일환으로 더 성숙한 보안 관행을 도입하도록 유도하고 있다”라고 분석했다.

사이버 복구 전략의 필요성

전문가들은 랜섬웨어 공격 이후의 사이버 복구를 단순한 기술 조치가 아닌 ‘재난 복구’ 수준으로 다뤄야 한다고 조언했다. 이를 위해서는 명확하게 정의된 내부 복구 계획을 마련하고 전 과정을 문서화해, 손상되지 않은 데이터를 신뢰성 있게 복원할 수 있는 체계를 갖춰야 한다.

인덱스엔진스(Index Engines)의 최고마케팅책임자 짐 맥갠은 “기업이 랜섬웨어 공격을 받으면 가장 시급하게 해야 할 일은 공격의 전체 범위를 파악하는 것”이라고 언급했다. 그는 “어떤 데이터가 침해됐는지, 어떤 시스템이 영향을 받았는지, 그리고 기존 백업이 신뢰할 수 있는 상태인지 확인하는 것이 핵심”이라고 말했다.

맥갠은 이어 “백업이 존재하더라도 무결성 검증이라는 중요한 과제가 남는다. 백업 데이터에 손상되거나 변조된 파일이 포함돼 있다면 복구 과정에서 다시 위협이 유입될 위험이 있다”라고 경고했다.

그는 “이제 기업은 단순한 데이터 복원 수준을 넘어 철저한 데이터 무결성 검증 절차를 포함한 내부 복구 계획을 마련해야 한다”라고 조언했다.
dl-ciokorea@foundryco.com

For decades, power companies were the definition of dull. Powering your home was necessary but uninspiring, a commodity no different than running water. NRG Energy is proving that view outdated with acquisitions, partnerships, and a willingness to reimagine what a power generator can be, turning electricity into an engaging experience.

“Energy providers have always been thought of as the background players in people’s lives,” says Dak Liyanearachchi, the company’s EVP and CTO. “Our job now is to move to the foreground and show that energy can be personal and intelligent.”

From residential power to connected experiences

NRG began as a power generator before broadening its reach to serve residential customers. In recent years, it’s redefined its consumer strategy by bringing together electricity, smart home solutions, and digital platforms. The acquisition of Vivint Smart Home and partnerships with Renew Home gave NRG the foundation to link thermostats, energy services, and residential devices into one ecosystem, unlocking the potential of virtual power plant (VPP) technology.

A VPP aggregates distributed resources like thermostats, batteries, and rooftop solar across thousands of homes. Coordinated effectively, it becomes a flexible network that shifts demand, balances supply, and supports the grid during times of crisis.

The result is energy management that feels seamless and intentional. The Vivint and Nest thermostats don’t just heat and cool, they dynamically reduce demand on the grid during peak hours, improving reliability while realizing new capabilities for the company. Consumers see lower bills and greater comfort, but behind the scenes, the technology powers something larger.

In Texas, where extreme weather and surging demand from AI data centers can strain the grid, NRG’s VPP approach provides resilience. The company is targeting a gigawatt of capacity, enough to power hundreds of thousands of homes without building a single new plant.

“This isn’t just about keeping the lights on,” Liyanearachchi explains. “It’s about turning millions of small resources into a collective force that ensures reliability, reduces costs, and creates value for everyone.”

Rewiring technology to match strategy

NRG’s consumer story wouldn’t be possible without reimagining how technology operates inside the company. Under Liyanearachchi’s leadership, NRG has moved to a product operating model, aligning business and technology teams around shared outcomes rather than siloed projects.

“Historically, electricity providers approached technology as a request and deliver model,” he says. “The business would hand over requirements, and six to 12 months later, technology would deliver, often out of sync with the need. We knew that wasn’t sustainable if we wanted to bring smart home and energy into one seamless experience.”

The shift has introduced budget transparency, empowered business leaders to set technology priorities, and created a single cadence for planning and execution. Quarterly sessions also bring residential power, smart home, and energy teams together to align on customer priorities and deliver integrated products.

When developing new home energy offerings, NRGs’ teams now also span smart home, energy, engineering, and business leaders. The result is concepts moving quickly into products delivered to millions of households.

Additionally, AI enablement throughout the software development lifecycle is poised to continue pushing the operating model toward leaner, faster deployment, while promoting democratized AI usage by non-technology team members.

“The product operating model has given us a shared language,” Liyanearachchi says. “It’s no longer about technology supporting the business from the sidelines. We’re building solutions together, side by side.”

The AI catalyst

AI runs through NRG’s industry and internal strategies, and traditional machine learning powers personalization, fraud detection, and forecasting. Plus, generative AI has opened new horizons, particularly in customer care and sales, where it reduces friction and improves both customer and employee experience.

“We see AI through two lenses,” Liyanearachchi says. “One is industry wide with the surge of data centers, EV adoption, and smart devices creating unprecedented demand for power. AI will be part of managing that. The second is internal, using AI to transform how we work, from forecasting weather driven demand to reimagining customer interactions.”

NRG’s transformation office plays a central role, too, looking beyond immediate use cases to envision the business of 2030. Forecasting demand with more precision, integrating renewables, and managing a grid strained by AI workloads are all on the agenda as well.

Building for unprecedented demand

States like Texas, Georgia, and Virginia face surging energy consumption from population growth, electrification, and AI driven data centers. Left unchecked, that demand could result in brownouts or blackouts.

NRG is addressing this challenge on two fronts: through its VPP strategy, which reduces strain on the grid by orchestrating demand at scale, and through continued investment in traditional generation to ensure reliability by acquiring assets such as the Rockland portfolio, which closed earlier this year, and pursuing additional opportunities like LS Power (subject to close).

“It isn’t either or,” Liyanearachchi adds. “The future of energy will be both virtual and physical. We’re investing in power plants and power pixels, the distributed intelligence that turns homes into part of the solution.”

Lessons for leaders

For Fortune 500 CIOs, NRG’s transformation is more than a power provider story. It’s a playbook for reinvention. Energy may be the context, but the underlying themes resonate across industries.

NRG shows what it looks like to turn a commodity into an experience, shifting electricity from a background service into something customers actively value. It demonstrates how aligning business and technology through a product operating model can move IT from service provider to co-creator. It also highlights how AI can serve not only as an efficiency driver, but as a catalyst to reimagine how the business operates and engages customers.

The reminder is clear that even the most commoditized industries can reinvent themselves. The real question is whether leaders are ready to challenge assumptions and rewire their organizations to make it happen.

For NRG, the days of being seen as just another power provider are over. The company is showing that transformation isn’t reserved for digital natives. It’s available to any industry bold enough to put experience at the center.

“Power may never be sexy in the traditional sense, but when you deliver comfort, reliability, and innovation into people’s homes, and reshape how the grid works in the process, that’s pretty exciting,” says Liyanearachchi.

You’ve focused on making credible, board-level promises that connect technology to business value by going Beyond the business case: A playbook for securing board-level buy-in. After you secure your mandate and walk out with the buy-in you need to drive real change, your accountability shifts from the vision you sold to the delivery engine you must build.

Think of yourself as the team principal of a Formula 1 racing team. You’ve just convinced the sponsors to back your vision of podium finishes and championships; the promises still echo in the boardroom. But a vision doesn’t win races. A finely tuned car, an elite pit crew and a world-class driver do.

In the enterprise, it’s the same. Boardroom commitments mean nothing without an organization designed to deliver them. The single greatest predictor of your success isn’t your technology stack: it’s your organizational architecture. But before you can lay out a new blueprint, you must first understand the flawed models holding you back.

The organizational models that hold you back

Most technology organizations are not designed; they’re inherited. They’re a collection of vertical silos (applications, infrastructure, data, security, etc.) optimized for a bygone era of stability and control.

It’s like an F1 team where the engine designers aren’t allowed to speak to the chassis engineers and the driver only sees the car on race day.

This isn’t just inefficient; it’s disempowering. Talented professionals become ticket-takers in a feature factory, stripped of ownership and lacking context. They burn out under the weight of handoffs and politics, while the business loses faith in IT’s ability to execute and turns to shadow IT or unsanctioned third-party solutions that only exacerbate the problem.

And every missed deadline or clumsy release is more than an operational hiccup; it’s a withdrawal from the political capital you worked so hard to build. CIOs rarely get fired over a single outage. They get fired because the organization they inherited was incapable of delivering on the promises they made.

The engines of a modern technology organization

To deliver on your commitments, you must re-architect around the flow of value, just as an F1 car is architected not for raw speed, but for sustainable performance: the ability to be fast, reliable and precise, lap after lap. That means moving beyond technology layers and designing a system with three core engines, each with a distinct but interlocking purpose.

Engine 1: Product teams as the driver and the car

Product teams are your race crews: durable, cross-functional units that own business outcomes end to end. Unlike project teams that disband after launch, product teams stay with their domain, whether that’s digital onboarding, checkout and payments, or inventory and fulfillment.

