For years, applicant tracking systems and recruiting platforms were treated as HR technology: Important for workflow, efficiency, compliance and candidate experience, but rarely viewed as core security infrastructure. That assumption no longer holds. Once AI begins reading resumes, scoring candidates, conducting interviews, ranking applicants and influencing who moves forward, the hiring platform stops being a passive system of record. It becomes a decision system.

And any system that accepts public input, processes sensitive data and influences business decisions belongs inside the security conversation.

I learned this during an AI hiring platform rollout that never made it to production. The vendor was established, the product had a strong market reputation and the AI feature looked attractive: Upload a resume, compare it to a job description and return a neat percentage match. For recruiters, it promised speed. For executives, it promised modernization.

Before moving real candidate data into the system, I tested it with synthetic resumes. One weak resume came back with a surprisingly strong match. The reason was not hidden in the candidate’s experience. It was hidden in the text. The resume contained language instructing the AI to treat the candidate as an excellent fit, and the system appeared to follow that instruction instead of evaluating the resume on merit.

That changed the question from “Does the tool improve productivity?” to “Can the person being evaluated influence the evaluation itself?”

That is a security question.

The trust boundary has moved

CIOs do not need to become recruiting experts. They only need to look at the mechanics.

An anonymous user submits content into an enterprise system. That content is processed by software. The software then produces an output that can influence a business decision. In every other environment, security teams know what to call that: untrusted input crossing a trust boundary.

The difference is that in hiring, the input looks harmless. It is a resume, a cover letter, a chatbot reply or a spoken answer in an AI-led interview. But once AI reads that content and treats it as instruction, the harmless-looking input becomes part of the system’s control surface.

That is why prompt injection matters in hiring. It is not just an AI oddity or a model behavior issue. It is the same category of failure enterprises have spent decades trying to prevent: User-controlled input changing what the system does. OWASP lists prompt injection as the first risk in its Top 10 for LLM applications, describing it as a case where user prompts alter a model’s behavior or output in unintended ways.

In hiring, the implication is direct: A candidate may be able to manipulate the score, ranking or interview assessment that determines whether a human ever sees them.

The business impact is not theoretical

The obvious risk is that an unqualified candidate moves forward. But the impact is broader.

First, decision quality degrades. Hiring teams adopt AI scoring because they believe it improves signal. If the score can be manipulated, the business is not gaining signal; it is gaining false confidence. Recruiters may spend time on candidates who gamed the system while stronger candidates are buried lower in the queue. A tool bought to reduce friction can quietly create more of it.

Second, cost increases under the appearance of efficiency. Every false positive consumes recruiter time, hiring-manager attention, interview slots and opportunity cost. A small weakness in screening integrity can become a measurable operational drag across open roles.

Third, trust suffers. Candidates already question whether AI hiring tools are fair, explainable or accurate. If it becomes clear that a screening system can be manipulated by hidden instructions or verbal prompting, the issue is no longer just security. It becomes reputational. Strong candidates may lose confidence in the process, and employers may have to defend decisions made by systems they did not fully understand.

Fourth, sensitive data exposure becomes harder to contain. Recruiting systems hold names, addresses, work histories, education histories, compensation details, work authorization information and sometimes accommodation or demographic data. NIST guidance on personally identifiable information includes employment information as linkable personal data that must be protected from inappropriate access, use and disclosure. Yet hiring platforms often receive less security scrutiny than systems holding customer or financial data.

That mismatch is dangerous: High-value data, public-facing workflows and increasing automation.

The 2025 McHire incident should have made this impossible to ignore. Researchers reported that weaknesses in McDonald’s AI hiring platform, including default credentials and an access-control flaw, exposed applicant data at large scale before the issue was patched. The lesson for CIOs is not merely that a weak password was used. The lesson is that AI hiring systems can ship with basic, preventable security failures while still being treated as HR tools rather than enterprise risk surfaces.

Vendor reputation does not transfer to every AI feature

One reason this risk slips through is that buyers often trust the platform brand. Mature vendors may have strong security programs, enterprise customers, compliance documentation and procurement-friendly answers.

But AI features can change the architecture of risk.

A platform that was safe as a workflow tool may behave very differently once it adds resume scoring, interview grading, chatbot screening or automated ranking. The new feature may introduce new inputs, new model behavior, new data flows, new third-party dependencies and new decision points. In practical terms, the attack surface has changed.

CIOs should not allow AI features to inherit trust automatically from the legacy platform around them. When a vendor adds AI, the enterprise should reassess the feature as if it were a new product. That does not mean slowing innovation for bureaucracy. It means AI-enabled decision-making carries different failure modes from ordinary workflow automation.

The ownership gap is the real vulnerability

The biggest risk may not be the model. It may be the ownership gap.

Talent acquisition may buy the tool. HR operations may configure it. The vendor may guide implementation. Procurement and legal may approve the contract. But who owns the security of the candidate-facing AI layer?

In many organizations, the honest answer is unclear.

That ambiguity is where risk grows. Recruiting technology sits at the intersection of public input, sensitive data, third-party software, automated decision support and brand trust. That is exactly the kind of environment that needs named security ownership, asset inventory, vendor review, access-control testing, logging and incident-response planning.

If the hiring stack is not in the security inventory, the organization is already making an assumption it may later regret.

What CIOs should require now

The fix is not exotic. It is applying existing security discipline to a surface that has been underestimated.

Treat every candidate submission as untrusted input. Resumes, cover letters, chatbot responses, interview transcripts and spoken answers should be handled as attacker-controllable content. If AI processes it, the system must separate content from instruction.

Reassess vendors when AI features are introduced. A prior security review should not be treated as permanent approval for new AI capabilities. Ask what changed in the architecture, what data the model sees, what actions it can influence and how manipulation attempts are detected.

Ask AI-specific questions before signing. Can candidate-provided content alter scoring? Are hidden instructions filtered or ignored? Is there human review before AI output influences a decision? Can the vendor produce testing evidence for prompt injection, access control and data exposure risks?

Assign ownership. HR can own the process, but security must own the risk model. AI hiring systems should be included in third-party risk management, application security reviews, access governance, monitoring and incident response planning.

Measure business impact, not just AI adoption. The goal is not to say the recruiting function uses AI. The goal is to improve hiring speed, quality, fairness and cost without creating new risk. If the system cannot protect decision integrity, the business case is weaker than it appears.

The hiring platform is now part of the enterprise attack surface

AI has turned the careers page into more than a front door for applicants. It is now a public input channel feeding systems that store sensitive data and influence workforce decisions.

That makes it a CIO concern.

The next failure in AI hiring may not look like a traditional breach at first. It may look like bad rankings, manipulated scores, unexplainable decisions, wasted recruiter time or a candidate process no one trusts. But underneath those symptoms is a familiar security problem: A system trusted input it should have treated as hostile.

Enterprises have hardened payment systems, customer portals, APIs and employee applications around that lesson. Hiring deserves the same treatment.

AI hiring is not just an HR transformation. It is a security boundary. And it is time CIOs treated it like one.

Salesforce customers more than doubled their agentic workforces year on year, according to the company’s second annual Agentic Enterprise Index, which looks at trends in AI agent development and deployment over the past five quarters.

It compiled data from customers who had activated agents in production every month of the analysis period to determine how their use of the technology has evolved between February 2025 and April 2026, as well as incorporating data from May 2026 Salesforce research studies.

It found that businesses grew their agentic workforces from an average of five agents in February 2025 to 13 by April 2026, a 7% compound monthly growth rate (CMGR). In April 2026, it only took an average of 1.9 days to deploy an agent into production, a 53% decrease since the beginning of the report period.

Not only were agents deployed more quickly, they have been progressively taking on more work once in use; over the 15 months, the average number of actions per account had a CMGR of 31%.

“These agents are expanding beyond their initial scope to really become cross-functional,” said Caila Schwartz, Salesforce’s head of agentic commerce insights, during a media briefing.

Salesforce has attempted to measure how much work agents perform, rather than how many tokens they consume, creating its own Agentic Work Unit (AWU) metric, although analysts have criticized the measure as being unrelated to business outcomes. Nevertheless, Salesforce said that as of April, Agentforce agents had performed 734 million AWUs, a number growing at about 15% each month.

The research also showed that agents are acting across multiple cloud domains which, the company said, “underscores the practical necessity of a headless architecture. By decoupling the agent’s logic from traditional front-end user interfaces, agents can process tasks, execute actions, and trigger workflows anywhere.”

Within the company, Salesforce itself has seen explosive growth in AI agent use, said Joe Inzerillo, president of enterprise & AI technology at Salesforce, with a threefold increase in sessions between February 2025 and April 2026. He said that the AI agent in Slack, Slackbot, saves the average employee five hours per week, with 83% of the company having adopted it.

But Schwartz pointed out that different industries are approaching agentic AI in different ways, some more sophisticated than others. To measure that, Salesforce developed a Sophistication Index, a five-point scale scoring the cognitive complexity of an agent’s actions. Levels 1- 3  are assigned to tasks such as record lookups, drafting emails, or summarizing documents, while levels 4 and 5 include more complex functions such as updating database fields.

The data showed that manufacturing, financial services, and healthcare and life sciences have built more sophisticated agent networks than what it called traditional AI frontrunners such as technology and retail.

However, Inzerillo said, the most common use case industry wide, and the best place to start, is the service use case, which provides “far and away the best ROI to start with.”

He also noted that, as people have become more conscious of what agents can do, they are asking agents to perform tasks, rather than simply answer questions.

“Now what you’re starting to see people do is very action oriented. So instead of asking ’how do I file a form to request my vacation’ from our employee agent, they’re telling the employee agent, ‘hey I’m taking a vacation, you need to enter this form for me, and here’s the details,’” he said, adding that this bias towards action represents the evolution of agentic use.

There’s something very attractive about saying “we embed very closely with our customers and just figure it out with them”, especially since the company that started “forward deploying engineers” is growing 84% with $5B+ revenue. But “forward deployed engineer” is a vague term and means different things depending on the business you’re running.

I spent almost 5 years at Palantir as a forward-deployed software engineer, and Palantir’s version of an “FDE” does not make sense for most companies I now meet as an early-stage VC. Depending on the type of business you’re building, this role could broadly mean one of two things: “the product builder” or “the platform operator.” Clearly defining which bucket you fall into will make it easier to hire for this role and run your FDE org.

The product builder: The OG Palantir version

The north star is: do whatever it takes to actually solve the user’s problem. FDEs are not just responsible for making the platform work, but also discovering what to build and building it (actually creating software) in service of the customer.

The platform operator: Solutions + technical customer success

The north star is: make the product work for the customer – deploy and operationalize it. This is what most startups today really mean when they want FDEs. FDEs here configure the core platform, manage account relationships and drive adoption. This is not new – companies have always had solutions engineers, sales engineers, customer success etc., although the work looks different as FDEs are increasingly building prototypes, configuring evals and building MCPs.

Which FDE is right for you

For most situations, hiring product builder FDEs is a mistake.

At scale, the FDEs should be the platform operator. It’s hard to have FDEs build and maintain highly custom product features, especially as the company scales. Over time, the custom product surface area distracts from building the core product, even though AI coding tools make it easy to ship new features quickly and maintain them.

Many fast-growing AI startups recognize these constraints and structure the FDE role more like the platform operator. This also allows them to have 5-10 accounts per FDE, which is a much higher ratio than Palantir had (at least in 2023). Even the Palantir FDE role has evolved to look more like the platform operator.

There are, however, situations when your FDEs should be the product builder archetype.

1. You have very large customers (F500 scale)

Technical complexity: Large customers have complex environments with legacy infrastructure that often requires “out-of-platform” engineering work. I often encountered bespoke data infrastructure, privacy requirements, etc. at various Palantir customers that required me to build “out-of-platform” connectors, UIs and backends.

Organizational inertia and trust: Serving large enterprises is about building trust. In short time periods, overfitting product to a specific user/workflow is often what delivers the most value, builds trust and helps organizations get over the inertia of moving away from Excel and legacy software tools that are part of their day-to-day workflow. For AI-native startups, it’s arguably even more important to invest in doing “unscalable” development with engineering boots on the ground, as it helps solidify your right to exist and eventually expand the customer relationship.

2. You have many ICPs and workflows

If you have a broad range of ICPs and workflows that you serve, your product probably is not walk-up usable on day 1 of deployment. The short-term hacky things that product builder FDEs build to make the product work for these heterogeneous users/workflows will help you shape the product long-term.

Note: see Palantir Foundry’s architecture here.

This was a big reason why Palantir FDEs were more like product builders (and are still able to – see the Forward Deployed Software Engineer job profiles as an example). The vision for Foundry was to be the operating system for an enterprise’s critical decisions – inherently multiple industries, users and workflows. A lot of FDE-led development showed that solving many of these use cases required complex data integrations, which led to the early versions of Foundry being best-suited for complex data integrations and building a customer’s “Ontology”. Similarly, FDEs like myself built custom frontend applications for fraud analysis, pricing, etc. As certain patterns of what these applications required became more clear, they were centralized into an application-layer product.

Who you should hire

Platform operator: There is a much broader set of people you could hire, testing for technical fluency (e.g., being good at data analysis, complex Excel work, even SQL), product intuition and an inclination to build customer relationships. Backgrounds like technical customer success, solutions engineering, software engineering, product management and consulting are all strong fits.

Product builder: You want candidates that are high ownership and missionary software engineers, or technical PMs who want to ship products themselves.

Hiring for these profiles, especially product builders, is hard. It’s worth calling out two things that helped Palantir hire software engineers into what might be considered a less sexy role.

1. Culture of building at the edge: Strong engineers are motivated to build things. Palantir gave FDEs a lot of ownership to build products, which is why much of the core product leadership was former FDEs.
2. Cult built around mission: Internally, there was a cult-like devotion to the mission. Everyone always talked about why outcomes were far more important than software, and why most companies building tools had it wrong. I’ve never been at a company where people feel so closely bonded around a mission.

As founders building AI startups think about hiring FDEs, it’s worth being specific about your culture and asking: Am I just hiring people to support development teams, or am I hiring people to shape and build product? It’s hard to get software engineers (even today) to be excited about an FDE role that might just be technical customer success.

What FDEs should be doing (regardless of archetype)

You’ve hired the right people. How do you best leverage your team of FDEs?

FDEs were Palantir’s way of delivering outcomes rather than tools. AI-native startups can take this much further and FDEs can help in a few unique ways by leveraging their proximity to customers.

1. Find the most critical workflows: As AI lowers the cost of producing software, companies will face a lot more competition. FDEs at AI startups should be constantly finding ways to serve the most critical workflows for a customer and paying attention to how customers do work across newer and legacy tools. For example, FDEs at Harvey should pay attention to which workflows are in Westlaw, which ones are moving to ChatGPT/Claude, and how the Harvey product can stay ahead.
2. Build around nondeterminism: In more regulated environments, FDEs should be hyper-focused on making products reliable for specific use cases using evals and configs. Previously, product reliability lived with product and support. As companies provide outcomes instead of tools, configuring products appropriately and managing evals shifts towards FDE teams.

Business application development is entering a new operating model. The traditional approach of gathering requirements, designing screens, writing services, integrating systems, testing, fixing defects and preparing release documentation still exists, but it is no longer sufficient for enterprises that need speed, traceability, resilience and regulatory confidence at the same time. Hyperautomation brings a broader discipline to this challenge. It combines workflow orchestration, intelligent document processing, robotic automation, API-led integration, process mining, test automation, observability and artificial intelligence into a connected delivery fabric. With embedded Generative AI, this fabric becomes more adaptive because applications can interpret natural language, summarize complex data, generate explanations, detect exceptions and support decision workflows rather than merely execute predefined rules.

In banking, this shift is especially meaningful. Banks operate across dense application landscapes: trade reporting platforms, wealth management portals, core banking systems, investment banking applications, digital compliance engines, reconciliation utilities, operational dashboards, audit repositories and daily, weekly and monthly reporting platforms. Each of these areas has its own data models, control points, integration patterns, validation rules, exception paths and regulatory obligations. Hyperautomation does not replace engineering discipline; it strengthens it by making business intent, technical execution, control evidence and continuous improvement part of the same lifecycle.

From automation to hyperautomation in banking applications

Automation usually addresses a specific task: moving data from one system to another, generating a report, running a batch job or validating a transaction against a rule. Hyperautomation goes further. It looks at the complete business outcome and asks how the entire chain can be streamlined, governed, observed and improved. For example, a trade reporting process may begin with transaction capture, enrich the trade with reference data, validate regulatory fields, identify breaks, generate a submission file, transmit it to a regulator or trade repository, monitor acknowledgements and preserve audit evidence. A narrow automation script may accelerate one step, but a hyperautomated design coordinates the complete flow, including exception handling and evidence generation.

Figure: Automation vs. hyperautomation

Embedded Generative AI adds a new layer of intelligence. Instead of forcing every user interaction into rigid screens and codes, business applications can accept natural language prompts, interpret document content, summarize cases, generate draft responses, explain anomalies, produce test scenarios and create release notes. In a banking environment, this intelligence must be carefully bounded. Every AI-assisted action should be traceable, explainable, reviewable and aligned with data privacy, model risk, information security and regulatory expectations. The goal is not uncontrolled autonomy; the goal is governed acceleration.

Banking application components suitable for hyperautomation

A modern banking application is rarely a single monolithic system. It is a composition of business capabilities, integration services, workflow engines, data pipelines, user experience layers, analytics models, control dashboards and audit stores. Hyperautomation can accelerate the development and integration of these components by turning repetitive engineering work into reusable patterns and by embedding intelligence directly into business processes.

• Trade reporting applications: Generative AI can help map trade attributes to regulatory fields, explain validation failures, summarize rejected submissions and generate test cases for reporting scenarios. Hyperautomation can orchestrate enrichment, validation, submission, acknowledgement tracking and evidence archival.
• Wealth management platforms: Advisors can use embedded AI to summarize client portfolios, generate suitability narratives, identify missing documents and prepare personalized investment review notes. Automation can coordinate onboarding, risk profiling, document verification, portfolio rebalancing workflows and client communication approvals.
• Core banking applications: Account opening, loan servicing, deposits, payments, interest calculations and customer maintenance can benefit from automated validations, intelligent forms, workflow routing and natural language assistance for operations teams. AI can explain account events or transaction exceptions in plain language.
• Investment banking systems: Deal pipelines, research workflows, underwriting processes, trade lifecycle functions and risk calculations require strong coordination across front-office, middle-office and back-office platforms. Hyperautomation can standardize approvals, documentation, exception resolution and control evidence across these stages.
• Digital compliance applications: Compliance teams can use AI to summarize policy obligations, compare regulatory changes with internal controls, classify alerts, draft investigation notes and produce evidence packs. Automation ensures routing, approvals, segregation of duties, audit trails and regulatory reporting timelines are consistently enforced.
• Reconciliation platforms: AI can assist in matching narratives, explaining breaks, clustering exception patterns and suggesting resolution actions. Hyperautomation can pull data from ledgers, statements, payment processors, trading systems and data warehouses, then route unresolved breaks to the right teams.
• Reporting and audit applications: Daily, weekly and monthly reports can be generated through controlled data pipelines, automated quality checks, narrative generation, variance explanations and approval workflows. Audit applications can preserve lineage, approvals, source extracts, model outputs and control attestations.

Embedded generative AI as an application capability

Embedding Generative AI into business applications should be treated as an architectural capability, not as a decorative chatbot. A banking application may use AI for search, summarization, reasoning support, content generation, code generation, policy interpretation or anomaly explanation. Each use case requires clear boundaries. The application must know which data the model can access, which actions require approval, what evidence must be captured and where deterministic controls must override probabilistic suggestions.

For example, in trade reporting, an embedded AI assistant can explain why a transaction failed validation and suggest likely fields to review. However, the final correction should pass through rule-based validations, maker-checker approval and audit logging. In wealth management, AI may draft a client review note based on portfolio movements and risk profile, but the advisor must verify suitability, disclosures and final communication. In reconciliation, AI can propose likely matches or categorize break reasons, while the system preserves the original data, confidence score, reviewer action and final resolution path.

Hyperautomating the product development lifecycle

The Product Development Lifecycle can itself become hyperautomated. Instead of treating ideation, analysis, design, development, testing, security review, release and operations as disconnected phases, enterprises can create an AI-assisted delivery loop where every stage produces structured artifacts that the next stage can consume. Platforms such as GitHub Copilot, Claude Code or Claude Cowork-style agentic development environments and OpenAI Codex can support this movement by helping teams reason over requirements, generate code, create tests, review changes, modernize legacy modules and produce documentation. Their value increases when they are connected to repositories, issue trackers, design documents, build pipelines, test suites, security scanners, observability data and enterprise knowledge bases.

PDLC Stage	Hyperautomation Opportunity	AI-Assisted Outcome
Business discovery	Process mining, domain interviews, regulatory mapping, backlog creation	Structured epics, user stories, acceptance criteria, process maps and control requirements
Architecture and design	Reference architectures, API contracts, data models, event flows, security patterns	Architecture options, integration blueprints, threat-model prompts and design decision records
Development	Code generation, service scaffolding, UI component creation, data pipeline templates	Review-ready code increments, reusable components, migration utilities and integration adapters
Testing	Unit, integration, regression, performance, compliance and synthetic data testing	Generated test cases, defect reproduction steps, test automation scripts and coverage summaries
Security and compliance review	Static analysis, dependency checks, policy validation, evidence capture	Risk explanations, remediation suggestions, control traceability and approval evidence
Release and deployment	CI/CD orchestration, environment promotion, release notes, rollback preparation	Automated deployment packs, release summaries, operational checklists and change records
Operations and feedback	Observability, incident analysis, user feedback mining, backlog refinement	Incident summaries, root-cause hypotheses, improvement stories and reliability recommendations

Role of GitHub Copilot, Claude Cowork and Codex

GitHub Copilot is useful where developers need assistance inside the engineering flow: explaining code, generating functions, proposing tests, reviewing pull requests and helping teams move from issue to implementation. In a banking PDLC, it can accelerate microservice creation, API integration, batch processing logic, reconciliation rules, regulatory validation routines and UI workflows. When used with repository context and proper review discipline, it can reduce the time developers spend on repetitive coding while preserving human accountability for design and correctness.

Claude Cowork or Claude Code-style agentic environments are valuable for multi-file reasoning, refactoring, debugging and documentation-heavy engineering work. Banking applications often contain deep domain logic scattered across services, configuration files, stored procedures, integration scripts and test suites. An agentic coding assistant that can understand a wider codebase context can help engineers analyze dependencies, prepare modernization plans, update multiple files coherently and draft explanations for reviewers. This is particularly useful in core banking modernization, trade reporting rule updates and compliance workflow refactoring.

OpenAI Codex can support issue-to-pull-request workflows, test generation, code review, bug reproduction, migration activities and broader software engineering tasks across the lifecycle. In a hyperautomated PDLC, Codex-like agents can be assigned well-scoped work items, asked to inspect failing tests, propose fixes, create regression coverage and summarize the change for human reviewers. The important design principle is to keep agents inside controlled boundaries: clear prompts, repository permissions, test gates, approval workflows and traceable outputs.

Integration architecture for hyperautomated banking applications

A practical architecture begins with business capability decomposition. Each banking domain should be expressed as a set of bounded capabilities such as customer onboarding, account maintenance, trade enrichment, exception management, portfolio review, control attestation, report generation and audit retrieval. These capabilities should be exposed through APIs, events, workflow tasks, data products and user interfaces. Hyperautomation then connects these capabilities using orchestration engines, event streams, rules engines, AI services, RPA connectors where legacy integration is unavoidable and observability layers that capture business and technical telemetry.

The embedded AI layer should sit behind a secure application service boundary. It should use retrieval-augmented generation where approved policies, product rules, application documentation and regulatory mappings are retrieved from trusted sources. It should avoid uncontrolled exposure of sensitive customer information. Prompt templates, response validation, redaction, grounding checks, model monitoring and human-in-the-loop approval should be part of the production design. In banking, the most successful AI pattern is often not full automation but assisted decisioning with strong controls.

Example: Hyperautomated reconciliation and reporting flow

Consider a reconciliation application that compares ledger balances, payment files, trade settlement records and external statements. In a conventional model, operations teams spend significant time downloading files, running macros, investigating mismatches, documenting break reasons and preparing status reports. In a hyperautomated model, data ingestion is scheduled and monitored, schema checks run automatically, matching engines classify obvious matches, AI assists with ambiguous narratives, exceptions are routed through workflow queues and dashboards update in near real time. At the end of the day, the system can generate a draft operations report explaining unresolved breaks, aging trends, risk exposure and pending approvals.

The same pattern can extend to daily, weekly and monthly reporting. Data quality rules validate inputs, report templates are populated automatically, AI generates narrative commentary on variances, reviewers approve or amend explanations and the final report is archived with lineage and approvals. Audit teams can later retrieve not only the report but also the source extracts, transformation logs, exception history, reviewer decisions and AI-generated drafts. This creates a richer control environment than manual reporting because evidence is captured by design rather than reconstructed later.

Governance, risk and control considerations

Hyperautomation in banking must be designed with governance from the beginning. The development team should define which activities can be automated, which can be AI-assisted and which must remain under human approval. Source code generated by AI must pass normal engineering controls, including peer review, static analysis, dependency scanning, secure coding checks, test execution and production readiness review. Business outputs generated by AI, such as compliance narratives or client-facing explanations, should be reviewed where regulatory or reputational risk is material.

Data governance is equally important. AI-enabled applications must respect data classification, residency, retention, masking and access policies. The model should not become an uncontrolled channel through which confidential customer, trading or employee information can leak. Every prompt, retrieved source, generated response, user action and final decision may need to be logged depending on the use case. For audit applications, this traceability is not optional; it is the foundation of trust.

Operating model for AI-native PDLC

A hyperautomated PDLC requires changes in team behavior. Product owners should write requirements in a structured manner so that AI tools can generate better stories, acceptance criteria and test scenarios. Architects should maintain living decision records, reference patterns and integration standards that AI agents can use as context. Developers should learn prompt discipline, context packaging and review techniques. Test engineers should focus on coverage strategy, synthetic data, compliance scenarios and defect prevention rather than only manual execution. Operations teams should feed incident learnings back into the backlog so the system improves continuously.

The role of human experts becomes more important, not less. AI can draft, generate, compare and suggest, but domain judgment remains essential. A trade reporting specialist understands regulatory nuance. A wealth advisor understands client suitability. A core banking architect understands transaction integrity. A compliance officer understands control interpretation. Hyperautomation works best when it amplifies these experts and removes repetitive friction around them.

Conclusion

Hyperautomation in business application development is not simply a faster way to write software. It is a new way to connect business intent, engineering execution, operational control and continuous learning. In banking, where applications must be reliable, explainable, secure and compliant, the combination of embedded Generative AI and disciplined automation can transform how applications are designed, built, integrated, tested, released and operated. Trade reporting, wealth management, core banking, investment banking, compliance, reconciliation, reporting and audit functions can all benefit when AI is embedded responsibly and automation is orchestrated across the complete lifecycle.

Platforms such as GitHub Copilot, Claude Cowork or Claude Code and OpenAI Codex can play an important role in this transformation by accelerating analysis, development, testing, review, modernization and documentation. Their greatest value appears when enterprises treat them not as isolated productivity tools but as part of a governed, AI-native PDLC. The future of banking application development will belong to teams that can combine human expertise, reusable engineering patterns, intelligent automation and strong governance into one coherent delivery model.

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects.

Samsung Electronics has unveiled a trio of next-generation memory technologies aimed at overcoming the performance, power and capacity limitations facing artificial intelligence infrastructure.

The announcements, made at the Future of Memory and Storage (FMS) conference, introduced new concepts for vertically integrated memory along with a breakthrough NAND architecture designed for the AI era.

The three new memory types have one thing that unites them: they all use wafer bonding. Wafer bonding is a semiconductor manufacturing process technique in which two or more completed silicon wafers are permanently joined together to form a single integrated device, the vendor stated.

Instead of fabricating every component on one wafer, manufacturers build different parts separately, then align and bond them with extremely high precision. Think of it as a high-tech Oreo cookie.

Wafer bonding is significant because it represents one of the few remaining ways to continue scaling semiconductor devices after conventional manufacturing techniques begin to hit physical and economic limits. It enables much higher memory density as more memory is squeezed into the same 2D space, according to the company.

It also allows different manufacturing processes to be combined, so wafer bonding lets companies use the optimal manufacturing process for each wafer independently before joining them. Samsung said the new manufacturing technique fabricates the memory cell array and peripheral circuitry separately before bonding them together.

It is already being used now in NAND flash memory for 3D stacking. Rather than spread the memory circuits out, they are stacked on top of each other like stories on a high-rise building. The technique was first introduced in 2014, with 24-layer NAND flash period last year it broke the 300-layer mark.

The centerpiece of the announcement was BV-NAND, or Bonding V-NAND, Samsung’s next-generation flash memory architecture that employs wafer-bonding. The company said the technology enables NAND devices with more than 400 layers while boosting storage density by approximately 58% compared with its current V9 generation, Samsung stated.

The company said the architecture also improves read, write and input/output performance while reducing power consumption, making it better suited for AI servers that increasingly depend on high-capacity flash storage.

Beyond BV-NAND, Samsung outlined two longer-term memory concepts that could radically alter AI system architecture. The first, dubbed zHBM, calls for stacking HBM memory on top of the AI accelerator rather than alongside processors, as is done today.

This shortens the distance data must travel between processor and memory. Samsung said the design could dramatically increase bandwidth while reducing power consumption and thermal resistance.

The company estimates that combining the architecture with wafer-bonding technology could ultimately deliver more than ten times the memory density of conventional HBM5 while tripling energy efficiency and cutting thermal resistance by more than half.

But don’t plan for deployment just yet. zHBM is still a research concept. It illustrates how memory manufacturers are increasingly looking too 3D designs to continue scaling as traditional 2D packaging becomes more difficult.

Samsung also introduced zNAND-O, another conceptual architecture designed to extend three-dimensional memory beyond conventional NAND implementations. Details were scant but Samsung did say zNAND-O was a next-generation high-performance NAND solution built on its V-NAND technology and in development in four- and eight-layer versions.

The technologies reflect how the industry is being driven by AI, and that AI concerns are driving chip development. HBM Has emerged as an important component of AI computation, but very quickly the industry hit limitations in terms of bandwidth and speed. The proposed technologies above reflect Samsung’s attempts to alleviate the bandwidth problem.

Salesforce customers more than doubled their agentic workforces year on year, according to the company’s second annual Agentic Enterprise Index, which looks at trends in AI agent development and deployment over the past five quarters.

It compiled data from customers who had activated agents in production every month of the analysis period to determine how their use of the technology has evolved between February 2025 and April 2026, as well as incorporating data from May 2026 Salesforce research studies.

It found that businesses grew their agentic workforces from an average of five agents in February 2025 to 13 by April 2026, a 7% compound monthly growth rate (CMGR). In April 2026, it only took an average of 1.9 days to deploy an agent into production, a 53% decrease since the beginning of the report period.

Not only were agents deployed more quickly, they have been progressively taking on more work once in use; over the 15 months, the average number of actions per account had a CMGR of 31%.

“These agents are expanding beyond their initial scope to really become cross-functional,” said Caila Schwartz, Salesforce’s head of agentic commerce insights, during a media briefing.

Salesforce has attempted to measure how much work agents perform, rather than how many tokens they consume, creating its own Agentic Work Unit (AWU) metric, although analysts have criticized the measure as being unrelated to business outcomes. Nevertheless, Salesforce said that as of April, Agentforce agents had performed 734 million AWUs, a number growing at about 15% each month.

The research also showed that agents are acting across multiple cloud domains which, the company said, “underscores the practical necessity of a headless architecture. By decoupling the agent’s logic from traditional front-end user interfaces, agents can process tasks, execute actions, and trigger workflows anywhere.”

Within the company, Salesforce itself has seen explosive growth in AI agent use, said Joe Inzerillo, president of enterprise & AI technology at Salesforce, with a threefold increase in sessions between February 2025 and April 2026. He said that the AI agent in Slack, Slackbot, saves the average employee five hours per week, with 83% of the company having adopted it.

But Schwartz pointed out that different industries are approaching agentic AI in different ways, some more sophisticated than others. To measure that, Salesforce developed a Sophistication Index, a five-point scale scoring the cognitive complexity of an agent’s actions. Levels 1- 3  are assigned to tasks such as record lookups, drafting emails, or summarizing documents, while levels 4 and 5 include more complex functions such as updating database fields.

The data showed that manufacturing, financial services, and healthcare and life sciences have built more sophisticated agent networks than what it called traditional AI frontrunners such as technology and retail.

However, Inzerillo said, the most common use case industry wide, and the best place to start, is the service use case, which provides “far and away the best ROI to start with.”

He also noted that, as people have become more conscious of what agents can do, they are asking agents to perform tasks, rather than simply answer questions.

“Now what you’re starting to see people do is very action oriented. So instead of asking ’how do I file a form to request my vacation’ from our employee agent, they’re telling the employee agent, ‘hey I’m taking a vacation, you need to enter this form for me, and here’s the details,’” he said, adding that this bias towards action represents the evolution of agentic use.

There’s something very attractive about saying “we embed very closely with our customers and just figure it out with them”, especially since the company that started “forward deploying engineers” is growing 84% with $5B+ revenue. But “forward deployed engineer” is a vague term and means different things depending on the business you’re running.

I spent almost 5 years at Palantir as a forward-deployed software engineer, and Palantir’s version of an “FDE” does not make sense for most companies I now meet as an early-stage VC. Depending on the type of business you’re building, this role could broadly mean one of two things: “the product builder” or “the platform operator.” Clearly defining which bucket you fall into will make it easier to hire for this role and run your FDE org.

The product builder: The OG Palantir version

The north star is: do whatever it takes to actually solve the user’s problem. FDEs are not just responsible for making the platform work, but also discovering what to build and building it (actually creating software) in service of the customer.

The platform operator: Solutions + technical customer success

The north star is: make the product work for the customer – deploy and operationalize it. This is what most startups today really mean when they want FDEs. FDEs here configure the core platform, manage account relationships and drive adoption. This is not new – companies have always had solutions engineers, sales engineers, customer success etc., although the work looks different as FDEs are increasingly building prototypes, configuring evals and building MCPs.

Which FDE is right for you

For most situations, hiring product builder FDEs is a mistake.

At scale, the FDEs should be the platform operator. It’s hard to have FDEs build and maintain highly custom product features, especially as the company scales. Over time, the custom product surface area distracts from building the core product, even though AI coding tools make it easy to ship new features quickly and maintain them.

Many fast-growing AI startups recognize these constraints and structure the FDE role more like the platform operator. This also allows them to have 5-10 accounts per FDE, which is a much higher ratio than Palantir had (at least in 2023). Even the Palantir FDE role has evolved to look more like the platform operator.

There are, however, situations when your FDEs should be the product builder archetype.

1. You have very large customers (F500 scale)

Technical complexity: Large customers have complex environments with legacy infrastructure that often requires “out-of-platform” engineering work. I often encountered bespoke data infrastructure, privacy requirements, etc. at various Palantir customers that required me to build “out-of-platform” connectors, UIs and backends.

Organizational inertia and trust: Serving large enterprises is about building trust. In short time periods, overfitting product to a specific user/workflow is often what delivers the most value, builds trust and helps organizations get over the inertia of moving away from Excel and legacy software tools that are part of their day-to-day workflow. For AI-native startups, it’s arguably even more important to invest in doing “unscalable” development with engineering boots on the ground, as it helps solidify your right to exist and eventually expand the customer relationship.

2. You have many ICPs and workflows

If you have a broad range of ICPs and workflows that you serve, your product probably is not walk-up usable on day 1 of deployment. The short-term hacky things that product builder FDEs build to make the product work for these heterogeneous users/workflows will help you shape the product long-term.

Note: see Palantir Foundry’s architecture here.

This was a big reason why Palantir FDEs were more like product builders (and are still able to – see the Forward Deployed Software Engineer job profiles as an example). The vision for Foundry was to be the operating system for an enterprise’s critical decisions – inherently multiple industries, users and workflows. A lot of FDE-led development showed that solving many of these use cases required complex data integrations, which led to the early versions of Foundry being best-suited for complex data integrations and building a customer’s “Ontology”. Similarly, FDEs like myself built custom frontend applications for fraud analysis, pricing, etc. As certain patterns of what these applications required became more clear, they were centralized into an application-layer product.

Who you should hire

Platform operator: There is a much broader set of people you could hire, testing for technical fluency (e.g., being good at data analysis, complex Excel work, even SQL), product intuition and an inclination to build customer relationships. Backgrounds like technical customer success, solutions engineering, software engineering, product management and consulting are all strong fits.

Product builder: You want candidates that are high ownership and missionary software engineers, or technical PMs who want to ship products themselves.

Hiring for these profiles, especially product builders, is hard. It’s worth calling out two things that helped Palantir hire software engineers into what might be considered a less sexy role.

1. Culture of building at the edge: Strong engineers are motivated to build things. Palantir gave FDEs a lot of ownership to build products, which is why much of the core product leadership was former FDEs.
2. Cult built around mission: Internally, there was a cult-like devotion to the mission. Everyone always talked about why outcomes were far more important than software, and why most companies building tools had it wrong. I’ve never been at a company where people feel so closely bonded around a mission.

As founders building AI startups think about hiring FDEs, it’s worth being specific about your culture and asking: Am I just hiring people to support development teams, or am I hiring people to shape and build product? It’s hard to get software engineers (even today) to be excited about an FDE role that might just be technical customer success.