Their mission isn’t to deliver a set of features; it’s to achieve measurable outcomes. Instead of reporting “20 new features shipped,” they point to “+15% customer retention” or “three weeks shaved off onboarding.” That’s how promises to the board become the day-to-day mission of empowered teams.

The payoff is enormous. McKinsey’s analysis shows companies with mature product models deliver 60% higher shareholder returns and 16% higher operating margins.

In my own experience at Sagent, we saw the transformation firsthand: velocity increased, but so did solution quality, because teams had the context and autonomy to solve real industry problems, not just build to a spec.

When you design your organization this way, you don’t just build software. You build a culture of ownership that becomes a magnet for top talent.

Engine 2: Platform teams as the high-tech garage

In Formula 1, a world-class car is built and perfected in a world-class garage. It’s the high-tech hub where perfectly engineered parts are organized, specialized tools are ready and expert mechanics can work with speed and precision. Your platform teams are this well-stocked garage.

Their mission is to treat infrastructure, cloud services, developer tools and data pipelines as first-class citizens. Their customers are the engineers inside your company and success is measured by how frictionless they make delivery.

This approach tackles the reality of cognitive load, which is the mental energy engineers spend on things other than creating customer value. As the book “Team Topologies” explains, no team can master every domain.

Without platform teams, you get duplication of effort, with multiple teams solving authentication, CI/CD or observability in inconsistent ways. The result is waste, inconsistency and maintenance nightmares.

Platform teams prevent this by providing a custom-molded tool chest where every tool is in its place. This includes specialized diagnostic software (well-documented APIs), automated assembly workflows (golden paths to deployment) and a unified telemetry dashboard (shared observability). That level of organization frees product teams to focus on high-performance engineering, not on searching for the right wrench.

And don’t underestimate the talent advantage. World-class engineers want to build; they don’t want to fight brittle pipelines or reinvent tools. A thoughtful platform strategy doesn’t just speed delivery. It helps you attract and retain the very people you need to win.

Engine 3: The office of the CIO as the car concept and design team

While the other engines are winning races today, this is the team that designs the championship-winning car concept for next season. This strategic function governs cross-cutting architecture, mitigates long-term technology risk, manages the technical debt portfolio and scans the horizon for innovation.

Crucially, it doesn’t need to be a heavy bureaucracy. In some organizations, it’s a formal architecture team; in others, a rotating council of senior engineers or lightweight guilds. The form matters less than the function: which is to ensure today’s speed doesn’t become tomorrow’s technical bankruptcy.

This team makes conscious decisions: which technical debt is acceptable for now, which must be retired to enable scale and which emerging technologies, like AI governance, agentic automation and quantum security, demand early exploration.

Far from being an ivory tower, this function is about credibility. It ensures your technology investments stand up to scrutiny from investors, regulators and customers. It’s the safeguard that keeps the enterprise competitive not just this quarter, but for years to come.

Beyond the org chart: Dismantling cultural silos

A perfect blueprint isn’t enough. A high-performance engine will seize without lubrication; and the friction that grinds a technology organization to a halt comes from its silos. Not the technical ones, but the cultural ones.

I once saw a development team and a security team each assume the other owned API encryption standards. The result? Over a dozen services were deployed without consistent safeguards.

That wasn’t a tech failure … it was a leadership failure to establish a cultural default of shared accountability. And it carried real stakes: promises made to the board were compromised well before they reached production.

This is why leading firms pursue what Deloitte’s Human Capital Trends calls a “boundaryless organization.” To get there, you need rituals that create a culture of transparency and shared ownership. I focus on what I call JAB: three non-negotiables that jab away at the cultural silos that hold organizations back.

• J for joint planning: A shared rhythm where teams align on goals, dependencies and trade-offs. It replaces siloed roadmaps with a single, unified mission.
• A for architecture showcases: Regular forums where teams present work in progress. This serves as a powerful antidote to the “not invented here” syndrome and creates a culture of shared learning.
• B for blameless post-mortems: A process focused on systemic causes, not individual blame. This is the bedrock of psychological safety: replacing a culture of fear with one of continuous improvement.

These practices force the conversations that legacy silos were designed to avoid.

At the same time, balance matters. Over-collaboration slows everything down. The goal isn’t endless consensus; it’s precision alignment with enough shared context to keep the chassis stable while the engine runs at full speed.

The leadership transformation

Architecting this model requires a fundamental shift in leadership. As team principal, your primary job is no longer to direct every turn from the pit wall. It’s to lead with CARE, a people-oriented framework that elevates structure into sustained performance:

• Clarify: Translate board-level promises into a cohesive mission that aligns strategy, structure and outcomes. Teams must know not just what hill to take, but whyit matters.
• Amplify: Relentlessly amplify the why through storytelling at scale. It’s your job to keep the vision alive when day-to-day pressures threaten to bury it.
• Remove: Dismantle the friction (processes, silos or politics) that slow execution. Clearing obstacles is one of the most high-leverage acts of leadership you can perform.
• Empower: Grant teams true ownership of outcomes, shifting the conversation from assigned activities to measurable impact. When leaders let go, teams step up.

Your legacy isn’t the systems you ship: it’s the organization you leave behind … resilient, empowered and capable of delivering value year after year.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

There may be just over two months left in 2025, but that’s enough time to deliver a few more IT wins and set the stage for bigger victories in the year to come.

Given the long list of priorities CIOs had at the start of this year, IT leaders still have plenty of opportunities to pursue — from AI initiatives to strategy adjustments.

What work are IT leaders looking to push across the finish line before the year runs out? Here’s a look at the end-of-year projects making CIOs’ must-do-now lists.

1. Shoring up the AI governance policy

The race to harness artificial intelligence in the enterprise has been under way for years, yet many organizations don’t yet have a fully formed AI governance policy.

The 2025 Public Company Board Practices and Oversight Survey from the National Association of Corporate Directors found that only 36% of boards have adopted an AI governance framework, only 23% have reevaluated corporate strategies to incorporate AI’s impact, and a mere 27% have incorporated AI oversight responsibilities into board committee charters.

“AI governance is all over the place,” says Eric Bloom, executive director of the IT Management and Leadership Institute. “For CIOs [whose organizations] don’t have AI governance and usage guidelines, they should create them now. And if they developed them more than a year ago, then they should be readdressing them because the technology has changed so much and so quickly.”

RGP CIO Keith Golden is tackling this task, knowing that having up-to-date guidelines is key for successful AI deployments. The global consulting and project execution company has an AI task force working to develop “a fully-fledged governance model” that will include ways to evaluate and prioritize proposed AI projects, he says, adding that this work will include establishing processes to monitor and measure AI initiatives to ensure they deliver business value.

“We’re taking steps to really manage our own AI shop effectively,” Golden says, noting that he’s aiming to finish work on this by year’s end.

2. Strengthening the foundation needed for AI deployments

Successful AI deployments require more than good governance; they also need the right data and technology environment.

Many CIOs are making sure those elements are in place ASAP, says Eric Stettler, partner in the technology transformation practice at Kearney, a global strategy and management consulting firm.

“The CIO needs to make sure the foundational capabilities — data, application architecture, the enterprise architecture, the needed skill sets — are all set up to take full advantage of AI technologies and deliver meaningful outcomes for the organization,” Stettler says, noting that the lack of these contributes to the high percentage of organizations struggling to move AI pilots to enterprise-scale production.

Brian Fruh, former CIO and head of technology at Impax Asset Management and now offering fractional CIO services, says he and other CIOs are making big plays to that end, particularly around data.

“There is still more work to be done with data governance and making sure [organizations] have a single source of truth. There is a sense of urgency now as AI is maturing, because you can’t fully capitalize on AI until data governance, the single source of truth, data security, and those other foundational pieces are in place,” Fruh says.

3. Delivering AI that has demonstrable value

A September 2025 report from Boston Consulting Group titled The Widening AI Value Gap included sobering findings: “Only 5% of companies in our 2025 study of more than 1,250 firms worldwide are achieving AI value at scale — a measure of how tough the full AI transformation is. Fully 60% of companies are not achieving material value at all, reporting minimal revenue and cost gains despite substantial investment.”

Given such figures, CIOs are feeling the pressure to deliver, says Ian Pitt, executive vice president and CIO at Progress Software.

“It feels as if we’re almost in the second trough of disillusionment with AI, the first being after ChatGPT came out when we found it didn’t solve all our problems. Now, with this new round of AI, CEOs and CFOs are now saying, ‘Show me the value,’” he says. “If CIOs aren’t working on that, they should, because the life of the IT leader is all about returns on investment. We can talk about keeping the bad guys out, keeping the lights on, enabling a great workplace, but it all has to come with a was-it-all-worth-it mindset.”

Pitt and his IT team are working to deploy more AI within the company that will measurably boost productivity or generate efficiencies, he says.

A big focus heading into the last quarter for Pitt is making sure “everyone in the company is a frequent return visitor” to the Microsoft Copilot capabilities that IT had deployed earlier this year. He is measuring the rate of the technology’s use by user and identifying those who need more training to ensure the company gets to full adoption fast. Working to get high adoption rates means the company can maximize the value of its investment, he says.

“It’s all around making sure we can end the year on a high point,” he adds.

Other CIOs, including Pegasystems CIO David Vidoni, are making a similar push to close out 2025.

Vidoni is looking to deploy agentic AI in ways that support the company’s goals of rapid growth without additional costs. He and his IT team are creating agents to help employees move through their work more quickly and easily. For example, one agent in progress will identify sales leads, pull relevant information on the customer and products, and draft custom proposals — enabling Pegasystems account executives to finalize the messaging without having to manually perform as much of that work.

4. Readying employees for AI-enabled attacks

Deepfake incidents are increasingly impacting organizations, according to research firm Gartner, pointing to a 2025 survey showing that 43% of responding tech leaders saw at least one audio call incident and 37% experienced deepfakes in video calls.

RGP’s Golden is now working to step up his organization’s readiness to fend off those and other AI-enabled attacks.

“The threat actors are using AI tools and AI automation, so it’s a good idea for CIOs to look at their own tooling and coverage to see where there are weaknesses and also talk to vendors about how they’re preparing,” he says.

Golden and others list several steps they’re taking now to help their organizations better defend against AI-enabled attacks, a list that includes educating leadership on the risks, implementing training programs that specifically address the threat, and implementing more AI in their security programs.

5. Improving customer and employee experiences

Both lines of business leaders and IT leaders listed improving customer experience as a top priority for 2025, according to the State of the CIO Survey published in May by CIO.com.

Gartner in its 2025 CIO Agenda survey similarly found that improving customer experience was a top goal for the year, coming in at No. 5 on the list of CIO priorities.

Pegasystems’ Vidoni wants to close out the year with a few more wins in this category.

“On the client experience side, we’re having a big push to make it easier for them to find what they’re looking for from us, make it more intuitive for customers to interact with us, make it easier to find what they need,” he says, stressing that customers now expect both great products and great experiences from companies.

Vidoni says improving customer experience supports company objectives beyond customer satisfaction and retention, explaining that improved customer experience reduces the workload on staff by reducing the need for customers to connect with employees for information.

He and his IT team are working to add AI agents to customer-facing features to help make company-customer interactions fast, seamless, productive, and personalized.

6. Speeding up

Jamil Farshchi, CTO at Equifax, one of the three major credit reporting agencies in the US, says he wants IT to focus on bringing more speed to the business — something he has been working on but isn’t yet finished with.

“Our most significant IT win this year isn’t a single product or a platform. It’s making every part of our business run faster,” he says. “Our multiyear, approximately $3 billion Equifax cloud transformation has equipped us to increase our speed in a variety of ways, including processing data, onboarding customers, shipping new products, and detecting threats.”

That transformation has brought the company plenty of wins already, “and we’re on track to launch around 150 new products before the end of the year,” Farshchi says, noting “we’ve made great strides, but there’s no finish line.”

7. Preparing a realistic 2026 budget (that can handle uncertainty)

The outlook for 2026 is mixed, with executives downgrading expectations and bracing for possible economic turbulence.

That’s the message CIOs are getting. Gartner’s 2026 CIO Agenda Preview report declared, “Executives have hit the brakes on 2025 growth forecasts,” explaining that “74% of executive leadership teams have lowered 2025 top-line growth expectations for their organizations. Organizations are, on average, recalibrating top-line growth expectations downward by 8.3% relative to expectations at the start of the year.”

The Gartner report also found that only 53% of CIOs expect their budgets to increase in 2026, with the average increase being only 2.79%. Some 27% expect a level-funded budget and 19% anticipate a decrease in IT spending year of year. CIOs can expect “to face sustained pressure to reduce costs and improve productivity,” Gartner wrote in its report.

RGP’s Golden is developing an IT budget for 2026 that will deliver what the business needs while respecting the current macroeconomic uncertainty, listing the ability to successfully balance those issues as one win he wants to notch before the year closes.

“For most people this is budget season coming up, and for most of the colleagues I talk to and what I hear back from clients is that we’re still in a time of economic uncertainty. So our budget is all-weather. We need to be prepared if there is a lift, and we need to be prepared for choppy waters. Many of my colleagues have that same kind of framing,” Golden says.

To thread the needle here, Golden says he’s building a budget based on “what we absolutely have to have regardless of economic conditions and what we might do if the macroeconomic lift is coming. We’ll have what we’re prepared to do under any circumstance.”

In Navigating the honeymoon phase of a new product launch, I stressed how important it is for product leaders to lay a strong foundation during the initial phase of product launch, or risk losing momentum and time due to rework, reestablishing credibility with your stakeholders and experiencing misalignment on key goals and even the overall strategy.

Now I want to dig in deeper on strategy.

Launching a product is one of the most exciting (and daunting) moments in a company’s lifecycle. I’ve led teams through this process multiple times and have seen firsthand that the difference between a successful launch and a frustrating misstep often comes down to strategy. Strategy isn’t just having a vague idea of “what we want to build,” but a clear, repeatable and well-communicated strategy that aligns stakeholders, guides decision-making and withstands the inevitable challenges.

These are the principles I’ve developed over the years while leading product strategy at companies like Chronosphere and Splunk. My hope is to give other leaders a practical framework for approaching launches with discipline and confidence.

Start with the why and build alignment

One of the most common mistakes product leaders and the C-suite alike often make is assuming a strategy already exists. An idea exists, but an idea isn’t a strategy. Before building roadmaps or sprint plans, take a step back and think: Why are we doing this?

A strong strategy rests on three foundations.

1. Market opportunity: Something has shifted or been overlooked in the market. Maybe existing vendors are overpriced, or an entire segment is underserved. Articulating the gap crisply is step one.
2. Why us: Equally important is explaining why your company is best positioned to seize that opportunity. Is it brand reputation? Unique technology? Distribution reach? Stakeholders need to hear a credible reason why this isn’t just another good idea, but an idea that will succeed.
3. How: How is your company realistically going to get there? Stakeholders and project teams are looking for something simple, believable, compelling and convincing.  This should be the 10-second version of the core pillars or standout capabilities of the roadmap. This is not the detailed roadmap.

When I joined Chronosphere, for example, I knew getting engineering leaders invested early was critical. Their analytical perspective challenged me to refine assumptions and by the time we rolled out the strategy more broadly, it was already stress-tested. This early buy-in also turned them into my biggest champions, reinforcing the message across the organization.

According to research by consulting and training firm LSA Global, companies that align product strategy with corporate strategy see significantly higher growth rates than their peers. But alignment doesn’t happen by accident — it requires intentional conversations with stakeholders, often individually, before group settings, to avoid groupthink and uncover true expectations.

Balance disruption with pragmatism

Every product team wants to be disruptive, but disruption has to be strategic. I’ve seen teams try to reinvent every aspect of a product, from the UI to the backend to the go-to-market strategy, only to burn out. The truth is, not every part of a launch needs disruption.

Instead, I map out distinct phases for the first few years and identify where we will disrupt versus where we will follow. If a competitor is doing something right, I’m not afraid to take notes. In fact, in many cases, users have limits to how much disruption they can accept in a new product, and you must understand those limits. Ask yourself, are you another player in the market with some differentiation, or are you creating a market for something materially new? The former will have a higher mix of table stakes features relative to disruptive features versus the latter. Understanding and embracing the reality of which one of those you are doing will help you balance your investments in disruptive capabilities vs. table stakes.

Key takeaway: Disruption is only valuable when the market craves it.

South Park’s “Underpants Gnomes” episode captures this pitfall well:

• Phase 1: Collect underpants
• Phase 2: ?
• Phase 3: Profit

Without clear links between disruption and value creation, a strategy collapses into wishful thinking.

Make the team co-owners of the strategy

Strategies fail when they’re imposed. They succeed when teams feel ownership. At Chronosphere, before bringing stakeholders into the fold, I first iterated with engineering leaders. This not only improved the plan but also created internal advocates who could carry the message forward.

Giving teams skin in the game helps do two things:

• Strengthens the strategy itself, because people closest to the work sharpen the assumptions.
• Ensures the strategy lives beyond the leadership team, because employees repeat it with genuine, authentic conviction.

When stakeholders see excited teams, they trust the direction more. Excitement is contagious, and in my experience, it’s the best signal that a strategy will survive the ups and downs of execution.

Repeat success criteria, make it your mantra

Another hard lesson I learned at my former company, Splunk, was that success criteria can drift. Midway through a product’s lifecycle, stakeholders sometimes “remember” different goals than the ones we agreed on. The product under my purview exceeded revenue targets for several years, but because I hadn’t consistently repeated the strategy and success metrics, late-stage perceptions shifted. As a result, the product was seen as less successful than it really was.

That experience taught me the importance of ruthless clarity and repetition. A strategy should be explainable in five minutes without slides. I rehearse it until I can deliver it to a busy executive in an elevator ride. Then I repeat it — at all-hands, in board meetings, during one-on-ones — until people can recite it back.

Neuroscience shows repetition is how people internalize ideas. In the context of product launches, repetition ensures the vision doesn’t get diluted as teams sprint toward delivery.