What FDEs should be doing (regardless of archetype)

You’ve hired the right people. How do you best leverage your team of FDEs?

FDEs were Palantir’s way of delivering outcomes rather than tools. AI-native startups can take this much further and FDEs can help in a few unique ways by leveraging their proximity to customers.

1. Find the most critical workflows: As AI lowers the cost of producing software, companies will face a lot more competition. FDEs at AI startups should be constantly finding ways to serve the most critical workflows for a customer and paying attention to how customers do work across newer and legacy tools. For example, FDEs at Harvey should pay attention to which workflows are in Westlaw, which ones are moving to ChatGPT/Claude, and how the Harvey product can stay ahead.
2. Build around nondeterminism: In more regulated environments, FDEs should be hyper-focused on making products reliable for specific use cases using evals and configs. Previously, product reliability lived with product and support. As companies provide outcomes instead of tools, configuring products appropriately and managing evals shifts towards FDE teams.

Business application development is entering a new operating model. The traditional approach of gathering requirements, designing screens, writing services, integrating systems, testing, fixing defects and preparing release documentation still exists, but it is no longer sufficient for enterprises that need speed, traceability, resilience and regulatory confidence at the same time. Hyperautomation brings a broader discipline to this challenge. It combines workflow orchestration, intelligent document processing, robotic automation, API-led integration, process mining, test automation, observability and artificial intelligence into a connected delivery fabric. With embedded Generative AI, this fabric becomes more adaptive because applications can interpret natural language, summarize complex data, generate explanations, detect exceptions and support decision workflows rather than merely execute predefined rules.

In banking, this shift is especially meaningful. Banks operate across dense application landscapes: trade reporting platforms, wealth management portals, core banking systems, investment banking applications, digital compliance engines, reconciliation utilities, operational dashboards, audit repositories and daily, weekly and monthly reporting platforms. Each of these areas has its own data models, control points, integration patterns, validation rules, exception paths and regulatory obligations. Hyperautomation does not replace engineering discipline; it strengthens it by making business intent, technical execution, control evidence and continuous improvement part of the same lifecycle.

From automation to hyperautomation in banking applications

Automation usually addresses a specific task: moving data from one system to another, generating a report, running a batch job or validating a transaction against a rule. Hyperautomation goes further. It looks at the complete business outcome and asks how the entire chain can be streamlined, governed, observed and improved. For example, a trade reporting process may begin with transaction capture, enrich the trade with reference data, validate regulatory fields, identify breaks, generate a submission file, transmit it to a regulator or trade repository, monitor acknowledgements and preserve audit evidence. A narrow automation script may accelerate one step, but a hyperautomated design coordinates the complete flow, including exception handling and evidence generation.

Figure: Automation vs. hyperautomation

Embedded Generative AI adds a new layer of intelligence. Instead of forcing every user interaction into rigid screens and codes, business applications can accept natural language prompts, interpret document content, summarize cases, generate draft responses, explain anomalies, produce test scenarios and create release notes. In a banking environment, this intelligence must be carefully bounded. Every AI-assisted action should be traceable, explainable, reviewable and aligned with data privacy, model risk, information security and regulatory expectations. The goal is not uncontrolled autonomy; the goal is governed acceleration.

Banking application components suitable for hyperautomation

A modern banking application is rarely a single monolithic system. It is a composition of business capabilities, integration services, workflow engines, data pipelines, user experience layers, analytics models, control dashboards and audit stores. Hyperautomation can accelerate the development and integration of these components by turning repetitive engineering work into reusable patterns and by embedding intelligence directly into business processes.

• Trade reporting applications: Generative AI can help map trade attributes to regulatory fields, explain validation failures, summarize rejected submissions and generate test cases for reporting scenarios. Hyperautomation can orchestrate enrichment, validation, submission, acknowledgement tracking and evidence archival.
• Wealth management platforms: Advisors can use embedded AI to summarize client portfolios, generate suitability narratives, identify missing documents and prepare personalized investment review notes. Automation can coordinate onboarding, risk profiling, document verification, portfolio rebalancing workflows and client communication approvals.
• Core banking applications: Account opening, loan servicing, deposits, payments, interest calculations and customer maintenance can benefit from automated validations, intelligent forms, workflow routing and natural language assistance for operations teams. AI can explain account events or transaction exceptions in plain language.
• Investment banking systems: Deal pipelines, research workflows, underwriting processes, trade lifecycle functions and risk calculations require strong coordination across front-office, middle-office and back-office platforms. Hyperautomation can standardize approvals, documentation, exception resolution and control evidence across these stages.
• Digital compliance applications: Compliance teams can use AI to summarize policy obligations, compare regulatory changes with internal controls, classify alerts, draft investigation notes and produce evidence packs. Automation ensures routing, approvals, segregation of duties, audit trails and regulatory reporting timelines are consistently enforced.
• Reconciliation platforms: AI can assist in matching narratives, explaining breaks, clustering exception patterns and suggesting resolution actions. Hyperautomation can pull data from ledgers, statements, payment processors, trading systems and data warehouses, then route unresolved breaks to the right teams.
• Reporting and audit applications: Daily, weekly and monthly reports can be generated through controlled data pipelines, automated quality checks, narrative generation, variance explanations and approval workflows. Audit applications can preserve lineage, approvals, source extracts, model outputs and control attestations.

Embedded generative AI as an application capability

Embedding Generative AI into business applications should be treated as an architectural capability, not as a decorative chatbot. A banking application may use AI for search, summarization, reasoning support, content generation, code generation, policy interpretation or anomaly explanation. Each use case requires clear boundaries. The application must know which data the model can access, which actions require approval, what evidence must be captured and where deterministic controls must override probabilistic suggestions.

For example, in trade reporting, an embedded AI assistant can explain why a transaction failed validation and suggest likely fields to review. However, the final correction should pass through rule-based validations, maker-checker approval and audit logging. In wealth management, AI may draft a client review note based on portfolio movements and risk profile, but the advisor must verify suitability, disclosures and final communication. In reconciliation, AI can propose likely matches or categorize break reasons, while the system preserves the original data, confidence score, reviewer action and final resolution path.

Hyperautomating the product development lifecycle

The Product Development Lifecycle can itself become hyperautomated. Instead of treating ideation, analysis, design, development, testing, security review, release and operations as disconnected phases, enterprises can create an AI-assisted delivery loop where every stage produces structured artifacts that the next stage can consume. Platforms such as GitHub Copilot, Claude Code or Claude Cowork-style agentic development environments and OpenAI Codex can support this movement by helping teams reason over requirements, generate code, create tests, review changes, modernize legacy modules and produce documentation. Their value increases when they are connected to repositories, issue trackers, design documents, build pipelines, test suites, security scanners, observability data and enterprise knowledge bases.

PDLC Stage	Hyperautomation Opportunity	AI-Assisted Outcome
Business discovery	Process mining, domain interviews, regulatory mapping, backlog creation	Structured epics, user stories, acceptance criteria, process maps and control requirements
Architecture and design	Reference architectures, API contracts, data models, event flows, security patterns	Architecture options, integration blueprints, threat-model prompts and design decision records
Development	Code generation, service scaffolding, UI component creation, data pipeline templates	Review-ready code increments, reusable components, migration utilities and integration adapters
Testing	Unit, integration, regression, performance, compliance and synthetic data testing	Generated test cases, defect reproduction steps, test automation scripts and coverage summaries
Security and compliance review	Static analysis, dependency checks, policy validation, evidence capture	Risk explanations, remediation suggestions, control traceability and approval evidence
Release and deployment	CI/CD orchestration, environment promotion, release notes, rollback preparation	Automated deployment packs, release summaries, operational checklists and change records
Operations and feedback	Observability, incident analysis, user feedback mining, backlog refinement	Incident summaries, root-cause hypotheses, improvement stories and reliability recommendations

Role of GitHub Copilot, Claude Cowork and Codex

GitHub Copilot is useful where developers need assistance inside the engineering flow: explaining code, generating functions, proposing tests, reviewing pull requests and helping teams move from issue to implementation. In a banking PDLC, it can accelerate microservice creation, API integration, batch processing logic, reconciliation rules, regulatory validation routines and UI workflows. When used with repository context and proper review discipline, it can reduce the time developers spend on repetitive coding while preserving human accountability for design and correctness.

Claude Cowork or Claude Code-style agentic environments are valuable for multi-file reasoning, refactoring, debugging and documentation-heavy engineering work. Banking applications often contain deep domain logic scattered across services, configuration files, stored procedures, integration scripts and test suites. An agentic coding assistant that can understand a wider codebase context can help engineers analyze dependencies, prepare modernization plans, update multiple files coherently and draft explanations for reviewers. This is particularly useful in core banking modernization, trade reporting rule updates and compliance workflow refactoring.

OpenAI Codex can support issue-to-pull-request workflows, test generation, code review, bug reproduction, migration activities and broader software engineering tasks across the lifecycle. In a hyperautomated PDLC, Codex-like agents can be assigned well-scoped work items, asked to inspect failing tests, propose fixes, create regression coverage and summarize the change for human reviewers. The important design principle is to keep agents inside controlled boundaries: clear prompts, repository permissions, test gates, approval workflows and traceable outputs.

Integration architecture for hyperautomated banking applications

A practical architecture begins with business capability decomposition. Each banking domain should be expressed as a set of bounded capabilities such as customer onboarding, account maintenance, trade enrichment, exception management, portfolio review, control attestation, report generation and audit retrieval. These capabilities should be exposed through APIs, events, workflow tasks, data products and user interfaces. Hyperautomation then connects these capabilities using orchestration engines, event streams, rules engines, AI services, RPA connectors where legacy integration is unavoidable and observability layers that capture business and technical telemetry.

The embedded AI layer should sit behind a secure application service boundary. It should use retrieval-augmented generation where approved policies, product rules, application documentation and regulatory mappings are retrieved from trusted sources. It should avoid uncontrolled exposure of sensitive customer information. Prompt templates, response validation, redaction, grounding checks, model monitoring and human-in-the-loop approval should be part of the production design. In banking, the most successful AI pattern is often not full automation but assisted decisioning with strong controls.

Example: Hyperautomated reconciliation and reporting flow

Consider a reconciliation application that compares ledger balances, payment files, trade settlement records and external statements. In a conventional model, operations teams spend significant time downloading files, running macros, investigating mismatches, documenting break reasons and preparing status reports. In a hyperautomated model, data ingestion is scheduled and monitored, schema checks run automatically, matching engines classify obvious matches, AI assists with ambiguous narratives, exceptions are routed through workflow queues and dashboards update in near real time. At the end of the day, the system can generate a draft operations report explaining unresolved breaks, aging trends, risk exposure and pending approvals.

The same pattern can extend to daily, weekly and monthly reporting. Data quality rules validate inputs, report templates are populated automatically, AI generates narrative commentary on variances, reviewers approve or amend explanations and the final report is archived with lineage and approvals. Audit teams can later retrieve not only the report but also the source extracts, transformation logs, exception history, reviewer decisions and AI-generated drafts. This creates a richer control environment than manual reporting because evidence is captured by design rather than reconstructed later.

Governance, risk and control considerations

Hyperautomation in banking must be designed with governance from the beginning. The development team should define which activities can be automated, which can be AI-assisted and which must remain under human approval. Source code generated by AI must pass normal engineering controls, including peer review, static analysis, dependency scanning, secure coding checks, test execution and production readiness review. Business outputs generated by AI, such as compliance narratives or client-facing explanations, should be reviewed where regulatory or reputational risk is material.

Data governance is equally important. AI-enabled applications must respect data classification, residency, retention, masking and access policies. The model should not become an uncontrolled channel through which confidential customer, trading or employee information can leak. Every prompt, retrieved source, generated response, user action and final decision may need to be logged depending on the use case. For audit applications, this traceability is not optional; it is the foundation of trust.

Operating model for AI-native PDLC

A hyperautomated PDLC requires changes in team behavior. Product owners should write requirements in a structured manner so that AI tools can generate better stories, acceptance criteria and test scenarios. Architects should maintain living decision records, reference patterns and integration standards that AI agents can use as context. Developers should learn prompt discipline, context packaging and review techniques. Test engineers should focus on coverage strategy, synthetic data, compliance scenarios and defect prevention rather than only manual execution. Operations teams should feed incident learnings back into the backlog so the system improves continuously.

The role of human experts becomes more important, not less. AI can draft, generate, compare and suggest, but domain judgment remains essential. A trade reporting specialist understands regulatory nuance. A wealth advisor understands client suitability. A core banking architect understands transaction integrity. A compliance officer understands control interpretation. Hyperautomation works best when it amplifies these experts and removes repetitive friction around them.

Conclusion

Hyperautomation in business application development is not simply a faster way to write software. It is a new way to connect business intent, engineering execution, operational control and continuous learning. In banking, where applications must be reliable, explainable, secure and compliant, the combination of embedded Generative AI and disciplined automation can transform how applications are designed, built, integrated, tested, released and operated. Trade reporting, wealth management, core banking, investment banking, compliance, reconciliation, reporting and audit functions can all benefit when AI is embedded responsibly and automation is orchestrated across the complete lifecycle.

Platforms such as GitHub Copilot, Claude Cowork or Claude Code and OpenAI Codex can play an important role in this transformation by accelerating analysis, development, testing, review, modernization and documentation. Their greatest value appears when enterprises treat them not as isolated productivity tools but as part of a governed, AI-native PDLC. The future of banking application development will belong to teams that can combine human expertise, reusable engineering patterns, intelligent automation and strong governance into one coherent delivery model.

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects.

For years, applicant tracking systems and recruiting platforms were treated as HR technology: Important for workflow, efficiency, compliance and candidate experience, but rarely viewed as core security infrastructure. That assumption no longer holds. Once AI begins reading resumes, scoring candidates, conducting interviews, ranking applicants and influencing who moves forward, the hiring platform stops being a passive system of record. It becomes a decision system.

And any system that accepts public input, processes sensitive data and influences business decisions belongs inside the security conversation.

I learned this during an AI hiring platform rollout that never made it to production. The vendor was established, the product had a strong market reputation and the AI feature looked attractive: Upload a resume, compare it to a job description and return a neat percentage match. For recruiters, it promised speed. For executives, it promised modernization.

Before moving real candidate data into the system, I tested it with synthetic resumes. One weak resume came back with a surprisingly strong match. The reason was not hidden in the candidate’s experience. It was hidden in the text. The resume contained language instructing the AI to treat the candidate as an excellent fit, and the system appeared to follow that instruction instead of evaluating the resume on merit.

That changed the question from “Does the tool improve productivity?” to “Can the person being evaluated influence the evaluation itself?”

That is a security question.

The trust boundary has moved

CIOs do not need to become recruiting experts. They only need to look at the mechanics.

An anonymous user submits content into an enterprise system. That content is processed by software. The software then produces an output that can influence a business decision. In every other environment, security teams know what to call that: untrusted input crossing a trust boundary.

The difference is that in hiring, the input looks harmless. It is a resume, a cover letter, a chatbot reply or a spoken answer in an AI-led interview. But once AI reads that content and treats it as instruction, the harmless-looking input becomes part of the system’s control surface.

That is why prompt injection matters in hiring. It is not just an AI oddity or a model behavior issue. It is the same category of failure enterprises have spent decades trying to prevent: User-controlled input changing what the system does. OWASP lists prompt injection as the first risk in its Top 10 for LLM applications, describing it as a case where user prompts alter a model’s behavior or output in unintended ways.

In hiring, the implication is direct: A candidate may be able to manipulate the score, ranking or interview assessment that determines whether a human ever sees them.

The business impact is not theoretical

The obvious risk is that an unqualified candidate moves forward. But the impact is broader.

First, decision quality degrades. Hiring teams adopt AI scoring because they believe it improves signal. If the score can be manipulated, the business is not gaining signal; it is gaining false confidence. Recruiters may spend time on candidates who gamed the system while stronger candidates are buried lower in the queue. A tool bought to reduce friction can quietly create more of it.

Second, cost increases under the appearance of efficiency. Every false positive consumes recruiter time, hiring-manager attention, interview slots and opportunity cost. A small weakness in screening integrity can become a measurable operational drag across open roles.

Third, trust suffers. Candidates already question whether AI hiring tools are fair, explainable or accurate. If it becomes clear that a screening system can be manipulated by hidden instructions or verbal prompting, the issue is no longer just security. It becomes reputational. Strong candidates may lose confidence in the process, and employers may have to defend decisions made by systems they did not fully understand.

Fourth, sensitive data exposure becomes harder to contain. Recruiting systems hold names, addresses, work histories, education histories, compensation details, work authorization information and sometimes accommodation or demographic data. NIST guidance on personally identifiable information includes employment information as linkable personal data that must be protected from inappropriate access, use and disclosure. Yet hiring platforms often receive less security scrutiny than systems holding customer or financial data.

That mismatch is dangerous: High-value data, public-facing workflows and increasing automation.

The 2025 McHire incident should have made this impossible to ignore. Researchers reported that weaknesses in McDonald’s AI hiring platform, including default credentials and an access-control flaw, exposed applicant data at large scale before the issue was patched. The lesson for CIOs is not merely that a weak password was used. The lesson is that AI hiring systems can ship with basic, preventable security failures while still being treated as HR tools rather than enterprise risk surfaces.

Vendor reputation does not transfer to every AI feature

One reason this risk slips through is that buyers often trust the platform brand. Mature vendors may have strong security programs, enterprise customers, compliance documentation and procurement-friendly answers.

But AI features can change the architecture of risk.

A platform that was safe as a workflow tool may behave very differently once it adds resume scoring, interview grading, chatbot screening or automated ranking. The new feature may introduce new inputs, new model behavior, new data flows, new third-party dependencies and new decision points. In practical terms, the attack surface has changed.

CIOs should not allow AI features to inherit trust automatically from the legacy platform around them. When a vendor adds AI, the enterprise should reassess the feature as if it were a new product. That does not mean slowing innovation for bureaucracy. It means AI-enabled decision-making carries different failure modes from ordinary workflow automation.

The ownership gap is the real vulnerability

The biggest risk may not be the model. It may be the ownership gap.

Talent acquisition may buy the tool. HR operations may configure it. The vendor may guide implementation. Procurement and legal may approve the contract. But who owns the security of the candidate-facing AI layer?

In many organizations, the honest answer is unclear.

That ambiguity is where risk grows. Recruiting technology sits at the intersection of public input, sensitive data, third-party software, automated decision support and brand trust. That is exactly the kind of environment that needs named security ownership, asset inventory, vendor review, access-control testing, logging and incident-response planning.

If the hiring stack is not in the security inventory, the organization is already making an assumption it may later regret.

What CIOs should require now

The fix is not exotic. It is applying existing security discipline to a surface that has been underestimated.

Treat every candidate submission as untrusted input. Resumes, cover letters, chatbot responses, interview transcripts and spoken answers should be handled as attacker-controllable content. If AI processes it, the system must separate content from instruction.

Reassess vendors when AI features are introduced. A prior security review should not be treated as permanent approval for new AI capabilities. Ask what changed in the architecture, what data the model sees, what actions it can influence and how manipulation attempts are detected.

Ask AI-specific questions before signing. Can candidate-provided content alter scoring? Are hidden instructions filtered or ignored? Is there human review before AI output influences a decision? Can the vendor produce testing evidence for prompt injection, access control and data exposure risks?

Assign ownership. HR can own the process, but security must own the risk model. AI hiring systems should be included in third-party risk management, application security reviews, access governance, monitoring and incident response planning.

Measure business impact, not just AI adoption. The goal is not to say the recruiting function uses AI. The goal is to improve hiring speed, quality, fairness and cost without creating new risk. If the system cannot protect decision integrity, the business case is weaker than it appears.

The hiring platform is now part of the enterprise attack surface

AI has turned the careers page into more than a front door for applicants. It is now a public input channel feeding systems that store sensitive data and influence workforce decisions.

That makes it a CIO concern.

The next failure in AI hiring may not look like a traditional breach at first. It may look like bad rankings, manipulated scores, unexplainable decisions, wasted recruiter time or a candidate process no one trusts. But underneath those symptoms is a familiar security problem: A system trusted input it should have treated as hostile.

Enterprises have hardened payment systems, customer portals, APIs and employee applications around that lesson. Hiring deserves the same treatment.

AI hiring is not just an HR transformation. It is a security boundary. And it is time CIOs treated it like one.

Enterprises deploying agentic AI may need a new generation of AI servers as conventional GPU-centric infrastructure struggles to efficiently execute multi-step AI workflows, according to researchers from Microsoft Azure and the University of Texas at Austin.

Drawing on production telemetry from Microsoft’s Azure cloud and experiments with representative open-source agent frameworks, the researchers found that AI agents spend far more time coordinating models, tools, and orchestration software than conventional inference systems assume.

Rather than behaving like standalone LLM requests, agentic applications execute as dynamic workflows that repeatedly move work between CPUs, GPUs, and external services, exposing inefficiencies in today’s server designs.

“Our study shows that agentic execution is fundamentally fragmented and heterogeneous,” the researchers wrote in the paper. “Each request expands into a workflow of LLM inferences, tool invocations, and orchestration decisions that repeatedly crosses the CPU-GPU boundary.”

According to the paper, that execution pattern places the CPU on the application’s critical path because orchestration software and tools execute on the host while model inference runs on GPUs.

The researchers said conventional server architectures are poorly matched to those workloads because fragmented execution strands CPU and GPU resources, different host-side software roles have different resource requirements, and multiplexing multiple agents increases coordination overhead.

Production data points to fragmented execution

The researchers said a representative production request alternated between multiple LLM calls, tool discovery, tool execution, and orchestration before completing. In a controlled study using the CORAL framework, a single workload expanded into 580 LLM calls interleaved with 552 tool invocations, causing execution to “ping-pong between the two processors hundreds of times.”

The study also found that host CPU utilization remained low for extended periods before rising sharply during bursts of tool execution, while GPU utilization varied widely depending on workflow composition, leaving some accelerators saturated and others idle.

According to the researchers, the fragmented execution pattern leaves CPUs and GPUs underutilized on average while allowing either processor to become “a transient bottleneck on the workflow’s critical path,” making static resource provisioning inefficient for agentic workloads.

Sanchit Vir Gogia, chief analyst at Greyhound Research, said the findings show enterprises should evaluate agentic AI infrastructure differently from conventional inference deployments.

“Agentic AI is not a bigger chatbot; it is a distributed application with inference embedded inside it,” Gogia said. “The individual ingredients are familiar. The execution graph is new.”

“The GPU remains indispensable, but it no longer owns the entire clock,” he added. “Tool time matched or beat inference time in more than 27 per cent of requests, and average utilisation is beginning to lie to infrastructure teams.”

Researchers propose workflow-aware server design

Based on those findings, the researchers proposed a server architecture, called Agora, that dynamically reallocates CPU and GPU resources, separates scheduling, orchestration, and tool execution into dedicated host roles, and adapts resource allocation to workload behavior.

“Agora dynamically harvests idle CPU cores for co-located throughput work, while protecting agentic tail latency against tool spikes. It also oversubscribes GPU memory by placing more agents on each GPU, prefetching the next agent’s state to hide swap latency,” the researchers wrote in the paper. “To match the machine to the heterogeneous roles, Agora pools cores by role and applies affinity-aware scheduling to restore locality. These techniques substantially improve CPU and GPU utilization and per-server throughput while preserving agent tail latency.”

In their evaluation, the researchers reported that Agora increased host CPU utilization by about 30%, recovered about 95% of a co-located workload’s standalone throughput under low load, freed roughly one-third of GPUs through workload consolidation, increased generation throughput by 82%, and reduced tail latency by 2.5 times.

Gogia said the findings indicate that infrastructure procurement should focus less on individual processors and more on how entire AI workflows execute.

“The CPU is not returning to the throne; the throne itself is disappearing,” he said. “Competitive advantage is moving from the individual processor to the heterogeneous server, rack and runtime operating as one system.” He said organizations should “procure the workflow, not the box,” arguing that workload profiling and scheduling are likely to deliver greater benefits than sizing infrastructure based on model inference alone.

Traditional operating systems (OS) were built to manage hardware, files, apps, and users on a device, but Cloudflare says the agentic AI era requires a whole new format.

The company this week announced Cloudflare OS, which connects AI agents, enterprise data and context, internal systems, and workflows together in one secure workspace. It is open source and browser-based, sparing companies the need to build all-new infrastructure.

The OS is launching alongside several other new security, identity, spending, and user insight tools that Cloudflare has built for the AI-based workplace.

“Cloudflare OS isn’t a traditional desktop OS,” said Rita Kozlov, VP of product at Cloudflare. “It reimagines the workplace computing environment for AI.”

Open source OS runs in a browser

Cloudflare OS serves as a secure, AI-equipped workspace that is plugged into internal company systems. Available now through Cloudflare’s open source repository, it is accessible directly in a browser, and runs inside an enterprise’s Cloudflare account.

“It is a browser-based workspace that begins with a conversation,” Kozlov explained. Users can ask an agent to research, create slides, spreadsheets, and documents, build full-stack apps, or automate workflows without the need for a terminal. Those outputs are then shareable, but kept in isolated databases with access controls.

Enterprises will soon be able to access the OS directly through Cloudflare or via a “select group” of partners that will build tailored offerings on Cloudflare’s architecture, the company says. Because it is open source, organizational processes, internal system connections, and context aren’t locked into a vendor product or AI model provider. Customers can use whatever models they choose.

Cloudflare OS is built on Cloudflare Workers, Dynamic Workers, Durable Objects, and Access, the company’s zero trust network access (ZTNA) tool that verifies every user and request. Agents start with zero permissions by default and are only granted access to tools required for a specific task. Organizations configure their own Access policies, models, branding, skills, and integrations, Kozlov explained.

Governed connectors known as gatekeepers give admins control over what AI can see, what it can change, and when the system needs human sign-off. They can also control budgets, set rate limits, and delegate tasks to different models.

“Because agents act on people’s behalf and produce work others can access and modify, they require a new security model,” Kozlov said. Thus, Cloudflare OS tracks the resources an agent requires so the right access controls follow its work when it is shared.

Cloudflare initially built the OS for internal use, and employees “across every team” use it daily. Kozlov estimated that, over the last 30 days, internal users have used it to create more than 4,000 apps, automations, and tools. Over that same period, she claimed, the company’s sales team saved an estimated 10,000 hours by automating previously manual tasks like territory planning and proposal creation.

“We open sourced Cloudflare OS so any organization can build ‘Your Company OS,’” Kozlov said. Open source is critical because “you cannot put your company into software you do not own. Organizations need to be able to inspect the platform, customize it, connect their own systems, and make it their own,” she explained.

A more cohesive bundle

Cloudflare deserves credit for packaging Cloudflare OS as an operating system, noted tech analyst Carmi Levy.

“This very much is not Windows, macOS, or Linux, and it isn’t an operating system by its common definition,” he said. “But Cloudflare’s use of this terminology implies familiarity to enterprise IT buyers.”

This makes for an easier discussion as enterprises struggle to understand how to best incorporate AI-related platforms and workflows into infrastructure that wasn’t initially designed for it.

Microsoft has marketed the combination of its Azure, Entra, Fabric, Windows, and Microsoft 365 offerings as an operating system of sorts, but hasn’t pulled all the pieces into a common brand, Levy said. And Google’s Gemini, Workspace, Vertex AI, and Cloud Run are “circling similar territory.”

But, he noted, Cloudflare OS is “more cohesively bundled” and infrastructure-focused, offering a single pane of glass platform for buyers worried about stitching together otherwise disparate AI-aware networking pieces. The company recognizes that AI introduces new architectural realities such as inference and model routing “over and above” traditional OS core competencies.

“While competing offerings generally leave the infrastructure heavy lifting to enterprise decision-makers, Cloudflare is marketing itself as a single-source vendor, which potentially frees IT planners from having to integrate all the AI pieces on their own,” Levy said.

An infrastructure-first, application-agnostic approach means Cloudflare OS can coexist with whatever AI applications already exist in an enterprise, he said. It will “play nice” with OpenAI, Anthropic, Google, Microsoft, Meta, or open source layers, allowing employees to begin working in familiar workflows after sign-in.

“Its open-source architecture also minimizes the potential for vendor lock-in as enterprises gradually figure out how to evolve their stacks to align with new AI-era realities,” Levy said.

Managing identities and budgets for both humans and AI

As AI agents emerge across the enterprise, tracking their use can be challenging, causing problems from both a security and a spend standpoint. Along with Cloudflare OS, the company has launched a way to address this issue with its new Identity-Aware AI Gateway, now in beta.

Also integrated with Access, the offering gives admins visibility into what users (both human and AI) are requesting from AI models. It allows security teams to set up custom domains in front of their gateways and replace shared API keys by integrating with their identity provider, like Okta or Entra, and ZTNA infrastructure, Cloudflare explained.

Every request is tied to Access-verified identities, and enterprises can filter each user’s logs, analytics, and spend. IT teams can track redundancies, limit usage rates, and apply filters that strip out employee names, passwords, and other sensitive data before requests go to outside model providers.

A companion feature, AI Spend, tracks every user’s behavior over time to create a baseline of normal AI usage. When spending deviates from that pattern, the system alerts the IT team.

A new tab, User Insights, tracks cost and identifies over-spend caused by activities such as low cache-hit rates or oversized context windows. The capability scores sessions and compares them against account history using a 95th percentile session cost over the previous 30 days, Cloudflare product managers Ming Lu, Kenny Johnson, and Ayush Kumar explain in a blog post. Anything above 2x an account’s 95th percentile is a “strong candidate for anomalous behavior.”

For instance, one Cloudflare customer had an employee who left a rogue AI session running, generating a $30K bill. “User Insights helped them identify the problem and shut off access before the problem was further exacerbated,” Kozlov said.

Cloudflare is also building prompt classification functionality that sorts requests into categories such as coding or writing. This can help enterprises understand what AI is being used for.

“Once business traffic is separated from everything else, personal use becomes visible,” the project managers explained. “From the outside, someone running a side hustle on company time and someone quietly moving data out through a model look the same. Telling them apart is central to catching insider risk.”

Looking at the bigger picture

Identity-Aware AI Gateway and AI Spend address the visibility problem that has dogged so many recent AI deployments where enterprises failed to monitor usage, Levy noted. Projects “crashed and burned” as users unwittingly blew through token allocations.

These platforms provide single-point visibility into what is being used, how it’s being used, and where the potential lies for raising the productivity bar, he said. They overlay with existing models; in doing so, they enhance security with more precise control over resource allocations, and via automated anonymization protocols that prevent inadvertent sharing of sensitive data.

Ultimately, he said, vendors who free IT from having to independently assemble the pieces of their own AI implementations, and who assist them with answers to AI-specific questions, “will gain advantage over vendors that aren’t looking at the bigger picture.

This article originally appeared on CIO.com.

Traditional operating systems (OS) were built to manage hardware, files, apps, and users on a device, but Cloudflare says the agentic AI era requires a whole new format.

The company this week announced Cloudflare OS, which connects AI agents, enterprise data and context, internal systems, and workflows together in one secure workspace. It is open source and browser-based, sparing companies the need to build all-new infrastructure.

The OS is launching alongside several other new security, identity, spending, and user insight tools that Cloudflare has built for the AI-based workplace.

“Cloudflare OS isn’t a traditional desktop OS,” said Rita Kozlov, VP of product at Cloudflare. “It reimagines the workplace computing environment for AI.”

Open source OS runs in a browser

Cloudflare OS serves as a secure, AI-equipped workspace that is plugged into internal company systems. Available now through Cloudflare’s open source repository, it is accessible directly in a browser, and runs inside an enterprise’s Cloudflare account.

“It is a browser-based workspace that begins with a conversation,” Kozlov explained. Users can ask an agent to research, create slides, spreadsheets, and documents, build full-stack apps, or automate workflows without the need for a terminal. Those outputs are then shareable, but kept in isolated databases with access controls.

Enterprises will soon be able to access the OS directly through Cloudflare or via a “select group” of partners that will build tailored offerings on Cloudflare’s architecture, the company says. Because it is open source, organizational processes, internal system connections, and context aren’t locked into a vendor product or AI model provider. Customers can use whatever models they choose.

Cloudflare OS is built on Cloudflare Workers, Dynamic Workers, Durable Objects, and Access, the company’s zero trust network access (ZTNA) tool that verifies every user and request. Agents start with zero permissions by default and are only granted access to tools required for a specific task. Organizations configure their own Access policies, models, branding, skills, and integrations, Kozlov explained.

Governed connectors known as gatekeepers give admins control over what AI can see, what it can change, and when the system needs human sign-off. They can also control budgets, set rate limits, and delegate tasks to different models.

“Because agents act on people’s behalf and produce work others can access and modify, they require a new security model,” Kozlov said. Thus, Cloudflare OS tracks the resources an agent requires so the right access controls follow its work when it is shared.

Cloudflare initially built the OS for internal use, and employees “across every team” use it daily. Kozlov estimated that, over the last 30 days, internal users have used it to create more than 4,000 apps, automations, and tools. Over that same period, she claimed, the company’s sales team saved an estimated 10,000 hours by automating previously manual tasks like territory planning and proposal creation.

“We open sourced Cloudflare OS so any organization can build ‘Your Company OS,’” Kozlov said. Open source is critical because “you cannot put your company into software you do not own. Organizations need to be able to inspect the platform, customize it, connect their own systems, and make it their own,” she explained.

A more cohesive bundle

Cloudflare deserves credit for packaging Cloudflare OS as an operating system, noted tech analyst Carmi Levy.

“This very much is not Windows, macOS, or Linux, and it isn’t an operating system by its common definition,” he said. “But Cloudflare’s use of this terminology implies familiarity to enterprise IT buyers.”

This makes for an easier discussion as enterprises struggle to understand how to best incorporate AI-related platforms and workflows into infrastructure that wasn’t initially designed for it.

Microsoft has marketed the combination of its Azure, Entra, Fabric, Windows, and Microsoft 365 offerings as an operating system of sorts, but hasn’t pulled all the pieces into a common brand, Levy said. And Google’s Gemini, Workspace, Vertex AI, and Cloud Run are “circling similar territory.”

But, he noted, Cloudflare OS is “more cohesively bundled” and infrastructure-focused, offering a single pane of glass platform for buyers worried about stitching together otherwise disparate AI-aware networking pieces. The company recognizes that AI introduces new architectural realities such as inference and model routing “over and above” traditional OS core competencies.

“While competing offerings generally leave the infrastructure heavy lifting to enterprise decision-makers, Cloudflare is marketing itself as a single-source vendor, which potentially frees IT planners from having to integrate all the AI pieces on their own,” Levy said.

An infrastructure-first, application-agnostic approach means Cloudflare OS can coexist with whatever AI applications already exist in an enterprise, he said. It will “play nice” with OpenAI, Anthropic, Google, Microsoft, Meta, or open source layers, allowing employees to begin working in familiar workflows after sign-in.

“Its open-source architecture also minimizes the potential for vendor lock-in as enterprises gradually figure out how to evolve their stacks to align with new AI-era realities,” Levy said.

Managing identities and budgets for both humans and AI

As AI agents emerge across the enterprise, tracking their use can be challenging, causing problems from both a security and a spend standpoint. Along with Cloudflare OS, the company has launched a way to address this issue with its new Identity-Aware AI Gateway, now in beta.

Also integrated with Access, the offering gives admins visibility into what users (both human and AI) are requesting from AI models. It allows security teams to set up custom domains in front of their gateways and replace shared API keys by integrating with their identity provider, like Okta or Entra, and ZTNA infrastructure, Cloudflare explained.

Every request is tied to Access-verified identities, and enterprises can filter each user’s logs, analytics, and spend. IT teams can track redundancies, limit usage rates, and apply filters that strip out employee names, passwords, and other sensitive data before requests go to outside model providers.

A companion feature, AI Spend, tracks every user’s behavior over time to create a baseline of normal AI usage. When spending deviates from that pattern, the system alerts the IT team.

A new tab, User Insights, tracks cost and identifies over-spend caused by activities such as low cache-hit rates or oversized context windows. The capability scores sessions and compares them against account history using a 95th percentile session cost over the previous 30 days, Cloudflare product managers Ming Lu, Kenny Johnson, and Ayush Kumar explain in a blog post. Anything above 2x an account’s 95th percentile is a “strong candidate for anomalous behavior.”

For instance, one Cloudflare customer had an employee who left a rogue AI session running, generating a $30K bill. “User Insights helped them identify the problem and shut off access before the problem was further exacerbated,” Kozlov said.

Cloudflare is also building prompt classification functionality that sorts requests into categories such as coding or writing. This can help enterprises understand what AI is being used for.

“Once business traffic is separated from everything else, personal use becomes visible,” the project managers explained. “From the outside, someone running a side hustle on company time and someone quietly moving data out through a model look the same. Telling them apart is central to catching insider risk.”

Looking at the bigger picture

Identity-Aware AI Gateway and AI Spend address the visibility problem that has dogged so many recent AI deployments where enterprises failed to monitor usage, Levy noted. Projects “crashed and burned” as users unwittingly blew through token allocations.

These platforms provide single-point visibility into what is being used, how it’s being used, and where the potential lies for raising the productivity bar, he said. They overlay with existing models; in doing so, they enhance security with more precise control over resource allocations, and via automated anonymization protocols that prevent inadvertent sharing of sensitive data.

Ultimately, he said, vendors who free IT from having to independently assemble the pieces of their own AI implementations, and who assist them with answers to AI-specific questions, “will gain advantage over vendors that aren’t looking at the bigger picture.

Traditional operating systems (OS) were built to manage hardware, files, apps, and users on a device, but Cloudflare says the agentic AI era requires a whole new format.

The company this week announced Cloudflare OS, which connects AI agents, enterprise data and context, internal systems, and workflows together in one secure workspace. It is open source and browser-based, sparing companies the need to build all-new infrastructure.

The OS is launching alongside several other new security, identity, spending, and user insight tools that Cloudflare has built for the AI-based workplace.

“Cloudflare OS isn’t a traditional desktop OS,” said Rita Kozlov, VP of product at Cloudflare. “It reimagines the workplace computing environment for AI.”

Open source OS runs in a browser

Cloudflare OS serves as a secure, AI-equipped workspace that is plugged into internal company systems. Available now through Cloudflare’s open source repository, it is accessible directly in a browser, and runs inside an enterprise’s Cloudflare account.

“It is a browser-based workspace that begins with a conversation,” Kozlov explained. Users can ask an agent to research, create slides, spreadsheets, and documents, build full-stack apps, or automate workflows without the need for a terminal. Those outputs are then shareable, but kept in isolated databases with access controls.

Enterprises will soon be able to access the OS directly through Cloudflare or via a “select group” of partners that will build tailored offerings on Cloudflare’s architecture, the company says. Because it is open source, organizational processes, internal system connections, and context aren’t locked into a vendor product or AI model provider. Customers can use whatever models they choose.

Cloudflare OS is built on Cloudflare Workers, Dynamic Workers, Durable Objects, and Access, the company’s zero trust network access (ZTNA) tool that verifies every user and request. Agents start with zero permissions by default and are only granted access to tools required for a specific task. Organizations configure their own Access policies, models, branding, skills, and integrations, Kozlov explained.

Governed connectors known as gatekeepers give admins control over what AI can see, what it can change, and when the system needs human sign-off. They can also control budgets, set rate limits, and delegate tasks to different models.

“Because agents act on people’s behalf and produce work others can access and modify, they require a new security model,” Kozlov said. Thus, Cloudflare OS tracks the resources an agent requires so the right access controls follow its work when it is shared.

Cloudflare initially built the OS for internal use, and employees “across every team” use it daily. Kozlov estimated that, over the last 30 days, internal users have used it to create more than 4,000 apps, automations, and tools. Over that same period, she claimed, the company’s sales team saved an estimated 10,000 hours by automating previously manual tasks like territory planning and proposal creation.

“We open sourced Cloudflare OS so any organization can build ‘Your Company OS,’” Kozlov said. Open source is critical because “you cannot put your company into software you do not own. Organizations need to be able to inspect the platform, customize it, connect their own systems, and make it their own,” she explained.

A more cohesive bundle

Cloudflare deserves credit for packaging Cloudflare OS as an operating system, noted tech analyst Carmi Levy.

“This very much is not Windows, macOS, or Linux, and it isn’t an operating system by its common definition,” he said. “But Cloudflare’s use of this terminology implies familiarity to enterprise IT buyers.”

This makes for an easier discussion as enterprises struggle to understand how to best incorporate AI-related platforms and workflows into infrastructure that wasn’t initially designed for it.

Microsoft has marketed the combination of its Azure, Entra, Fabric, Windows, and Microsoft 365 offerings as an operating system of sorts, but hasn’t pulled all the pieces into a common brand, Levy said. And Google’s Gemini, Workspace, Vertex AI, and Cloud Run are “circling similar territory.”

But, he noted, Cloudflare OS is “more cohesively bundled” and infrastructure-focused, offering a single pane of glass platform for buyers worried about stitching together otherwise disparate AI-aware networking pieces. The company recognizes that AI introduces new architectural realities such as inference and model routing “over and above” traditional OS core competencies.

“While competing offerings generally leave the infrastructure heavy lifting to enterprise decision-makers, Cloudflare is marketing itself as a single-source vendor, which potentially frees IT planners from having to integrate all the AI pieces on their own,” Levy said.

An infrastructure-first, application-agnostic approach means Cloudflare OS can coexist with whatever AI applications already exist in an enterprise, he said. It will “play nice” with OpenAI, Anthropic, Google, Microsoft, Meta, or open source layers, allowing employees to begin working in familiar workflows after sign-in.

“Its open-source architecture also minimizes the potential for vendor lock-in as enterprises gradually figure out how to evolve their stacks to align with new AI-era realities,” Levy said.

Managing identities and budgets for both humans and AI

As AI agents emerge across the enterprise, tracking their use can be challenging, causing problems from both a security and a spend standpoint. Along with Cloudflare OS, the company has launched a way to address this issue with its new Identity-Aware AI Gateway, now in beta.

Also integrated with Access, the offering gives admins visibility into what users (both human and AI) are requesting from AI models. It allows security teams to set up custom domains in front of their gateways and replace shared API keys by integrating with their identity provider, like Okta or Entra, and ZTNA infrastructure, Cloudflare explained.

Every request is tied to Access-verified identities, and enterprises can filter each user’s logs, analytics, and spend. IT teams can track redundancies, limit usage rates, and apply filters that strip out employee names, passwords, and other sensitive data before requests go to outside model providers.

A companion feature, AI Spend, tracks every user’s behavior over time to create a baseline of normal AI usage. When spending deviates from that pattern, the system alerts the IT team.

A new tab, User Insights, tracks cost and identifies over-spend caused by activities such as low cache-hit rates or oversized context windows. The capability scores sessions and compares them against account history using a 95th percentile session cost over the previous 30 days, Cloudflare product managers Ming Lu, Kenny Johnson, and Ayush Kumar explain in a blog post. Anything above 2x an account’s 95th percentile is a “strong candidate for anomalous behavior.”

For instance, one Cloudflare customer had an employee who left a rogue AI session running, generating a $30K bill. “User Insights helped them identify the problem and shut off access before the problem was further exacerbated,” Kozlov said.

Cloudflare is also building prompt classification functionality that sorts requests into categories such as coding or writing. This can help enterprises understand what AI is being used for.

“Once business traffic is separated from everything else, personal use becomes visible,” the project managers explained. “From the outside, someone running a side hustle on company time and someone quietly moving data out through a model look the same. Telling them apart is central to catching insider risk.”

Looking at the bigger picture

Identity-Aware AI Gateway and AI Spend address the visibility problem that has dogged so many recent AI deployments where enterprises failed to monitor usage, Levy noted. Projects “crashed and burned” as users unwittingly blew through token allocations.

These platforms provide single-point visibility into what is being used, how it’s being used, and where the potential lies for raising the productivity bar, he said. They overlay with existing models; in doing so, they enhance security with more precise control over resource allocations, and via automated anonymization protocols that prevent inadvertent sharing of sensitive data.

Ultimately, he said, vendors who free IT from having to independently assemble the pieces of their own AI implementations, and who assist them with answers to AI-specific questions, “will gain advantage over vendors that aren’t looking at the bigger picture.

Given the widespread enterprise adoption of passkeys to replace passwords, a Palo Alto Networks Unit 42 report disclosing ways attackers are getting around passkey protections is concerning, analysts say, but they stress that the demonstrated attacks can only happen after a successful intrusion.

They also pointed out that the issues are not strictly caused by holes in passkeys so much as by weaknesses in the procedures surrounding them. 

“The researchers didn’t break the underlying cryptography. They exploited the seams around it: onboarding flows, recovery mechanisms and trust signals that weren’t being validated,” said Justin Greis, CEO of consulting firm Acceligence. “That distinction matters because it tells us where the actual risk lives.”

The Palo Alto report showed attacks that, it said, “demonstrate how malware on a compromised endpoint can misuse onboarding, recovery and device trust workflows to take over passkey-protected accounts,” as well as “how an attacker can authenticate without user interaction, bypass user verification requirements and extract all synced passkey private keys.”

Palo Alto described three categories of attack, collectively dubbed Pass-ta-key: Pass-ta-key, where an attacker takes over an account protected by a Google-synced passkey using malware running on the victim’s device, without requiring privilege escalation, device unlock or user interaction; Silver Pass-ta-key, which involves an attacker tricking Google Cloud Authenticator into believing the victim has unlocked the device with biometrics, leading to full account takeover without using the victim’s device during authentication; and Golden Pass-ta-key, which allows an attacker to extract all synced passkeys in a form that lets them be shared or sold on the credential black market.

Given the complexity of most global enterprise threat surfaces, some CISOs have struggled with adapting passwordless processes to environments with legacy and virtual environments. Passcodes have been recently embraced by enterprise CISOs as the first step in implementing a passwordless strategy.

Analysts and consultants in the main agreed that the flaw Palo Alto reports is significant, despite the fact that it assumes the attacker has already penetrated an environment and successfully installed malware. Sadly, given that such penetration only requires one privileged user anywhere to accidentally click on a poisoned link or attachment, the assumption of prior penetration is likely valid.

Implementation issues are the problem

What the report reveals is less about any flaws within passcodes directly, and more about the lack of attention paid to a wide range of mechanisms surrounding them. 

Greis said CISOs now need to focus on what to do, and what to test, based on the assumption that user behavior is not always as expected. 

In several cases cited in the report, he pointed out, issues occurred “not because the standard is flawed, but because implementations haven’t caught up to it. It mirrors what we’ve seen repeatedly in security: the specification is sound, but the ecosystem implementing it is uneven.”

Consultant Brian Levine, executive director of FormerGov, agreed. 

“On any service where your organization is the relying party, require user verification and actually validate the user-verified flag in the authentication response,” he said. “The researchers found real-world services accepting logins without it, which quietly collapses a multi-factor login back into a single factor.”

Frank Dickson, group VP for security at IDC, added that he would stress to CISOs that this attack assumes a prior successful penetration. 

“This isn’t passkeys getting hacked from across the internet. It’s what [an attacker] does once they’re already inside the house. So the real headline is that ‘phishing resistant’ stops being resistant the moment the endpoint stops being clean,” he said.

“Stop treating verification as optional,” he advised. “Flip it to required, check it server side every single time, and save your hardware bound keys, the YubiKeys of the world, for the accounts that matter most. A key that never leaves a physical device is a key no attacker can ever harvest in bulk.”

Or Finkelstein, head of marketing at Secret Double Octopus, agreed that CISOs have gotten complacent about the way in which systems support passkeys.

“CISOs should probably look at how user verification is enforced, how enrollment and recovery work, have a clear and enforced policy on whether credentials are synced or device-bound, and have some ITDR system to quickly mitigate suspicious endpoints and authenticators,” he said. “In most serious enterprise environments, EDR and device management reduce the likelihood of initial attacks, but do not close every post-compromise attack path.”

Poor support processes weaken passkeys

Some have argued that the lack of sufficiently robust support processes actually weakens passkey capabilities and undermines the whole point of such systems.

J. Wolfgang Goerlich, a member of the faculty of IANS and a longtime cybersecurity consultant, pointed out that the original FIDO2 spec eliminated credential theft by binding the private key to a physical authenticator. Synced passkeys reintroduced credential portability and therefore reintroduced the form of credential theft risk cited in the Palo Alto report.

“A passwordless system is exactly as strong as the flow that re-establishes it,” he said. “Both serious techniques here start by forcing a device to re-enroll. Many security teams have never modeled, never monitored and never rehearsed a response to this.”

Goerlich’s advice to CISOs is to require device-bound authenticators, such as hardware tokens or computers, for all privileged and sensitive access. They may consider allowing wallets for lower risk access, he said, “however, much like passwords in Web browsers have long been at risk, we must now consider passkeys in the browsers an unacceptable risk.”

This article originally appeared on CSOonline.

Most security teams don’t suffer from a lack of data. They suffer from a lack of certainty.

Vulnerability scanners, annual penetration tests, and compliance assessments can generate thousands of findings. Yet they often fail to answer a simple question: Which risks actually matter?

For a global investment firm operating across 18 locations, that question became increasingly important. A small security engineering team was responsible for securing a growing environment while balancing infrastructure projects, identity management, user support, and the countless responsibilities that come with protecting a modern enterprise.

The team wasn’t struggling to generate findings. They were struggling to understand which findings represented real risk, whether remediation efforts were working, and how to ensure leadership would never be surprised by an exposure that should have been discovered earlier.

That journey led them from point-in-time testing to continuous validation.

Outcomes at a glance

• Reduced impacts from 251 to 0 in a same-scope internal penetration test (pentest)
• Reduced compromised credentials from 52 to 0
• Reduced compromised hosts from 67 to 0
• Reduced cracked Active Directory passwords from 40 to 0
• Expanded continuous validation across 18 locations using a phased rollout strategy
• Enabled a lean security team to continuously validate risk without significant operational overhead

Impact

The team wasn’t expecting perfection. Every environment contains weaknesses, and no experienced security practitioner assumes an internal pentest will come back clean.

What surprised them was how effectively those weaknesses could be chained together once an attacker gained a foothold.

One of the firm’s early internal pentests identified 85 weaknesses. By itself, the number wouldn’t have stood out to most security teams. The real concern wasn’t the weaknesses themselves. It was what those weaknesses enabled.

NodeZero^® showed that those weaknesses could produce 251 impacts, including domain compromise, sensitive data exposure, ransomware exposure, host compromise, domain user compromise, and compromised credentials. 

That distinction matters because attackers don’t exploit weaknesses in isolation. They chain weaknesses, misconfigurations, and credentials together to achieve an objective. A low-priority finding on its own may appear manageable, but when combined with other weaknesses, it can become part of a pathway to something much more serious.

Figure 1. An early internal pentest identified 85 weaknesses that led to 251 impacts, including domain compromise, ransomware exposure, sensitive data exposure, and host compromise.

As the organization’s senior security engineer explained: “That impact section in NodeZero is just pure evidence of what can happen in a real life scenario.”

The shift from theoretical risk to demonstrated impact changed how the team approached remediation, shifting the conversation from identifying weaknesses to understanding their potential business impact.

Background

Like many organizations, this organization was already investing in security testing. The challenge wasn’t finding another tool. It was finding an approach that could scale across the business without creating additional work for a small security team already balancing infrastructure projects, identity management, user support, and countless other responsibilities.

As the senior security engineer described: “NodeZero is, let’s say, 5% of my work. I’m dealing with a million different things, a million different projects, a million different responsibilities.”

That reality made operational simplicity more than a convenience. It became a requirement.

The team had experience with security testing platforms that required significant infrastructure and ongoing maintenance to keep running effectively. For a small team juggling competing priorities, that overhead mattered. NodeZero offered a different model. The platform was simple to deploy, easy to operate, and allowed the team to begin testing immediately without dedicating resources to managing complex hardware infrastructure.

That ease of deployment became particularly important because the team wasn’t interested in running a proof of concept. They wanted to build a sustainable program that could scale with the business.

Click here to continue reading about the obstacles the organization faced and how they mitigated them.

The need to validate outcomes

The objective was never to eliminate every weakness. It was to eliminate uncertainty around the risks that mattered most.

That’s the difference between measuring activity and validating outcomes.

Learn more about Horizon3.ai and NodeZero.

Given the widespread enterprise adoption of passkeys to replace passwords, a Palo Alto Networks Unit 42 report disclosing ways attackers are getting around passkey protections is concerning, analysts say, but they stress that the demonstrated attacks can only happen after a successful intrusion.

They also pointed out that the issues are not strictly caused by holes in passkeys so much as by weaknesses in the procedures surrounding them. 

“The researchers didn’t break the underlying cryptography. They exploited the seams around it: onboarding flows, recovery mechanisms and trust signals that weren’t being validated,” said Justin Greis, CEO of consulting firm Acceligence. “That distinction matters because it tells us where the actual risk lives.”

The Palo Alto report showed attacks that, it said, “demonstrate how malware on a compromised endpoint can misuse onboarding, recovery and device trust workflows to take over passkey-protected accounts,” as well as “how an attacker can authenticate without user interaction, bypass user verification requirements and extract all synced passkey private keys.”

Palo Alto described three categories of attack, collectively dubbed Pass-ta-key: Pass-ta-key, where an attacker takes over an account protected by a Google-synced passkey using malware running on the victim’s device, without requiring privilege escalation, device unlock or user interaction; Silver Pass-ta-key, which involves an attacker tricking Google Cloud Authenticator into believing the victim has unlocked the device with biometrics, leading to full account takeover without using the victim’s device during authentication; and Golden Pass-ta-key, which allows an attacker to extract all synced passkeys in a form that lets them be shared or sold on the credential black market.

Given the complexity of most global enterprise threat surfaces, some CISOs have struggled with adapting passwordless processes to environments with legacy and virtual environments. Passcodes have been recently embraced by enterprise CISOs as the first step in implementing a passwordless strategy.

Analysts and consultants in the main agreed that the flaw Palo Alto reports is significant, despite the fact that it assumes the attacker has already penetrated an environment and successfully installed malware. Sadly, given that such penetration only requires one privileged user anywhere to accidentally click on a poisoned link or attachment, the assumption of prior penetration is likely valid.

Implementation issues are the problem

What the report reveals is less about any flaws within passcodes directly, and more about the lack of attention paid to a wide range of mechanisms surrounding them. 

Greis said CISOs now need to focus on what to do, and what to test, based on the assumption that user behavior is not always as expected. 

In several cases cited in the report, he pointed out, issues occurred “not because the standard is flawed, but because implementations haven’t caught up to it. It mirrors what we’ve seen repeatedly in security: the specification is sound, but the ecosystem implementing it is uneven.”

Consultant Brian Levine, executive director of FormerGov, agreed. 

“On any service where your organization is the relying party, require user verification and actually validate the user-verified flag in the authentication response,” he said. “The researchers found real-world services accepting logins without it, which quietly collapses a multi-factor login back into a single factor.”

Frank Dickson, group VP for security at IDC, added that he would stress to CISOs that this attack assumes a prior successful penetration. 

“This isn’t passkeys getting hacked from across the internet. It’s what [an attacker] does once they’re already inside the house. So the real headline is that ‘phishing resistant’ stops being resistant the moment the endpoint stops being clean,” he said.

“Stop treating verification as optional,” he advised. “Flip it to required, check it server side every single time, and save your hardware bound keys, the YubiKeys of the world, for the accounts that matter most. A key that never leaves a physical device is a key no attacker can ever harvest in bulk.”

Or Finkelstein, head of marketing at Secret Double Octopus, agreed that CISOs have gotten complacent about the way in which systems support passkeys.

“CISOs should probably look at how user verification is enforced, how enrollment and recovery work, have a clear and enforced policy on whether credentials are synced or device-bound, and have some ITDR system to quickly mitigate suspicious endpoints and authenticators,” he said. “In most serious enterprise environments, EDR and device management reduce the likelihood of initial attacks, but do not close every post-compromise attack path.”

Poor support processes weaken passkeys

Some have argued that the lack of sufficiently robust support processes actually weakens passkey capabilities and undermines the whole point of such systems.

J. Wolfgang Goerlich, a member of the faculty of IANS and a longtime cybersecurity consultant, pointed out that the original FIDO2 spec eliminated credential theft by binding the private key to a physical authenticator. Synced passkeys reintroduced credential portability and therefore reintroduced the form of credential theft risk cited in the Palo Alto report.

“A passwordless system is exactly as strong as the flow that re-establishes it,” he said. “Both serious techniques here start by forcing a device to re-enroll. Many security teams have never modeled, never monitored and never rehearsed a response to this.”

Goerlich’s advice to CISOs is to require device-bound authenticators, such as hardware tokens or computers, for all privileged and sensitive access. They may consider allowing wallets for lower risk access, he said, “however, much like passwords in Web browsers have long been at risk, we must now consider passkeys in the browsers an unacceptable risk.”

Given the widespread enterprise adoption of passkeys to replace passwords, a Palo Alto Networks Unit 42 report disclosing ways attackers are getting around passkey protections is concerning, analysts say, but they stress that the demonstrated attacks can only happen after a successful intrusion.

They also pointed out that the issues are not strictly caused by holes in passkeys so much as by weaknesses in the procedures surrounding them. 

“The researchers didn’t break the underlying cryptography. They exploited the seams around it: onboarding flows, recovery mechanisms and trust signals that weren’t being validated,” said Justin Greis, CEO of consulting firm Acceligence. “That distinction matters because it tells us where the actual risk lives.”

The Palo Alto report showed attacks that, it said, “demonstrate how malware on a compromised endpoint can misuse onboarding, recovery and device trust workflows to take over passkey-protected accounts,” as well as “how an attacker can authenticate without user interaction, bypass user verification requirements and extract all synced passkey private keys.”

Palo Alto described three categories of attack, collectively dubbed Pass-ta-key: Pass-ta-key, where an attacker takes over an account protected by a Google-synced passkey using malware running on the victim’s device, without requiring privilege escalation, device unlock or user interaction; Silver Pass-ta-key, which involves an attacker tricking Google Cloud Authenticator into believing the victim has unlocked the device with biometrics, leading to full account takeover without using the victim’s device during authentication; and Golden Pass-ta-key, which allows an attacker to extract all synced passkeys in a form that lets them be shared or sold on the credential black market.

Given the complexity of most global enterprise threat surfaces, some CISOs have struggled with adapting passwordless processes to environments with legacy and virtual environments. Passcodes have been recently embraced by enterprise CISOs as the first step in implementing a passwordless strategy.

Analysts and consultants in the main agreed that the flaw Palo Alto reports is significant, despite the fact that it assumes the attacker has already penetrated an environment and successfully installed malware. Sadly, given that such penetration only requires one privileged user anywhere to accidentally click on a poisoned link or attachment, the assumption of prior penetration is likely valid.

Implementation issues are the problem

What the report reveals is less about any flaws within passcodes directly, and more about the lack of attention paid to a wide range of mechanisms surrounding them. 

Greis said CISOs now need to focus on what to do, and what to test, based on the assumption that user behavior is not always as expected. 

In several cases cited in the report, he pointed out, issues occurred “not because the standard is flawed, but because implementations haven’t caught up to it. It mirrors what we’ve seen repeatedly in security: the specification is sound, but the ecosystem implementing it is uneven.”

Consultant Brian Levine, executive director of FormerGov, agreed. 

“On any service where your organization is the relying party, require user verification and actually validate the user-verified flag in the authentication response,” he said. “The researchers found real-world services accepting logins without it, which quietly collapses a multi-factor login back into a single factor.”

Frank Dickson, group VP for security at IDC, added that he would stress to CISOs that this attack assumes a prior successful penetration. 

“This isn’t passkeys getting hacked from across the internet. It’s what [an attacker] does once they’re already inside the house. So the real headline is that ‘phishing resistant’ stops being resistant the moment the endpoint stops being clean,” he said.

“Stop treating verification as optional,” he advised. “Flip it to required, check it server side every single time, and save your hardware bound keys, the YubiKeys of the world, for the accounts that matter most. A key that never leaves a physical device is a key no attacker can ever harvest in bulk.”

Or Finkelstein, head of marketing at Secret Double Octopus, agreed that CISOs have gotten complacent about the way in which systems support passkeys.

“CISOs should probably look at how user verification is enforced, how enrollment and recovery work, have a clear and enforced policy on whether credentials are synced or device-bound, and have some ITDR system to quickly mitigate suspicious endpoints and authenticators,” he said. “In most serious enterprise environments, EDR and device management reduce the likelihood of initial attacks, but do not close every post-compromise attack path.”

Poor support processes weaken passkeys

Some have argued that the lack of sufficiently robust support processes actually weakens passkey capabilities and undermines the whole point of such systems.

J. Wolfgang Goerlich, a member of the faculty of IANS and a longtime cybersecurity consultant, pointed out that the original FIDO2 spec eliminated credential theft by binding the private key to a physical authenticator. Synced passkeys reintroduced credential portability and therefore reintroduced the form of credential theft risk cited in the Palo Alto report.

“A passwordless system is exactly as strong as the flow that re-establishes it,” he said. “Both serious techniques here start by forcing a device to re-enroll. Many security teams have never modeled, never monitored and never rehearsed a response to this.”

Goerlich’s advice to CISOs is to require device-bound authenticators, such as hardware tokens or computers, for all privileged and sensitive access. They may consider allowing wallets for lower risk access, he said, “however, much like passwords in Web browsers have long been at risk, we must now consider passkeys in the browsers an unacceptable risk.”

This article originally appeared on CSOonline.

The updated Cybersecurity Maturity Model Certification (CMMC) represents a critical evolution in the Department of War (DoW) strategy to secure the Defense Industrial Base (DIB). It is more than a regulatory hurdle. It is a direct response to a rapidly changing and increasingly hostile threat landscape faced by the DIB.

Updated CMMC guidance issued in 2025 simplifies the prior framework, focusing on the most essential security practices aligned with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. Its fundamental purpose remains unchanged: to protect sensitive, unclassified defense information — specifically Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) — from foreign adversaries.

The updated CMMC phases. Image from https://dodcio.defense.gov/cmmc/About/ 

CMMC implementation phases

The CMMC requirements are being implemented in phases to ease the burden on both organizations and auditors.

• Phase 1 (Nov 10, 2025 – Nov 9, 2026): Focus on self-assessments for Levels 1 and 2
• Beginning Nov 10, 2026: Solicitations will require Level 2 certifications

For thousands of companies across the DIB— from prime contractors to small, specialized machine shops — compliance is not optional. It is the prerequisite for doing business with the DoW. It establishes a standardized, measured approach to cybersecurity across the supply chain.

A shift in adversary strategy

The strategic focus of adversaries has shifted. Rather than launching costly, direct attacks against well-defended prime contractors, they increasingly target the weakest link in the supply chain.

Suppliers and subcontractors often:

• Possess valuable intellectual property, schematics, and operational details
• Operate without the same security resources as larger defense firms

These operational activities create a pathway into the broader ecosystem. A breach at any tier can reverberate across the supply chain, exposing sensitive information and impacting mission outcomes.

The limitations of point-in-time security

The traditional model of cybersecurity compliance has relied on periodic, point-in-time assessments. This approach is fundamentally limited in the context of a dynamic and interconnected supply chain.

Security is not static. A posture that was compliant weeks ago can become vulnerable due to:

• New exploits or zero-day vulnerabilities
• System configuration changes
• Introduction of new technologies or shadow IT

The core issue is straightforward: You are only as secure as your last evaluation. In an environment that is constantly evolving, this model leaves a persistent gap between compliance and actual risk.

Enabling continuous validation

Horizon3.ai’s NodeZero Federal™ enables a more continuous approach to security validation. Unlike traditional penetration testing or vulnerability scanning, NodeZero identifies and validates exploitable weaknesses and demonstrates how they can be chained together.

This provides organizations with the ability to:

• Validate controls regularly: Demonstrate effectiveness on an ongoing basis, not just during audits
• Close the compliance gap: Move beyond documentation to show how controls mitigate real-world risk
• Identify attack paths: Understand how an adversary could move through the environment

This approach supports a more realistic understanding of security posture and risk.

Expanding the scope: From enterprise to ecosystem

Elevating supply chain security for FCI and CUI represents a broader shift in how the DoW approaches risk. The focus is no longer limited to securing individual networks. It extends across the entire DIB ecosystem.

The objective is not only compliance, but:

• Measurable risk reduction
• Greater resilience across interconnected environments
• Assurance of mission continuity

Implications for prime contractors

CMMC reinforces a long-standing reality: The security posture of a prime contractor is directly influenced by the posture of its suppliers.

This introduces cascading risks across the supply chain, particularly where subcontractors process, store, or transmit CUI.

Key implications include:

• Jeopardized prime contractor posture: A security incident at a supplier can impact the prime’s certification.
• Contract ineligibility and business impact: Non-compliance may lead to disqualification from DoW contracts.
• Mission assurance risk: Compromised CUI can affect operational integrity and outcomes

Common sources of compromise

Compromise often originates in predictable areas of the supply chain.

Third-party providers. Managed service providers (MSPs) and vendors supporting multiple organizations can introduce systemic risk. A single compromise can expose multiple environments.

Specialized suppliers. Small and medium-sized organizations may handle sensitive data but lack enterprise-grade security controls.

Interconnected access points. Common weaknesses include:

• Shared credentials
• Weak or misconfigured VPN access
• Federated identity systems without proper segmentation

Example: Assume-breach scenario

In a recent assume-breach test, NodeZero began with access to a single host without credentials. From that starting point, it enumerated domain users and executed a password spray, successfully obtaining a valid domain credential.

That account had local administrator privileges, enabling further actions:

• Deployment of a remote access tool (RAT)
• LSASS access and credential harvesting

This scenario highlights a common issue: controls that are assumed to be in place may not perform as expected in practice.

Why the legacy model does not scale

The legacy model of periodic assessments does not account for the dynamic nature of modern environments.

Risk is introduced through:

• Supply chain changes and new vendors
• Ongoing system reconfigurations
• Expansion of SaaS, APIs, and cloud services
• Gradual degradation of controls over time

As a result, a point-in-time certification can quickly become outdated.

Continuous readiness under CMMC

The updated CMMC guidance emphasizes continuous readiness rather than periodic validation. Self-assessments are expected to be supported by documented, day-to-day evidence of control effectiveness.

This reflects the need to maintain security posture over time, not just demonstrate it at a single point.

Continuous validation as a practical requirement

Moving to continuous validation helps organizations keep pace with:

• Changing threat activity
• Evolving supplier ecosystems
• The need to maintain confidence in control effectiveness

Without this, organizations rely on outdated assumptions about their environment and exposure.

Closing the gap between compliance and security

HORIZON3.ai’s NodeZero® Proactive Security Platform helps bridge the gap between compliance and operational security. By validating controls through real-world attack scenarios, it provides evidence of effectiveness and identifies gaps across both internal environments and critical suppliers.

This enables organizations to treat CMMC not just as a compliance requirement, but as part of an ongoing risk management program.

Final thought

True security posture is not defined by a completed assessment.

It is defined by how systems perform under real conditions, and how quickly organizations can identify and address weaknesses as they emerge. 

Learn more about how Horizon3.ai strengthens supply chain security for CMMC.
Please refer to the full white paper.

Most organizations assume remediation reduces risk.

It’s a reasonable assumption. A vulnerability is identified, a patch is applied, the scanner comes back clean, and the ticket is closed. The workflow is complete, the metrics improve, and the issue is considered resolved.

The problem is that attackers don’t care about remediation workflows. They care about outcomes.

A scanner may no longer report the vulnerability, but those activities do not matter if an attacker can still achieve the same objective through the same attack path, excessive privileges, or a different weakness that was never addressed in the first place.

Many security programs measure whether work was completed, but they don’t always measure whether risk was actually reduced.

The assumption that gets teams in trouble

The cybersecurity industry has become very good at measuring mean time to remediate, patch compliance, SLA attainment, and ticket closure rates. Those metrics have value, but none of them answer the question an attacker is asking.

Can I still get in?

In practice, that’s where the assumption breaks down. Remediation activity and risk reduction are often treated as the same thing, even though they measure very different outcomes. One measures whether work was performed. The other measures whether the conditions that made an attack possible still exist.

Our recent survey of 750 security leaders and practitioners revealed a consistent pattern. Only 30% of CISOs reported that their organizations patch and then test to ensure risk has actually been remediated. Nearly half patch and rescan with a vulnerability scanner instead.

Security teams are working hard, remediating vulnerabilities, deploying controls, and closing tickets every day. The issue is verification. A patch may remove a vulnerability and a rescan may confirm the patch was applied, but neither proves an attacker can no longer succeed.

Security teams don’t get credit for completing work, they get credit for reducing risk. And the only way to know whether risk was actually reduced is to verify it.

Verification changes the conversation

Most security teams don’t struggle to find vulnerabilities. They struggle to verify that their remediation efforts actually worked.

That was the challenge facing a global investment firm operating across 18 locations. They already had vulnerability data, security assessments, and remediation workflows. What they lacked was certainty. They wanted to understand which weaknesses represented real risk, whether their fixes were reducing exposure, and how to avoid being surprised by an issue that should have been discovered earlier.

An early internal penetration test (pentest) revealed 85 weaknesses. By itself, that number wasn’t particularly alarming. The real risk emerged when those flaws enabled 251 impacts, including domain compromise, compromised credentials, host compromise, ransomware exposure, and sensitive data exposure. The weaknesses themselves were only part of the story. The real risk emerged when those weaknesses were chained together the way an attacker would chain them together.

While many organizations would stop there, this team retested. That decision changed the conversation from remediation activity to measurable risk reduction. A follow-up, same-scope pentest showed that impacts had dropped from 251 to zero. Compromised credentials fell from 52 to zero. Compromised hosts fell from 67 to zero. Cracked Active Directory passwords dropped from 40 to zero.

That’s what verification looks like.

Not a closed ticket, but concrete evidence that the outcomes an attacker cared about are no longer achievable.

Why verification remains elusive

In our survey, 22% of practitioners identified verification of fixes as their biggest cybersecurity challenge going into 2026, while another 21% pointed to demonstrating measurable risk reduction. Both ranked ahead of budget constraints and talent shortages.

That gap persists because confirmation is harder than remediation. Applying a patch is a discrete action. Proving that an attacker can no longer achieve the same objective is harder. It requires testing and verifying that the attack path is gone, not simply assuming it disappeared because a vulnerability no longer appears in a scan report.

That’s where many organizations fall back on proxies. A vulnerability scanner reports that: the affected version is gone; a ticket is closed; a dashboard shows improving metrics. Those signals are useful, but they are still indicators of activity. They are not proof that exposure was reduced.

That gap matters because attackers measure success by achieving objectives, not by confirming that a version number changed. Defenders need the same standard.

That’s the difference between remediation and verification.

What mature security programs do differently

The organizations that make the greatest progress aren’t necessarily the ones that find the most vulnerabilities. They’re the ones that become disciplined about proving whether their actions reduced risk.

That shift changes the conversation. Instead of asking: “Did we patch it?” they ask: “Can an attacker still achieve the same objective?”

Instead of measuring success by ticket closure, they measure success by whether the outcomes attackers care about are still possible.

You can see that mindset across many of our Pentest Wednesday™ stories. Financial services organizations built continuous verification into their operations because leadership needed confidence that remediation remained effective over time. Manufacturers and defense industrial base organizations used repeat testing to ensure attack paths stayed closed as environments evolved.

The common thread isn’t the industry or the technology, it’s the discipline to keep going after the fix:

• Validate the exposure.
• Fix the exposure.
• Verify the exposure is gone.
• Repeat.

Mature organizations build continuous verification into their operations because leadership needs to trust that remediation remains effective as the network evolves.

The future belongs to verification

The cybersecurity industry is entering another period of rapid change. AI is accelerating prioritization, remediation, reporting, and analysis. Security teams will find vulnerabilities faster, process findings faster, and automate more workflows than ever before.

Validating exposure and fixing it are essential, but neither closes the loop. Verification closes the loop. Confidence alone will not stop an attacker, but repeatable verification will.

Get a demo

For years, cooling has played a supporting role in data center design. Decisions have been driven primarily by compute, storage and networking requirements, while cooling systems quietly ensured everything stayed within safe operating limits. Most enterprise environments operated well within the capabilities of traditional air-cooling that was designed to sustain normal growth. This let organizations focus their attention on capacity, performance and cost of the compute.

That balance is now being disrupted.

Artificial intelligence is reshaping the thermal profile of modern data centers. As organizations roll out more powerful CPUs, GPUs and TPU’s to support AI workloads, heat generation is rising at a pace that many facilities were never built to handle. With AI in the picture, cooling is no longer simply an operational consideration. It is becoming a primary constraint and strategic differentiator on AI infrastructure growth.

The limits of air cooling are becoming clear

Although traditional air cooling continues to support many enterprise workloads effectively, its limitations are becoming increasingly evident as organizations deploy larger AI clusters with increasingly power-hungry CPUs and GPUs, generating heat at levels older data centers were never designed to accommodate.

Racks that once operated at 5–10kW are being replaced by AI systems drawing 60kW or more, with some high-end deployments exceeding 100kW per rack. At the component level, individual GPUs are drawing 700W–1,200W each, placing large amounts of heat into a very small space. This shift represents a step-change in thermal density that conventional air-cooling systems, typically effective only up to around 20–30kW per rack, struggle to handle efficiently.

At these levels, the challenge becomes structural. Air can only do so much. There’s a hard limit to how efficiently it can move heat, and simply increasing airflow or optimising ventilation isn’t enough to keep pace with the rate at which heat is being generated.

The consequence is a growing imbalance between compute capability and cooling capacity. Data centers are being forced to use more energy for cooling, while simultaneously managing higher thermal risk and operational complexity. In some cases, this also introduces performance constraints, as systems throttle workloads to remain within safe operating temperatures.

Because of this, more organizations are turning to liquid cooling — particularly direct-to-chip approaches.

How direct-to-chip cooling is addressing rising heat challenges

The main limitation of air cooling is its relative inefficiency at removing concentrated heat. Direct-to-chip cooling addresses this. Instead of relying on chilled air moving around the room, direct-to-chip systems put cooling exactly where it’s needed, by placing cold plates directly onto high-heat components such as CPUs and GPUs. Coolant flows through these plates, absorbing heat at the source before carrying it away for dissipation via a heat exchange system.

A direct-to-chip cooling system is made of several parts working together. Cold plates absorb heat straight from the chips, while a coolant distribution unit (CDU) manages the temperature, pressure and flow of the liquid. The coolant moves through pipes connected to each rack, carrying heat away from the servers and into the facility’s wider cooling system while sensors monitor temperatures, flow rates and leak detection.