Iterations and updates to strategy are expected

Your strategy will be an evolving organism; very rarely can you consider it done and dusted the first time you craft it. Expect pivots, missed targets and unexpected obstacles. What matters is that you can evolve your strategy as you learn more. 

However, while it is true that a strategy will evolve, a well-thought-out strategy will change when the underlying assumptions or real-world data change, and hopefully those will change infrequently.

Strategy as the anchor

Crafting a winning product strategy isn’t about writing a perfect document. It’s about building a living framework that aligns people, withstands pressure and guides tough decisions.

Every launch I’ve been part of has reinforced this: Ideas are plentiful, but disciplined strategies are rare. The leaders who can articulate a compelling “why,” repeat it until it sticks, balance disruption with pragmatism and bring their teams along for the ride are the ones who consistently turn launches into lasting successes.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

A new era of AI is taking shape. Over the last year, the demand for deploying trained models in real-time applications has surged, along with a continuous stream of challengers and disruptors entering the scene. AI inference, the process of using a trained AI model to make predictions or decisions by crunching new data inside neural-networked systems, has become a critical and complex growth area. It’s backed by deep investment and projected to grow at a compound annual growth rate (CAGR) of 19.2% through 2030.

Right now, a top concern across the industry is simple: We need to process significantly more data (tokens) through more AI models for dramatically less cost. Processing inference AI tokens is 10 to 100 times more expensive than it should be, forming a challenging barrier to entry that cuts across a wide variety of use cases with different input data modalities such as text, image, video and audio, as well as multimodal combinations of them.

Complexity and cost are tightly connected. Model size, data movement and computational demands all stack up and every one of them impacts ROI. To move beyond limited pilot programs and into real business impact, we must confront this challenge head-on.

We need to fix the broken economics to unlock adoption. Until the cost curve is repaired, we will fall short of realizing AI’s full potential for enhancing existing markets and creating new ones.

In the race to commoditize generative and agentic AI tokens, the winners will be those who can deliver the best, fastest and most cost-effective options. To get there, we must break with legacy assumptions.

What led us here

Looking back at the deep learning revolution, everything changed with AlexNet’s breakthrough in 2012. That neural network shattered image-recognition accuracy records and proved deep learning could deliver game-changing results.

What made AlexNet possible? Nvidia’s GPU. Originally built for gaming, it turned out GPUs were well-suited for the massive, repetitive calculations of neural networks. Nvidia had already invested in making GPUs programmable for general-purpose computing for HPC workloads, giving them a huge head start when AI erupted.

GPU performance for AI began outpacing CPUs at an exponential rate, leading to what became known as Huang’s Law: the observation that AI performance on GPUs doubles every 12 to 18 months. Unlike Moore’s Law, Huang’s Law is holding strong, fueled by a more parallelized GPU architecture and the evolving system architecture surrounding it.

Which brings us to today. We have powerful GPUs and custom AI accelerators, aka XPUs, but we’re connecting them to an infrastructure built with repurposed legacy CPUs and NICs. It’s like putting a Ferrari engine into a go-kart.

The legacy x86 architecture used by most AI servers’ CPU head nodes isn’t built to keep up with AI. It’s a general-purpose processor that can’t maintain the volume and velocity of processing required of the AI server’s head node by ever-evolving AI workloads. It ends up leaving expensive GPUs sitting idle, underutilized and underperforming.

One GPU is not sufficient anymore, so bigger arrays of GPUs are now used. They form a larger virtual processor to run those huge models and do it faster, which improves user experience and offers faster response time to agents in need of multiple iterations of model querying. Improved network connectivity and data transfer time between GPUs is now critical so GPUs will not be wasted waiting on data.

Employing the full stack

AI needs massive data flows in the blink of an eye (actually, much faster than that). To drive the cost-per-data-token down toward near zero, we need a full-stack approach with smarter software, purpose-built hardware and intelligent orchestration.

On the hardware side, GPUs and other XPUs are evolving rapidly. Their performance is improving year over year and not just because of more transistors, but because of better architecture, tighter integration and faster memory. Huang’s Law continues to deliver.

But these powerful AI processors are held back by the systems they’re embedded in. It’s like lining up Ferraris and asking them to race during rush-hour traffic.

New classes of specialized AI chips are emerging, fundamentally transforming computing, connectivity and networking for AI. This isn’t another GPU or XPU; it’s innovation at the core of the system — both from the head-node side as well as from the scale-up and scale-out network sides. These AI-optimized, purpose-built chips are masters of traffic control and processing that enable GPUs to run at full speed.

It is increasingly clear that we need faster, smarter, compute-enabled and AI-optimized NICs natively integrated into those evolving networking frameworks and stacks (nCCL, xCCL, etc.) while bypassing the CPU during data-transferring stages. The network becomes not just a superhighway, but part of the brain of the operation. These new NICs can adapt to new and future protocols designed for AI and HPC, like the ultra ethernet protocol.

On the software side, we’re seeing major advances. Techniques like pruning and knowledge distillation help make models faster, lighter and more efficient. Smaller models, like DeepSeek, outperform expectations by optimizing and balancing inference compute and data flows.

To truly reduce the cost-per-AI-token, everything across the stack must work in sync, from silicon and software to system design. The right combination can enable this synchronization to bring down costs while delivering new levels of performance.

The path to zero marginal cost

AI inference costs remain stubbornly high, even with massive capital investment. Tech companies and cloud providers often run at negative margins, pouring money into inefficient systems that were never designed for the demands of modern inference.

The fundamental issue is marginal cost. In any scalable business, success depends on driving down the cost of producing one more unit. That’s what makes them profitable and what made the whole SaaS business viable and scalable.

The same principle applies to AI. To be truly transformative, the cost of generating additional tokens needs to approach zero. That’s when the market stops subsidizing and starts extracting real, repeatable business value.

We can get there by closing the gap between Moore’s Law and Huang’s Law and by making sure networks leap ahead of GPUs. Doing so demands architecture that works with, not against, the GPUs and XPUs already leading progress.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Engines dead. Five Beaufort winds. A patrol ship drifting in open water. Twenty men staring at me — waiting for direction, waiting for calm, waiting for a decision. In those thirty minutes, while we fought to restart the engines, I felt the weight of accountability in its purest form. Fear was on every face, including mine. My first job wasn’t to solve the problem — it was to steady myself so that I could steady them. Only then could we focus on the solution instead of the danger surrounding us.

Years later, as I led technology teams, I realized how familiar that feeling was. A system crash, a cyber incident, a project spiraling off-course — the team looks to the CIO in the same way my crew looked at me on that ship. The data is incomplete, the risks are real and the clock is merciless. And just like at sea, calm is contagious. If the leader panics, the team collapses.

My career has taken me from commanding a naval vessel to writing code as a junior engineer, to founding a company and eventually to executive roles leading global technology initiatives. Every stage forced me to reinvent myself, often painfully, always urgently. Reinvention isn’t optional — it’s the core skill that has kept me relevant across two completely different worlds.

That’s why I believe reinvention is the defining leadership challenge for today’s CIOs. Technology changes every day, regulations arrive faster than roadmaps and boards expect transformation without excuses. The leaders who thrive are the ones who can pivot, absorb pressure and help others rise to challenges they didn’t think they could handle.

Reinventing teams

On one mission, my crew and I were ordered to leave our base for more than two months, sailing to unknown ports with little certainty about what awaited us. At first, I worried about morale — long separations from home, new routines, constant change. I expected resistance, maybe even complaints. But something surprising happened. Once I set the expectation that this was our mission and we would succeed together, the crew adapted. More than that, they performed better than I thought possible.

It taught me a lasting lesson: people rise to the expectations you set. If you frame change as a burden, they’ll feel burdened. If you frame it as a mission, they’ll find the strength they didn’t know they had.

For CIOs, the same truth applies. Moving teams from on-prem to cloud, from waterfall to Agile or from manual workflows to AI-driven automation will always be uncomfortable. Leaders who over-index on empathy risk reinforcing fear. Leaders who set confident expectations create confidence in others.

Pivoting with discipline

When I left the Navy and entered the technology industry, I learned quickly that plans rarely survive the first contact. Early on, I embraced agile as a way to adapt. And while agile has undeniable value, I also saw how it can become an excuse for chaos. Too often, teams skipped preparation and architecture, assuming they could “pivot later.” The result wasn’t agility — it was debt.

As a CEO, I discovered the hard way that the quality of a Statement of Work (SoW) often determines the quality of the relationship. A strong SoW builds clarity and trust. A weak one breeds confusion and conflict. Agile doesn’t change that truth. Pivoting can be necessary, but without preparation and strong architecture, you’re not adapting — you’re gambling.

For CIOs, agility is vital, but it cannot replace discipline. The most vigorous transformations strike a balance between adaptability and structure, so pivots occur on a solid foundation.