Liquids transfer heat far more efficiently than air, so direct-to-chip cooling allows significantly greater thermal loads to be managed with lower energy overheads. Because heat is removed more directly and effectively at the source, data centers require less power for fans, airflow and chiller operation, reducing overall energy consumption.

In most cases, only the components that generate the most heat are liquid-cooled. The rest of the system continues to rely on familiar air-cooling approaches. That mix is a big part of the appeal. A hybrid cooling approach allows organizations to improve cooling performance where it matters most, without having to redesign their entire environment.

Direct-to-chip isn’t one-size-fits-all

While direct-to-chip is talked about as a single approach, there are actually a few different ways to implement it. Most organizations use single-phase liquid cooling, where the coolant stays in liquid form throughout the process. It’s simple, easy to manage and fits well with existing operational models, which makes it a natural starting point.

But there is also a growing shift towards warm-water cooling. Because water is so effective at absorbing heat, systems don’t need to run at the same low temperatures as traditional air-cooled environments. This can reduce the need for energy-intensive chilling and improve overall efficiency.

In some setups, direct-to-chip cooling is paired with rear-door heat exchangers. These capture any remaining heat as air leaves the rack, helping to push densities even higher without overloading the system.

Ultimately, there isn’t a single “correct” way to approach cooling. The best method depends on the workloads being supported, the constraints of the facility and the organization’s longer-term plans. What’s clear, however, is that flexibility is becoming increasingly important as cooling requirements continue to evolve.

Direct-to-chip vs immersion cooling

As liquid cooling gains traction, direct-to-chip is often compared with immersion cooling. While both approaches address the same fundamental problem — removing significantly higher levels of heat – they do so in very different ways, with different implications for how data centers are designed and operated.

Immersion cooling takes a more radical route by fully submerging servers in dielectric fluid — a liquid that does not conduct electricity or conducts it extremely poorly. From a cooling perspective, it is highly effective and can handle extremely dense, high compute environments. But it comes with trade-offs.

Immersion cooling requires a rethink of how data centers operate. It also demands significant infrastructure shifts, which can make adoption challenging for organizations with established data center models.

Direct-to-chip cooling, on the other hand, offers a more gradual step forward. In general, servers keep their familiar design, and day-to-day maintenance doesn’t change dramatically. Teams can continue working in ways they already understand, making it a more practical step for many organizations.

This practicality makes all the difference. For most organizations, the decision isn’t just about which solution performs best in theory, it’s about what can be deployed, managed and scaled within the realities of existing operations. In that sense, direct-to-chip strikes a balance between performance gains and operational continuity, making it a more accessible starting point for many data centers navigating the shift to higher-density workloads.

Cooling as a competitive advantage

Cooling is no longer simply an operational concern. It is becoming a defining factor in how data centers scale, how efficiently they run and how reliably they perform. As AI workloads push infrastructure to new limits, the ability to manage heat effectively will directly influence how far and how fast organizations can grow.

That shift is also changing who owns the conversation. Decisions that once sat with facilities teams are now firmly on the agenda for CIOs, CTOs and infrastructure leaders. Thermal design, energy efficiency and cooling architecture are no longer niche considerations, they are central to cost control, sustainability targets and overall competitiveness.

At the same time, there is no one correct solution. Air cooling will continue to support many workloads, while immersion cooling will remain relevant for specialised, high-density use cases. Direct-to-chip cooling sits between the two, offering a practical way to handle increasing thermal demands without disrupting established operating models.

For organizations planning the next phase of their infrastructure, cooling can no longer be treated as an afterthought. It needs to be considered alongside compute, storage and networking from the outset.

For years, cooling has played a supporting role in data center design. Decisions have been driven primarily by compute, storage and networking requirements, while cooling systems quietly ensured everything stayed within safe operating limits. Most enterprise environments operated well within the capabilities of traditional air-cooling that was designed to sustain normal growth. This let organizations focus their attention on capacity, performance and cost of the compute.

That balance is now being disrupted.

Artificial intelligence is reshaping the thermal profile of modern data centers. As organizations roll out more powerful CPUs, GPUs and TPU’s to support AI workloads, heat generation is rising at a pace that many facilities were never built to handle. With AI in the picture, cooling is no longer simply an operational consideration. It is becoming a primary constraint and strategic differentiator on AI infrastructure growth.

The limits of air cooling are becoming clear

Although traditional air cooling continues to support many enterprise workloads effectively, its limitations are becoming increasingly evident as organizations deploy larger AI clusters with increasingly power-hungry CPUs and GPUs, generating heat at levels older data centers were never designed to accommodate.

Racks that once operated at 5–10kW are being replaced by AI systems drawing 60kW or more, with some high-end deployments exceeding 100kW per rack. At the component level, individual GPUs are drawing 700W–1,200W each, placing large amounts of heat into a very small space. This shift represents a step-change in thermal density that conventional air-cooling systems, typically effective only up to around 20–30kW per rack, struggle to handle efficiently.

At these levels, the challenge becomes structural. Air can only do so much. There’s a hard limit to how efficiently it can move heat, and simply increasing airflow or optimising ventilation isn’t enough to keep pace with the rate at which heat is being generated.

The consequence is a growing imbalance between compute capability and cooling capacity. Data centers are being forced to use more energy for cooling, while simultaneously managing higher thermal risk and operational complexity. In some cases, this also introduces performance constraints, as systems throttle workloads to remain within safe operating temperatures.

Because of this, more organizations are turning to liquid cooling — particularly direct-to-chip approaches.

How direct-to-chip cooling is addressing rising heat challenges

The main limitation of air cooling is its relative inefficiency at removing concentrated heat. Direct-to-chip cooling addresses this. Instead of relying on chilled air moving around the room, direct-to-chip systems put cooling exactly where it’s needed, by placing cold plates directly onto high-heat components such as CPUs and GPUs. Coolant flows through these plates, absorbing heat at the source before carrying it away for dissipation via a heat exchange system.

A direct-to-chip cooling system is made of several parts working together. Cold plates absorb heat straight from the chips, while a coolant distribution unit (CDU) manages the temperature, pressure and flow of the liquid. The coolant moves through pipes connected to each rack, carrying heat away from the servers and into the facility’s wider cooling system while sensors monitor temperatures, flow rates and leak detection.

Liquids transfer heat far more efficiently than air, so direct-to-chip cooling allows significantly greater thermal loads to be managed with lower energy overheads. Because heat is removed more directly and effectively at the source, data centers require less power for fans, airflow and chiller operation, reducing overall energy consumption.

In most cases, only the components that generate the most heat are liquid-cooled. The rest of the system continues to rely on familiar air-cooling approaches. That mix is a big part of the appeal. A hybrid cooling approach allows organizations to improve cooling performance where it matters most, without having to redesign their entire environment.

Direct-to-chip isn’t one-size-fits-all

While direct-to-chip is talked about as a single approach, there are actually a few different ways to implement it. Most organizations use single-phase liquid cooling, where the coolant stays in liquid form throughout the process. It’s simple, easy to manage and fits well with existing operational models, which makes it a natural starting point.

But there is also a growing shift towards warm-water cooling. Because water is so effective at absorbing heat, systems don’t need to run at the same low temperatures as traditional air-cooled environments. This can reduce the need for energy-intensive chilling and improve overall efficiency.

In some setups, direct-to-chip cooling is paired with rear-door heat exchangers. These capture any remaining heat as air leaves the rack, helping to push densities even higher without overloading the system.

Ultimately, there isn’t a single “correct” way to approach cooling. The best method depends on the workloads being supported, the constraints of the facility and the organization’s longer-term plans. What’s clear, however, is that flexibility is becoming increasingly important as cooling requirements continue to evolve.

Direct-to-chip vs immersion cooling

As liquid cooling gains traction, direct-to-chip is often compared with immersion cooling. While both approaches address the same fundamental problem — removing significantly higher levels of heat – they do so in very different ways, with different implications for how data centers are designed and operated.

Immersion cooling takes a more radical route by fully submerging servers in dielectric fluid — a liquid that does not conduct electricity or conducts it extremely poorly. From a cooling perspective, it is highly effective and can handle extremely dense, high compute environments. But it comes with trade-offs.

Immersion cooling requires a rethink of how data centers operate. It also demands significant infrastructure shifts, which can make adoption challenging for organizations with established data center models.

Direct-to-chip cooling, on the other hand, offers a more gradual step forward. In general, servers keep their familiar design, and day-to-day maintenance doesn’t change dramatically. Teams can continue working in ways they already understand, making it a more practical step for many organizations.

This practicality makes all the difference. For most organizations, the decision isn’t just about which solution performs best in theory, it’s about what can be deployed, managed and scaled within the realities of existing operations. In that sense, direct-to-chip strikes a balance between performance gains and operational continuity, making it a more accessible starting point for many data centers navigating the shift to higher-density workloads.

Cooling as a competitive advantage

Cooling is no longer simply an operational concern. It is becoming a defining factor in how data centers scale, how efficiently they run and how reliably they perform. As AI workloads push infrastructure to new limits, the ability to manage heat effectively will directly influence how far and how fast organizations can grow.

That shift is also changing who owns the conversation. Decisions that once sat with facilities teams are now firmly on the agenda for CIOs, CTOs and infrastructure leaders. Thermal design, energy efficiency and cooling architecture are no longer niche considerations, they are central to cost control, sustainability targets and overall competitiveness.

At the same time, there is no one correct solution. Air cooling will continue to support many workloads, while immersion cooling will remain relevant for specialised, high-density use cases. Direct-to-chip cooling sits between the two, offering a practical way to handle increasing thermal demands without disrupting established operating models.

For organizations planning the next phase of their infrastructure, cooling can no longer be treated as an afterthought. It needs to be considered alongside compute, storage and networking from the outset.

Open the history tab of any epic that has been alive for more than two quarters. Go ahead, pick one. Count the edits. Somewhere around edit 11, the description was rewritten to satisfy a stakeholder who has since changed roles. Around edit 19, the scope was trimmed to protect a date that, in the end, moved anyway. By edit 26 someone renamed the whole thing, and the sentence that explained why the work existed in the first place didn’t survive the paste. 26 edits, several hundred hours of delivery behind them, and nobody left who can say what the money was for.

Nobody deleted that reason on purpose. That’s what makes this so hard to see.

I’ve been shuttling between the people who fund technology work and the teams who deliver it for a couple of decades now, and something has always struck me as odd: the backlog is probably the only important document in the enterprise that gets edited every day and remembers nothing. Contracts have version control and signatures. Financial statements have audit trails. Even architecture, in mature shops, has decision records. But the artifact that actually steers what hundreds of people build week after week? It has a title, a status and a description that mutates until the original intent becomes archaeology.

The most expensive failures I’ve seen were all fast. The teams shipped and shipped, and somewhere along the way the work stopped meaning what everyone assumed it still meant. Nobody slowed down long enough to notice.

One problem, two lenses

Strategy and delivery look at the same work through very different mental models. On one side, leaders talk in outcomes, intent and value; they worry about whether the original justification for the investment still holds months later. On the other side, teams think in iterations, flow and momentum, and they worry about keeping complex programs moving in small, manageable steps. Both lenses are legitimate, and in my experience both sides generally believe they’re the ones doing everything right.

The disagreement between them is never loud. Strategy quietly assumes the logic will remain constant across every sprint and every decision. Delivery quietly assumes the strategic reasoning will naturally update itself based on what gets learned along the way. There’s nothing wrong with either assumption on its own. But in the absence of a structural bridge between them, every program gradually accumulates small half-measures and shifted meanings that nobody registers until it’s too late.

The evidence on how badly intent travels is humbling. Donald Sull and his colleagues, in a multi-year study of strategy execution, found that only half of middle managers can name any of their company’s top five priorities. Those are the managers. Now imagine the epic, eleven edits later.

Let me be fair to agile here, because agile is not the villain. It does exactly what it says on the tin: it helps teams learn quickly and adjust to what they discover, and that speed is a genuine strength. The problem is that organizations blur the line between two kinds of change. Some of it is genuine learning: teams discover real behaviors, markets shift, leaders sharpen their thinking. And some of it is erosion, the slow loss of rationale that nobody actually decided and nobody can trace back to a witting choice. From the outside, the two are indistinguishable. They show up the same way in the tooling: movement in the backlog, shifting priorities, even working software. Only one of them stays anchored to the reason the money was spent.

Most organizations have no instrument for telling these two apart. Which means they’re flying at full speed without knowing whether they’re navigating or just moving.

The pattern we keep seeing

Agile in style, not in substance

The board gets moved every day, stand-ups start on time and retrospectives produce long lists of things to improve. Then you ask why a specific feature exists, what it’s actually meant to change, and the room gets quiet. The rituals persist while the substance underneath them slowly thins out. Teams keep closing tasks, and somewhere along the way they shed the shared sense of purpose that made the tasks worth doing.

Velocity becomes a proxy for value

A smooth sprint demo can hide a deeper problem, because progress toward delivery and progress toward outcomes are two different measurements, and only one of them is on the wall. I’ve seen features that were stable, polished and warmly received in the demo, and that contributed absolutely nothing to the decision they were supposed to improve. The pace was real enough; whether any of it mattered took months to find out. And your delivery metrics can be excellent, genuinely excellent, while every one of these patterns is running underneath them.

This is not a niche affliction, by the way. Pendo analyzed feature usage across hundreds of software products and found that 80% of features are rarely or never used. Built at full velocity, shipped into silence.

Product owners absorb pressure instead of defending logic

The PO is supposed to hold the thread, to protect the reasoning behind the work when everyone else is pushing on it. In practice, many find themselves wedged between demand and delivery, forced into a permanent state of reactive prioritization. Over time they stop challenging requests. Then they stop defending the logic behind decisions. Eventually they stop framing choices around outcomes at all, and the backlog, which should be a strategic instrument, turns into the place where everything gets dumped because nobody has the space left to ask what actually belongs there.

Backlog churn masks strategic drift

Items get revisited, split, recast and reprioritized as everyone works to keep momentum going, and from a distance it can all look like reasonable adaptation. But when the connection to intent is severed, all that motion begins to dissolve into static. Work keeps getting passed around, the board stays busy and the program veers off course without producing a single alarming signal, because busy is what everyone was looking for.

Every quarter is a reset

New OKRs arrive. A fresh wave of leadership messaging follows. Sometimes the team gets reshuffled too. With each round, a little of the shared context that held everything together quietly slips away. Epics get new names, stories get rewritten, priorities rearrange themselves almost by accident. The organization keeps rebooting itself without ever asking what it left behind in the reset.

Taken one at a time, each of these patterns is understandable, even forgivable. Together they produce a program that looks healthy from every angle while it quietly hollows out the meaning behind the work.

Why this keeps happening, and why it’s about to get worse

Big programs tend to assume that intent will simply carry itself forward as the work passes through teams, decisions and iterations. It won’t. Intent doesn’t carry itself. If nobody actively preserves and updates the reasoning, it starts to loosen and fray, quietly and almost politely, one story, one trade-off, one shift in priority at a time.

The structural cause is a speed mismatch that most governance was never designed for. The delivery system evolves in hours; the organization’s memory of why updates in quarters, if at all. In between those two clocks, thousands of micro-decisions reshape what the work means, far faster than anyone captures the reasoning behind them.

Now add what’s happening in 2026. AI agents inside the delivery tooling can already organize, create and edit backlog items on a team’s behalf. Atlassian’s own customers describe agents that generate requirements, break them into epics and stories and take delegated work like a teammate, and these capabilities now ship inside the standard Jira plans that most enterprises already pay for. I’m not against any of this; some of it is genuinely useful. But notice what it means for our problem. Every one of those operations is an edit to a document that has no memory. Backlog amnesia at human speed was survivable. Painful, but survivable, because humans forget slowly. Amnesia at machine speed is a different animal altogether. The ratio of motion to memory, already unhealthy in most organizations, is about to go vertical.

If your backlog can’t remember why an item exists after a human rewrote it a few times, think about what happens when an agent grooms it continuously.

What to do about it

The countermeasures I use are deliberately small. None of them adds a ceremony, a tool, or a governance layer. They simply orient the practices teams already run toward one job: keeping the reasoning alive while the work moves. Together, they form the discipline I call Structural Agile.

• Start with the outcome. Before an epic or major story enters the backlog, three questions, every time: What behavior are we trying to shift? How will we know if that behavior changes? What signals will confirm success after release? If the room can’t answer, the work waits, because items that lack outcome clarity tend to drift first and drift fastest.
• Elevate the PO. Position the product owner as the carrier of outcome logic, with an explicit mandate to preserve rationale, flag trade-offs that erode intent and track deferred items together with the reasoning behind them. And be realistic about the limits, because many POs inherit chaotic backlogs, rotate mid-stream, or simply lack the authority to push back on stakeholders. The rule I give teams is simple: if the PO can’t carry the logic, someone must: a coach prompting context checks, an architect recording the reasoning behind technical trade-offs, an analyst keeping the outcome picture current. Build logic stewardship into the structure. Left to personality, it leaves with the person.
• Anchor epics to why. Every epic carries its rationale as metadata, inside the tool where the work actually lives. Slide decks from last spring don’t count. When a decision reshapes the epic, the rationale gets updated in the same motion; waivers and scope cuts get recorded next to the item they changed. Do this consistently and the backlog stops being a queue of tasks and becomes a living map of intent, one that a new joiner can read on day one, and that survives a challenge from leadership without anyone having to reconstruct history from memory. It cuts both ways, too: the same rationale that protects the team from whiplash protects the business from a backlog that has drifted away from what they actually asked for. Prioritization turns into a conversation about evidence rather than a contest of opinions.
• Rehearse erosion. This is the practice I’d start with, and the one that surprises teams most. Every two or three sprints, run a short, structured session that is not a retrospective and not a risk review. Its purpose is to test the continuity of intent itself: Does the assumed user behavior still make sense? Where might adoption fail even though delivery is technically correct? Which parts of the outcome logic feel fragile, outdated, or untested? A retro examines how the team worked; an erosion rehearsal examines whether the reasoning still holds. You rehearse erosion the same way pilots rehearse emergencies: you hope the drill is wasted, and you run it anyway, because catching drift early is what makes fixing it cheap. In my experience, a single one of these sessions surfaces more strategic risk than a quarter’s worth of status reporting, and it costs the team about half an hour.
• Keep the logic alive. Capture only what prevents strategic amnesia and nothing more: why a feature was removed or reshaped, who approved it and which assumptions should be revisited, and when. Keep it visible where teams already work. If logic lives in Confluence but dies in conversation, it’s already gone.

Start Monday

You don’t need a reorganization or a new framework to begin, and frankly you shouldn’t want one. Three entry points, close to zero overhead. Assign a critical reviewer: one team member whose standing job is to periodically ask whether stories still connect to the intended outcome. Add a one-minute outcome check before major refinements: the behavior targeted, the indicator watched, the signal expected. And run a single erosion rehearsal on your most important program; teams usually surface something real in the first session, long before it would have shown up in any metric.

For readers keeping score: yes, neighboring practices exist, and they’re good ones. Architecture decision records preserve the why behind technical choices, and impact mapping connects deliverables to goals at planning time. I use both. Neither operates continuously, inside the backlog, at the level of the individual item, which happens to be exactly where the forgetting occurs. OKRs don’t solve it either; objectives at altitude are necessary, but teams still need the rationale embedded in the work itself, so they don’t have to keep a separate decoder.

The history tab, revisited

Go back to that epic with the twenty-six edits, and imagine the same history with one difference: each consequential edit carries a line of reasoning, current and human-readable, and every few sprints someone deliberately tested whether that reasoning still held. Same team, same velocity, same tool and a completely different answer when someone finally asks why the work exists.

Velocity tells you how fast the work is moving. Only memory can tell you whether anyone still knows where it’s going.

I’ve published the full discipline behind this approach (the five principles, the roles, the facilitation guides and the objections seasoned practitioners will raise, along with my answers) as a featured paper in PM World Journal. The mechanics are free to steal. The forgetting, at this point, is optional.

Open the history tab of any epic that has been alive for more than two quarters. Go ahead, pick one. Count the edits. Somewhere around edit 11, the description was rewritten to satisfy a stakeholder who has since changed roles. Around edit 19, the scope was trimmed to protect a date that, in the end, moved anyway. By edit 26 someone renamed the whole thing, and the sentence that explained why the work existed in the first place didn’t survive the paste. 26 edits, several hundred hours of delivery behind them, and nobody left who can say what the money was for.

Nobody deleted that reason on purpose. That’s what makes this so hard to see.

I’ve been shuttling between the people who fund technology work and the teams who deliver it for a couple of decades now, and something has always struck me as odd: the backlog is probably the only important document in the enterprise that gets edited every day and remembers nothing. Contracts have version control and signatures. Financial statements have audit trails. Even architecture, in mature shops, has decision records. But the artifact that actually steers what hundreds of people build week after week? It has a title, a status and a description that mutates until the original intent becomes archaeology.

The most expensive failures I’ve seen were all fast. The teams shipped and shipped, and somewhere along the way the work stopped meaning what everyone assumed it still meant. Nobody slowed down long enough to notice.

One problem, two lenses

Strategy and delivery look at the same work through very different mental models. On one side, leaders talk in outcomes, intent and value; they worry about whether the original justification for the investment still holds months later. On the other side, teams think in iterations, flow and momentum, and they worry about keeping complex programs moving in small, manageable steps. Both lenses are legitimate, and in my experience both sides generally believe they’re the ones doing everything right.

The disagreement between them is never loud. Strategy quietly assumes the logic will remain constant across every sprint and every decision. Delivery quietly assumes the strategic reasoning will naturally update itself based on what gets learned along the way. There’s nothing wrong with either assumption on its own. But in the absence of a structural bridge between them, every program gradually accumulates small half-measures and shifted meanings that nobody registers until it’s too late.

The evidence on how badly intent travels is humbling. Donald Sull and his colleagues, in a multi-year study of strategy execution, found that only half of middle managers can name any of their company’s top five priorities. Those are the managers. Now imagine the epic, eleven edits later.

Let me be fair to agile here, because agile is not the villain. It does exactly what it says on the tin: it helps teams learn quickly and adjust to what they discover, and that speed is a genuine strength. The problem is that organizations blur the line between two kinds of change. Some of it is genuine learning: teams discover real behaviors, markets shift, leaders sharpen their thinking. And some of it is erosion, the slow loss of rationale that nobody actually decided and nobody can trace back to a witting choice. From the outside, the two are indistinguishable. They show up the same way in the tooling: movement in the backlog, shifting priorities, even working software. Only one of them stays anchored to the reason the money was spent.

Most organizations have no instrument for telling these two apart. Which means they’re flying at full speed without knowing whether they’re navigating or just moving.

The pattern we keep seeing

Agile in style, not in substance

The board gets moved every day, stand-ups start on time and retrospectives produce long lists of things to improve. Then you ask why a specific feature exists, what it’s actually meant to change, and the room gets quiet. The rituals persist while the substance underneath them slowly thins out. Teams keep closing tasks, and somewhere along the way they shed the shared sense of purpose that made the tasks worth doing.

Velocity becomes a proxy for value

A smooth sprint demo can hide a deeper problem, because progress toward delivery and progress toward outcomes are two different measurements, and only one of them is on the wall. I’ve seen features that were stable, polished and warmly received in the demo, and that contributed absolutely nothing to the decision they were supposed to improve. The pace was real enough; whether any of it mattered took months to find out. And your delivery metrics can be excellent, genuinely excellent, while every one of these patterns is running underneath them.

This is not a niche affliction, by the way. Pendo analyzed feature usage across hundreds of software products and found that 80% of features are rarely or never used. Built at full velocity, shipped into silence.

Product owners absorb pressure instead of defending logic

The PO is supposed to hold the thread, to protect the reasoning behind the work when everyone else is pushing on it. In practice, many find themselves wedged between demand and delivery, forced into a permanent state of reactive prioritization. Over time they stop challenging requests. Then they stop defending the logic behind decisions. Eventually they stop framing choices around outcomes at all, and the backlog, which should be a strategic instrument, turns into the place where everything gets dumped because nobody has the space left to ask what actually belongs there.

Backlog churn masks strategic drift

Items get revisited, split, recast and reprioritized as everyone works to keep momentum going, and from a distance it can all look like reasonable adaptation. But when the connection to intent is severed, all that motion begins to dissolve into static. Work keeps getting passed around, the board stays busy and the program veers off course without producing a single alarming signal, because busy is what everyone was looking for.

Every quarter is a reset

New OKRs arrive. A fresh wave of leadership messaging follows. Sometimes the team gets reshuffled too. With each round, a little of the shared context that held everything together quietly slips away. Epics get new names, stories get rewritten, priorities rearrange themselves almost by accident. The organization keeps rebooting itself without ever asking what it left behind in the reset.

Taken one at a time, each of these patterns is understandable, even forgivable. Together they produce a program that looks healthy from every angle while it quietly hollows out the meaning behind the work.

Why this keeps happening, and why it’s about to get worse

Big programs tend to assume that intent will simply carry itself forward as the work passes through teams, decisions and iterations. It won’t. Intent doesn’t carry itself. If nobody actively preserves and updates the reasoning, it starts to loosen and fray, quietly and almost politely, one story, one trade-off, one shift in priority at a time.

The structural cause is a speed mismatch that most governance was never designed for. The delivery system evolves in hours; the organization’s memory of why updates in quarters, if at all. In between those two clocks, thousands of micro-decisions reshape what the work means, far faster than anyone captures the reasoning behind them.

Now add what’s happening in 2026. AI agents inside the delivery tooling can already organize, create and edit backlog items on a team’s behalf. Atlassian’s own customers describe agents that generate requirements, break them into epics and stories and take delegated work like a teammate, and these capabilities now ship inside the standard Jira plans that most enterprises already pay for. I’m not against any of this; some of it is genuinely useful. But notice what it means for our problem. Every one of those operations is an edit to a document that has no memory. Backlog amnesia at human speed was survivable. Painful, but survivable, because humans forget slowly. Amnesia at machine speed is a different animal altogether. The ratio of motion to memory, already unhealthy in most organizations, is about to go vertical.

If your backlog can’t remember why an item exists after a human rewrote it a few times, think about what happens when an agent grooms it continuously.

What to do about it

The countermeasures I use are deliberately small. None of them adds a ceremony, a tool, or a governance layer. They simply orient the practices teams already run toward one job: keeping the reasoning alive while the work moves. Together, they form the discipline I call Structural Agile.

• Start with the outcome. Before an epic or major story enters the backlog, three questions, every time: What behavior are we trying to shift? How will we know if that behavior changes? What signals will confirm success after release? If the room can’t answer, the work waits, because items that lack outcome clarity tend to drift first and drift fastest.
• Elevate the PO. Position the product owner as the carrier of outcome logic, with an explicit mandate to preserve rationale, flag trade-offs that erode intent and track deferred items together with the reasoning behind them. And be realistic about the limits, because many POs inherit chaotic backlogs, rotate mid-stream, or simply lack the authority to push back on stakeholders. The rule I give teams is simple: if the PO can’t carry the logic, someone must: a coach prompting context checks, an architect recording the reasoning behind technical trade-offs, an analyst keeping the outcome picture current. Build logic stewardship into the structure. Left to personality, it leaves with the person.
• Anchor epics to why. Every epic carries its rationale as metadata, inside the tool where the work actually lives. Slide decks from last spring don’t count. When a decision reshapes the epic, the rationale gets updated in the same motion; waivers and scope cuts get recorded next to the item they changed. Do this consistently and the backlog stops being a queue of tasks and becomes a living map of intent, one that a new joiner can read on day one, and that survives a challenge from leadership without anyone having to reconstruct history from memory. It cuts both ways, too: the same rationale that protects the team from whiplash protects the business from a backlog that has drifted away from what they actually asked for. Prioritization turns into a conversation about evidence rather than a contest of opinions.
• Rehearse erosion. This is the practice I’d start with, and the one that surprises teams most. Every two or three sprints, run a short, structured session that is not a retrospective and not a risk review. Its purpose is to test the continuity of intent itself: Does the assumed user behavior still make sense? Where might adoption fail even though delivery is technically correct? Which parts of the outcome logic feel fragile, outdated, or untested? A retro examines how the team worked; an erosion rehearsal examines whether the reasoning still holds. You rehearse erosion the same way pilots rehearse emergencies: you hope the drill is wasted, and you run it anyway, because catching drift early is what makes fixing it cheap. In my experience, a single one of these sessions surfaces more strategic risk than a quarter’s worth of status reporting, and it costs the team about half an hour.
• Keep the logic alive. Capture only what prevents strategic amnesia and nothing more: why a feature was removed or reshaped, who approved it and which assumptions should be revisited, and when. Keep it visible where teams already work. If logic lives in Confluence but dies in conversation, it’s already gone.

Start Monday

You don’t need a reorganization or a new framework to begin, and frankly you shouldn’t want one. Three entry points, close to zero overhead. Assign a critical reviewer: one team member whose standing job is to periodically ask whether stories still connect to the intended outcome. Add a one-minute outcome check before major refinements: the behavior targeted, the indicator watched, the signal expected. And run a single erosion rehearsal on your most important program; teams usually surface something real in the first session, long before it would have shown up in any metric.

For readers keeping score: yes, neighboring practices exist, and they’re good ones. Architecture decision records preserve the why behind technical choices, and impact mapping connects deliverables to goals at planning time. I use both. Neither operates continuously, inside the backlog, at the level of the individual item, which happens to be exactly where the forgetting occurs. OKRs don’t solve it either; objectives at altitude are necessary, but teams still need the rationale embedded in the work itself, so they don’t have to keep a separate decoder.

The history tab, revisited

Go back to that epic with the twenty-six edits, and imagine the same history with one difference: each consequential edit carries a line of reasoning, current and human-readable, and every few sprints someone deliberately tested whether that reasoning still held. Same team, same velocity, same tool and a completely different answer when someone finally asks why the work exists.

Velocity tells you how fast the work is moving. Only memory can tell you whether anyone still knows where it’s going.

I’ve published the full discipline behind this approach (the five principles, the roles, the facilitation guides and the objections seasoned practitioners will raise, along with my answers) as a featured paper in PM World Journal. The mechanics are free to steal. The forgetting, at this point, is optional.

Microsoft has unveiled a suite of IQ products over the last few months. Work IQ, Fabric IQ, and Foundry IQ build on what Microsoft used to call its “Graphs,” the underlying data architecture that underpins its cloud services. These graphs provided a way to query the data your business uses, treating that data as nodes in a graph database and using the GraphQL API model to extract that data — for example, to pull data related to a specific individual held across the various Microsoft 365 applications.

The IQ suite follows a similar approach, using the same data, but treating it as the sparse vector store needed to provide grounding data for LLM-based applications. By treating the data as a set of embedding vectors, and integrating it with Model Context Protocol (MCP) servers, Microsoft is giving you the necessary tools to tie LLM output to your data, reducing the risk of hallucination and improving accuracy. Using your own data is a key part of delivering effective agents, ensuring they work within your constraints.

Extending IQ to the web

Web IQ, the latest member of the IQ suite, was unveiled at Build 2026. A modernization of the retired Bing Search APIs, Web IQ is an agent-focused web search tool that builds on the massive Bing search index to provide up-to-date general information for use in your applications.

It may seem a little odd to be talking about a web-wide source of grounding data in the context of a suite of tools that exist to improve the accuracy of your AI applications by providing access to your Microsoft-hosted data. However, in many cases you want to link your agent not only to your data but also to related information from the wider world. For example, an agent powering an ecommerce service could use Web IQ and web-based data sources to provide product comparisons. An agent managing stock levels for a product that is weather-sensitive could use Web IQ as a source of weather data, using Bing’s multiple weather feeds and forecasts.

Just as Google Gemini drew on Google Search, Microsoft Copilot began by using Bing search data to provide grounding for consumer chatbots. It’s easy to take a service like Bing and use it with a LLM, as the nearest neighbor search algorithms use semantic vector similarity techniques to find results that look like your query, ranking them according to their proximity to your search terms.

Microsoft has been tuning its search vector index and the underlying technology stack to work with agents, as agents operate much differently than humans searching the web or querying a chatbot. Providing web search capabilities to agents means having to deal with persistent queries, as the agent hunts for the information it needs, refining queries and applying reasoning algorithms to develop the response it needs. LLM inferencing requires quick responses that deliver large amounts of data, working with queries that go far beyond the one-word or two-word requests that are typical of humans.

More than the training weights

Using Web IQ gives you access to up-to-date information, beyond the training data used to build and weight an LLM. Bing’s crawler works within the standards developed by the search engine industry, obeying meta tags and using its own algorithms to crawl regularly updated websites more often. Bing’s crawler ensures that data is both fresh and being used appropriately, with a focus on quality rather than quantity.

Providing access to web data is only part of Web IQ. Microsoft is using Web IQ to host its own models to manage embeddings, ranking, and content extraction, all running on the company’s global hyperscale platform. The intent here is to use only a limited number of models, to keep the system performance high while aiming to deliver accurate results. The Web IQ models are different from those used to deliver search results to humans, as they’re designed to deliver responses that are suitable for LLMs to use for reasoning.

The underlying search system is based on the DiskANN algorithm developed by Microsoft Research, which allows fast search without requiring enormous amounts of in-memory data access. This approach has been extended to manage information retrieval at scale, building on Microsoft’s distributed systems architectures, to support the demands Microsoft is seeing from agent-based systems. At the same time, it must respond to the rapidly changing economics of inference, where token costs now demand the best possible output from the fewest tokens.

To meet those economic demands, the Web IQ platform doesn’t deliver whole documents to querying agents. Whole documents can lead to expensive inference further down the chain, as LLMs process results repeatedly to drive the agent workflow. Instead, Web IQ structures the information retrieved from the underlying search engine data, delivering what Microsoft calls “structured evidence objects” as well as passage-level information from unstructured text documents. This should result in a much higher signal-to-noise ratio than simply querying a search engine, with a focus on delivering information that lets agents work using fewer tokens.

Using Web IQ in your agent code

The API for Web IQ is a standard REST call, delivering a request object to the Web IQ endpoint. Along with your API authorization key, you will send a query, a set of parameters that control the number of results returned, the language and region used, and the maximum size of the responses and the format used. Responses can be returned in text, HTML, or markdown formats, as well as extracted passages that are selected for context. All other options return the full document, so can be more expensive to use. Markdown is an interesting alternative, as it can be used as the basis for giving agents semantic memories.

Results include important contextual and citation information, including web page titles and URLs, as well as data about when the site was last crawled and how stale the underlying information is. This can be used to improve grounding and provide more information that can be included in formatted responses — much in the same way as Bing’s Copilot displays context in the form of footnotes in its responses.

Responses to video searches include text descriptions. If these aren’t provided as part of the original web content, they will be generated by an LLM. The same approach is used for image searches, with both offering the same contextual cues as the web search API. If you don’t care about the type of data being returned, you can choose a “classic search,” which will return text, images, video, and news.

Supporting autonomous agents

Microsoft provides LLM-ready documentation for the Web IQ service, with an llms.txt file and an OpenAPI description. These allow AI tools to discover Web IQ capabilities and include them in workflows as part of autonomous operations, so that agents and other AI applications can implement grounding calls to Web IQ whenever user interactions require them. The API descriptions include errors as well as the structure of a standard 200 response.

As Web IQ is designed for use by modern agent frameworks, the Web IQ API is available through an MCP server. The Web IQ MCP server exposes tools that map to API calls: web, videos, news, and images. They also include a browse option, which lets you pull content from a target URL. The service can be configured with a standard JSON file and requires an API key to control access and manage billing. If your account doesn’t have access to a specific tool, then it won’t be available from inside the MCP server.

If you’re building an agent and you want to evaluate the Web IQ MCP server, it can be added to common coding agents, such as the GitHub Copilot CLI. You can then test it out using familiar tools and generate code that can be dropped into applications via your choice of development tooling. Queries sent to the Web IQ MCP server use the same syntax as REST calls, without having to construct the calls yourself. Working with the MCP server allows you to connect Web IQ to your choice of agent framework, relying on its built-in MCP methods to reduce the code and maintenance overhead.

Web IQ is not for human interactions; Microsoft provides an alternative “Grounding with Bing” service for chatbots. Instead, Web IQ is a tool for agents, providing necessary background information that helps keep results fresh and relevant. It’s easy to use, fast, and, above all, cheap, which makes it an ideal tool for modern inference platforms built around Microsoft Azure’s AI tooling.

Shortly after OpenAI publicly acknowledged the Hugging Face breach on July 21, Reuters journalist Raphael Satter called me for comment on a story which would reveal shocking new details about OpenAI’s “rogue model” incident: The agent hadn’t just slipped its leash for a few hours, as many assumed, but had in fact been wreaking havoc for days without the company’s knowledge.

When I hung up, I immediately called a close friend who has worked inside frontier‑AI labs since before the term even existed. When she heard the timeline, she was stunned. In her view, “If proper industry regulations were in place, those four days would be grounds to terminate OpenAI’s R&D GPU clusters until they get a full independent audit.”

Demystifying the incident

There have been numerous reports that frame OpenAI’s model as a “rogue agent” escaping captivity and “breaking out” of the research lab, with both the BBC and Cloud Security Alliance comparing its actions to the dinosaurs in Jurassic Park.

This framing is narratively compelling and is an easy way to communicate the gravity of the situation to a layperson. However, it undermines OpenAI’s agency both before and throughout the incident and plays into a larger problem due to the evangelizing way the company communicated its actions.

OpenAI, in simplified terms, had been testing two models against a benchmark which scores how well an agent can find and exploit real-world software vulnerabilities. Both models ran with their cyber refusals deliberately reduced, in a sandbox environment meant to be isolated to a single internally hosted proxy. The models targeted Hugging Face, correctly inferring that the AI platform hosted the benchmark’s answer key — in short, “choosing” to cheat on the test they were given to complete the challenge.

Following the breach, Hugging Face’s forensic team found thousands of agent actions in its logs, indicating that the time it took to break into Hugging Face, plus the attack itself, totaled 4 days.

Hugging Face went public about the attack before it even knew that OpenAI was responsible. OpenAI, meanwhile, didn’t realize its own agent was the culprit until Hugging Face’s public disclosure made them check their own logs. In total, it took OpenAI nearly two weeks from its agent’s initial escape to come clean, and only once a rival’s hand had forced the issue.

OpenAI’s “problem child”

From a human perspective, it’s bewildering that out of all paths the OpenAI agent could have taken to beat a standardized security challenge, it chose a ludicrously convoluted approach taking tens of thousands of attempted paths and barreling through set restrictions. However, it was par for the course given one of the model’s track records.

In a post published the day before the Hugging Face disclosure, OpenAI describes one of its models that, unlike older versions that would simply stop at a sandbox restriction, would continue to persist until it found a way around, once even spending an hour hunting a sandbox vulnerability only to post its results to GitHub against explicit instructions. This model is GPT Sol 5.6, the public model involved in the Hugging Face attack.

Long before the Hugging Face incident, GPT Sol 5.6 was already gaining a reputation for breaking rules, taking laughably long to accomplish simple tasks, and being destructive — in one case deleting an AI entrepreneur’s entire Mac contents.

Even during internal testing, the model had been caught killing random processes when it couldn’t find the right virtual machines, lying about checking its work, and using credentials it wasn’t supposed to access. However, it was still given public access by the company.

Profit before safety

CSA’s report states that an OpenAI model escaped a test container in September 2024 for a different evaluation, was contained quietly and “largely celebrated at the time” rather than treated as a warning. The same report calls this kind of escape “the standard, not the exception.” The former head of OpenAI’s “superalignment” safety team resigned in May 2024 and wrote publicly that “safety culture and processes have taken a backseat to shiny products.” It was reported that nearly half of the team working on long-term AI safety had left.

Even the language used by OpenAI in their disclosure reads as more braggadocious than concerned. From OpenAI’s perspective, its failure was in not overseeing the agent’s choices as a whole, as each step taken by the model can remain fairly innocuous-seeming until pieced together. The company does not acknowledge that leaving an agent unsupervised in a testing setting with its safety classifiers off for even one hour, let alone days, is potentially catastrophic to begin with.

Some researchers have argued that the recent incident is fundamentally a decades-old security failure rather than a narrative about a rogue intelligence: the exploit involved an exposed proxy, reused credentials and infrastructure that should have never had a path outward. However, a skilled human attacker given that same door would have needed weeks to achieve a fraction of what the agent did in days.

A symptom of underlying issues

The incident reveals larger issues about the culture of safety at frontier model companies, whose employees are driven to crunch R&D cycles and ignore potential issues until they become active problems. This isn’t unique to OpenAI, either — the UK’s AI Security Institute has reportedly found that every frontier model it has tested cheats on cybersecurity evaluations at least occasionally, and that pre-deployment testing windows have shrunk industrywide from roughly five weeks to as few as five days.

Regulatory bodies have also failed to keep up with or understand the industry’s rapid advancements. The US has no binding legal framework that would have required a different response from OpenAI, as labs are only beholden to voluntary commitments weighed against commercial pressure, and in cases like these, huge security breaches only serve to make the model look extremely smart and powerful.

The US has attempted to create guardrails, but they fail to understand the ecosystem. We can see effects stemming from this lack of understanding in the recent attack: when Hugging Face’s responders needed to analyze what its attacker had done, Anthropic’s models declined the forensic work, citing their own guardrails, and Hugging Face instead ran the analysis on GLM 5.2, an open-weight model from the Beijing company Z.ai. In addition to being an ineffective band-aid, this also drives business outside of the US and therefore outside of its regulatory control. Today, roughly 80 percent of US AI startups now build on Chinese open-source models.

US Representatives have introduced a bill citing this incident by name, requiring killswitch capability and incident reporting, but nothing like it has passed, and no jurisdiction anywhere has demonstrated the insight to regulate evaluation-time behavior in addition to deployment-time behavior. This incident happened entirely during testing, before any release decision, in a stage every proposal currently treats as exempt.

It’s important to note here that AI safety and practices differ from other branches of cybersecurity in that they have to build from a behavioral and psychological framework instead of one based on capability alone.

For example, although Anthropic’s track record is far from spotless, it has invested significantly more energy than others into understanding the unconscious “thought processes” (or “j-space”) of its models to better predict potential transgressions and set up more effective guardrails. What we can learn from these “rogue models” is that their behavior is actually very predictable; we know that when given a goal to accomplish, models will overstep boundaries freely in pursuit of their objective, simply because they have no actual understanding of the way we categorize “acceptable behavior”. In the real world, vulnerability exploitation encourages rule-breaking and disregard for boundaries by design, so why would a model trained to think this way see a test’s rules any differently?

For CSOs and CIOs, the practical implication of this event remains narrow, for now. CSA’s post-mortem offers mostly traditional advice: isolate package proxies and credential stores with a path to the open internet by default, log AI evaluation environments the way you log anything customer-facing, and build incident response around machine speed rather than human speed.

The key risk factor for now is volume, with agents deploying actions at higher numbers than our pipelines are built to catch, and organizations that survive the next iteration of “rogue agents” will be the ones that assume as much beforehand.

When I first started working on enterprise AI security initiatives, I expected the biggest challenges to be technical. I assumed we’d spend most of our time discussing prompt injection, model security, vector databases or the latest LLM vulnerabilities.

I was wrong — or at least incomplete.

The technology certainly matters, but after working with multiple enterprise AI initiatives, I’ve learned that the hardest security problems rarely come from the model itself. They emerge when AI becomes part of real business processes.

An AI assistant doesn’t simply answer questions. In a single workflow, it might pull a customer record from Salesforce, open a ticket in ServiceNow and send an update through Microsoft 365 before anyone has finished reading the summary. Increasingly, it makes decisions before a human even notices, and that shift changes the threat model. Traditional application security assumes software executes deterministic code. AI systems don’t. They reason, adapt and generate outputs that cannot always be predicted in advance, which means many of the controls we’ve relied on for years remain necessary but are no longer sufficient.

What follows is what I keep coming back to in architecture reviews: Not the model vulnerabilities that dominate the headlines, but the quieter failures that show up once an agent is already running.

Identity is only the starting point

One of the first surprises I encountered was how quickly organizations focus on authentication while overlooking runtime behavior. Most enterprise AI projects begin with questions such as “Can the AI access SharePoint?” “Can it connect to ServiceNow?” “Can it connect to GitLab?” or “Can it read Microsoft 365 tools like Outlook, Word, etc.?” Those are important questions, but the more important one is: What should the AI be allowed to do after a specific type of access (for example, read-only access) has been granted?

Identity answers who the agent is. Authorization answers what it may access. Neither answers whether the AI should perform a particular action; in the above case only performs read-only access.

The capability question and the safeguard question are too often answered by different teams on different timelines. Security reviews that focus only on what the AI can access tend to miss the more revealing question of what it is permitted to do once that access exists. I have started treating those two questions as a single design problem, because every gap between them eventually surfaces as an incident.

I remember an architecture review where this became concrete. An employee asked an internal assistant — one built on Microsoft 365 and SharePoint — to summarize several incident reports, and during its reasoning the assistant discovered privileged administrative documentation in a linked site and decided it might also be useful to include those details. Nothing technically failed. The credentials were valid. The permissions were correct. Yet the outcome violated business intent. That moment reframed the conversation for everyone in the room. We realized our threat model had been built for outsiders trying to get in, not for authorized systems acting a little too helpfully. Closing that gap meant designing controls that evaluated behavior in context, not just credentials at the door, and it’s why I’ve come to view runtime governance as one of the defining security challenges of enterprise AI.

Organizations such as the OWASP GenAI Security Project and the NIST AI Risk Management Framework emphasize that AI risks extend well beyond authentication authorizations to include monitoring, governance and continuous oversight throughout execution. CSOonline’s coverage of agentic identity makes the same point: Existing controls weren’t designed for AI agents, and static credentials and standing privileges are no longer sufficient when organizations must rapidly authorize, limit and revoke permissions from autonomous agents, sometimes more than once within a single workflow.

The biggest failures rarely look like cyberattacks

Most security professionals naturally look for malicious activity: Prompt injection, data poisoning, credential theft, model manipulation. Those attacks certainly matter. What I’ve seen more frequently, however, are failures caused by legitimate AI behavior. A Finance, HR, Customer or risk management AI assistant retrieves more documents than necessary because it tries to provide a “better” answer. An autonomous workflow performs five approved actions instead of one. An AI agent continues executing after the user’s original intent has already been satisfied. None of these resemble traditional attacks, yet they may create compliance violations, privacy issues or operational disruption.

One mental model has consistently helped executives understand why this is so dangerous. I ask them to stop thinking about AI as software and instead think about it as hiring thousands of new digital employees, aka AI agents. Every employee receives training, limited access, monitoring, auditing and oversight. AI agents deserve the same treatment.

One deployment I worked on involved multiple specialized AI agents collaborating to complete a single business task. One queried ServiceNow for ticket history, another analyzed documents in SharePoint, a third drafted recommendations and a fourth wrote updates back into Jira. Individually, each agent had relatively limited permissions like read-only and/or write. Collectively, they represented a powerful autonomous workflow. That experience reinforced an important lesson: Security can no longer focus only on individual AI components. It must govern the complete chain of autonomous decision-making. The MITRE ATLAS framework is an excellent way to think about adversarial AI techniques, but equally important is understanding how normal autonomous behavior can unintentionally create business risk.

The most instructive cases I’ve seen involve agents that delegate to other agents. In one review, a frontline support agent had strictly read-only access to Salesforce, but it could hand tasks to a second agent that held write privileges across ServiceNow and the billing platform. When the first agent couldn’t resolve a customer issue within its own scope, it quietly routed the request through the second agent, which updated the case and issued a credit. Nothing was hacked. The credentials were valid, the delegation was technically permitted, and yet a read-only agent had effectively performed write actions it was never meant to perform. That is the defining difference between an assistant and an agent. An assistant answers; an agent enlists other agents, and that escalation path is itself the vulnerability.

That’s why we started asking a different question during architecture reviews. Instead of asking “Can the AI do this?” we asked, “Should the AI still be doing this?” That subtle shift changed many design decisions. It pushed teams to build in stopping conditions, scope checks and confirmation prompts rather than assuming an agent would naturally know when to stop. In one review, simply requiring a human to confirm before an agent crossed from a read-only step into a write action eliminated the majority of the risky paths we had been debating.

Start with governance before autonomy

One pattern I’ve repeatedly observed is that organizations become excited about autonomy long before they’re prepared to govern it. Everyone wants AI agents, but few initially invest in runtime policy enforcement. That sequencing should be reversed. In my experience, successful enterprise AI programs put a few foundations in place before expanding automation: Clear business boundaries that an agent isn’t allowed to cross, least-privilege access for every agent, and human approval at any step that touches sensitive/restricted data/systems, including the production data /systems. Only after those exist does it make sense to widen autonomous decision-making. I’ve watched teams try to shortcut this order, and the result is almost always the same: A promising pilot gets pulled back because no one can confidently explain what the AI did or why.

A big part of that foundation is visibility. Traditional audit logs record actions, but AI systems also need to record reasoning. When an AI agent creates a ticket, updates a configuration or sends an email, investigators should understand why the decision occurred. This doesn’t mean recording every token generated by a large language model. I’ve found more value in capturing three things: The original business request, the systems the agent touched and the decisions it made along the way. Those records become invaluable during investigations, compliance reviews and operational troubleshooting, and they help organizations build trust. Business leaders become far more comfortable adopting AI when they can explain how an important decision was reached. Approaches like Google’s Secure AI Framework reinforce the same idea: AI security has to be measurable, observable and accountable end to end.

One misconception I still encounter is that AI security exists to restrict innovation. In practice, the organizations moving fastest with enterprise AI are often the ones investing most heavily in governance, because executives gain confidence, developers move faster and business units adopt AI more broadly. Done well, security is what makes that speed possible.

Looking back, the most valuable lesson hasn’t been about prompt engineering, model selection or agent frameworks. It’s that secure AI isn’t achieved through one perfect control but through hundreds of small engineering decisions that keep autonomous systems aligned with business intent. As we move from assistants toward fully autonomous agents, that distinction only matters more. The teams I trust to scale AI aren’t the ones with the smartest models. They’re the ones who can answer, for any action an agent took, why it took it — and where it would have stopped.

The loudest conversation in business right now is about how much value AI actually generates. Over the last year, AI has moved from a side experiment to a strategic priority. It has its own budget line, its own place on the board’s agenda and its own pressure to show results. Every leader is asking a version of the same question: What are we getting back?

To answer it, most reach for the three measures they have always trusted to judge a technology:

• How much faster are we now?
• How much money has it saved us?
• How many of our people are using it?

Speed, cost and adoption were the right yardsticks for every major technology of the past two decades. They worked because the capability of traditional software was fixed and known on the day you deployed it. The tool did a defined job. Its value had a ceiling you could see, and each metric measured your progress toward that ceiling. Cost reduction told you how much you could save. Adoption told you how much of the capability you had rolled out. Speed told you how much of the promised acceleration was reaching the output.

In every case, the tool was a constant, and the metric measured how fully the organization had absorbed that constant.

These metrics are not working for AI. The reason starts with how AI entered our organizations.

Every technology before this was chosen somewhere above us, deployed to us and trained into us. By the time it arrived on our desks, someone had already decided what it was for. AI came the other way. It landed as a personal productivity tool. You opened a tab, typed a question and something useful came back. Nobody defined its capability in advance, because its capability is not fixed. What it produces depends on who is using it and how well. Metrics built for fixed capabilities have nothing stable to measure, and here is what happens when you apply them anyway.

Why speed, cost and adoption fail as AI evaluation metrics

Let’s start with speed. Task speed and business speed are different quantities, and AI only touches the former. Suppose a report that took eight hours now takes two. Your dashboard shows a 75% improvement. But the report still waits three days for review and a week for approval before anyone acts on it. The organization sees dramatic task-level gains but no movement in business results and concludes AI failed. The problem is the metric measuring a layer that was never the bottleneck.

Speed creates a second problem, and it is worse. Getting good output from AI requires checking it, correcting it and feeding those corrections back into how the tool is used. That work is slow. On any speed metric, it looks like inefficiency. So, people under speed pressure skip it. They accept output uncritically and produce more volume with less scrutiny.

Cost reduction has an arithmetic problem. If you frame AI as a way to reduce what you currently spend, your maximum possible win is your current spend. If your content team costs a million dollars, the best case in a cost frame is saving a million dollars. Every general-purpose technology has followed the same sequence: Efficiency gains came first, and the larger value came later, from work that did not exist before.

For AI, that means the analysis nobody had time for, the personalization no team could staff, the experiments too expensive to justify. A cost frame makes all of that invisible because new work doesn’t reduce anything. There is no column on the dashboard for things you couldn’t do last year.

Cost framing also works against its own inputs. AI improves through use by knowledgeable people. It needs their corrections, their context and their judgment about what good output looks like. When AI’s success is measured in headcount avoided, those people understand exactly what they are being asked to build: Their own replacement. They respond rationally. They use the tools shallowly and keep their expertise to themselves. The metric announces an intent, and the intent destroys the participation the technology depends on.

Adoption looks like the safest of the three. The problem is that adoption measures usage, and usage is not a value. Researchers at several central banks recently asked thousands of senior executives about this and heard the same two things from most of them: Yes, we use AI across the business, and no, it has not changed our results yet.

A thousand employees asking AI to shorten their emails will produce a spectacular adoption number and almost nothing else. Fifty employees using AI on judgment-heavy work, feeding it real context and checking its output against real standards, will barely register on the dashboard and generate most of the actual return. Adoption metrics cannot tell these two groups apart. Worse, they reward the shallow pattern. Shallow use is easy to spread, and deep use is hard, so an organization managed on adoption drifts toward the use that is easiest to count.

6 signals that track the real value

A few months ago, I realized the ROI question was aimed at the wrong object. Every company I compete with has access to the same models I do, at the same price. Whatever value comes from the model itself, my competitors receive too, so it cancels out any comparison between us. It cannot be an advantage, and it is not an interesting thing to measure. The only variable left is us. The standards, the context and the judgment we build around the model, because none of that arrives with the subscription and none of it can be bought. So, when I evaluate AI, I am evaluating my own organization and how quickly it turns a commodity everyone has into a capability only we have. The six signals below all measure that second thing.

1. Review burden is falling on the same class of work

Take any recurring task the organization runs through AI: Monthly reports, vendor evaluations, code review. Track how much human checking each unit of output needs, quarter over quarter. If a task needed a full senior review in January and needed a spot check in June, something real happened. The organization encoded its quality standards, improved its inputs and learned where the tool fails. If the review burden is flat, the organization is consuming AI, not compounding on it, no matter what the adoption dashboard says.

• How to measure it: Pick five recurring workflows, log review hours per output and plot the trend. The trend is the signal. The absolute number matters far less.

2. Corrections become shared fixes

When someone discovers that the AI gets something wrong, how long does it take for that discovery to become a shared fix? In a healthy system, one person’s correction becomes an updated prompt, a revised guideline or a documented example of good versus bad within days. Nobody else has to rediscover the same failure. In an unhealthy system, every employee privately learns the same lessons. The knowledge lives in individual chat histories, and it leaves with each departure.

• How to measure it: Sample recent corrections and trace them. Did they land anywhere reusable? How long did it take? An organization that cannot answer these questions at all has its answer.

3. The team does work that it could not do before

The largest returns from any general-purpose technology come from previously impossible work, not from old work done faster. So, look at the work itself. Is the organization doing the same portfolio of tasks faster, or is the portfolio expanding?

• How to measure it: Once a year, list what the team produces now that it did not and could not produce before. If the list is empty after a year of heavy AI use, the organization has been optimizing instead of expanding, and it is capturing the smallest slice of the available value.

4. The delegation boundary is moving

Every organization has an implicit line: Work AI does alone, work AI does with human review, work humans do entirely. Watch whether that line moves. Work that needed full human ownership last year and needs only oversight now is direct evidence of accumulated capability, clearer standards and earned trust. A frozen boundary means frozen capability.

• How to measure it: Make the implicit map explicit. Build a simple inventory of task types and their current delegation level, then re-score it quarterly. The change is the signal. It is also one of the few AI metrics a board can grasp intuitively: This category moved from full review to spot check, and here is what we built to make that safe.

5. Cost per verified outcome is falling

What does it cost, all in, to produce a unit of work you would actually ship: checked, corrected, done? All in means the subscription, the prompting time, the review time and the rework when errors slip through.

This number does two jobs. It exposes the true economics, which usually look worse than the dashboard claims early on, because the human labor around the tool costs more than the tool itself. And it gives you the one number that should fall over time if capability is genuinely accumulating, because encoded standards and better context reduce exactly those human hours.

• How to measure it: Instrument one workflow end-to-end, honestly, before generalizing. Most organizations have never done this once.

6. Use is getting deeper, not just wider

Adoption metrics count users. This signal counts the nature of use. Shallow use, such as rewriting emails and summarizing documents, spreads fast and produces little. Deep use, where AI is applied to judgment-heavy work with real context and real evaluation, spreads slowly and produces most of the return.

• How to measure it: Classify actual usage into shallow and deep, even roughly, and track the ratio. Fifty deep users beat a thousand shallow ones, and only this signal can tell you which group you have.

Two cautions

First, any of these signals can be gamed once it becomes a target. This is Goodhart’s Law. The review burden can fall because people simply review less. So, pair every efficiency signal with a quality check, such as error rates, rework and downstream complaints.

Second, expect the early numbers to look bad. Honest instrumentation usually shows that AI currently costs more per verified outcome than the old process, because the organization is still paying its learning costs.

Final thoughts

I am not saying AI is overhyped, and I am not saying speed, cost and adoption will never matter. Every real gain eventually shows up in those numbers. I am saying they show up last because they are the output of a learning process, not the process itself. Judge AI by them today, and you will make your keep-or-kill decisions years before the evidence arrives.

If I could track only one thing, it would be the delegation boundary. It compresses everything else into a single observable fact. The boundary only moves when context has been encoded, standards have been made explicit, corrections have been institutionalized and trust has been earned through verified results. It is the output yardstick of the entire learning system. If this has not moved in a year, no other number on the dashboard means anything, however green it looks.

Measure the learning, and the returns will follow. Measure only the returns, and you may kill the learning that produces them.

The scheduling fallacy and the shift to autonomy

Walk onto almost any manufacturing shop floor, and you will witness the same systemic vulnerability: a brilliantly engineered, multi-million-dollar Advanced Planning and Scheduling (APS) system rendered completely useless by a single delayed delivery truck, an unexpected machine drift or a sudden workforce shortage. Industrial operations do not happen in a sterile room; the moment a perfect plan hits the messy reality of the physical shop floor, real-world variables inevitably shatter it.

This is the scenario (or challenge) that I have been navigating over the past few months and is likely to keep me occupied for the remainder of the year. I began this project believing the scheduling engine was the problem. After months of experimentation, including trying to make LLMs perform optimization, I realized I was solving the wrong problem. The realization that dawned on me was that it wasn’t about a better algorithm; it was about separating mathematical optimization from operational reasoning.

According to the 2026 Gartner Manufacturing Predicts report, factory orchestration is moving rapidly toward a “double helix” model where software-defined enterprise data intricately intertwines with autonomous production orchestration. Gartner also projects that 40% of enterprise applications will feature integrated, task-specific AI agents by the end of 2026 — a massive leap from less than 5% in 2025. For technology leaders, the mandate is clear.

Deconstructing the “reasoning layer”

Let’s first demystify what a “Reasoning Layer” is and what it is not. It is not a Generative AI nor is it a glorified Robotic Process Automation (RPA) script executing static, hardcoded logic. Instead, the Reasoning Layer is a cognitive overlay powered by foundation models. These models have been fine-tuned on operational ontologies, enterprise supply chain strategies and real-time shop-floor data streams. Pretty much everything that happens in your organization and, in many cases, outside as well, as some decisions are impacted by the prevailing external situation.

A reasoning layer continuously answers a complex question: Given this specific disruption, what is the optimal business choice right now?

The dual-engine architecture: Math meets cognition

A common pitfall has been to expect an LLM to handle both. That was the blunder I committed was to assume that a sufficiently trained LLM can get the job done.

The true breakthrough in designing a production-grade scheduling application lies in pairing semantic intelligence with raw mathematical muscle.

To solve this, what I discovered was that you need to split it into two layers. A number-crunching mathematical layer and a qualitative layer. Both working in sync.  

1. The quantitative engine: Global pathfinding, sequence optimization and multi-plant capacity balancing are treated as a highly complex routing problem. Ant Colony Optimization (ACO) algorithm, for example, excels here. It can navigate massive combinatorial data spaces to find optimal/near-optimal scheduling sequences across interdependent lines. A word of caution though: This requires good quality data and lots of it.
2. The qualitative brain (agentic AI): The AI agent serves as the dynamic coordinator. It monitors the operational environment for live telemetry anomalies (such as machine cycle-time drifts or supply chain delays). When an anomaly occurs, the agent evaluates the business impact. Determines whether a re-optimization is required and crucially rewrites the constraints and boundary conditions before triggering the ACO engine.

By using the Agentic Layer to bound the mathematical problem, the system avoids the fatal flaw of traditional advanced planning tools: completely rewriting a global schedule over a minor local exception.

The multi-plant orchestration paradox

When a manufacturing organization expands from a single facility to a distributed, multi-plant network, operational complexity does not scale linearly — it scales exponentially. In theory, a multi-plant footprint should provide an enterprise with built-in resilience, giving leadership the flexibility to shift production loads when disruptions strike. Most manufacturing organizations suffer from the multi-plant orchestration paradox: they possess massive regional capacity but are structurally blind to how to leverage it dynamically.

The root cause of this paradox is the historical legacy corporate silo. If a plant in Chennai faces a sudden logistics bottleneck or a critical machine breakdown, its local team scrambles in isolation. Meanwhile, a sister plant in Pune operates completely unaware that it possesses the excess capacity, specific tooling or material buffers required to absorb the overflow.

By the time information filters up to corporate logistics and decisions are taken, you would have lost precious capacity and time.

Enter MAGS: The rise of agent-to-agent collaboration

To shatter these corporate silos, the reasoning layer must expand past local optimizations and facilitate cross-facility orchestration. This shift is driven by a distinct architectural evolution: Multi-agent generative systems (MAGS). Gartner highlights the rapid acceleration of this trend, predicting that by 2027, one-third of all agentic AI implementations will focus heavily on autonomous agent-to-agent collaboration.

In a MAGS framework, the scheduling agents of individual plants do not operate in a vacuum. Instead, they form an interconnected, distributed network capable of autonomous negotiation. The architectural flow of this cross-facility negotiation occurs across three distinct phases:

• Perception: Local plant agents continuously ingest live IIoT telemetry, tracking real-time machine interdependencies, resource pooling variances and material transit times across physical transport lanes.
• Interpretation: When an anomaly occurs, the local agent instantly evaluates the disruption against localized business constraints.
• Negotiation: Rather than escalating every minor bottleneck to a human director, Plant A’s scheduling agent connects directly to Plant B’s agent over the secure network. The agents cross-negotiate load-balancing options, evaluate transportation lead times and run localized optimization calculations in parallel.

Instead of forcing supply chain teams to manually bridge data gaps during a crisis, the system bypasses legacy functional silos. It presents the COO’s operations team with a pre-validated, end-to-end scheduling solution.

Real-world applications: Grounding autonomy in industrial reality

To understand how this functions in the real world, we must look beyond theoretical multi-agent frameworks and examine how this architecture operates within live factories. The following two case studies—drawn from highly documented, peer-reviewed industrial implementations — demonstrate how multi-agent generative systems (MAGS) actively protect margins and timelines when unexpected disruptions strike.

Case study 1: The discrete architecture (The Festo cyber-physical agent framework)

• The context: This architecture is modeled after the landmark decentralized orchestration frameworks deployed at Festo’s Scharnhausen Technology Plant. Instead of relying on a centralized ERP/MES brain to dictate every move, the facility utilizes cyber-physical systems (CPS) where the physical components and machines operate as an interconnected multi-agent system (MAS).
• The disruption: During a high-volume discrete run of automation components, a critical machining center suffering an unexpected tooling failure, in a traditional centralized setup, would have triggered a cascade of line stoppages.
• The intervention: The affected machine’s resource agent instantly broadcasts its downtime status across the network. The task agents ingest the anomaly and independently query neighboring machining cells. The setup utilizes an underlying ACO routing routine to calculate the most efficient physical path through alternative, under-utilized cells. The Task Agents actively barter for open capacity with these alternative resource agents, dynamically adjusting their own operational sequences.

Case study 2: The process pivot (The TU Dresden battery manufacturing framework)

• The context: This case is drawn directly from a multi-layer agent-based framework engineered for a European lead-acid battery manufacturer in coordination with researchers at TU Dresden. The environment features 31 highly energy-intensive heat-treatment and curing chambers, where localized utility tariff volatility drastically impacts production margins. Continuous chemical process lines cannot simply be shut down without massive material waste and lengthy restart sequences.
• The disruption: A sudden, localized weather event triggers an unpredicted spike in peak-load electricity pricing, threatening to entirely erase the profit margin on a high-volume production run.
• The intervention: To solve this, the plant utilized a multi-layer agent-based framework. An energy-monitoring agent tracking live utility tariff feeds communicated the financial threat directly to the production scheduling agent. Instead of a crude emergency halt, the reasoning layer queried the facility’s computerized maintenance management system (CMMS). The agentic layer identified a mandatory 4-hour preventative maintenance window scheduled for three days later. The agent made an executive operational decision: it pulled that maintenance window forward to occur during the exact hours of peak utility pricing, converting an expensive tariff penalty into required downtime. Simultaneously, lower-level agents representing the individual curing chambers and material pallets recalculated local constraints, instructing the optimization engine to compress and accelerate subsequent production batches during the cheaper, off-peak night shifts.

The business outcome

In both cases, the agents optimized an operational pivot, and optimally utilised production capacity in the former and saved precious cash in the latter.

Governance, trust and the “human-in-the-loop” guardrails

All that seems great and seems like science fiction; it inevitably raises a critical, polarizing question for the C-suite: If the algorithms are making multi-thousand-dollar operational choices in real time, how do we maintain control?

The solution to this executive anxiety is a framework defined as “autonomy within boundaries,” executed through policy-as-code. Under this model, operational leaders stop managing the volatility of daily schedules. Instead, they focus on creating and managing policy boundaries within which the agents are permitted to negotiate and self-heal.

This splits operational exceptions into 2 zones:

• Autonomous execution zone: The multi-agent system has full authority to re-sequence lines, re-route components or shift maintenance windows autonomously, provided the financial & operational impact is under a predefined limit.  
• Expert advisory zone: The moment a proposed optimization breaches either of these metrics, the agent pushes it to an executive dashboard for immediate human intervention, validation and approval.

This dual-layer approach introduces a reliable operational framework to industrial manufacturing: leadership manages strategic intent, while tactical units manage real-time execution.

By establishing clear thresholds, the fear of an algorithmic “runaway train” is entirely mitigated. However, deploying a complete multi-agent governance framework across an entire enterprise footprint cannot happen overnight.

To move this from my serendipitous but compelling discovery to a live, risk-mitigated environment, I need a highly controlled, phased deployment strategy, an actionable roadmap to pilot, test and scale the reasoning layer without disrupting current production baselines.

We often say Industry 4.0 connected machines. I believe Industry 5.0 will connect decisions. The factories that succeed will not simply automate workflows; they will build systems capable of reasoning within clearly defined operational boundaries.

I am therefore not writing a conclusion here. I would probably be back in a few months writing about the outcome of this exercise. Somehow deep-down I suspect it would be less oriented to technology but how the change management progressed. I have a strong feeling that “…operational leaders stop managing the volatility of daily schedules. Instead, they focus on creating and managing policy boundaries …” would be the toughest part of this change.   

The scheduling fallacy and the shift to autonomy

Walk onto almost any manufacturing shop floor, and you will witness the same systemic vulnerability: a brilliantly engineered, multi-million-dollar Advanced Planning and Scheduling (APS) system rendered completely useless by a single delayed delivery truck, an unexpected machine drift or a sudden workforce shortage. Industrial operations do not happen in a sterile room; the moment a perfect plan hits the messy reality of the physical shop floor, real-world variables inevitably shatter it.

This is the scenario (or challenge) that I have been navigating over the past few months and is likely to keep me occupied for the remainder of the year. I began this project believing the scheduling engine was the problem. After months of experimentation, including trying to make LLMs perform optimization, I realized I was solving the wrong problem. The realization that dawned on me was that it wasn’t about a better algorithm; it was about separating mathematical optimization from operational reasoning.

According to the 2026 Gartner Manufacturing Predicts report, factory orchestration is moving rapidly toward a “double helix” model where software-defined enterprise data intricately intertwines with autonomous production orchestration. Gartner also projects that 40% of enterprise applications will feature integrated, task-specific AI agents by the end of 2026 — a massive leap from less than 5% in 2025. For technology leaders, the mandate is clear.

Deconstructing the “reasoning layer”

Let’s first demystify what a “Reasoning Layer” is and what it is not. It is not a Generative AI nor is it a glorified Robotic Process Automation (RPA) script executing static, hardcoded logic. Instead, the Reasoning Layer is a cognitive overlay powered by foundation models. These models have been fine-tuned on operational ontologies, enterprise supply chain strategies and real-time shop-floor data streams. Pretty much everything that happens in your organization and, in many cases, outside as well, as some decisions are impacted by the prevailing external situation.

A reasoning layer continuously answers a complex question: Given this specific disruption, what is the optimal business choice right now?

The dual-engine architecture: Math meets cognition

A common pitfall has been to expect an LLM to handle both. That was the blunder I committed was to assume that a sufficiently trained LLM can get the job done.

The true breakthrough in designing a production-grade scheduling application lies in pairing semantic intelligence with raw mathematical muscle.

To solve this, what I discovered was that you need to split it into two layers. A number-crunching mathematical layer and a qualitative layer. Both working in sync.  

1. The quantitative engine: Global pathfinding, sequence optimization and multi-plant capacity balancing are treated as a highly complex routing problem. Ant Colony Optimization (ACO) algorithm, for example, excels here. It can navigate massive combinatorial data spaces to find optimal/near-optimal scheduling sequences across interdependent lines. A word of caution though: This requires good quality data and lots of it.
2. The qualitative brain (agentic AI): The AI agent serves as the dynamic coordinator. It monitors the operational environment for live telemetry anomalies (such as machine cycle-time drifts or supply chain delays). When an anomaly occurs, the agent evaluates the business impact. Determines whether a re-optimization is required and crucially rewrites the constraints and boundary conditions before triggering the ACO engine.

By using the Agentic Layer to bound the mathematical problem, the system avoids the fatal flaw of traditional advanced planning tools: completely rewriting a global schedule over a minor local exception.

The multi-plant orchestration paradox

When a manufacturing organization expands from a single facility to a distributed, multi-plant network, operational complexity does not scale linearly — it scales exponentially. In theory, a multi-plant footprint should provide an enterprise with built-in resilience, giving leadership the flexibility to shift production loads when disruptions strike. Most manufacturing organizations suffer from the multi-plant orchestration paradox: they possess massive regional capacity but are structurally blind to how to leverage it dynamically.

The root cause of this paradox is the historical legacy corporate silo. If a plant in Chennai faces a sudden logistics bottleneck or a critical machine breakdown, its local team scrambles in isolation. Meanwhile, a sister plant in Pune operates completely unaware that it possesses the excess capacity, specific tooling or material buffers required to absorb the overflow.

By the time information filters up to corporate logistics and decisions are taken, you would have lost precious capacity and time.

Enter MAGS: The rise of agent-to-agent collaboration

To shatter these corporate silos, the reasoning layer must expand past local optimizations and facilitate cross-facility orchestration. This shift is driven by a distinct architectural evolution: Multi-agent generative systems (MAGS). Gartner highlights the rapid acceleration of this trend, predicting that by 2027, one-third of all agentic AI implementations will focus heavily on autonomous agent-to-agent collaboration.

In a MAGS framework, the scheduling agents of individual plants do not operate in a vacuum. Instead, they form an interconnected, distributed network capable of autonomous negotiation. The architectural flow of this cross-facility negotiation occurs across three distinct phases:

• Perception: Local plant agents continuously ingest live IIoT telemetry, tracking real-time machine interdependencies, resource pooling variances and material transit times across physical transport lanes.
• Interpretation: When an anomaly occurs, the local agent instantly evaluates the disruption against localized business constraints.
• Negotiation: Rather than escalating every minor bottleneck to a human director, Plant A’s scheduling agent connects directly to Plant B’s agent over the secure network. The agents cross-negotiate load-balancing options, evaluate transportation lead times and run localized optimization calculations in parallel.

Instead of forcing supply chain teams to manually bridge data gaps during a crisis, the system bypasses legacy functional silos. It presents the COO’s operations team with a pre-validated, end-to-end scheduling solution.

Real-world applications: Grounding autonomy in industrial reality

To understand how this functions in the real world, we must look beyond theoretical multi-agent frameworks and examine how this architecture operates within live factories. The following two case studies—drawn from highly documented, peer-reviewed industrial implementations — demonstrate how multi-agent generative systems (MAGS) actively protect margins and timelines when unexpected disruptions strike.

Case study 1: The discrete architecture (The Festo cyber-physical agent framework)

• The context: This architecture is modeled after the landmark decentralized orchestration frameworks deployed at Festo’s Scharnhausen Technology Plant. Instead of relying on a centralized ERP/MES brain to dictate every move, the facility utilizes cyber-physical systems (CPS) where the physical components and machines operate as an interconnected multi-agent system (MAS).
• The disruption: During a high-volume discrete run of automation components, a critical machining center suffering an unexpected tooling failure, in a traditional centralized setup, would have triggered a cascade of line stoppages.
• The intervention: The affected machine’s resource agent instantly broadcasts its downtime status across the network. The task agents ingest the anomaly and independently query neighboring machining cells. The setup utilizes an underlying ACO routing routine to calculate the most efficient physical path through alternative, under-utilized cells. The Task Agents actively barter for open capacity with these alternative resource agents, dynamically adjusting their own operational sequences.

Case study 2: The process pivot (The TU Dresden battery manufacturing framework)

• The context: This case is drawn directly from a multi-layer agent-based framework engineered for a European lead-acid battery manufacturer in coordination with researchers at TU Dresden. The environment features 31 highly energy-intensive heat-treatment and curing chambers, where localized utility tariff volatility drastically impacts production margins. Continuous chemical process lines cannot simply be shut down without massive material waste and lengthy restart sequences.
• The disruption: A sudden, localized weather event triggers an unpredicted spike in peak-load electricity pricing, threatening to entirely erase the profit margin on a high-volume production run.
• The intervention: To solve this, the plant utilized a multi-layer agent-based framework. An energy-monitoring agent tracking live utility tariff feeds communicated the financial threat directly to the production scheduling agent. Instead of a crude emergency halt, the reasoning layer queried the facility’s computerized maintenance management system (CMMS). The agentic layer identified a mandatory 4-hour preventative maintenance window scheduled for three days later. The agent made an executive operational decision: it pulled that maintenance window forward to occur during the exact hours of peak utility pricing, converting an expensive tariff penalty into required downtime. Simultaneously, lower-level agents representing the individual curing chambers and material pallets recalculated local constraints, instructing the optimization engine to compress and accelerate subsequent production batches during the cheaper, off-peak night shifts.