The power of letting go

When I became CEO of my own firm, I thought the best way to protect the company was to be everywhere at once. In the morning, I was the project manager in the trenches with the client’s technical team. In the evening, I was the CEO negotiating with their executives. When a large customer tried to change the scope just weeks before delivery, I realized I had created the opposite effect. By being both PM and CEO, I blurred the lines, weakened our position and allowed the client to take us for granted.

We pulled through the project, but the lesson stuck: when leaders try to do everything, they actually harm the organization. They don’t give their teams room to grow, they dilute their authority and they create unhealthy dynamics with stakeholders.

CIOs often fall into the same trap. Out of responsibility, they insert themselves into every decision, every firefight, every meeting. But the higher the role, the more damaging this becomes. Authentic leadership is about empowering others while maintaining your authority for the moments that truly matter. Delegation isn’t abdication — it’s how organizations build strength.

Reinventing self

For years, I defined myself as an engineer. My job was to build what I was told to make. But over time, working side by side with customers, I realized the real value wasn’t in the code — it was in understanding what should be built. Customers didn’t always articulate needs in technical terms. Translating those fragments into real solutions was a different kind of leadership.

That was the moment I crossed the line from technologist to executive. Technology was no longer the end in itself — it was the tool. My responsibility had shifted from execution to vision, from building things right to creating the right things.

CIOs face a similar transformation. For decades, the role was centered on custodianship: maintaining systems, controlling costs and managing risks. Today, the CIO must be a strategist, shaping digital vision and influencing enterprise direction. Reinventing yourself from executor to visionary isn’t optional. It’s survival.

Staying relevant

When I transitioned from the Navy into tech, I didn’t have the luxury of endless resources. I had a 256MB USB stick and an internet café. I’d download documentation at night, study it after duty and repeat the next day — all while raising two young daughters. There was no shortcut, just focus and perseverance.

That discipline has been my most valuable asset. Today, I see professionals with smartphones, cloud platforms and AI copilots at their fingertips — yet many struggle to focus for more than a few seconds. The tools are better, but the mindset is weaker.

For CIOs, this isn’t just nostalgia. As Harvard Business Review has discussed, the half-life of knowledge is shrinking. What you know today may be irrelevant in twelve months. Reinvention requires continuous learning, the ability to block out noise and the discipline to focus when it matters. Tools change. Leadership discipline doesn’t.

My 5 rules of reinvention

Across both my naval and technology careers, I’ve found five rules that hold in any environment:

1. Calm is contagious.  Before addressing your team in a crisis, take two minutes to steady yourself — breathe, clarify the top priority, then communicate with focus.
2. Expectations shape performance. Frame reskilling or transformation not as a burden, but as a mission. Instead of asking, “What worries you?”ask, “How will we make this succeed together?”
3. Discipline anchors agility. When launching any major initiative, insist on a written “minimum viable architecture.” It doesn’t need to be perfect, but it must exist before pivots begin.
4. Delegation builds authority. In your next project, identify one decision you usually make yourself — and assign it fully to a lieutenant. Then support their decision publicly.
5. Focus is a superpower. Block two hours weekly in your calendar for uninterrupted learning or deep work. Treat it with the same respect as a board meeting — immovable and protected.

Reinvention as a leadership imperative

Leadership, in every chapter of my career, has been reinvention. On a ship with no engines, I had to reinvent fear into focus. On long deployments, I had to reinvent uncertainty into confidence. In technology, I’ve had to reinvent failed plans into disciplined pivots, personal failures into lessons and myself from engineer into strategist.

CIOs face the same reality every day. Systems will fail. Strategies will collapse. Regulations like the EU AI Act will reshape compliance. Teams will resist new directions. None of that is optional. What is optional is how leaders respond: whether they cling to old habits or reinvent themselves and their organizations for the next challenge.

Technology will keep evolving daily. The leadership challenge doesn’t change. Reinvention isn’t a one-time act. It is the CIO’s career. And those who embrace it won’t just survive disruption — they’ll define the future of their enterprises.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Growing use of AI coding assistants and low-code development tools appears to be driving down demand for junior developers as many companies look to cut workforce expenses.

Outlooks for software developer jobs are mixed, with the US Bureau of Labor Statistics projecting 15% growth between 2024 and 2034. But many IT experts see a softening job market for developers, particularly junior coders, with hiring freezes and layoffs on the horizon as organizations replace them with AI coding assistants.

Recent statistics support this view. The unemployment rate for recent US graduates in computer engineering stands at 7.5%, with computer science grads sitting at 6.1%, and information systems and management at 5.6%, according to projections from the US Federal Reserve Bank of New York.

Those percentages are higher than the overall US unemployment rate of 4.3% and significantly elevated compared to recent grads in nursing (1.4%), elementary education (1.8%), civil engineering (1%), and even art history (3%).

At the same time, a recent Resume.org survey of 1,000 US business leaders found that six in 10 companies are likely to lay off employees in 2026, with four in 10 planning to replace workers with AI by then. With AI coding assistants already near universally used, programmer jobs may be among the first on the chopping block.

Chirag Agrawal, a senior software engineer, sees junior developer roles disappearing as companies try to do more with less.

“Four years ago, I was that junior developer writing boilerplate CRUD code, proud of every clean PR I merged,” he says. “Today? I watch new grads struggle to land their first job, not because they’re unskilled, but because companies ask, ‘Why hire a junior for $90K when GitHub Copilot costs $10?’”

Still, Agrawal sees a future role for developers who can work with AI. The best software engineers won’t be the fastest coders, but instead, they will be those who know when to distrust AI, he says.

“At my company, my role has shifted from just coding to validating AI output, checking for edge cases, security risks, and logic gaps that AI can’t catch,” he says. “I’m not trying to out-code AI. I’m making myself essential by leading it with judgment.”

Cuts vs. productivity

There seem to be mixed responses to AI coding assistants, with some companies pushing for more productivity and others cutting jobs, adds Zeel Jadia, CEO and CTO at AI-based restaurant answering service ReachifyAI.

“Business priorities shift with economic conditions, and right now the baseline team is smaller, powered by AI-assisted developers,” he says. “Not every company is leaning in this direction, but private equity–backed groups and fast-moving incubators are already pushing the trend. Once the competitive advantage becomes too big to ignore, larger organizations will fall in line.”

Jadia predicts that hiring freezes for new developers will become common. Still, he sees a future role for developers who oversee AI-written code.

“Picture a future where AI handles the bulk of software development,” he says. “Fewer people will choose coding as a career, and those who do will command premium pay, more like lawyers today.”

This oversight will be necessary because AI still has problems with coordinating issues across multiple services, fixing security bugs, or resolving database lock scenarios, Jadia says.

“It becomes clear that you still need sharp engineers to step in and protect the house,” he adds. “At the end of the day, AI still depends on strong frameworks, high-quality documentation, and fundamental innovation to underlying technologies that AI cannot comprehend without the right technical mind guiding it.”

Senior devs needed

Other experts agree that roles for senior developers will continue to exist in the AI future. Junior developer jobs may be hard to come by, but coding jobs won’t go away, says Rachit Gupta, head of AI at AI-focused orchestration vendor Tredence.

“In the near term, it’s true that many of the tasks junior developers used to do like fixing bugs, writing test scripts, and cranking out boilerplate code, are now the kinds of things AI tools handle well,” he says. “That’s part of why new grads are having a harder time landing that first role.”

Gupta sees the developer role changing significantly in coming years.

“Instead of spending all day writing code from scratch, developers are increasingly guiding AI, stitching together outputs into larger systems, and focusing on higher-value problem-solving,” he says. “For juniors, that means the first rung on the ladder looks different; they are learning how to ask the right questions of AI, double-check its work, and put it into context.”

Senior developers will remain critical employees, he adds. “AI doesn’t make the tough calls on architecture, compliance, or security,” he says. “It can’t fully understand a company’s business logic or the ethical implications of a system. That oversight and judgment still rest with experienced engineers.”

Raymond Kok, CEO of low-code development platform Mendix, agrees, saying the senior developer role will change from writing code to ensuring that agents and other AI tools work together.

“If you think about agentic application development, people will move away from being coders to being what I call composers,” he says. “It’s about composing agents, and it’s about building workflows and hierarchies of agents, as opposed to really being focused on low-level compute instructions that you typically work on when you do programming.”

Replacing coders with technology

Still, Kok sees traditional coding dying, as AI, low-code tools, and visual programming languages reinvent the developer role. It’s past time for software development to move away from command-line coding to these graphical and AI-based methods, he says.

“Software engineering never made kind of the mainstream leap into model-based development, but it’s going to happen shortly,” Kok adds. “Most of the agentic IDEs that you see out there use visual abstractions, model-based abstractions, to build these chains of agents and to build out the agentic application experience that people want.”

IT leaders should prepare for this major change by redefining their software development lifecycles and embracing new tools, Kok advises. IT leaders also need to ensure that their employees are trained in these emerging coding techniques, he adds.

The way to define how a programmer is doing a good job will also change, he says.

“What will change is the definition of work,” Kok adds. “What people are going to be measured on going forward is, ‘How do you use properly this combination of generative AI and model-based software engineering and then implementing the right NFRs [non-functional requirements] into the application landscape that you want to go build?’”