The business outcome

In both cases, the agents optimized an operational pivot, and optimally utilised production capacity in the former and saved precious cash in the latter.

Governance, trust and the “human-in-the-loop” guardrails

All that seems great and seems like science fiction; it inevitably raises a critical, polarizing question for the C-suite: If the algorithms are making multi-thousand-dollar operational choices in real time, how do we maintain control?

The solution to this executive anxiety is a framework defined as “autonomy within boundaries,” executed through policy-as-code. Under this model, operational leaders stop managing the volatility of daily schedules. Instead, they focus on creating and managing policy boundaries within which the agents are permitted to negotiate and self-heal.

This splits operational exceptions into 2 zones:

• Autonomous execution zone: The multi-agent system has full authority to re-sequence lines, re-route components or shift maintenance windows autonomously, provided the financial & operational impact is under a predefined limit.  
• Expert advisory zone: The moment a proposed optimization breaches either of these metrics, the agent pushes it to an executive dashboard for immediate human intervention, validation and approval.

This dual-layer approach introduces a reliable operational framework to industrial manufacturing: leadership manages strategic intent, while tactical units manage real-time execution.

By establishing clear thresholds, the fear of an algorithmic “runaway train” is entirely mitigated. However, deploying a complete multi-agent governance framework across an entire enterprise footprint cannot happen overnight.

To move this from my serendipitous but compelling discovery to a live, risk-mitigated environment, I need a highly controlled, phased deployment strategy, an actionable roadmap to pilot, test and scale the reasoning layer without disrupting current production baselines.

We often say Industry 4.0 connected machines. I believe Industry 5.0 will connect decisions. The factories that succeed will not simply automate workflows; they will build systems capable of reasoning within clearly defined operational boundaries.

I am therefore not writing a conclusion here. I would probably be back in a few months writing about the outcome of this exercise. Somehow deep-down I suspect it would be less oriented to technology but how the change management progressed. I have a strong feeling that “…operational leaders stop managing the volatility of daily schedules. Instead, they focus on creating and managing policy boundaries …” would be the toughest part of this change.   

The loudest conversation in business right now is about how much value AI actually generates. Over the last year, AI has moved from a side experiment to a strategic priority. It has its own budget line, its own place on the board’s agenda and its own pressure to show results. Every leader is asking a version of the same question: What are we getting back?

To answer it, most reach for the three measures they have always trusted to judge a technology:

• How much faster are we now?
• How much money has it saved us?
• How many of our people are using it?

Speed, cost and adoption were the right yardsticks for every major technology of the past two decades. They worked because the capability of traditional software was fixed and known on the day you deployed it. The tool did a defined job. Its value had a ceiling you could see, and each metric measured your progress toward that ceiling. Cost reduction told you how much you could save. Adoption told you how much of the capability you had rolled out. Speed told you how much of the promised acceleration was reaching the output.

In every case, the tool was a constant, and the metric measured how fully the organization had absorbed that constant.

These metrics are not working for AI. The reason starts with how AI entered our organizations.

Every technology before this was chosen somewhere above us, deployed to us and trained into us. By the time it arrived on our desks, someone had already decided what it was for. AI came the other way. It landed as a personal productivity tool. You opened a tab, typed a question and something useful came back. Nobody defined its capability in advance, because its capability is not fixed. What it produces depends on who is using it and how well. Metrics built for fixed capabilities have nothing stable to measure, and here is what happens when you apply them anyway.

Why speed, cost and adoption fail as AI evaluation metrics

Let’s start with speed. Task speed and business speed are different quantities, and AI only touches the former. Suppose a report that took eight hours now takes two. Your dashboard shows a 75% improvement. But the report still waits three days for review and a week for approval before anyone acts on it. The organization sees dramatic task-level gains but no movement in business results and concludes AI failed. The problem is the metric measuring a layer that was never the bottleneck.

Speed creates a second problem, and it is worse. Getting good output from AI requires checking it, correcting it and feeding those corrections back into how the tool is used. That work is slow. On any speed metric, it looks like inefficiency. So, people under speed pressure skip it. They accept output uncritically and produce more volume with less scrutiny.

Cost reduction has an arithmetic problem. If you frame AI as a way to reduce what you currently spend, your maximum possible win is your current spend. If your content team costs a million dollars, the best case in a cost frame is saving a million dollars. Every general-purpose technology has followed the same sequence: Efficiency gains came first, and the larger value came later, from work that did not exist before.

For AI, that means the analysis nobody had time for, the personalization no team could staff, the experiments too expensive to justify. A cost frame makes all of that invisible because new work doesn’t reduce anything. There is no column on the dashboard for things you couldn’t do last year.

Cost framing also works against its own inputs. AI improves through use by knowledgeable people. It needs their corrections, their context and their judgment about what good output looks like. When AI’s success is measured in headcount avoided, those people understand exactly what they are being asked to build: Their own replacement. They respond rationally. They use the tools shallowly and keep their expertise to themselves. The metric announces an intent, and the intent destroys the participation the technology depends on.

Adoption looks like the safest of the three. The problem is that adoption measures usage, and usage is not a value. Researchers at several central banks recently asked thousands of senior executives about this and heard the same two things from most of them: Yes, we use AI across the business, and no, it has not changed our results yet.

A thousand employees asking AI to shorten their emails will produce a spectacular adoption number and almost nothing else. Fifty employees using AI on judgment-heavy work, feeding it real context and checking its output against real standards, will barely register on the dashboard and generate most of the actual return. Adoption metrics cannot tell these two groups apart. Worse, they reward the shallow pattern. Shallow use is easy to spread, and deep use is hard, so an organization managed on adoption drifts toward the use that is easiest to count.

6 signals that track the real value

A few months ago, I realized the ROI question was aimed at the wrong object. Every company I compete with has access to the same models I do, at the same price. Whatever value comes from the model itself, my competitors receive too, so it cancels out any comparison between us. It cannot be an advantage, and it is not an interesting thing to measure. The only variable left is us. The standards, the context and the judgment we build around the model, because none of that arrives with the subscription and none of it can be bought. So, when I evaluate AI, I am evaluating my own organization and how quickly it turns a commodity everyone has into a capability only we have. The six signals below all measure that second thing.

1. Review burden is falling on the same class of work

Take any recurring task the organization runs through AI: Monthly reports, vendor evaluations, code review. Track how much human checking each unit of output needs, quarter over quarter. If a task needed a full senior review in January and needed a spot check in June, something real happened. The organization encoded its quality standards, improved its inputs and learned where the tool fails. If the review burden is flat, the organization is consuming AI, not compounding on it, no matter what the adoption dashboard says.

• How to measure it: Pick five recurring workflows, log review hours per output and plot the trend. The trend is the signal. The absolute number matters far less.

2. Corrections become shared fixes

When someone discovers that the AI gets something wrong, how long does it take for that discovery to become a shared fix? In a healthy system, one person’s correction becomes an updated prompt, a revised guideline or a documented example of good versus bad within days. Nobody else has to rediscover the same failure. In an unhealthy system, every employee privately learns the same lessons. The knowledge lives in individual chat histories, and it leaves with each departure.

• How to measure it: Sample recent corrections and trace them. Did they land anywhere reusable? How long did it take? An organization that cannot answer these questions at all has its answer.

3. The team does work that it could not do before

The largest returns from any general-purpose technology come from previously impossible work, not from old work done faster. So, look at the work itself. Is the organization doing the same portfolio of tasks faster, or is the portfolio expanding?

• How to measure it: Once a year, list what the team produces now that it did not and could not produce before. If the list is empty after a year of heavy AI use, the organization has been optimizing instead of expanding, and it is capturing the smallest slice of the available value.

4. The delegation boundary is moving

Every organization has an implicit line: Work AI does alone, work AI does with human review, work humans do entirely. Watch whether that line moves. Work that needed full human ownership last year and needs only oversight now is direct evidence of accumulated capability, clearer standards and earned trust. A frozen boundary means frozen capability.

• How to measure it: Make the implicit map explicit. Build a simple inventory of task types and their current delegation level, then re-score it quarterly. The change is the signal. It is also one of the few AI metrics a board can grasp intuitively: This category moved from full review to spot check, and here is what we built to make that safe.

5. Cost per verified outcome is falling

What does it cost, all in, to produce a unit of work you would actually ship: checked, corrected, done? All in means the subscription, the prompting time, the review time and the rework when errors slip through.

This number does two jobs. It exposes the true economics, which usually look worse than the dashboard claims early on, because the human labor around the tool costs more than the tool itself. And it gives you the one number that should fall over time if capability is genuinely accumulating, because encoded standards and better context reduce exactly those human hours.

• How to measure it: Instrument one workflow end-to-end, honestly, before generalizing. Most organizations have never done this once.

6. Use is getting deeper, not just wider

Adoption metrics count users. This signal counts the nature of use. Shallow use, such as rewriting emails and summarizing documents, spreads fast and produces little. Deep use, where AI is applied to judgment-heavy work with real context and real evaluation, spreads slowly and produces most of the return.

• How to measure it: Classify actual usage into shallow and deep, even roughly, and track the ratio. Fifty deep users beat a thousand shallow ones, and only this signal can tell you which group you have.

Two cautions

First, any of these signals can be gamed once it becomes a target. This is Goodhart’s Law. The review burden can fall because people simply review less. So, pair every efficiency signal with a quality check, such as error rates, rework and downstream complaints.

Second, expect the early numbers to look bad. Honest instrumentation usually shows that AI currently costs more per verified outcome than the old process, because the organization is still paying its learning costs.

Final thoughts

I am not saying AI is overhyped, and I am not saying speed, cost and adoption will never matter. Every real gain eventually shows up in those numbers. I am saying they show up last because they are the output of a learning process, not the process itself. Judge AI by them today, and you will make your keep-or-kill decisions years before the evidence arrives.

If I could track only one thing, it would be the delegation boundary. It compresses everything else into a single observable fact. The boundary only moves when context has been encoded, standards have been made explicit, corrections have been institutionalized and trust has been earned through verified results. It is the output yardstick of the entire learning system. If this has not moved in a year, no other number on the dashboard means anything, however green it looks.

Measure the learning, and the returns will follow. Measure only the returns, and you may kill the learning that produces them.

Given the widespread enterprise adoption of passkeys to replace passwords, a Palo Alto Networks Unit 42 report disclosing ways attackers are getting around passkey protections is concerning, analysts say, but they stress that the demonstrated attacks can only happen after a successful intrusion.

They also pointed out that the issues are not strictly caused by holes in passkeys so much as by weaknesses in the procedures surrounding them. 

“The researchers didn’t break the underlying cryptography. They exploited the seams around it: onboarding flows, recovery mechanisms and trust signals that weren’t being validated,” said Justin Greis, CEO of consulting firm Acceligence. “That distinction matters because it tells us where the actual risk lives.”

The Palo Alto report showed attacks that, it said, “demonstrate how malware on a compromised endpoint can misuse onboarding, recovery and device trust workflows to take over passkey-protected accounts,” as well as “how an attacker can authenticate without user interaction, bypass user verification requirements and extract all synced passkey private keys.”

Palo Alto described three categories of attack, collectively dubbed Pass-ta-key: Pass-ta-key, where an attacker takes over an account protected by a Google-synced passkey using malware running on the victim’s device, without requiring privilege escalation, device unlock or user interaction; Silver Pass-ta-key, which involves an attacker tricking Google Cloud Authenticator into believing the victim has unlocked the device with biometrics, leading to full account takeover without using the victim’s device during authentication; and Golden Pass-ta-key, which allows an attacker to extract all synced passkeys in a form that lets them be shared or sold on the credential black market.

Given the complexity of most global enterprise threat surfaces, some CISOs have struggled with adapting passwordless processes to environments with legacy and virtual environments. Passcodes have been recently embraced by enterprise CISOs as the first step in implementing a passwordless strategy.

Analysts and consultants in the main agreed that the flaw Palo Alto reports is significant, despite the fact that it assumes the attacker has already penetrated an environment and successfully installed malware. Sadly, given that such penetration only requires one privileged user anywhere to accidentally click on a poisoned link or attachment, the assumption of prior penetration is likely valid.

Implementation issues are the problem

What the report reveals is less about any flaws within passcodes directly, and more about the lack of attention paid to a wide range of mechanisms surrounding them. 

Greis said CISOs now need to focus on what to do, and what to test, based on the assumption that user behavior is not always as expected. 

In several cases cited in the report, he pointed out, issues occurred “not because the standard is flawed, but because implementations haven’t caught up to it. It mirrors what we’ve seen repeatedly in security: the specification is sound, but the ecosystem implementing it is uneven.”

Consultant Brian Levine, executive director of FormerGov, agreed. 

“On any service where your organization is the relying party, require user verification and actually validate the user-verified flag in the authentication response,” he said. “The researchers found real-world services accepting logins without it, which quietly collapses a multi-factor login back into a single factor.”

Frank Dickson, group VP for security at IDC, added that he would stress to CISOs that this attack assumes a prior successful penetration. 

“This isn’t passkeys getting hacked from across the internet. It’s what [an attacker] does once they’re already inside the house. So the real headline is that ‘phishing resistant’ stops being resistant the moment the endpoint stops being clean,” he said.

“Stop treating verification as optional,” he advised. “Flip it to required, check it server side every single time, and save your hardware bound keys, the YubiKeys of the world, for the accounts that matter most. A key that never leaves a physical device is a key no attacker can ever harvest in bulk.”

Or Finkelstein, head of marketing at Secret Double Octopus, agreed that CISOs have gotten complacent about the way in which systems support passkeys.

“CISOs should probably look at how user verification is enforced, how enrollment and recovery work, have a clear and enforced policy on whether credentials are synced or device-bound, and have some ITDR system to quickly mitigate suspicious endpoints and authenticators,” he said. “In most serious enterprise environments, EDR and device management reduce the likelihood of initial attacks, but do not close every post-compromise attack path.”

Poor support processes weaken passkeys

Some have argued that the lack of sufficiently robust support processes actually weakens passkey capabilities and undermines the whole point of such systems.

J. Wolfgang Goerlich, a member of the faculty of IANS and a longtime cybersecurity consultant, pointed out that the original FIDO2 spec eliminated credential theft by binding the private key to a physical authenticator. Synced passkeys reintroduced credential portability and therefore reintroduced the form of credential theft risk cited in the Palo Alto report.

“A passwordless system is exactly as strong as the flow that re-establishes it,” he said. “Both serious techniques here start by forcing a device to re-enroll. Many security teams have never modeled, never monitored and never rehearsed a response to this.”

Goerlich’s advice to CISOs is to require device-bound authenticators, such as hardware tokens or computers, for all privileged and sensitive access. They may consider allowing wallets for lower risk access, he said, “however, much like passwords in Web browsers have long been at risk, we must now consider passkeys in the browsers an unacceptable risk.”

This article originally appeared on CSOonline.

Given the widespread enterprise adoption of passkeys to replace passwords, a Palo Alto Networks Unit 42 report disclosing ways attackers are getting around passkey protections is concerning, analysts say, but they stress that the demonstrated attacks can only happen after a successful intrusion.

They also pointed out that the issues are not strictly caused by holes in passkeys so much as by weaknesses in the procedures surrounding them. 

“The researchers didn’t break the underlying cryptography. They exploited the seams around it: onboarding flows, recovery mechanisms and trust signals that weren’t being validated,” said Justin Greis, CEO of consulting firm Acceligence. “That distinction matters because it tells us where the actual risk lives.”

The Palo Alto report showed attacks that, it said, “demonstrate how malware on a compromised endpoint can misuse onboarding, recovery and device trust workflows to take over passkey-protected accounts,” as well as “how an attacker can authenticate without user interaction, bypass user verification requirements and extract all synced passkey private keys.”

Palo Alto described three categories of attack, collectively dubbed Pass-ta-key: Pass-ta-key, where an attacker takes over an account protected by a Google-synced passkey using malware running on the victim’s device, without requiring privilege escalation, device unlock or user interaction; Silver Pass-ta-key, which involves an attacker tricking Google Cloud Authenticator into believing the victim has unlocked the device with biometrics, leading to full account takeover without using the victim’s device during authentication; and Golden Pass-ta-key, which allows an attacker to extract all synced passkeys in a form that lets them be shared or sold on the credential black market.

Given the complexity of most global enterprise threat surfaces, some CISOs have struggled with adapting passwordless processes to environments with legacy and virtual environments. Passcodes have been recently embraced by enterprise CISOs as the first step in implementing a passwordless strategy.

Analysts and consultants in the main agreed that the flaw Palo Alto reports is significant, despite the fact that it assumes the attacker has already penetrated an environment and successfully installed malware. Sadly, given that such penetration only requires one privileged user anywhere to accidentally click on a poisoned link or attachment, the assumption of prior penetration is likely valid.

Implementation issues are the problem

What the report reveals is less about any flaws within passcodes directly, and more about the lack of attention paid to a wide range of mechanisms surrounding them. 

Greis said CISOs now need to focus on what to do, and what to test, based on the assumption that user behavior is not always as expected. 

In several cases cited in the report, he pointed out, issues occurred “not because the standard is flawed, but because implementations haven’t caught up to it. It mirrors what we’ve seen repeatedly in security: the specification is sound, but the ecosystem implementing it is uneven.”

Consultant Brian Levine, executive director of FormerGov, agreed. 

“On any service where your organization is the relying party, require user verification and actually validate the user-verified flag in the authentication response,” he said. “The researchers found real-world services accepting logins without it, which quietly collapses a multi-factor login back into a single factor.”

Frank Dickson, group VP for security at IDC, added that he would stress to CISOs that this attack assumes a prior successful penetration. 

“This isn’t passkeys getting hacked from across the internet. It’s what [an attacker] does once they’re already inside the house. So the real headline is that ‘phishing resistant’ stops being resistant the moment the endpoint stops being clean,” he said.

“Stop treating verification as optional,” he advised. “Flip it to required, check it server side every single time, and save your hardware bound keys, the YubiKeys of the world, for the accounts that matter most. A key that never leaves a physical device is a key no attacker can ever harvest in bulk.”

Or Finkelstein, head of marketing at Secret Double Octopus, agreed that CISOs have gotten complacent about the way in which systems support passkeys.

“CISOs should probably look at how user verification is enforced, how enrollment and recovery work, have a clear and enforced policy on whether credentials are synced or device-bound, and have some ITDR system to quickly mitigate suspicious endpoints and authenticators,” he said. “In most serious enterprise environments, EDR and device management reduce the likelihood of initial attacks, but do not close every post-compromise attack path.”

Poor support processes weaken passkeys

Some have argued that the lack of sufficiently robust support processes actually weakens passkey capabilities and undermines the whole point of such systems.

J. Wolfgang Goerlich, a member of the faculty of IANS and a longtime cybersecurity consultant, pointed out that the original FIDO2 spec eliminated credential theft by binding the private key to a physical authenticator. Synced passkeys reintroduced credential portability and therefore reintroduced the form of credential theft risk cited in the Palo Alto report.

“A passwordless system is exactly as strong as the flow that re-establishes it,” he said. “Both serious techniques here start by forcing a device to re-enroll. Many security teams have never modeled, never monitored and never rehearsed a response to this.”

Goerlich’s advice to CISOs is to require device-bound authenticators, such as hardware tokens or computers, for all privileged and sensitive access. They may consider allowing wallets for lower risk access, he said, “however, much like passwords in Web browsers have long been at risk, we must now consider passkeys in the browsers an unacceptable risk.”

Given the widespread enterprise adoption of passkeys to replace passwords, a Palo Alto Networks Unit 42 report disclosing ways attackers are getting around passkey protections is concerning, analysts say, but they stress that the demonstrated attacks can only happen after a successful intrusion.

They also pointed out that the issues are not strictly caused by holes in passkeys so much as by weaknesses in the procedures surrounding them. 

“The researchers didn’t break the underlying cryptography. They exploited the seams around it: onboarding flows, recovery mechanisms and trust signals that weren’t being validated,” said Justin Greis, CEO of consulting firm Acceligence. “That distinction matters because it tells us where the actual risk lives.”

The Palo Alto report showed attacks that, it said, “demonstrate how malware on a compromised endpoint can misuse onboarding, recovery and device trust workflows to take over passkey-protected accounts,” as well as “how an attacker can authenticate without user interaction, bypass user verification requirements and extract all synced passkey private keys.”

Palo Alto described three categories of attack, collectively dubbed Pass-ta-key: Pass-ta-key, where an attacker takes over an account protected by a Google-synced passkey using malware running on the victim’s device, without requiring privilege escalation, device unlock or user interaction; Silver Pass-ta-key, which involves an attacker tricking Google Cloud Authenticator into believing the victim has unlocked the device with biometrics, leading to full account takeover without using the victim’s device during authentication; and Golden Pass-ta-key, which allows an attacker to extract all synced passkeys in a form that lets them be shared or sold on the credential black market.

Given the complexity of most global enterprise threat surfaces, some CISOs have struggled with adapting passwordless processes to environments with legacy and virtual environments. Passcodes have been recently embraced by enterprise CISOs as the first step in implementing a passwordless strategy.

Analysts and consultants in the main agreed that the flaw Palo Alto reports is significant, despite the fact that it assumes the attacker has already penetrated an environment and successfully installed malware. Sadly, given that such penetration only requires one privileged user anywhere to accidentally click on a poisoned link or attachment, the assumption of prior penetration is likely valid.

Implementation issues are the problem

What the report reveals is less about any flaws within passcodes directly, and more about the lack of attention paid to a wide range of mechanisms surrounding them. 

Greis said CISOs now need to focus on what to do, and what to test, based on the assumption that user behavior is not always as expected. 

In several cases cited in the report, he pointed out, issues occurred “not because the standard is flawed, but because implementations haven’t caught up to it. It mirrors what we’ve seen repeatedly in security: the specification is sound, but the ecosystem implementing it is uneven.”

Consultant Brian Levine, executive director of FormerGov, agreed. 

“On any service where your organization is the relying party, require user verification and actually validate the user-verified flag in the authentication response,” he said. “The researchers found real-world services accepting logins without it, which quietly collapses a multi-factor login back into a single factor.”

Frank Dickson, group VP for security at IDC, added that he would stress to CISOs that this attack assumes a prior successful penetration. 

“This isn’t passkeys getting hacked from across the internet. It’s what [an attacker] does once they’re already inside the house. So the real headline is that ‘phishing resistant’ stops being resistant the moment the endpoint stops being clean,” he said.

“Stop treating verification as optional,” he advised. “Flip it to required, check it server side every single time, and save your hardware bound keys, the YubiKeys of the world, for the accounts that matter most. A key that never leaves a physical device is a key no attacker can ever harvest in bulk.”

Or Finkelstein, head of marketing at Secret Double Octopus, agreed that CISOs have gotten complacent about the way in which systems support passkeys.

“CISOs should probably look at how user verification is enforced, how enrollment and recovery work, have a clear and enforced policy on whether credentials are synced or device-bound, and have some ITDR system to quickly mitigate suspicious endpoints and authenticators,” he said. “In most serious enterprise environments, EDR and device management reduce the likelihood of initial attacks, but do not close every post-compromise attack path.”

Poor support processes weaken passkeys

Some have argued that the lack of sufficiently robust support processes actually weakens passkey capabilities and undermines the whole point of such systems.

J. Wolfgang Goerlich, a member of the faculty of IANS and a longtime cybersecurity consultant, pointed out that the original FIDO2 spec eliminated credential theft by binding the private key to a physical authenticator. Synced passkeys reintroduced credential portability and therefore reintroduced the form of credential theft risk cited in the Palo Alto report.

“A passwordless system is exactly as strong as the flow that re-establishes it,” he said. “Both serious techniques here start by forcing a device to re-enroll. Many security teams have never modeled, never monitored and never rehearsed a response to this.”

Goerlich’s advice to CISOs is to require device-bound authenticators, such as hardware tokens or computers, for all privileged and sensitive access. They may consider allowing wallets for lower risk access, he said, “however, much like passwords in Web browsers have long been at risk, we must now consider passkeys in the browsers an unacceptable risk.”

This article originally appeared on CSOonline.

Modern attacks increasingly begin with the web application.

Customer portals, partner platforms, APIs, external business applications, and AI-powered services have become the front door to the enterprise. The systems organizations build to create value are now the same systems attackers target for initial access.

For years, security teams have invested heavily in protecting networks, endpoints, identities, and cloud infrastructure. Those investments remain essential, but the way attackers gain initial access has changed. Business-critical applications are internet-facing, constantly evolving, deeply connected to enterprise systems, and often changing faster than organizations can continuously validate them.

Artificial intelligence is accelerating this shift. The time between vulnerability discovery and exploitation continues to shrink, allowing attackers to identify and weaponize weaknesses at machine speed. Yet while attacks have evolved, much of security validation still reflects yesterday’s architecture.

That shift is exactly why we built NodeZero WebApp, extending autonomous attack validation to where modern attacks increasingly begin.

Validation still reflects yesterday’s architecture

Most organizations still organize security by technology. Application security teams test web applications. Identity teams validate authentication and access controls. Cloud teams secure cloud infrastructure, while infrastructure teams assess networks and endpoints. Each discipline performs valuable work.

The problem is that attackers don’t organize themselves the same way. They move across technologies, chaining weaknesses together until they reach their objective. A vulnerable application becomes compromised credentials. Compromised credentials become identity abuse. Identity abuse becomes access to cloud resources, infrastructure, and eventually the business systems they were after all along.

Taken together, this means security validation often stops where the next stage of the attack begins.

Attack paths don’t stop at the web application

A SQL injection isn’t the outcome. It’s the beginning of an attack path. An authentication weakness isn’t the breach. It’s simply the first opportunity to move deeper into the environment.

The question isn’t whether a vulnerability exists. Security teams already have plenty of ways to answer that. The real question is what an attacker can do after exploiting it.

Can they compromise identities? Reach sensitive data? Pivot into cloud resources? Move laterally into critical business systems?

Security teams don’t lose because they missed a vulnerability. They lose because they never validated where it could lead. Modern attacks don’t unfold within a single technology stack. They move across applications, identities, infrastructure, and cloud environments until they create business impact. Security validation has to reflect that reality.

Security validation has to change

For years, organizations validated individual technologies because that’s how enterprise environments were built. That approach made sense when applications, identities, infrastructure, and cloud platforms operated more independently and attackers moved more slowly.

Today’s attacks don’t respect those boundaries. Validation shouldn’t either.

It has to begin where attackers begin and continue until business impact is understood.

Asking the right question

Many security tools begin with privileged knowledge. They analyze source code, configuration files, or other internal artifacts before identifying weaknesses. Those approaches answer important questions during software development and secure coding, and they remain an important part of building secure software.

Attackers begin with what they can reach, interacting with an application as it exists in production, scouring exposed source code looking for novel vulnerabilities and stored identities, authenticating when they can, observing how it behaves, and looking for opportunities to move deeper into the environment. Every decision is driven by what the application reveals, not what its developers intended.

Security validation should begin with the same perspective an attacker has, and answer the same question every attacker is trying to answer:

What can I actually reach from here?

That shift changes more than where testing starts. It fundamentally changes what security teams learn from the exercise.

src="https://b2b-contenthub.com/wp-content/uploads/2026/08/configurationimages.png" alt="horizon3">Security validation shouldn’t stop at anonymous pages. NodeZero WebApp safely validates authenticated application workflows, helping organizations assess the same privileged experiences attackers seek after gaining initial access.

Click here to discover how NodeZero WebApp addresses modern attacks.

See NodeZero WebApp in action

Modern attacks start with web applications — but they rarely end there. Join our live webinar to see how NodeZero WebApp safely validates real attack paths from authenticated applications into identity, cloud, and infrastructure, helping you understand the business impact of exploitable weaknesses before attackers do.

Register for our webinar

The mainframe remains the system of record for many of the world’s largest organizations and some of their most critical data. As of 2025, 71% of Fortune 500 companies still use mainframes, and nearly 97% of banks worldwide rely on IBM mainframe products.

Yet many security programs continue to treat the mainframe differently from the rest of the enterprise. Many organizations still assume the mainframe is inherently secure.

Mainframes are designed with strong security controls. But strong controls alone are not enough. Like any critical enterprise system, the mainframe requires continuous verification to ensure those controls are working as intended.

Risk can exist anywhere. An overlooked configuration in a z/OS environment can create opportunities for unauthorized access to sensitive systems and data. As the time between vulnerability discovery and exploitation continues to shrink, organizations need greater visibility into risk across the enterprise—including the mainframe.

Myth #1: Mainframes are unbreachable 

Can mainframes be breached? Although mainframes are designed with robust security features, no technology platform is immune to risk. The reality is simple: attackers go where the valuable data is stored.

The mainframe isn’t isolated from the rest of the enterprise. Mainframes routinely process millions of transactions per day, and high-end systems can process over a million transactions per second in certain workloads. Mainframes are estimated to handle a substantial share of the world’s transactional workloads and credit card processing.

As organizations modernize and connect systems across environments, visibility into potential exposure becomes just as important on z/OS as it is everywhere else. Attackers follow opportunity. Wherever valuable data and business-critical assets reside, flaws will attract attention. As organizations adopt hybrid architectures, the number of interconnected systems continues to grow, making identity governance and access assurance increasingly important.

The solution is to treat the mainframe as part of the enterprise attack surface and manage risk there the same way you do everywhere else. Mainframe security requires the same continuous visibility organizations expect across the rest of the enterprise.

Myth #2: Specialized systems are too complex for attackers

How is AI changing vulnerability discovery? In the past, surfacing exposures on the mainframe required deep expertise that relatively few people had. That complexity made these environments harder to analyze.

Recent attention around Mythos, Anthropic’s highly restricted security research model, has sparked debate about AI’s role in cybersecurity. If security flaws become dramatically easier to find, organizations may have less time to identify and remediate weaknesses before others discover them.

The important point isn’t Mythos itself. It’s that identifying exploitable weaknesses is becoming faster, cheaper, and easier.

Organizations can no longer assume that complexity will keep attackers at bay. Mainframe security strategies should account for a future in which gaps are discovered faster than ever before.

That requires greater visibility into the z/OS environment and the risks it may pose. Continuous analysis helps organizations uncover potential weaknesses early, and the sooner security teams can detect security gaps, the more time they have to fix them.

Myth #3: Annual security assessments are sufficient

Why is continuous vulnerability analysis important for mainframe security? Many organizations still rely on periodic configuration assessments, even though today’s threats move much faster than they did when those processes were created. Today’s mainframe environments are constantly evolving, and new weaknesses can emerge between checkpoints long before the next scheduled assessment.

Security teams need ongoing visibility into risk, not occasional snapshots. That’s why continuous vulnerability analysis has become a critical component of modern mainframe management, helping teams identify and remediate weaknesses before they escalate into incidents.

Organizations have long benefited from the security architecture and integrity of mainframe environments. As vulnerability discovery becomes more efficient, maintaining visibility into those environments becomes increasingly important. Rocket Mainframe Security solutions help organizations build continuous visibility across their z/OS environments and act on it early.

For organizations seeking greater visibility across their z/OS environment, Rocket z/Assure Vulnerability Analysis Program (VAP) helps identify weaknesses within authorized programs and supports ongoing remediation efforts. VAP helps security teams identify security gaps in software earlier, reducing risk before they affect critical systems.

What continuous mainframe security requires

• Visibility into sensitivities across the z/OS environment
• Ongoing validation of security controls
• Integration with enterprise risk management processes
• Faster identification and remediation of emerging weaknesses
• Continuous assessment rather than periodic review

The future of mainframe security requires continuous vulnerability analysis

Security weaknesses can exist anywhere in the enterprise, and they are being discovered faster than ever before. Detecting risk is getting easier, and organizations should plan accordingly.

This is where continuous vulnerability analysis becomes essential. Point-in-time assessments provide a snapshot of risk, while continuous risk analysis helps organizations maintain visibility as systems change.

The broader lesson from advanced AI models like Mythos is that vulnerability discovery is accelerating. For organizations that depend on the mainframe, visibility becomes more important as the time between discovery and exploitation shrinks. Organizations that adopt continuous analysis across critical environments will be better positioned to identify and address risk before attackers do.

Learn more here.

The mainframe remains the system of record for many of the world’s largest organizations and some of their most critical data. As of 2025, 71% of Fortune 500 companies still use mainframes, and nearly 97% of banks worldwide rely on IBM mainframe products.

Yet many security programs continue to treat the mainframe differently from the rest of the enterprise. Many organizations still assume the mainframe is inherently secure.

Mainframes are designed with strong security controls. But strong controls alone are not enough. Like any critical enterprise system, the mainframe requires continuous verification to ensure those controls are working as intended.

Risk can exist anywhere. An overlooked configuration in a z/OS environment can create opportunities for unauthorized access to sensitive systems and data. As the time between vulnerability discovery and exploitation continues to shrink, organizations need greater visibility into risk across the enterprise—including the mainframe.

Myth #1: Mainframes are unbreachable 

Can mainframes be breached? Although mainframes are designed with robust security features, no technology platform is immune to risk. The reality is simple: attackers go where the valuable data is stored.

The mainframe isn’t isolated from the rest of the enterprise. Mainframes routinely process millions of transactions per day, and high-end systems can process over a million transactions per second in certain workloads. Mainframes are estimated to handle a substantial share of the world’s transactional workloads and credit card processing.

As organizations modernize and connect systems across environments, visibility into potential exposure becomes just as important on z/OS as it is everywhere else. Attackers follow opportunity. Wherever valuable data and business-critical assets reside, flaws will attract attention. As organizations adopt hybrid architectures, the number of interconnected systems continues to grow, making identity governance and access assurance increasingly important.

The solution is to treat the mainframe as part of the enterprise attack surface and manage risk there the same way you do everywhere else. Mainframe security requires the same continuous visibility organizations expect across the rest of the enterprise.

Myth #2: Specialized systems are too complex for attackers

How is AI changing vulnerability discovery? In the past, surfacing exposures on the mainframe required deep expertise that relatively few people had. That complexity made these environments harder to analyze.

Recent attention around Mythos, Anthropic’s highly restricted security research model, has sparked debate about AI’s role in cybersecurity. If security flaws become dramatically easier to find, organizations may have less time to identify and remediate weaknesses before others discover them.

The important point isn’t Mythos itself. It’s that identifying exploitable weaknesses is becoming faster, cheaper, and easier.

Organizations can no longer assume that complexity will keep attackers at bay. Mainframe security strategies should account for a future in which gaps are discovered faster than ever before.

That requires greater visibility into the z/OS environment and the risks it may pose. Continuous analysis helps organizations uncover potential weaknesses early, and the sooner security teams can detect security gaps, the more time they have to fix them.

Myth #3: Annual security assessments are sufficient

Why is continuous vulnerability analysis important for mainframe security? Many organizations still rely on periodic configuration assessments, even though today’s threats move much faster than they did when those processes were created. Today’s mainframe environments are constantly evolving, and new weaknesses can emerge between checkpoints long before the next scheduled assessment.

Security teams need ongoing visibility into risk, not occasional snapshots. That’s why continuous vulnerability analysis has become a critical component of modern mainframe management, helping teams identify and remediate weaknesses before they escalate into incidents.

Organizations have long benefited from the security architecture and integrity of mainframe environments. As vulnerability discovery becomes more efficient, maintaining visibility into those environments becomes increasingly important. Rocket Mainframe Security solutions help organizations build continuous visibility across their z/OS environments and act on it early.

For organizations seeking greater visibility across their z/OS environment, Rocket z/Assure Vulnerability Analysis Program (VAP) helps identify weaknesses within authorized programs and supports ongoing remediation efforts. VAP helps security teams identify security gaps in software earlier, reducing risk before they affect critical systems.

What continuous mainframe security requires

• Visibility into sensitivities across the z/OS environment
• Ongoing validation of security controls
• Integration with enterprise risk management processes
• Faster identification and remediation of emerging weaknesses
• Continuous assessment rather than periodic review

The future of mainframe security requires continuous vulnerability analysis

Security weaknesses can exist anywhere in the enterprise, and they are being discovered faster than ever before. Detecting risk is getting easier, and organizations should plan accordingly.

This is where continuous vulnerability analysis becomes essential. Point-in-time assessments provide a snapshot of risk, while continuous risk analysis helps organizations maintain visibility as systems change.

The broader lesson from advanced AI models like Mythos is that vulnerability discovery is accelerating. For organizations that depend on the mainframe, visibility becomes more important as the time between discovery and exploitation shrinks. Organizations that adopt continuous analysis across critical environments will be better positioned to identify and address risk before attackers do.

Learn more here.

AWS is finally adding native vector search to its managed NoSQL database DynamoDB, which is typically used to store high-volume operational and transactional data.

The update, according to analysts, removes complexity for development teams that are trying to maintain separate vector databases for a rapidly growing class of AI and agentic applications that rely on real-time access to operational and transactional data to improve the accuracy and relevance of their responses.

“This collapses a common two-database architecture into one operational data layer. Developers can update an item and its vector representation together, use familiar DynamoDB APIs, and avoid building a separate synchronization pipeline. That should materially shorten time-to-market for AI features built around existing DynamoDB data,” said Stephanie Walter, practice lead of the AI stack at HyperFRAME Research.

Prior to the update, enterprises using DynamoDB typically had to copy data into OpenSearch or another vector database, such as Pinecone and Weaviate, often using DynamoDB Streams or custom pipelines, which meant operating two data layers and managing embedding generation, backfills, retries, schema changes, security policies, and synchronization, Walter noted.

That dependence on two separate data layers, Walter pointed out, added to query latency and increased the risk of the vector index lagging behind the operational record.

Such delays, according to Ashish Chaturvedi, executive research leader at HFS Research, can have real consequences for AI agents: “If an agent is acting on what it retrieves, a synced-five-minutes-ago copy can mean a confident wrong action.”

Beyond improving data freshness, eliminating a separate vector database could also lower cloud and operational costs, Chaturvedi said: “Maintaining a second database meant paying at least $700 a month for a second database regardless of usage.”

For CIOs, those benefits combined could translate into lower total cost of ownership and simpler governance as enterprises scale AI applications, Chaturvedi added.

“It is a real consolidation for CIOs: fewer systems to secure, no pipelines to maintain, fresh data. Add to it usage-based cost, which means no standing minimums for idle infrastructure, even at trillion-vector scale,” Chaturvedi noted.

The architectural simplification could also make AI adoption easier for business leaders by eliminating the need to staff and govern a second data platform, said Michael Leone, principal analyst at Moor Insights & Strategy.

Native vector search capabilities have been gaining popularity over the past few years. Over the last three years, AWS has steadily expanded vector search across its database portfolio, adding support to Aurora PostgreSQL through pgvector, Amazon MemoryDB for Redis and Amazon DocumentDB as enterprise demand for generative AI applications has grown.

Rivals have followed a similar path, with MongoDB, Microsoft, Google Cloud, Oracle and Couchbase integrating native vector search into their databases to support retrieval-augmented generation (RAG), AI agents and other generative AI workloads.

These announcements themselves reflect a broader convergence in the database market since the rise of generative AI. While specialized vector databases have expanded beyond similarity search by adding SQL, NoSQL and operational database capabilities, mainstream operational databases have been embedding vector search and RAG capabilities into their core platforms, allowing enterprises to consolidate AI and transactional workloads on fewer data platforms.

AWS has not shared details on the rollout of DynamoDB’s native vector search capability, including its availability timeline or the AWS Regions where it will initially be offered.

Most enterprises are rushing toward autonomous AI. They shouldn’t. Autonomy you haven’t earned doesn’t speed you up. In fact, it slows you down.

Here’s what I’ve moved our organization toward: a five-stage set of AI adoption maturity benchmarks. It’s a practical framework for understanding where employee development, decision-making and business value intersect. Each stage provides value for your organization. Some roles and functions may only ever reach Stage 1 or 2, while others should be fast-tracked to Stage 5. By understanding this progression, leadership can stop viewing AI as a tool for task delegation and treat it as a catalyst for developing stronger, more decisive and more valuable teams.

Stage 1: Research assistance

You hand people a premium ChatGPT account. Employees stop Googling and start prompting. Their experience improves: no ads, paragraph-form answers instead of blue links. But the underlying dynamic hasn’t changed. Output quality depends on input quality. A vague Google search returns a mess of links. A vague ChatGPT prompt returns a well-formatted mess of paragraphs. If your team didn’t know how to ask a precise question before, they still don’t.
           
The real danger at Stage 1 isn’t the bad answers – it’s the confident-sounding ones. A hallucinated statistic arrives in the same calm, authoritative prose as an accurate one. Teams that don’t verify sources in Google don’t suddenly fact-check ChatGPT. Before moving to Stage 2, your team needs to develop the instinct to ask, “How do I know this is true?”

Stage 2: Task assistance

The next stage uses AI tools to complete tasks. It starts simply: “I need to write this email,” or “Make a spreadsheet to track open items.”

The average employee takes what AI produces and passes it off without revision. At best, their efforts pass muster, with only a dash of workslop. At worst, the flood of unchecked AI outputs creates rework for teammates and clients.

Another employee further along in Stage 2 may augment what AI produces. That impulse serves them well. But if they default to editing AI output rather than dictating the rules for what AI should produce, they can easily spend more time editing AI’s work than creating work from scratch.

For employees whose work will largely remain in Stage 2, the focus should be on writing more precise prompts. The instinct to edit AI output isn’t wrong. The problem arises when the prompt is a rough starting point rather than a detailed spec. AI cares that your instructions are clear, specific and unambiguous. Get the spec right up front.

Stage 3: Workflow integration

My daughter’s class recently had an assignment: write a paper on the causes of the Civil War.

Her teacher knew what was going to happen. Every 11-year-old would go home and use ChatGPT to write a five-paragraph essay. So, she changed the exercise. The class generated and printed out the essay. Then, the teacher explained how to annotate, how to ask follow-up questions and how to revise in ChatGPT using the marked-up draft.

The same three-step sequence — assemble context, build the prompt, edit hard — applies when someone writes a post-mortem. The temptation is to skip straight to the draft. Pull the incident data, ask Gemini for a timeline and root cause analysis, clean it up, get a quick peer review and send it.

An engineer working at Stage 3 does what the teacher did. First, they assemble context: the Slack thread where someone flagged the anomaly two hours before the alert fired, the Jira ticket, the gap in monitoring that nobody documented. Then they build a prompt that reflects the full context and generate a draft. Now the red pen comes out: push back on the root cause analysis, add the institutional context Gemini couldn’t know, tighten the remediation steps until they’re actionable.

The result is a better document — and an engineer who understands what failed and builds a better repeatable process. Saving time on a first draft is a fine side effect. The goal is to produce a final draft that’s worthy of review.

Stage 4: Guided automation

The fourth stage is where collaboration becomes self-sustaining. You’re no longer asking AI to help you do a task. You’re asking it to run the task and surface the decisions that require your judgment.

My LinkedIn workflow is a good example of what this looks like in practice.

A couple of years ago, I would read an article, develop a point of view, write two or three paragraphs and publish. Not bad, but dependent on me having the time and cognitive bandwidth.

The friction was the 15 decisions that came before drafting: Which angle is worth pursuing? Does this use my voice? Have I said this before?

So, I started researching my patterns. First, I fed Claude my prior LinkedIn posts and prompted it to analyze my tone, sentence patterns and structural habits. I didn’t ask it to “describe my voice” – that gets you a paragraph of flattering generalities. This analysis became the base layer of the tool.

Then I added a second layer: LinkedIn-specific rules and AI writing patterns to avoid. That context got embedded alongside the voice analysis.

Now the workflow runs like this. I click a link, save the article, highlight and annotate the sections that interest me. My Claude Managed Agent picks up the annotation, infers what I found worth engaging with and writes four drafts with meaningfully different angles on the source material. It compares each draft against my post history and proposes two. I read the proposals, pick one, edit and authorize publication with Buffer.

The automation didn’t remove my judgment from the process. It freed me from work that didn’t depend on judgment. Now I do the work that matters: deciding what to say, identifying patterns and sharing my point of view.

That shift in what I’m accountable for is where the ROI changes. The value isn’t in the time saved on any single post. It’s that the workflow no longer depends on me having the bandwidth to start from zero. The capacity was always there; the system makes it consistent and repeatable.

Stage 5: Full automation

The most advanced stage of maturity is when the system largely runs on its own. You’re no longer managing step-by-step actions; you’re defining goals, setting guardrails and measuring outcomes.

We have one running in our engineering org right now. When a ticket gets escalated from our support team to engineering, the agent triages it and routes it to the team responsible for the fix. When an engineering manager reassigns the ticket – because the routing was wrong – the agent picks up that correction, feeds it back into its prompt tooling and updates its model of who owns what. We’re now extending it further: the agent is learning which parts of the codebase need to change and which engineers are likely to own the fix.

There’s a critical catch: this stage only works if you’ve earned your way there. We learned this firsthand. When we first rolled out the routing agent, we used a static map of application areas to engineering teams and assumed that was enough. It wasn’t. We couldn’t reliably distinguish front-end bugs from back-end ones, so the front-end team kept getting tickets caused by a misbehaving API. Features were split between teams in ways the map didn’t capture — one team owned exports, another owned reports. Before the routing could work, the knowledge had to exist somewhere it could be used. An autonomous system is only as good as the foundation beneath it – the clarity of your workflows, the health of your data, the alignment of your teams. Deploy an autonomous agent into a broken process and you get bad results at scale. You cannot safely delegate what you don’t fully understand.

This is why racing straight to Stage 5 often fails. You need to know what “good” output looks like (Stages 2 and 3) and how to orchestrate the pieces (Stage 4) before you can confidently take your hands off the wheel.

Where business value emerges

The evolution from a premium search engine to an autonomous system is an organizational challenge, not a technology one. Realizing the value of AI is determined not by the sophistication of the underlying model, but by the maturity of the team wielding it.

The practical move isn’t to audit your whole organization’s AI readiness. Start with one workflow. Push it one stage higher. Measure what changes. That’s how you find out if this matters in your specific context – not in theory, but in the work your team actually does.

Most enterprises are rushing toward autonomous AI. They shouldn’t. Autonomy you haven’t earned doesn’t speed you up. In fact, it slows you down.

Here’s what I’ve moved our organization toward: a five-stage set of AI adoption maturity benchmarks. It’s a practical framework for understanding where employee development, decision-making and business value intersect. Each stage provides value for your organization. Some roles and functions may only ever reach Stage 1 or 2, while others should be fast-tracked to Stage 5. By understanding this progression, leadership can stop viewing AI as a tool for task delegation and treat it as a catalyst for developing stronger, more decisive and more valuable teams.

Stage 1: Research assistance

You hand people a premium ChatGPT account. Employees stop Googling and start prompting. Their experience improves: no ads, paragraph-form answers instead of blue links. But the underlying dynamic hasn’t changed. Output quality depends on input quality. A vague Google search returns a mess of links. A vague ChatGPT prompt returns a well-formatted mess of paragraphs. If your team didn’t know how to ask a precise question before, they still don’t.
           
The real danger at Stage 1 isn’t the bad answers – it’s the confident-sounding ones. A hallucinated statistic arrives in the same calm, authoritative prose as an accurate one. Teams that don’t verify sources in Google don’t suddenly fact-check ChatGPT. Before moving to Stage 2, your team needs to develop the instinct to ask, “How do I know this is true?”

Stage 2: Task assistance

The next stage uses AI tools to complete tasks. It starts simply: “I need to write this email,” or “Make a spreadsheet to track open items.”

The average employee takes what AI produces and passes it off without revision. At best, their efforts pass muster, with only a dash of workslop. At worst, the flood of unchecked AI outputs creates rework for teammates and clients.

Another employee further along in Stage 2 may augment what AI produces. That impulse serves them well. But if they default to editing AI output rather than dictating the rules for what AI should produce, they can easily spend more time editing AI’s work than creating work from scratch.

For employees whose work will largely remain in Stage 2, the focus should be on writing more precise prompts. The instinct to edit AI output isn’t wrong. The problem arises when the prompt is a rough starting point rather than a detailed spec. AI cares that your instructions are clear, specific and unambiguous. Get the spec right up front.

Stage 3: Workflow integration

My daughter’s class recently had an assignment: write a paper on the causes of the Civil War.

Her teacher knew what was going to happen. Every 11-year-old would go home and use ChatGPT to write a five-paragraph essay. So, she changed the exercise. The class generated and printed out the essay. Then, the teacher explained how to annotate, how to ask follow-up questions and how to revise in ChatGPT using the marked-up draft.

The same three-step sequence — assemble context, build the prompt, edit hard — applies when someone writes a post-mortem. The temptation is to skip straight to the draft. Pull the incident data, ask Gemini for a timeline and root cause analysis, clean it up, get a quick peer review and send it.

An engineer working at Stage 3 does what the teacher did. First, they assemble context: the Slack thread where someone flagged the anomaly two hours before the alert fired, the Jira ticket, the gap in monitoring that nobody documented. Then they build a prompt that reflects the full context and generate a draft. Now the red pen comes out: push back on the root cause analysis, add the institutional context Gemini couldn’t know, tighten the remediation steps until they’re actionable.

The result is a better document — and an engineer who understands what failed and builds a better repeatable process. Saving time on a first draft is a fine side effect. The goal is to produce a final draft that’s worthy of review.

Stage 4: Guided automation

The fourth stage is where collaboration becomes self-sustaining. You’re no longer asking AI to help you do a task. You’re asking it to run the task and surface the decisions that require your judgment.

My LinkedIn workflow is a good example of what this looks like in practice.

A couple of years ago, I would read an article, develop a point of view, write two or three paragraphs and publish. Not bad, but dependent on me having the time and cognitive bandwidth.

The friction was the 15 decisions that came before drafting: Which angle is worth pursuing? Does this use my voice? Have I said this before?

So, I started researching my patterns. First, I fed Claude my prior LinkedIn posts and prompted it to analyze my tone, sentence patterns and structural habits. I didn’t ask it to “describe my voice” – that gets you a paragraph of flattering generalities. This analysis became the base layer of the tool.

Then I added a second layer: LinkedIn-specific rules and AI writing patterns to avoid. That context got embedded alongside the voice analysis.

Now the workflow runs like this. I click a link, save the article, highlight and annotate the sections that interest me. My Claude Managed Agent picks up the annotation, infers what I found worth engaging with and writes four drafts with meaningfully different angles on the source material. It compares each draft against my post history and proposes two. I read the proposals, pick one, edit and authorize publication with Buffer.

The automation didn’t remove my judgment from the process. It freed me from work that didn’t depend on judgment. Now I do the work that matters: deciding what to say, identifying patterns and sharing my point of view.

That shift in what I’m accountable for is where the ROI changes. The value isn’t in the time saved on any single post. It’s that the workflow no longer depends on me having the bandwidth to start from zero. The capacity was always there; the system makes it consistent and repeatable.

Stage 5: Full automation

The most advanced stage of maturity is when the system largely runs on its own. You’re no longer managing step-by-step actions; you’re defining goals, setting guardrails and measuring outcomes.

We have one running in our engineering org right now. When a ticket gets escalated from our support team to engineering, the agent triages it and routes it to the team responsible for the fix. When an engineering manager reassigns the ticket – because the routing was wrong – the agent picks up that correction, feeds it back into its prompt tooling and updates its model of who owns what. We’re now extending it further: the agent is learning which parts of the codebase need to change and which engineers are likely to own the fix.

There’s a critical catch: this stage only works if you’ve earned your way there. We learned this firsthand. When we first rolled out the routing agent, we used a static map of application areas to engineering teams and assumed that was enough. It wasn’t. We couldn’t reliably distinguish front-end bugs from back-end ones, so the front-end team kept getting tickets caused by a misbehaving API. Features were split between teams in ways the map didn’t capture — one team owned exports, another owned reports. Before the routing could work, the knowledge had to exist somewhere it could be used. An autonomous system is only as good as the foundation beneath it – the clarity of your workflows, the health of your data, the alignment of your teams. Deploy an autonomous agent into a broken process and you get bad results at scale. You cannot safely delegate what you don’t fully understand.

This is why racing straight to Stage 5 often fails. You need to know what “good” output looks like (Stages 2 and 3) and how to orchestrate the pieces (Stage 4) before you can confidently take your hands off the wheel.

Where business value emerges

The evolution from a premium search engine to an autonomous system is an organizational challenge, not a technology one. Realizing the value of AI is determined not by the sophistication of the underlying model, but by the maturity of the team wielding it.

The practical move isn’t to audit your whole organization’s AI readiness. Start with one workflow. Push it one stage higher. Measure what changes. That’s how you find out if this matters in your specific context – not in theory, but in the work your team actually does.

Generative AI is notoriously eager to help, to the point that if it can’t find something matching what you ask for, it’ll create it. So the problem with relying on guardrails is that all too often, a model will be wrong, showing a high confidence score for an incorrect answer because it’s relying on stale or non-canonical data.

Not only do you need to be able to track the lineage of data your model uses from source to token, something the EU AI Act requires, you also need to be able to take into account where the data came from, whether it’s out of date, if it changed in a way that affects the result, or if it was never really relevant or authoritative in the first place.

Gartner expects organizations will abandon 60% of AI projects because they don’t have the right metadata management, data quality, and data observability. IBM’s acquisition of Confluent also highlights the importance of real-time data with lineage, governance, and policy for AI agents, and one of IBM’s 2026 predictions was the importance of smarter data.

The usual approach is adding metadata and validation later in the data pipeline. That’s similar to the way the bronze, silver, and gold tiers of typical lakehouse architecture are supposed to represent how filtering, cleaning, and augmenting data improves structure and quality until it’s ready to use. That can mean an enormous amount of work since nearly three quarters of the CPU work in training a frontier model is data cleansing and validation.

But that can also remove a lot of the context crucial for gen AI. Rather than cleaning data and losing the original context, it’s often more effective to keep as much information about the original state of the data, says David Aronchick, open-source platform Kubeflow founder, and CEO of distributed data pipeline vendor Expanso. “You can’t pursue exactly purely clean data; that’s just not possible,” he says. “As you pull data into your ML model, every line should have some mechanism saying where it came from. Otherwise, you’re never really going to know because you can’t mix them together and tease them apart later. You can search your raw content, your raw logs, but it’s just not going to be there.”

IoT digital twin systems often tag data all the way back to the device capturing it so you can see whether a temperature spike is a critical failure, which you want to react to, or a routine calibration, which you don’t. But that information may well be relevant down the line when you want to use that data more broadly. So unless you capture at least some elements about the source of data before you move it, you’re not going to be able to easily reconstruct the context later, or at all sometimes.

Ulrik Hansen, co-CEO of Encord, a platform for managing and annotating data, calls this in-stream labelling and cautions it’s not an alternative to cleansing data. “Dirty conflates two things: actual corruption you should fix, and context dependence, where a reading only looks anomalous because you threw away the frame that explained it,” he says. “Cleansing kills both. The point isn’t to stop cleaning, it’s to stop normalizing away context you can never recover.”

Context can be cheap to capture at the source and nearly impossible to recover after, he adds. “The question isn’t whether to keep it,” he says, “it’s about curating what actually helps.”

Raw but not rancid

Aronchick characterizes the state of most bronze tiers as toxic waste because raw data doesn’t get validated before ingestion, or have a metadata wrapper on each data point. “You’ve taken raw data and stripped it of context,” he says.

Take a wind farm operator, for instance. When sensor data about the turbines is generated, it comes from a particular turbine at a particular position in a specific wind farm at a known location, running at a specific speed in specific weather conditions, at a particular time. “If you have other turbines also working in the field, the performance of your turbine will go down, but the field performance will go up,” says Aronchick. “The performance of your turbine going down isn’t a negative, but unless you have the context at the point of data collection, you’re going to make your life much harder later on, when someone asks about the efficiency.”

Metadata needs to be much richer, and it needs to be added as early in your data pipeline as possible when you have the most detail available to make sense of the structure and complexity of the data, Aronchick adds. “You want to capture as much about the data you’re collecting as possible, where it doesn’t require insane activity to do so.”

But not all the metadata you need will be generated with the data, he says. You almost certainly need to augment and annotate your data, and provide extra structure, especially for something like a point of sale system with very light metadata. “Data comes off these things in poor structure,” he says. “It’s not OpenLineage, it’s often a CSV or a text record, and you have to reconstruct them into a full structured log. So do smart things where you’re creating data. That might be compressing, sampling, converting, appending metadata to it, and enforcing schema and lineage all before you start moving anything.”

That doesn’t have to mean bloating your data, Hansen points out. He suggests capturing what’s free and unrecoverable. “The system of origin is the label,” he says. “You don’t tag HR policy, you capture that it came from the HR system. Anything a model can derive later, you can skip.”

Structure isn’t static

Routine changes to APIs, schemas, and how data is collected or stored happen in every organization, and need to be reflected in metadata that lives alongside the data or added as data is collected, not reconstructed later in a fragile process that depends on knowing about all those changes. Google’s research into these data cascades shows how easily context gets lost and how badly it affects data quality.

Shifting schema enforcement further left in your data pipeline so you deal with it as soon as possible allows you to make more effective downstream decisions. For a sensor recording temperature and humidity, you need to know the temperature scale it uses, readings, and how the timestamp is recorded. Checking that against the schema before ingesting the data lets you route it differently depending on whether it validates or triggers alerts about data quality.

“Maybe I’ll delete it, or send it off to some place where a human being or other tooling can reconstruct it into something valuable,” says Aronchick. “But what it doesn’t do is allow the polluted or bad data into my pipeline. Saying whether or not something passed your schema makes your downstream systems much more reliable.”

Sensing structure

Unstructured and semistructured data needs more augmentation. A PDF or Word document has an author and a creation date, but doesn’t necessarily include any context about the job title and department of the author, whether it’s up to date, only applies to a particular group of customers, or is based on accounting regulations that can change. If that information is available, it needs to travel with the document, not be left in a compliance spreadsheet.

Data platforms like DataHub and SurrealDB both capture and create context. The latter can analyze a photo, for instance, using vision AI to understand what’s in the image. “From completely unstructured data, we get as much structure as possible,” says the company’s CEO Tobie Morgan Hitchcock.

That’s paired with other data potentially useful for an AI agent down the line. “Understanding what happened around an event becomes a lot easier if you’re tracking the conversation, telemetry, tool and model usage, geospatial data, and the vector search and relationships,” he says. “You’re going to have a far better chance of getting an accurate understanding of that data, which started off completely unstructured, than if you weren’t capturing anything.”

Metadata about document authors, which might come from the company directory, can show how much authority a document has. He describes that as building an understanding of what trust and provenance is over time by the weight and authority of who’s updating the information. After all, he says, company-generated information has more trust or can have traced provenance compared to conversational inputs from a user.

Incentives for annotating

DataHub CTO Shirshanka Das saw how much of a mess data can be even with strong guidelines as former architect of LinkedIn’s GDPR strategy. “The data was a swamp, despite us having had pretty good data-first and schema-first practices,” he says. As well as cleaning up the data governance, they added in the first nuggets of the DevOps’ ‘shift left’ approach.

LinkedIn already required data checked in to its Kafka ecosystem to have a schema, and ran CI/CD pipelines to check backward compatibility. “I attached metadata attribution and collection around compliance metadata into that pipeline, where developers weren’t able to check in a schema until they had declared what every column meant.”

The extra work was unpopular until teams who didn’t participate saw the flood of tickets that came their way, which allowed him to extend that same proactive governance and annotation at source approach to pretty much every data set being produced.

“The starting point of data at most companies is a lot more swampy,” he says. “Many people are using Kafka, which is a very schema forward system, and yet they’re just shoving in JSON and unstructured stuff.”

That’s common, agrees Megha Kumar, research VP for analytics and AI at IDC, because while collecting more metadata provides better context and cleaner data lineage, it’s hard in practice. “Most organizations batch process data, so real-time context capture rarely happens,” she says. “Even the ones that process in real-time tend to have pre-defined schemas, so adding context requires changes to the data, which unfortunately happens later.”

People don’t know how to start, says Das, so DataHub Cloud tries to add back context by collecting operational metadata from multiple systems, including queries and BI tools to extrapolate a semantic model. “We confront the mess by giving them something they can react to,” he says. “They can quickly validate, and then it starts becoming a governance layer on top where humans annotate at source.”

Online whiteboard provider Miro, for example, dramatically improved AI agent query accuracy from about 50% to 90% using DataHub. Then they applied GitOps principles on top of what was inferred with a human in the loop for approvals.

So getting people to do the work happened the same way at LinkedIn, says Das. “When a data scientist gets 10 times more requests because they didn’t document their work well, resulting in the AI making lots of mistakes and stakeholders constantly pinging them for answers, they have the incentive to add the annotation when they produce an analysis, because then they get out of the critical path.”

DBOMs and data contracts

Provenance and lineage of data is critical, Aronchick says, so you can preserve details like who collected the data, when, from where, if the source was authoritative or canonical, what transformations were run, and exactly what the model saw.

“It’s not just about the version and the metadata,” he says. “Where things really start to change is when you can say along the way this data has gone through these steps, this is the root source, and these were the other elements.” You want to be able to find out if there were any experimental flags, like a new customer campaign running when it was collected, as well as what claims the data contributes to.

Aronchick advocates for a SLSA-style data bill of materials using a tool like Makoto, which can add signed provenance and attestation to simplify applying central concepts of governance and structure to upstream data.

The notion of a data contract or a data product spec is starting to become common in the financial sector says Das, defining it as a data set, or a group of data sets, bound together by a contract that defines expectations which aren’t just cosmetic but machine verifiable. They can also include operational SLOs for APIs as contracts describe not just the shape of the data but operational characteristics and guarantees.

Document graph markup language (DGML), a new open source specification from Docugami, promises provenance down to individual data points automatically extracted from documents.

“It’s critical to know the validity and provenance of the information your AI is relying on,” Docugami CEO and XML co-creator Jean Paoli says. “Establishing the validity of data right from the start, at scale, is vital and far more efficient than trying to clean up bad data later.” DGML combines semantic tags describing what content means in its business context with bounding boxes showing exactly where in the document the content comes from, with attestation to prove it.

AI demands provenance

All this context is the kind of metadata Anthropic’s context engineering guide recommends feeding to agents for accuracy. Developers are already used to giving coding agents more context, Das argues. “The same thing is happening with data, as when people realize when AI agents can’t make sense of what they’re doing, hallucinations happen,” he says.

Kumar agrees that organizations realize agents need context to provide better insights. “In many cases, it has to do with ensuring the existing data had clear semantics and relationships,” she says.

If you want to make sure the purchase return window an AI chatbot promises customers is based on your own policy, not a wish list from a user forum, you need rich context. It’s not just metadata. Organizations need to have semantics, data lineage, and ontologies. “Many are also building knowledge and ontology graphs,” adds Kumar. “By ensuring the systems understand what the data means, it’ll be able to provide a better response.”

And if you’re going to the expense of fine tuning, which needs relevant and domain- or task-specific examples, you don’t want noise, duplication, or irrelevant content in your data. You can, of course, exclude poor data if it’s annotated and verified earlier, but you can also improve model performance with extra information, Aronchick points out. “The augmentation of the existing data makes the data you pull out more valuable,” he says.

Expanso recently won an Edge AI award for fine tuning a base level model with only about 3,200 images by augmenting them with metadata. “The reason it worked on that few is because I could tell it deterministically what was in the frame,” he adds. “It’s labeling at the point of capture instead of paying somebody to label it later. What if I developed models for predictive analytics of store behavior on a per city, region, or country basis? If I’m able to take the raw point of sale information and augment it with additional metadata, I’m turning this into a much easier thing to fine tune.”

Or you might even avoid the expense of fine tuning entirely, suggests Das. “You get the short-term advantage by fine-tuning and getting great performance at much cheaper cost on a smaller model, and it gets stripped away in a couple of months as a new model shows up,” he says. “You have to always run that calculus of when’s the right threshold to fine tune an existing model, distil it, and then run it for a fair amount of time to recoup the costs of fine tuning.”

Although regulated or slow-moving industries will see benefits from fine tuning a model they can run for six to 12 months on data with higher quality and better provenance, many organizations may use the improved data quality to get good results without fine tuning.

“We’re taking a more knowledge graph-oriented approach to grounding the model, and betting on the fact that because the knowledge graph is changing often, it’s better to keep it as a runtime artifact than a baked-in one.”

Generative AI is notoriously eager to help, to the point that if it can’t find something matching what you ask for, it’ll create it. So the problem with relying on guardrails is that all too often, a model will be wrong, showing a high confidence score for an incorrect answer because it’s relying on stale or non-canonical data.

Not only do you need to be able to track the lineage of data your model uses from source to token, something the EU AI Act requires, you also need to be able to take into account where the data came from, whether it’s out of date, if it changed in a way that affects the result, or if it was never really relevant or authoritative in the first place.

Gartner expects organizations will abandon 60% of AI projects because they don’t have the right metadata management, data quality, and data observability. IBM’s acquisition of Confluent also highlights the importance of real-time data with lineage, governance, and policy for AI agents, and one of IBM’s 2026 predictions was the importance of smarter data.

The usual approach is adding metadata and validation later in the data pipeline. That’s similar to the way the bronze, silver, and gold tiers of typical lakehouse architecture are supposed to represent how filtering, cleaning, and augmenting data improves structure and quality until it’s ready to use. That can mean an enormous amount of work since nearly three quarters of the CPU work in training a frontier model is data cleansing and validation.

But that can also remove a lot of the context crucial for gen AI. Rather than cleaning data and losing the original context, it’s often more effective to keep as much information about the original state of the data, says David Aronchick, open-source platform Kubeflow founder, and CEO of distributed data pipeline vendor Expanso. “You can’t pursue exactly purely clean data; that’s just not possible,” he says. “As you pull data into your ML model, every line should have some mechanism saying where it came from. Otherwise, you’re never really going to know because you can’t mix them together and tease them apart later. You can search your raw content, your raw logs, but it’s just not going to be there.”

IoT digital twin systems often tag data all the way back to the device capturing it so you can see whether a temperature spike is a critical failure, which you want to react to, or a routine calibration, which you don’t. But that information may well be relevant down the line when you want to use that data more broadly. So unless you capture at least some elements about the source of data before you move it, you’re not going to be able to easily reconstruct the context later, or at all sometimes.

Ulrik Hansen, co-CEO of Encord, a platform for managing and annotating data, calls this in-stream labelling and cautions it’s not an alternative to cleansing data. “Dirty conflates two things: actual corruption you should fix, and context dependence, where a reading only looks anomalous because you threw away the frame that explained it,” he says. “Cleansing kills both. The point isn’t to stop cleaning, it’s to stop normalizing away context you can never recover.”

Context can be cheap to capture at the source and nearly impossible to recover after, he adds. “The question isn’t whether to keep it,” he says, “it’s about curating what actually helps.”

Raw but not rancid

Aronchick characterizes the state of most bronze tiers as toxic waste because raw data doesn’t get validated before ingestion, or have a metadata wrapper on each data point. “You’ve taken raw data and stripped it of context,” he says.

Take a wind farm operator, for instance. When sensor data about the turbines is generated, it comes from a particular turbine at a particular position in a specific wind farm at a known location, running at a specific speed in specific weather conditions, at a particular time. “If you have other turbines also working in the field, the performance of your turbine will go down, but the field performance will go up,” says Aronchick. “The performance of your turbine going down isn’t a negative, but unless you have the context at the point of data collection, you’re going to make your life much harder later on, when someone asks about the efficiency.”

Metadata needs to be much richer, and it needs to be added as early in your data pipeline as possible when you have the most detail available to make sense of the structure and complexity of the data, Aronchick adds. “You want to capture as much about the data you’re collecting as possible, where it doesn’t require insane activity to do so.”

But not all the metadata you need will be generated with the data, he says. You almost certainly need to augment and annotate your data, and provide extra structure, especially for something like a point of sale system with very light metadata. “Data comes off these things in poor structure,” he says. “It’s not OpenLineage, it’s often a CSV or a text record, and you have to reconstruct them into a full structured log. So do smart things where you’re creating data. That might be compressing, sampling, converting, appending metadata to it, and enforcing schema and lineage all before you start moving anything.”

That doesn’t have to mean bloating your data, Hansen points out. He suggests capturing what’s free and unrecoverable. “The system of origin is the label,” he says. “You don’t tag HR policy, you capture that it came from the HR system. Anything a model can derive later, you can skip.”

Structure isn’t static

Routine changes to APIs, schemas, and how data is collected or stored happen in every organization, and need to be reflected in metadata that lives alongside the data or added as data is collected, not reconstructed later in a fragile process that depends on knowing about all those changes. Google’s research into these data cascades shows how easily context gets lost and how badly it affects data quality.

Shifting schema enforcement further left in your data pipeline so you deal with it as soon as possible allows you to make more effective downstream decisions. For a sensor recording temperature and humidity, you need to know the temperature scale it uses, readings, and how the timestamp is recorded. Checking that against the schema before ingesting the data lets you route it differently depending on whether it validates or triggers alerts about data quality.

“Maybe I’ll delete it, or send it off to some place where a human being or other tooling can reconstruct it into something valuable,” says Aronchick. “But what it doesn’t do is allow the polluted or bad data into my pipeline. Saying whether or not something passed your schema makes your downstream systems much more reliable.”

Sensing structure

Unstructured and semistructured data needs more augmentation. A PDF or Word document has an author and a creation date, but doesn’t necessarily include any context about the job title and department of the author, whether it’s up to date, only applies to a particular group of customers, or is based on accounting regulations that can change. If that information is available, it needs to travel with the document, not be left in a compliance spreadsheet.

Data platforms like DataHub and SurrealDB both capture and create context. The latter can analyze a photo, for instance, using vision AI to understand what’s in the image. “From completely unstructured data, we get as much structure as possible,” says the company’s CEO Tobie Morgan Hitchcock.

That’s paired with other data potentially useful for an AI agent down the line. “Understanding what happened around an event becomes a lot easier if you’re tracking the conversation, telemetry, tool and model usage, geospatial data, and the vector search and relationships,” he says. “You’re going to have a far better chance of getting an accurate understanding of that data, which started off completely unstructured, than if you weren’t capturing anything.”

Metadata about document authors, which might come from the company directory, can show how much authority a document has. He describes that as building an understanding of what trust and provenance is over time by the weight and authority of who’s updating the information. After all, he says, company-generated information has more trust or can have traced provenance compared to conversational inputs from a user.

Incentives for annotating

DataHub CTO Shirshanka Das saw how much of a mess data can be even with strong guidelines as former architect of LinkedIn’s GDPR strategy. “The data was a swamp, despite us having had pretty good data-first and schema-first practices,” he says. As well as cleaning up the data governance, they added in the first nuggets of the DevOps’ ‘shift left’ approach.

LinkedIn already required data checked in to its Kafka ecosystem to have a schema, and ran CI/CD pipelines to check backward compatibility. “I attached metadata attribution and collection around compliance metadata into that pipeline, where developers weren’t able to check in a schema until they had declared what every column meant.”

The extra work was unpopular until teams who didn’t participate saw the flood of tickets that came their way, which allowed him to extend that same proactive governance and annotation at source approach to pretty much every data set being produced.

“The starting point of data at most companies is a lot more swampy,” he says. “Many people are using Kafka, which is a very schema forward system, and yet they’re just shoving in JSON and unstructured stuff.”

That’s common, agrees Megha Kumar, research VP for analytics and AI at IDC, because while collecting more metadata provides better context and cleaner data lineage, it’s hard in practice. “Most organizations batch process data, so real-time context capture rarely happens,” she says. “Even the ones that process in real-time tend to have pre-defined schemas, so adding context requires changes to the data, which unfortunately happens later.”

People don’t know how to start, says Das, so DataHub Cloud tries to add back context by collecting operational metadata from multiple systems, including queries and BI tools to extrapolate a semantic model. “We confront the mess by giving them something they can react to,” he says. “They can quickly validate, and then it starts becoming a governance layer on top where humans annotate at source.”

Online whiteboard provider Miro, for example, dramatically improved AI agent query accuracy from about 50% to 90% using DataHub. Then they applied GitOps principles on top of what was inferred with a human in the loop for approvals.

So getting people to do the work happened the same way at LinkedIn, says Das. “When a data scientist gets 10 times more requests because they didn’t document their work well, resulting in the AI making lots of mistakes and stakeholders constantly pinging them for answers, they have the incentive to add the annotation when they produce an analysis, because then they get out of the critical path.”

DBOMs and data contracts

Provenance and lineage of data is critical, Aronchick says, so you can preserve details like who collected the data, when, from where, if the source was authoritative or canonical, what transformations were run, and exactly what the model saw.

“It’s not just about the version and the metadata,” he says. “Where things really start to change is when you can say along the way this data has gone through these steps, this is the root source, and these were the other elements.” You want to be able to find out if there were any experimental flags, like a new customer campaign running when it was collected, as well as what claims the data contributes to.

Aronchick advocates for a SLSA-style data bill of materials using a tool like Makoto, which can add signed provenance and attestation to simplify applying central concepts of governance and structure to upstream data.

The notion of a data contract or a data product spec is starting to become common in the financial sector says Das, defining it as a data set, or a group of data sets, bound together by a contract that defines expectations which aren’t just cosmetic but machine verifiable. They can also include operational SLOs for APIs as contracts describe not just the shape of the data but operational characteristics and guarantees.

Document graph markup language (DGML), a new open source specification from Docugami, promises provenance down to individual data points automatically extracted from documents.

“It’s critical to know the validity and provenance of the information your AI is relying on,” Docugami CEO and XML co-creator Jean Paoli says. “Establishing the validity of data right from the start, at scale, is vital and far more efficient than trying to clean up bad data later.” DGML combines semantic tags describing what content means in its business context with bounding boxes showing exactly where in the document the content comes from, with attestation to prove it.

AI demands provenance

All this context is the kind of metadata Anthropic’s context engineering guide recommends feeding to agents for accuracy. Developers are already used to giving coding agents more context, Das argues. “The same thing is happening with data, as when people realize when AI agents can’t make sense of what they’re doing, hallucinations happen,” he says.

Kumar agrees that organizations realize agents need context to provide better insights. “In many cases, it has to do with ensuring the existing data had clear semantics and relationships,” she says.