When scale becomes the wall

Not long ago, I was in a boardroom when a CIO leaned across the table and asked me a deceptively simple question: “We’ve proven this works in one market. Why does scaling it to five markets feel like rebuilding the whole thing from scratch?”

That question has echoed in my career ever since. I’ve heard it from enterprise executives in New York, from startup founders in Bangalore and from ecosystem builders in São Paulo. The problem is rarely the idea itself. It’s the ecosystem that determines whether innovation can scale without collapsing under its own weight.

Over time, I’ve come to realize the lesson is the same at both the startup and enterprise level: scalability isn’t just about technology. It’s about clouds, code and capital working together in harmony. CIOs who act as ecosystem architects, not just system owners, unlock growth that others struggle to replicate.

Treat clouds like water, not a warehouse

When I first led cloud migrations, I made the mistake many do: We treated the cloud as a shinier data center. Costs ballooned, agility stalled and developers still had to ask permission just to experiment.

The shift came when we started treating cloud like water, a utility. Always available, always measurable, always flowing to where it’s needed. That mindset changed everything. Suddenly, the conversation wasn’t about capacity, it was about speed, portability and cost per unit of value.

This is the same principle that enabled India’s startups to scale fintech apps to a billion people. They didn’t build everything themselves. They leaned on India Stack, a set of digital identity, payments and document services available as APIs to anyone. Cloud became the rails, not the roadblock.

For CIOs, the lesson is clear: abstract the basics. Build internal digital rails identity, payments, notifications and logging that every team can plug into. The faster you turn those into utilities, the faster your enterprise scales like a startup.

Write the rules once, share them everywhere

I used to believe technology dictated scale. But the more ecosystems I studied, the clearer it became that the rules matter just as much as rails.

Take Brazil’s financial sector. Fintech didn’t explode there because banks suddenly became generous partners. It happened because regulators forced everyone into a shared framework called Open Finance. APIs were mandated, and once the rules were clear, startups sprinted.

Inside enterprises, I often see the opposite, where every team negotiates compliance separately, re-litigating the same security policies and slowing innovation to a crawl. The fix is simple but powerful: codify compliance once, then expose it as reusable services.

Think of it as compliance as code. Privacy rules, data residency requirements and logging standards are baked into APIs and SDKs that every team consumes automatically. That way, innovation compounds instead of stalling.

Great policy isn’t a brake pedal. It’s a platform.

Only scale what pays

I’ve seen AI pilots win standing ovations in executive reviews only to die quietly six months later. The issue wasn’t the technology. It was the economics.

The best ecosystems don’t fall for hype. They scale only what pays.

• AI, where cost per inference lines up with either revenue lift or risk reduction.
• Blockchain, where reconciliation costs justify distributed ledgers.
• IoT and edge, where latency and visibility directly change business outcomes.

I’ve learned to be ruthless: pilot quickly, measure hard and kill what doesn’t earn its keep. In one enterprise program I led, we cut half the pilots in 60 days, but the ones that remained scaled profitably across multiple business lines.

The secret isn’t to chase every shiny technology. It’s to scale only the ones that have clear unit economics.

Borrow shamelessly from global playbooks

Each region of the world has developed its own scaling DNA. CIOs don’t need to reinvent the wheel; we just need to borrow wisely.

Every one of these regions is solving at ecosystem scale the same challenges CIOs face inside the enterprise.

Run the 90-day experiment

I believe in starting small but deliberately. Here’s the framework I’ve used to shift enterprises from firefighting projects to building ecosystems:

• Appoint an ecosystem PM. One accountable leader for digital rails and partner enablement.
• Expose a rails catalog. Package identity, payments, notifications, logging as APIs, documented like products.
• Launch two AI pilots. Pick use cases with measurable economics and enforce stop/go gates.
• Instrument cost and compliance. Dashboards that show unit economics and risk in real time.
• Open a sandbox. Synthetic data and mock APIs so partners and product teams can integrate quickly and safely.

In 90 days, the cultural shift becomes tangible. Teams stop asking “Can we?” and start asking “How fast?”

Don’t forget the people

Even the best rails and rules fail without the right talent to use them. Ecosystems scale because people do.

That means CIOs need to think about talent as part of the architecture. Distributed teams. Startup visas. Upskilling programs. Diversity as a driver of creativity.

In my own experience, distributed teams allowed us to scale expertise across geographies without waiting for relocation approvals. Tools like Slack, GitHub and remote compliance platforms made it seamless. And when we diversified teams, performance improved not by accident but because different perspectives solved problems faster.

This isn’t just my observation. Research from McKinsey found that companies with diverse leadership teams were significantly more likely to outperform on profitability. Ecosystems thrive on variety and so do enterprises.

The leadership pivot

Here’s the hard truth I’ve learned: CIOs who act as system owners will always be chasing. CIOs who embrace the role of ecosystem architects — balancing clouds, code, capital and people — will set the pace.

That CIO who asked me why scaling felt like rebuilding from scratch? They didn’t need bigger systems. They needed an ecosystem. Once they built it, scaling stopped being a wall and became their competitive edge.

And that’s the shift I believe every CIO must make from project leader to ecosystem builder. Because in today’s world, ecosystems scale innovation. Nothing else does.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Many of the leaders I talk to are struggling to move past the pilot stage of AI. They are in pilot purgatory. It’s not a lack of ambition that holds them back — it’s a lack of clarity. Questions about where to build, where to buy and how to structure teams for scale create a kind of organizational gridlock. I’ve faced the same challenges in my own experience leading digital transformation efforts, and I’ve found that what breaks the cycle is not hype or vision, but a practical, focused approach.

AI doesn’t need to be complicated to be effective. But it does require structure, prioritization and a willingness to rethink how work gets done.

Here’s how I think about it.

Buying versus building: Start with a philosophy, not a spreadsheet

Buying versus building: Start with a philosophy, not a spreadsheet

Early on, I heard IT leaders in my network trying to justify AI investments by comparing cost and performance between vendor platforms and in-house models. But I quickly realized that no spreadsheet could capture the broader trade-offs at play. Speed matters. So does the ability to scale, maintain and continuously improve what you build.

Over time, I settled on a general rule of thumb: aim to buy about 80% of the capabilities you need and build the remaining 20%. Some organizations may shift closer to 70/30, but the underlying idea holds: don’t reinvent what’s already working elsewhere.

Evidence backs this up. In a July 2025 Morgan Stanley AI Adopter Survey, analysts reported that AI is already delivering tangible returns across industries such as financial services, consumer goods and real estate — many of which are benefiting from off-the-shelf tools with embedded intelligence. That market reality is mirrored in the vendor landscape: enterprise software platforms are evolving at a remarkable pace. Vendors are embedding significant AI capabilities directly into their products. Gartner predicts that by 2026, more than 80% of software vendors will have embedded generative AI into enterprise applications, up from just 1% in February 2024.

That’s why I’ve found it far more effective to treat enterprise software platforms as the foundation and then identify where custom development is truly needed. This frees up internal teams to focus on high-value use cases rather than duplicating what’s already available.

Of course, out-of-the-box solutions don’t cover every scenario. In some cases — like stitching together data and workflows across platforms — agentic AI or internal development has been essential to close integration gaps. It’s not about choosing one approach over the other; it’s about knowing when each one makes sense.

Prioritizing problems, not projects

AI is not the strategy. The business is the strategy. That’s a lesson I learned after watching too many proofs of concept fail to scale because they didn’t tie directly to outcomes that mattered.

To make progress, it’s best to shift the conversation away from AI as a technology and toward AI as a tool for solving real business problems. That starts with listening — really listening — to what customers, frontline employees and partners are experiencing.

I attended the CIO 100 event in August, where Avery Dennison received an award for Program Loop, our AI program. While there, I had the chance to compare notes with other IT leaders about how they were approaching AI opportunity selection. One common theme was the use of workshops with functional leaders to surface pain points from the customer’s perspective. From there, several leaders described bringing cross-functional teams together to weigh potential solutions.

What struck me most was the simplicity of the prioritization methods. One approach rated opportunities across three dimensions: business impact, level of effort and urgency — each on a simple high, medium or low scale. When you map those ratings, the opportunities that score high in impact and urgency but low in effort naturally rise to the top. Those become the logical first focus areas, and the clarity it provides helps build early momentum.

What made this approach effective was how it aligned teams around what truly mattered. Several leaders described reframing challenges as “How might we…” questions, which naturally broadened the discussion and sparked more creative solutions. AI was then introduced not as the starting point, but as one of many possible enablers.

From my perspective, this mindset shift changes the tone of the entire conversation. It’s no longer a debate about whether to adopt AI — it becomes a dialogue about driving business value. That’s where real momentum begins to build.

From central authority to shared ownership

In conversations with other IT leaders, I’ve noticed a common pattern in how AI programs evolve. Most began with a centralized team — a logical first step to establish standards, consistency and a safe space for early experiments. But over time, it became clear that no central group could keep pace with every business request or understand each domain deeply enough to deliver the best solutions.

Many organizations have since shifted toward a hub-and-spoke model. The hub — often an AI center of excellence — takes responsibility for governance, education, best practices and the technically complex use cases. The spokes, led by product or functional teams, experiment with AI features embedded in the tools they use every day. Because they’re closer to the business, these teams can test, iterate and deliver solutions at speed.

When I look across industries, the majority of AI innovation is now happening at the edge, not the center. That’s largely because so much intelligence is already embedded into enterprise software. A CRM platform, for instance, might now offer AI-based lead scoring or predictive churn models — capabilities a team can enable and deploy with little to no involvement from the center of excellence.

According to McKinsey, “Over the next three years, 92 percent of companies plan to increase their AI investments. But while nearly all companies are investing in AI, only 1 percent of leaders call their companies ‘mature’ on the deployment spectrum, meaning that AI is fully integrated into workflows and drives substantial business outcomes. The big question is how business leaders can deploy capital and steer their organizations closer to AI maturity.” But the real insight is not the use of AI itself — it’s the decentralization of how it gets done.

This doesn’t mean the center becomes irrelevant. It means the center becomes an enabler. Its job is to create the conditions for responsible scale, not to own every initiative. That’s a subtle but important shift in how leadership needs to think about structure.

When intelligence becomes invisible

Some of the most powerful AI features are also the quietest. That’s something I’ve come to appreciate as adoption has matured. Early on, AI was treated as a distinct effort — something big and special. Today, the most valuable capabilities are often the ones that feel invisible. They just work.

Consider a finance process like accounts payable. In the past, automation meant scheduling payments strictly on invoice due dates. Now, embedded intelligence can recommend optimal timing based on supplier behavior, working capital goals and historical cash flow patterns. There’s no project name attached to it — just business value being delivered.

This shift — from AI as an initiative to AI as part of the foundation — is one of the most exciting developments I’ve seen. It doesn’t always require data scientists or specialized teams. It calls for product managers and business owners who understand the process and the outcomes they want to improve.

As more enterprise tools embed intelligent features, the role of IT leaders is increasingly about helping teams spot what’s already available, test it safely and scale what works.

Measuring the value of AI

One of the biggest hurdles I hear from leaders is how to measure the value of AI. The truth is, you don’t need a brand-new framework. Most organizations already track ROI, EBIT or productivity gains from the projects their IT teams deliver. The key is simply connecting those outcomes back to the fact that many of those projects are now powered by AI.

Take enterprise software as an example. Modern SaaS platforms — whether CRM, ERP, HR or supply chain — are increasingly embedded with AI features. In fact, most new systems already include intelligent capabilities as part of their core functionality. That means when IT delivers a new SaaS-based pricing system with an estimated ROI of 25% and $6 million in EBIT, the leader doesn’t need to invent a separate “AI metric.” All they need to recognize is that the $6M of EBIT is profitability driven in part by AI. There is no need to overthink it because in a few years, we will not be able to distinguish AI from modern software.

There’s another benefit: the stories about AI become much easier to tell. You no longer have to lean on anecdotes about experimental pilots running in some distant site. AI is already present in many of the enterprise solutions you’re deploying. That means you can add to the pure economic value of the new CRM system and also share stories about how it’s helping the commercial team work more efficiently — or even improving customer NPS.

Of course, not all value will come from enterprise software. There are also opportunities to monetize AI-first solutions — such as digital avatars, copilots and industry-specific applications — as well as custom-built models that solve unique challenges. These, too, should be captured and reported as part of the overall AI value story.

The main point is this: you don’t have to overengineer the measurement process. Simply ride the coattails of existing projects that are already leveraging AI in some way. By doing so, you give stakeholders both the numbers and the narratives they need to see AI as a driver of progress, not just an experiment.

Final thoughts

AI is not optional. But it’s also not magic. Turning AI into an advantage requires a clear sense of purpose, a willingness to let go of central control and the discipline to focus on what really matters.

I’ve learned that success has less to do with how advanced the technology is and more to do with how well it’s aligned with business needs. That means starting with the problem, picking the right approach and building a structure that allows teams to learn and adapt as they go.

It’s not about pilots. It’s about progress. And that starts with being honest about where you are, and bold and responsible enough to move forward.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Back in 2009 George Westerman and Richard Hunter introduced the idea of the CIO Plus in their book The Real Business of IT: How CIOs Create and Communicate Value.

Westerman says what he and Hunter noticed at the time was that the CIO role was expanding in both its responsibilities and its ability to make an impact.

Now, 15 years later, Westerman says the CIO role continues to expand. It’s still in charge of infrastructure, and it often owns transformation. It should have strategy, too. It should become more visionary, too, looking around corners to learn about emerging technology and figuring out how their organizations will be impacted by it.

More than ever, the C-suite is counting on the CIO to deliver. Indeed, 94% of CIOs are now expected to regularly report to the board on technology investments and their ROIs, according to the 2025 Global CIO Report from IT services and solutions provider Logicalis. Some 85% of surveyed CIOs also said they face growing pressure for technology to demonstrate tangible business impact within their organizations.

To deliver on such expectations and ensure career longevity, CIOs and executive advisers cite these five strategies for future-proofing IT leaders’ careers.

1. Lead strategy, don’t just contribute

The need for CIOs to be strategic advisers to their C-suite colleagues is not new.

“There has been a steady progression for years for CIOs to become more strategic leaders,” says Westerman, a senior lecturer at the MIT Sloan School of Management, founder of the Global Opportunity Forum, and co-chair of the MIT Sloan CIO Leadership Award.

But as the world heads into a future where artificial intelligence will reshape nearly every job and process, many will expect the CIO to lead strategy, not merely contribute.

Westerman acknowledges that many CIOs are already doing that, but he also says many are not.

“There are a lot of IT leaders who don’t get it yet, and they now have to become the strategy leader they should have been all along,” he says, adding that this dynamic persists because most IT talent still rises to top IT positions because of their technical skills and not their management and leadership capabilities.

For CIOs who aren’t yet engaged in strategy, Westerman and others say the key is to understand in depth the organization’s goals and how technology can help them.

The next step — and the one to take for CIOs already contributing to strategy — is to identify where and how technology provides measurable value and revenue to the organization and lead those initiatives.

“As a CIO you still have to keep things running, secure, help drive transformation, but you’ve also got to help people be aware of what’s possible with technology,” Westerman says. “Help them understand how IT helps the business. Focus on how you communicate the value of technology.”

Troy Rydman, CIO and CISO of Packsize, has been attentive to this dynamic, saying he focuses on understanding business processes, as well as how and where technology can “grow the company more quickly.”

“It’s about having a strategy for growth, understanding the market, where your competitors are at, and what technology they’re using. As a CIO that falls upon me,” he adds.

2. Embrace the technologist persona

In recent years some questioned whether IT chiefs really needed a technology background, but experts now say it’s clear that modern CIOs do indeed need to be well versed in technology. The role, they say, needs the triad: deep technology skills, business acumen, and strategic vision.

“The CIO needs a vision of what IT needs to be and the ability to execute,” says Keri Pearlson, senior lecturer and principal research scientist at MIT Sloan School as well as founding president of the Austin Society for Information Management (SIM).

Matt Richard, CIO of Laborers’ International Union of North America (LIUNA), says the AI revolution demonstrates just how valuable the CIO’s technical capabilities are, as it has been up to CIOs to dig into AI’s potential, limits, and risks then devise the strategies for their organizations on how to use it most effectively.

“We’re figuring out how AI will change how we live and work, but AI is just the latest revolution in technology. There was the internet, then the move to cloud, now AI. There will always be new tools, and we [CIOs] need to know how these things work, so we can inform others on how to use the tools,” Richard says.

To do that, Richard commits to learning about emerging technologies and “what they can do, how they’ll impact jobs, how they’re going to change how teams do work, how to implement them, how to find partners, how to manage expectations, and how to make sure we have security and guardrails.”

He takes sales calls from vendors and schedules demos, admitting he does so specifically to learn, not to buy.

And he still plays around with tech, breaking it and putting it back together, so to speak, to test its limits — a pastime many CIOs share.

“That’s important to do now and in the future. CIOs should be getting into the sandbox and trying to build things as the technology comes out,” Richard adds, noting that many did as much when generative AI appeared on the scene with the November 2022 launch of ChatGPT.

Beth Clark, CIO at Harvard Business School, also embraces this part of CIO work.

“I think really deep understanding of AI, machine learning, and generative AI are so critical. I need an understanding of the benefits, the dangers, how they sit in our environment,” she says. “I’m doing deep dives into technologies, and it’s fascinating to me. The space is always evolving, and I’m always learning.”

3. Drive change with agility, speed, and empathy

Many CIOs have embraced the change agent aspects of their jobs. That, though, is not enough in an age where new technologies evolve at an ever-increasing pace, where change is constant, the impacts of that are significant, and fears of job loss and displacement are high.

“It can be an exciting time or a fearful time, but the CIOs who future-proof their careers are working on how they communicate around that, and how they show up and lead,” says executive coach Lacey Leone McLaughlin, president and founder of LLM Consulting Group and host of the podcast “Unfolding Leadership.”

To be effective leaders now and tomorrow, Leone McLaughlin explains that CIOs must “communicate it in a way that excites versus elicits fear. They need to say, ‘We’ve gone through changes before; it just has to happen more often and faster, and [this new technology] will help us get smarter, help us do jobs better, help you spend time on tasks that really matter.’”

IT leaders must embody that mindset, too, she says. They need to have — or develop — agility. They must also embrace new technologies, adjust as technologies and markets change, and pivot without fear.

“They need to adapt and adjust to the changes coming, which are coming faster,” she adds. “A larger amount of adaptability is required today, and CIOs should be asking, ‘Am I adaptable enough?’”

Harvard Business School’s Clark sees technology reshaping jobs throughout the organization and believes CIOs will help shape the workforce of the future as a result.

“It’s change or die — at a really rapid pace,” she says.

Clark draws on the skills she gained as a social worker early in her career to lead through change now.

“I never stopped using those skills, those human behavior skills, and I need them for the future,” she says.

“Change is hard, and it’s harder now because we’re changing at warp speed, so I find those are skills I use every day,” Clark adds, explaining that such skills help her “ease people’s anxieties about things that are new, very fast, and threatening in many ways.”

4. Use curiosity and constant learning to shape your vision of what’s ahead

Quantum computing is on the horizon, and there’s the possibility that artificial general intelligence will become reality in the future. As such, CIOs say it’s critical that they don’t become complacent or wedded to the technologies they embrace today, because they will all be obsolete someday.

“CIOs can’t afford to be stuck in what worked in the past,” Leone McLaughlin says. “So CIOs have to be curious, ask the right questions, listen, learn, and hire people smarter than they are.”

Savio Lobo, CIO of IT services provider Ensono, agrees.

Although he has leveraged the transformative power of AI, he knows the arrival of other disruptive technologies is inevitable. “Today it’s AI; tomorrow it’s something else,” he says.

He’s focusing on learning what that “something else” will be by leaning into briefings, partner engagements, and public forums where people are speculating about what’s next.

“You have to continue to learn; you have to keep up to date,” he says, contending that the CIO is best positioned to create a vision of tomorrow for the executive team. “The CIO should be visionary.”

He expects his direct reports and others on his IT team to do the same, and he works to cultivate a “really good culture of learners” through formal training and development programs with names such as Summit 2025, Aspire, Ignite, and Ascend.

5. Improve your leadership abilities

The amount of change is impacting all jobs, including those in IT — up to and including the CIO role, Pearlson says. So CIOs need to be on top of emerging technology and all the implications that go with them. Otherwise, she says, they could be blindsided and see transformative work move from their office to another. That already happens, she notes, as evidenced by the creation of the chief digital officer, chief transformation officer, and chief AI officer positions.

CIOs who want to work on the opportunities that, for example, quantum computing will present — and not lose that work to a new chief quantum officer — need to demonstrate exemplary leadership capabilities now.

“We are at another inflection point for the skill set and role of a CIO today,” Pearlson adds.

Westerman says many CIOs have work to do here, as they to date have advanced their careers due to their tech talent and not for their management and executive skills. As a result, CIOs often have more work to do to sharpen those skills than others in the C-suite.

CIOs have plenty of opportunities to improve — they just have to be intentional, Westerman says, noting that tried-and-true leadership development strategies continue to work.

Develop relationships, deliver on promised expectations, seek feedback on how to do better, and then find ways to improve. “CIOs should be asking themselves, ‘Am I getting enough feedback? Am I effective in my environment?’” he adds.

Clark sees improving her leadership talents as an ongoing task that takes commitment.

“I’m always looking at my own leadership skills. I make sure I get feedback, so I know I’m effective in what I’m trying to achieve. I’m evaluating if I’m an effective peer for my peers. I’m asking, ‘Am I an effective leader? Am I an effective communicator? Am I getting my message out clearly? I’m doing 360s and really taking in the results, because you can’t become a more effective leader if you don’t know what you need to work on,” Clark says. “It’s a journey, and you do it for the rest of your life.”

Nvidia’s networking roadmap includes technology upgrades designed to transform data center compute, connectivity, and storage infrastructure into giant GPU-driven and network-defined AI factories.

Data centers are evolving into a new unit of computing, from a focus on CPUs to GPUs as the primary computing units and from the distribution of functions across different components to support the infrastructure for AI workloads, Gilad Shainer, senior vice president of networking at Nvidia, told Network World. This infrastructure evolution requires synchronized data movement and encompasses at least four networks: compute, scale-up, scale-out, and access.

[ Related: More Nvidia news and insights ]

“Today, the scale of the data center has shifted. In the era of AI, the data center itself has become the unit of computing. Instead of asking ‘How many CPUs can I buy?’ the question is now, ‘How do I design a data center capable of running my workloads at maximum efficiency?’ Shainer said. “This shift fundamentally changes how we design, connect, and optimize infrastructure. The giant data center has become the new unit of computing, and one current network architecture won’t handle,” he said.

“What’s needed is a layered design with bleeding-edge technologies — like co-packaged optics that once seemed like science fiction,” Shainer explained further in a recent blog.

“AI factories are rising — massive new data centers built not to serve up web pages or email, but to train and deploy intelligence itself,” Shainer wrote. “Welcome to the age of AI factories — where the rules are being rewritten and the wiring doesn’t look anything like the old internet. These aren’t typical hyperscale data centers. They’re something else entirely. Think of them as high-performance engines stitched together from tens to hundreds of thousands of GPUs — not just built, but orchestrated, operated and activated as a single unit. And that orchestration? It’s the whole game.”

It is this new data center network infrastructure that Nvidia has serious plans to develop now and in the future. Evidence of its intentions can be found in the vendor’s most recent announcement of extensions to Ethernet networking that will let widely distributed GPUs – in servers across multiple data centers, regardless of the distance between them – operate as a single, unified AI supercomputer.

Nvidia is baking into its Spectrum-X Ethernet platform a suite of algorithms that can implement networking protocols to allow Spectrum-X switches, ConnectX-8 SuperNICs, and systems with Blackwell GPUs to connect over wider distances without requiring hardware changes. These Spectrum-XGS algorithms use real-time telemetry — tracking traffic patterns, latency, congestion levels, and inter-site distances—to adjust controls dynamically.

Ethernet and InfiniBand

Developing and building Ethernet technology is a key part of Nvidia’s roadmap. Since it first introduced Spectrum-X in 2023, the vendor has rapidly made Ethernet a core development effort. This is in addition to InfiniBand development, which is still Nvidia’s bread-and-butter connectivity offering.

[ Related: What is an AI-optimized data center? ]

“InfiniBand was designed from the ground up for synchronous, high-performance computing — with features like RDMA to bypass CPU jitter, adaptive routing, and congestion control,” Shainer said. “It’s the gold standard for AI training at scale, connecting more than 270 of the world’s top supercomputers. Ethernet is catching up, but traditional Ethernet designs — built for telco, enterprise, or hyperscale cloud — aren’t optimized for AI’s unique demands,” Shainer said.

Most industry analysts predict Ethernet deployment for AI networking in enterprise and hyperscale deployments will increase in the next year; that makes Ethernet advancements a core direction for Nvidia and any vendor looking to offer AI connectivity options to customers.

“When we first initiated our coverage of AI back-end Networks in late 2023, the market was dominated by InfiniBand, holding over 80% share,” wrote Sameh Boujelbene, vice president of Dell ’Oro Group, in a recent report. “Despite its dominance, we have consistently predicted that Ethernet would ultimately prevail at scale. What is notable, however, is the rapid pace at which Ethernet gained ground in AI back-end networks. As the industry moves to 800 Gbps and beyond, we believe Ethernet is now firmly positioned to overtake InfiniBand in these high-performance deployments.”

In the coming year or two, “Ethernet will become the more prominent technology for networking, surpassing InfiniBand as 800G ramps and 1.6T take form,” predicts 650 Group in a recent report. “The 800G cycle for AI will set records for revenue and ports.”

“Spectrum‑X is fully standards‑based Ethernet. In addition to supporting Cumulus Linux, it supports the open‑source SONiC network operating system — giving customers flexibility,” Shainer wrote. “A key ingredient is Nvidia SuperNICs — based on Nvidia BlueField-3 or ConnectX-8 — which provide up to 800 Gb/s RoCE connectivity and offload packet reordering and congestion management.”

“Spectrum-X brings InfiniBand’s best innovations — like telemetry-driven congestion control, adaptive load balancing and direct data placement — to Ethernet, enabling enterprises to scale to hundreds of thousands of GPUs,” Shainer wrote. “Large-scale systems with Spectrum‑X, including the world’s most colossal AI supercomputer, have achieved 95% data throughput with zero application latency degradation. Standard Ethernet fabrics would deliver only ~60% throughput due to flow collisions.”

Copper and optics