If you want to make sure the purchase return window an AI chatbot promises customers is based on your own policy, not a wish list from a user forum, you need rich context. It’s not just metadata. Organizations need to have semantics, data lineage, and ontologies. “Many are also building knowledge and ontology graphs,” adds Kumar. “By ensuring the systems understand what the data means, it’ll be able to provide a better response.”

And if you’re going to the expense of fine tuning, which needs relevant and domain- or task-specific examples, you don’t want noise, duplication, or irrelevant content in your data. You can, of course, exclude poor data if it’s annotated and verified earlier, but you can also improve model performance with extra information, Aronchick points out. “The augmentation of the existing data makes the data you pull out more valuable,” he says.

Expanso recently won an Edge AI award for fine tuning a base level model with only about 3,200 images by augmenting them with metadata. “The reason it worked on that few is because I could tell it deterministically what was in the frame,” he adds. “It’s labeling at the point of capture instead of paying somebody to label it later. What if I developed models for predictive analytics of store behavior on a per city, region, or country basis? If I’m able to take the raw point of sale information and augment it with additional metadata, I’m turning this into a much easier thing to fine tune.”

Or you might even avoid the expense of fine tuning entirely, suggests Das. “You get the short-term advantage by fine-tuning and getting great performance at much cheaper cost on a smaller model, and it gets stripped away in a couple of months as a new model shows up,” he says. “You have to always run that calculus of when’s the right threshold to fine tune an existing model, distil it, and then run it for a fair amount of time to recoup the costs of fine tuning.”

Although regulated or slow-moving industries will see benefits from fine tuning a model they can run for six to 12 months on data with higher quality and better provenance, many organizations may use the improved data quality to get good results without fine tuning.

“We’re taking a more knowledge graph-oriented approach to grounding the model, and betting on the fact that because the knowledge graph is changing often, it’s better to keep it as a runtime artifact than a baked-in one.”

AI agent orchestration platforms coordinate role-based and task-based AI agents, along with the tools, data, and people they depend on, into multistep workflows. These platforms are highly important for organizations scaling from handfuls to thousands of AI agents running in production.  

Two open standards do the connective work: MCP (Model Context Protocol) gives agents governed access to tools and data, while A2A (Agent2Agent) lets agents discover and delegate to one another, including agents built on other platforms. The orchestration layer sits on top, adding the routing, shared state, guardrails, governance, security, and observability needed to run workflows that range from fully autonomous to human-in-the-loop.

AI orchestration platforms may be the hottest AI technology of the year. In researching this article, I identified more than 60 commercial and open source platforms that businesses can use as a control plane to manage work between AI agents, people, and automations.

Like data fabrics and automation platforms, I suspect enterprises will utilize more than one AI agent orchestration platform. Platforms are being released by hyperscalers and solution providers in enterprise SaaS, process automation, customer experience, data management, AIops, and IT infrastructure. Development-centric platforms include open source, commercial, and no-code integration solution providers.

Here are five considerations when reviewing AI agent orchestration platforms.

1. Observable control, oversight, and trust

AI agent orchestration platforms are non-deterministic and leverage AI capabilities to coordinate responses and actions across AI agents. One area to evaluate is how administrators implement controls and guardrails over which AI agents can coordinate with others and under what circumstances. Additionally, platforms should also have controls on when and where people should be involved before taking action.

“CIOs should focus on how the AI orchestration platform clearly applies controls over autonomous decision-making,” says Heather Richards, global vice president of go-to-market strategy at Verint. “Ideally, the platform makes it easy to define who or what can take actions, how decisions are approved, and where accountability sits when something goes wrong. If orchestration doesn’t have built-in governance, visibility, and human override, it will scale risk faster than it scales value.”

Observable AI agents are primary capabilities for tracing how they interact and where decisions are made. But even more important is to review how platforms govern access to the context layer, which can include retrieval-augmented generation (RAG) for language models, knowledge graphs, and semantic layers.

“When evaluating an AI orchestration platform, organizations should consider whether governance and observability were built into the architecture from day one,” says Caitlin Schuman, director of AI strategy and customer innovation at Presidio. “A strong platform should make it clear what context is being used and should have a control layer that routes work across systems, agents, and humans.”

Deploying trustworthy AI agents is important for gaining employee adoption. Charles Crouchman, chief product officer at Redwood Software, suggests evaluating how an AI agent orchestration platform establishes trustworthy operations with enterprise resources. He recommends asking these five questions:

• Can it connect to the systems actually running your business?
• Can it be trusted to execute mission-critical logic across your ERP, supply chain, and finance platforms?
• Does it provide deterministic guardrails for non-deterministic AI, so agents can’t go rogue in production?
• Is it model-agnostic, so you’re not locked into a single LLM or agent framework as the landscape shifts?
• Can you govern at scale with full audit trails, observability, and accountability?

“Validating these answers moves you from disconnected AI  reasoning to real execution, empowering you to take the next step towards an autonomous enterprise,” says Crouchman.

2. Secure and resilient operations

AI agent orchestration platforms centralize a growing number of operational workflows, so it’s important to evaluate whether their security, performance, reliability, and resiliency meet compliance and non-functional requirements.  

“Deploying agents is the easy part; the hard part is ensuring they operate safely, consistently, and in coordination with the people and systems around them,” says Daniel Meyer, CTO at Camunda. “Orchestration platforms should enforce controls between an agent’s decision and its action, handle long-running processes without losing state, and maintain a full audit trail natively.”

Organizations should also consider how platforms support agentic ops practices for identity management, monitoring, AI agent accuracy, and incident management.

“Don’t just seek solutions that coordinate workflow or handle the life cycle of an agent; also seek solutions that get the answers agents need faster, with more accuracy, all while meeting essential security and compliance requirements,” says James Urquhart, field CTO and technology evangelist at Kamiwaza. “A platform that securely coordinates context gathering and result formulation across widely disparate infrastructures and data sources is essential, not only to the performance of AI in the enterprise, but also to its agility.”

3. Integrated testing and feedback

Testing AI agents requires validating changes before deployment, just as with continuous testing for applications and APIs. But it also requires evaluating prompts, responses, and actions in production and ensuring that agents aren’t drifting from expected parameters or going rogue. One area in which AI agent orchestration platforms differ is how they support testing AI agents, monitoring them in production, and providing a centralized source of feedback to support accuracy improvements.

“When selecting an AI orchestration platform, don’t overlook where the software it produces actually gets tested and validated,” says Jean-Philippe LeBlanc, senior vice president of engineering at CircleCI. “AI can accelerate every stage of development, but without rigorous, automated validation integrated into the delivery pipeline, you’re compounding risk at the same rate you’re compounding velocity.”

Armando Franco, senior director of cloud and platform modernization at TEKsystems Global Services, says, “The criterion that actually matters is whether continuous outcome evaluation is a first-class capability of the platform itself, because without it, iteration speed collapses and the program stalls.”

4. Interoperability and open standards

MCP and A2A are two ways AI agent orchestration platforms support open standards and enable connecting to an ecosystem of agents. Many platforms also allow developers to select and replace the underlying AI models and to choose from a range of AI code-generation tools. These flexibilities ensure teams can optimize around performance, accuracy, compliance, costs, and other future considerations.

“When evaluating an AI orchestration platform, we look first at composability and interoperability,” says Rajesh Arora, chief data and analytics officer at Principal. “The real test is not how many features it offers today, but whether it can connect models, data sources, agentic solutions, and workflows in a way that adapts to our AI strategy, tech stack, and changing business needs.”

Other interoperability criteria to review include the platform’s AI agent cataloging capabilities, how permissions are configured dynamically, and whether prebuilt connectors are available for the required integrations.

5. Vendor viability and road map

Leaders recognize that AI is currently reshaping business more than driving transformation. To be successful, organizations require AI governance that keeps up with strategy and doesn’t lag too far behind. The same is true for AI agent orchestration platforms, so it’s important to review their release notes and road maps to see whether providers strike a reasonable balance between innovation and governance.

“The right orchestration platform provides a unified policy layer that follows work across agents, workflows, and AI tools, enabling your teams to build freely while IT and security maintain full visibility at the action and output levels,” says Brandon Sammut, chief people and AI transformation officer at Zapier. “If your governance can’t keep pace with how fast your people are building, you’ll either slow them down or lose sight of what they’re building.”

Since AI agent orchestration platforms are a new category, technology leaders should partner with their financial, legal, and compliance colleagues to assess vendor viability risks. In addition, reviewing customer adoption and support capabilities is important as top solution providers will continue to evolve their platforms.   

“A mature provider offers both a stable platform and the customer support you’ll need, and with a large customer base, they’ve already hit countless edge cases that can smooth your own implementation,” says Hannes Hapke, director of the 575 Lab at Dataiku. “Assess maturity by looking at funding and financial backing, the clarity and consistency of their public road map, and the size and activity of their community. An engaged user base, active forums, and a healthy ecosystem of integrations all signal a provider that will still be standing when you scale.”

Many organizations are still early in adopting AI agents and transitioning proofs of concept into production. But for those deploying a growing number of AI agents across many platforms, selecting an AI agent orchestration platform enables scaling workflows, operations, and governance. 

Black Hat 2026 is shaping up to be another AI-heavy conference, but this year’s announcements suggest the industry is moving beyond simply adding copilots to existing products.

Vendors are increasingly packaging AI into operational workflows, while pairing automation with governance, exposure management, and recovery capabilities aimed at making autonomous security more practical for enterprise environments.

Across this year’s launches, several themes stand out. Security vendors emphasize attack path analysis over raw vulnerability counts, integrating external threat intelligence directly into security and recovery workflows, and introducing purpose-built AI agents that promise to accelerate investigations without forcing customers to replace existing infrastructure.

Below is a running list of the announcements that stood out.

ArmorCode adds AI agents for vulnerability remediation

ArmorCode expanded its Agentic Control Plane with four new Anya AI agents and enhanced Context Risk Graph capabilities designed to help organizations prioritize and remediate vulnerabilities based on “real business risk” rather than raw CVE volume.

The new capabilities introduce attack path analysis, network reachability mapping, patch management integration, and support for compensating controls such as WAFs and EDR platforms. The company says the new AI agents can investigate exploitability, recommend mitigations, assess cloud exposures, and orchestrate patch rollouts while reusing shared security context to reduce redundant AI analysis and operational costs.

Cribl turns telemetry into AI observability

Cribl introduced a new AI Observability application alongside expanded detection engineering capabilities and stream-native detections. The AI Observability app promises enterprises visibility into AI model usage, token consumption, spending, and potential sensitive data exposure using telemetry they already collect.

The company also enhanced its detection engineering capabilities through its CardinalOps acquisition by mapping detections to MITRE ATT&CK, identifying coverage gaps, and applying AI-assisted workflows, while new stream-native detections aim to identify high-confidence threats directly from telemetry in motion without requiring another data platform.

CommVault brings Google Threat Intelligence into recovery workflows

CommVault announced an integration between its Threat Scan and Google Threat Intelligence to help organizations identify clean recovery points after cyberattacks.

The integration combines Google’s threat intelligence with CommVault’s backup validation workflows, while new inline file hash collection allows recovery points to be checked against threat indicators during backup operations. The company says the layered approach enables customers to validate recovery points faster before performing deeper malware or forensic analysis and strengthens its AI-enabled Synthetic Recovery capability. Availability is expected in the coming months.

SOCRadar focuses on identity exposure intelligence

SOCRadar is introducing People Intelligence, a new identity-focused offering within its Extended Threat Intelligence (XTI) platform.

The capability aggregates breached credentials, stealer logs, personally identifiable information, attacker telemetry, and other external identity exposure data into unified analyst records, allowing investigators to prioritize identity risks without integrating internal HR and IAM systems. Automated risk scoring and consolidated identity context are intended to reduce manual correlation work during investigations.

Arctic Wolf doubles down on cyber resilience

Arctic Wolf unveiled a new Cyber Resilience offering that bundles managed detection and response, exposure management, endpoint protection, incident response, and up to $3 million in warranty protection into a single package. The offering is available immediately through Arctic Wolf and its partner ecosystem.

Separately, Arctic Wolf also highlighted new milestones for its Aurora Agentic SOC, including processing more than 10 trillion security events per week, introducing a new Mean Time to Trusted Action (MTTA) metric, expanding its Swarm of Experts architecture, and enhancing customer visibility through updates to the Arctic Wolf Portal.

Additionally, the company announced a partner-focused Cyber AI Readiness Accelerator that combines Aurora Attack Surface Management with consulting and remediation services from channel partners. The 30-day assessment is designed to help organizations inventory exposed assets, identify attack paths, prioritize remediation, and establish broader cyber resilience programs.

Crogl pushes sovereign AI for the SOC

Crogl announced general availability of its Enterprise AI SOC Agent as a free download. Designed to run inside customer-controlled environments, including on-premises and air-gapped deployments, the autonomous investigation platform integrates with existing security tools without requiring new data pipelines or schema normalization. Crogl says the platform investigates alerts, performs threat hunts, documents investigative steps, and generates reports while allowing organizations to keep security data within their own infrastructure.

Tanium expands autonomous security platform

Tanium announced several additions to its Autonomous IT Platform spanning agentic AI, exposure management, and security operations. New Alas capabilities include background AI agents, agentic performance analysis, expanded automation, and an MCP server that exposes governed Tanium data to compatible AI assistants. The company also introduced External Attack Surface Management, Attack Path Mapping, Agent-Guided Threat Hunting, and a private preview integration with Google Threat Intelligence, extending its focus from endpoint management to coordinated autonomous security operations.

A new critical vulnerability in the Ruby on Rails (“Rails”) web application framework, CVE-2026-66066, could turn a seemingly innocuous image into a front door to your secrets.

Disclosed July 30, the high severity CVE (scored 9.5 out of 10) poses a significant risk to enterprises running apps that handle user-uploaded images in Rails.

Dubbed “KindaRails2Shell,” it targets the overly-trusting Active Storage component of the open-source framework, allowing unauthenticated attackers to read sensitive files or escalate to remote code execution (RCE).

The issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1 of Active Storage; enterprises running Rails should update immediately.

“The ‘chef’s kiss’ is the ability for an attacker to upload an image that isn’t actually an image [but] is code that allows them to steal secrets,” said David Shipley of Beauceron Security.

Attackers get the key to the castle

Ruby on Rails is an open-source, server-side application framework used for building full-stack web apps and application programming interfaces (APIs).

It is popular among developers because it is scalable, easy to learn and use, supports quick application development, taps into an active community of more than 1,000 engineers developing and maintaining it, and has an extensive library of nearly two million lines of prebuilt code.

CVE-2026-66066 specifically targets Rails’ built-in Active Storage component, which lets users upload files to cloud services or local disks and link them to their applications. In particular, the vulnerability exploits the way Active Storage interacts with the libvips image processing library to generate images.

Libvips contains what are known as “unfuzzed” operations which have not been hardened against malicious inputs through techniques known as fuzzing that test where they crash, leak data, or otherwise behave erratically. This makes them unsafe for use with untrusted content, but Active Storage does not adequately disable them.

“CVE-2026-66066 is particularly dangerous because an attacker may not need an account or privileged access,” explained Ensar Seker, CISO at SOCRadar.

Attackers can exploit the unsafe pipeline by uploading specially crafted files that trick Active Storage into giving them access to files that the Rails process is permitted to access, even highly-sensitive ones in app processing environments.

In practical terms, this could expose environment variables, Rails application secrets, database credentials, cloud access keys, API tokens and credentials for connected services, Seker explained.

Attackers can also gain access to the secret_key_base that signs and encrypts cookies, credentials, and session data. When secret_key_base is compromised, attackers essentially hold the key to the app.

“The immediate vulnerability is an arbitrary file-read issue, but the theft of secrets such as Rails’ secret_key_base can turn information disclosure into a much broader compromise,” Seker said.

Depending on the application, attackers could potentially forge trusted application data or sessions, access databases and cloud services, move laterally into connected systems, or achieve RCE.

That escalation path is what makes the vulnerability critical, Seker said. “A seemingly routine image upload feature, such as a profile picture, avatar or thumbnail generator, could become an entry point into the application’s underlying infrastructure.”

How to identify if you’re vulnerable

Applications are impacted when they are configured to use libvips for Active Storage image processing (the default behavior since Rails 7.0) and accept image uploads from untrusted or unauthenticated users. Enterprises should audit every internal and third-party app to determine whether they are configured this way, Seker advised, and patch Rails and Active Storage immediately. They should also examine every feature accepting images, including avatars, support attachments, product images, and administrative upload functions.

Upgrading Rails alone is not sufficient when an older libvips installation remains underneath it; libvips must be version 8.13 or later, he said.

Forensic guidance and tooling from the Rails project can help enterprises determine whether apps are vulnerable or files are exploitable, Seker noted. It’s also important to review app, proxy, object-storage, and image-processing logs for suspicious uploads or unusual requests.

Additionally, admins should rotate secret_key_base and every other credential available in Rails, invalidate active sessions, and investigate downstream systems for potentially exposed credentials.

“Security teams should treat this as a potential secret-exposure incident, not merely a patch-management exercise,” Seker said.

Don’t trust image processing pipelines

Complex image libraries support many formats and rely on numerous parsers and third-party components, creating a broad attack surface, Seker noted. Therefore, the libraries “should be treated as untrusted code execution territory.”

Image processing should be isolated in dedicated sandboxes, containers, or restricted to workers with minimal filesystem access, he advised. There should be no unnecessary network connectivity or access to an app’s files or secrets. Strict allowlists should be applied, file content human-validated, and uploads scanned before processing and stored outside app directories. 

Additional controls should include short-lived and narrowly scoped credentials, outbound network restrictions, dependency and software composition monitoring, and automated tests that confirm that dangerous codecs or operations are disabled post-upgrade, Seker said.

“The broader lesson is that organizations cannot assess exposure solely by asking whether they ‘use Rails,’” he noted, pointing out that two applications running the same Rails version may have very different exposure depending on their image processor, upload paths, and operating system packages. This makes visibility into runtime configuration, libraries, and app functionality critical.

This incident also demonstrates the importance of secret rotation in vulnerability response, he added. “When a vulnerability enables arbitrary file access, installing the patch closes the entry point but does not revoke credentials that may already have been copied.”

Don’t just assume you’re safe

This vulnerability illustrates a perfect use case for a software bill of materials (SBOM), which can speed up discovery of vulnerable software and triage it, Beauceron’s Shipley noted. And enterprises could also adopt intelligent web application firewall monitoring and intervention in addition to isolating systems and patching.

“The words you never want to hear in any critical vulnerability are ‘arbitrary code execution’ and ‘remote code execution’,” he said. “Either of those can mean bad news.”

What’s also interesting here is that the disclosure process was hijacked, he pointed out. Rails published technical details about the flaw and forensic tools to assess application vulnerability to it and to look for evidence of data exfiltration nearly a month before it planned to, because several researchers had reverse-engineered the attack and published proof of concept code.

The fact that proofs of concept are now available “materially increases the likelihood of opportunistic scanning and exploitation attempts,” Seker noted.

Therefore, he said, “even organizations that see no obvious evidence of compromise should not assume that patching alone removes the risk created by previously exposed secrets.”

This article originally appeared on CSOonline.

A new critical vulnerability in the Ruby on Rails (“Rails”) web application framework, CVE-2026-66066, could turn a seemingly innocuous image into a front door to your secrets.

Disclosed July 30, the high severity CVE (scored 9.5 out of 10) poses a significant risk to enterprises running apps that handle user-uploaded images in Rails.

Dubbed “KindaRails2Shell,” it targets the overly-trusting Active Storage component of the open-source framework, allowing unauthenticated attackers to read sensitive files or escalate to remote code execution (RCE).

The issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1 of Active Storage; enterprises running Rails should update immediately.

“The ‘chef’s kiss’ is the ability for an attacker to upload an image that isn’t actually an image [but] is code that allows them to steal secrets,” said David Shipley of Beauceron Security.

Attackers get the key to the castle

Ruby on Rails is an open-source, server-side application framework used for building full-stack web apps and application programming interfaces (APIs).

It is popular among developers because it is scalable, easy to learn and use, supports quick application development, taps into an active community of more than 1,000 engineers developing and maintaining it, and has an extensive library of nearly two million lines of prebuilt code.

CVE-2026-66066 specifically targets Rails’ built-in Active Storage component, which lets users upload files to cloud services or local disks and link them to their applications. In particular, the vulnerability exploits the way Active Storage interacts with the libvips image processing library to generate images.

Libvips contains what are known as “unfuzzed” operations which have not been hardened against malicious inputs through techniques known as fuzzing that test where they crash, leak data, or otherwise behave erratically. This makes them unsafe for use with untrusted content, but Active Storage does not adequately disable them.

“CVE-2026-66066 is particularly dangerous because an attacker may not need an account or privileged access,” explained Ensar Seker, CISO at SOCRadar.

Attackers can exploit the unsafe pipeline by uploading specially crafted files that trick Active Storage into giving them access to files that the Rails process is permitted to access, even highly-sensitive ones in app processing environments.

In practical terms, this could expose environment variables, Rails application secrets, database credentials, cloud access keys, API tokens and credentials for connected services, Seker explained.

Attackers can also gain access to the secret_key_base that signs and encrypts cookies, credentials, and session data. When secret_key_base is compromised, attackers essentially hold the key to the app.

“The immediate vulnerability is an arbitrary file-read issue, but the theft of secrets such as Rails’ secret_key_base can turn information disclosure into a much broader compromise,” Seker said.

Depending on the application, attackers could potentially forge trusted application data or sessions, access databases and cloud services, move laterally into connected systems, or achieve RCE.

That escalation path is what makes the vulnerability critical, Seker said. “A seemingly routine image upload feature, such as a profile picture, avatar or thumbnail generator, could become an entry point into the application’s underlying infrastructure.”

How to identify if you’re vulnerable

Applications are impacted when they are configured to use libvips for Active Storage image processing (the default behavior since Rails 7.0) and accept image uploads from untrusted or unauthenticated users. Enterprises should audit every internal and third-party app to determine whether they are configured this way, Seker advised, and patch Rails and Active Storage immediately. They should also examine every feature accepting images, including avatars, support attachments, product images, and administrative upload functions.

Upgrading Rails alone is not sufficient when an older libvips installation remains underneath it; libvips must be version 8.13 or later, he said.

Forensic guidance and tooling from the Rails project can help enterprises determine whether apps are vulnerable or files are exploitable, Seker noted. It’s also important to review app, proxy, object-storage, and image-processing logs for suspicious uploads or unusual requests.

Additionally, admins should rotate secret_key_base and every other credential available in Rails, invalidate active sessions, and investigate downstream systems for potentially exposed credentials.

“Security teams should treat this as a potential secret-exposure incident, not merely a patch-management exercise,” Seker said.

Don’t trust image processing pipelines

Complex image libraries support many formats and rely on numerous parsers and third-party components, creating a broad attack surface, Seker noted. Therefore, the libraries “should be treated as untrusted code execution territory.”

Image processing should be isolated in dedicated sandboxes, containers, or restricted to workers with minimal filesystem access, he advised. There should be no unnecessary network connectivity or access to an app’s files or secrets. Strict allowlists should be applied, file content human-validated, and uploads scanned before processing and stored outside app directories. 

Additional controls should include short-lived and narrowly scoped credentials, outbound network restrictions, dependency and software composition monitoring, and automated tests that confirm that dangerous codecs or operations are disabled post-upgrade, Seker said.

“The broader lesson is that organizations cannot assess exposure solely by asking whether they ‘use Rails,’” he noted, pointing out that two applications running the same Rails version may have very different exposure depending on their image processor, upload paths, and operating system packages. This makes visibility into runtime configuration, libraries, and app functionality critical.

This incident also demonstrates the importance of secret rotation in vulnerability response, he added. “When a vulnerability enables arbitrary file access, installing the patch closes the entry point but does not revoke credentials that may already have been copied.”

Don’t just assume you’re safe

This vulnerability illustrates a perfect use case for a software bill of materials (SBOM), which can speed up discovery of vulnerable software and triage it, Beauceron’s Shipley noted. And enterprises could also adopt intelligent web application firewall monitoring and intervention in addition to isolating systems and patching.

“The words you never want to hear in any critical vulnerability are ‘arbitrary code execution’ and ‘remote code execution’,” he said. “Either of those can mean bad news.”

What’s also interesting here is that the disclosure process was hijacked, he pointed out. Rails published technical details about the flaw and forensic tools to assess application vulnerability to it and to look for evidence of data exfiltration nearly a month before it planned to, because several researchers had reverse-engineered the attack and published proof of concept code.

The fact that proofs of concept are now available “materially increases the likelihood of opportunistic scanning and exploitation attempts,” Seker noted.

Therefore, he said, “even organizations that see no obvious evidence of compromise should not assume that patching alone removes the risk created by previously exposed secrets.”

Nvidia is looking to speed access to AI storage and memory systems by open-sourcing its cuFile APIs and software stack. It’s also promoting a new 40-vendor initiative that aims to standardize GPU-driven storage advancements.

At this week’s Future of Memory and Storage (FMS) conference, Nvidia said it would open-source its cuFile APIs and the vertical storage software stack underneath them, which allow GPUs, not just CPUs, to read from and write to storage directly. cuFile is an Nvidia software library that is part of its GPUDirect Storage (GDS) platform, and the APIs will be developed under the Accelerated IO Special Interest Group (xio-sig), an industry consortium focused on creating open standards for high-performance, low-latency I/O.

The move is intended to foster broader adoption and interoperability across the AI storage industry, making cuFile a more open foundation for AI-native storage rather than a proprietary Nvidia-only interface, according to Jason Hardy, vice president of storage technology at Nvidia. 

As GPUs become faster, storage is increasingly the bottleneck, and many GPUs can process data faster than many storage systems can deliver it. The idea behind cuFile is to increase storage throughput, reduce latency, improve GPU utilization, and speed AI training and inference workloads, Hardy wrote in a blog post about the news.

“Using hundreds of thousands of GPU threads, fast high-bandwidth memory and other methodologies, cuFile enables securely accessing data from storage in just microseconds,” Hardy wrote. “In addition, fast, secure access to data and storage is a foundational element to powering preventive and detective cybersecurity measures. Making cuFile openly available will help make security context, data and storage accessible at the speed AI-powered defenses need. Such open technologies support initiatives such as the new Open Secure AI Alliance.”

The xio-sig site is the new home for APIs that are open to contributions — with Google, Intel, Nvidia, and Meta as some of the first contributors — and can be optimized for use across various software and hardware platforms, driving innovation and efficiency for developers and enterprises, according to Hardy.

Nvidia also said it will be a leader of a new memory and storage industry initiative called Storage-Next. Storage-Next will bring together over 40 storage makers, controller vendors, thermal design, cooling and orchestration operators, and standards bodies to align on how GPU-driven storage should behave — then turn these advancements into interoperable, open industry standards, Hardy stated. The group will include DDN, Kioxa and Micron, each contributing to AI storage technologies.

“The initiative is grounded in accelerated data access for large AI datasets. To support this effort, Nvidia offers scaled, accelerated data access or SCADA — a framework that lets massively parallel GPUs pull only the data necessary for the application directly from storage into their own high-speed memory,” Hardy stated.

Storage vendor DDN is integrating SCADA with Infinia, its software-defined, AI-native data intelligence platform, for example. “Our collaboration with Nvidia is helping create a more direct, efficient connection between GPUs and data — keeping accelerated computing resources productive, speeding time to insight and enabling customers to achieve stronger business and financial returns from their AI investments,” stated Sven Oehme, chief technology officer at DDN, in the Hardy blog.

Hardy added that Storage-Next and SCADA extend Nvidia’s longstanding work on AI storage infrastructure, including its Nvidia Vera BlueField-4 STX — a modular, rack-scale foundation powered by the Nvidia Vera Rubin platform, Vera BlueField-4 storage processors, and Spectrum-X Ethernet networking. 

Nvidia’s STX unifies its Vera, Rubin, and BlueField-4 packages into a system fort high-performance storage, enterprise AI data, and memory. Nvidia STX is a key driver for the vendor as it unifies its Vera, Rubin, BlueField-4 and Spectrum-X Ethernet networking technologies to offer a blueprint for customers to upgrade traditional storage systems, Nvidia states.

AWS on Tuesday released Kiro Crew, an open-source orchestration platform designed to help enterprises move beyond interactive AI coding assistants toward long-running, autonomous engineering workflows that span repositories, developer tools, and multiple work sessions.

Rather than simply generating code, Kiro Crew coordinates multiple AI agents, schedules recurring work, preserves project context across sessions, and integrates with developer tools to investigate incidents, monitor pull requests (PRs), triage tickets, and automate software engineering tasks while developers are away from their keyboards, according to the hyperscaler.

“Kiro Crew is a persistent, open-source development workspace for work that is bigger than a single task in a single session,” Darko Mesaros, distinguished developer advocate at AWS, told InfoWorld. “Think of it as an application layer that turns AI coding agents into always-working, self-learning, autonomous teammates.”

To support that model, the offering ships with persistent memory, multi-agent orchestration tools, approval workflows, scheduling, security controls such as sandboxing and signed audit logs, and a web and desktop dashboard for monitoring agent activity, the hyperscaler said in a statement.

Kiro Crew was originally developed inside Amazon as an internal project called MeshClaw and was later adopted by more than 39,000 Amazon builders in less than six months.

It can be deployed entirely inside customer environments, including laptops, containers, or virtual machines, without requiring an AWS account or AWS-managed control plane, AWS said.

To demonstrate how the new offering can be used, AWS is also launching a set of reference applications built on top of it, including DevFleets for worktree management, Issue Radar for issue and pull-request triage, and Task Runner for executing long-running engineering tasks.

Rather than standalone products, these apps combine purpose-built user interfaces with Kiro Crew’s orchestration engine, memory, scheduling, integrations, and backend services to automate specific engineering workflows, Mesaros said, adding that the hyperscaler is expected to add more such apps in the future.

Boosting developer productivity

Such applications, according to Michael Leone, principal analyst at Moor Strategy and Insights, would help platform engineering, DevOps, and site reliability engineering (SRE) teams, where much of the work involves repetitive, long-running operational tasks rather than writing entirely new software.

“These tasks can include dependency upgrades, framework migrations, flaky test cleanup, triaging and routing a ticket queue, and the first pass on an incident investigation,” Leone said.

“It’s a strong fit for long-running migrations that require checkpoints and retries over hours without supervision,” echoed Manoj Chandra Jha, principal analyst at Nord-IQ Research.

Taken together, those capabilities could significantly reduce software release cycles as well as the time developers spend supervising AI tools and reconnecting context between engineering workflows, according to Dave McCarthy, vice president of enterprise infrastructure at IDC.

“It eliminates context-switching and babysitting single prompts. Work continues asynchronously in the background while developers are in meetings, off the clock, or asleep, allowing teams to return to completed progress rather than a stalled process,” McCarthy said.

That, in turn, will allow developers to spend more time on higher-value engineering tasks, such as designing systems, making architectural decisions, and solving complex engineering problems, echoed Ashish Chaturvedi, executive research leader at HFS Research.

Why CIOs should care

Kiro Crew’s open-source, self-hosted architecture could help enterprises looking to bring governance and visibility to the growing use of AI coding agents, analysts said.

“Agent use inside most companies right now is shadow IT, with individual developers wiring up their own agents against their own credentials and nobody tracking it. A shared workspace with approval gates and logging gives you one place to see what ran, what it touched, and who authorized it,” said Leone.

Those governance capabilities, combined with the ability to run inside customer-controlled environments, according to Chaturvedi, could also help CIOs address security and compliance concerns: “Being open source and self-hostable, a CIO can run it on their own infrastructure and keep code and credentials inside their perimeter rather than sending them to a black-box agent.”

That reduction in security concerns, combined with Kiro Crew’s human-approval workflows, could provide enterprises with a lower-risk path to broader agent adoption, Jha said. “Since it embeds consistency and security screening at scale, and because review remains human-approved, it’s a low-risk entry point for demonstrating agentic ROI before extending trust to higher-stakes, unattended workflows.”

Not without trade-offs

Despite its benefits, the adoption of Kiro Crew comes with trade-offs, analysts warned.

Adopting Kiro Crew may not be a simple plug-and-play operation, said Stephanie Walter, practice lead for AI Stack at HyperFRAME Research. Rather, it introduces yet another orchestration layer for enterprises to manage and secure, she said.

Enterprises would need to draft up policies covering least-privilege access, human approvals, memory retention, code provenance, and auditability before allowing persistent agents to operate across source code repositories and CI/CD pipelines, Walter said.

More so because most enterprises, Walter added, are still not operationally ready to manage swarms of autonomous AI agents: “Many are still struggling to measure the cost and value of individual AI agents. Parallel agents multiply model calls, compute, CI activity, API usage, tool access, and human review, not just token consumption.”

Open architecture, but questions remain

Even for organizations that are ready to experiment with autonomous coding agents, integrating Kiro Crew into existing development environments may require additional work.

Although AWS built Kiro Crew around open standards such as Agent Client Protocol (ACP) and Model Context Protocol (MCP), the platform runs on the proprietary Kiro CLI at launch, according to Mesaros.

That means enterprises using other AI coding agents, such as Claude Code, Codex, or Devin, may need to build and validate their own connectors before they can use Kiro Crew as their orchestration layer.

“The dependency is real. AWS says Crew runs on the Kiro CLI at launch, and that CLI is proprietary and metered by credits, so it’s the harness actually wired up on day one. Until someone runs a different agent under Crew and shows it working, the open part stops at the orchestration layer,” said Leone.

For enterprises and development teams already using Kiro, however, adoption is expected to be more straightforward, as Kiro Crew can reuse existing .kiro configurations, including steering files, skills, and custom agents, without requiring additional setup, according to Mesaros.

The new offering, due to its open-source nature, is free as well, Mesaros pointed out, adding that customers need to pay only for the AI coding agents and tools they choose to connect to Crew.

AWS said it will govern the project through a publicly listed steering committee operating under an open governance model, with proposals submitted as pull requests and debated openly.

Kiro and AWS engineers will initially maintain the project, with trusted community contributors expected to join the maintainer group over time, it added.

AI agents are performing roughly 1 in 3 actions in enterprise IT workflows (but that share is rising quickly), while human analysts are rejecting about one-quarter of AI-proposed actions (but that rate is falling), according to a new study of tens of thousands of human-AI interactions. Operational data, rather than underlying AI infrastructures, is often the culprit when things go wrong.

Human analysts are approving the most consequential actions, managing exceptions, and supervising and shaping agentic systems, while AI agents are carrying out routine tasks and executions, automation platform provider Fixify found in the study.

“That may sound less dramatic than replacing the help desk,” Matt Peters, Fixify’s co-founder and CEO, wrote in a blog post. “It’s also a much more credible path to changing how IT work gets done.”

Building scaffolding

Fixify identified four steps of agentic work: Planning, proposing, approving or declining, then acting on approved steps.

It analyzed nearly 18,000 plans and over 147,000 actions executed by agents across 40 companies over a three-month period, finding that agents are taking over one-third of IT actions, most notably in software, applications, security, and collaboration work where requests tend to be “repeatable and easy to reverse.”

Tasks that are well understood and that present low risk are best suited for the current generation of agents, Peters wrote. Human analysts remain closely involved in higher-stakes areas like identity verification, setting up and removing IT access (onboarding and offboarding), and hardware environments.

However, AI’s share of the work is increasing as feedback loops improve: Over the three-month period, human approval of AI-proposed actions rose from 23% to 41%, and rejection fell from 27% to 16%, Fixify found.

The company identified six types of actions in AI automation. Running a skill — actually doing something — accounted for 39.4% of all actions). Most of the rest were coordination: sending a message to the human requester (27.7% of actions), leaving an initial comment (13.2%), giving instructions to a human analyst (9.8%), or waiting (8.8%). Running entire workflows accounted for just 1.1% of actions.

AI is building “scaffolding” that wraps around meaningful changes, often planning far more scenarios than the agent will execute. Typically, agents map out 15 possible actions but run only two, Fixify said.

“The agent maps the paths a request could take, then walks down the path that makes the most sense as it meets reality,” the study said.

Peters pointed to one example where an AI agent identified which team needed access to process a high-volume type of ticket. Rather than fully automating the process, the agent did the initial triage, asked questions, then routed tickets to the team that had the information to act immediately.

“We didn’t need a world-ending hive mind,” he said. “We just needed to point a little conversational intelligence in the right direction.”

When AI breaks down

IT automation typically involves analyzing tickets and moving them along; in other words, low-risk tasks.

But agents do participate in areas like security (albeit only about 6%), most notably adding and removing people from groups or channels, unlocking accounts, resetting passwords, analyzing multi-factor authentication (MFA), provisioning (or deprovisioning) accounts, and assigning software licenses.

However, this identity-lifecycle work is where agents failed the most, particularly in onboarding and offboarding and identity-access management (IAM), the study found. “Hardware and connectivity changes rarely fail; identity-lifecycle changes fail three-to-nine times as often.”

Why AI breaks down

Thanks to human-in-the-loop controls, Fixify was able to analyze scenarios where agent recommendation diverged from human judgment. This occurred about 23% of the time.

The largest failure category (nearly 50%) was ‘target not found,’ meaning the agent couldn’t uncover what it needed. This typically comes down to poor data: A user, group, account, or resource was not where the system expected it to be. When people change teams, groups are restructured, accounts are renamed, or work has already been done but not reflected in the system, this is more of an identity hygiene problem than an AI problem. The system needs cleaner and more current data.

Invalid inputs accounted for around 29% of failures, followed by unhandled errors, denied permissions, or invalid operations or configurations. The latter signal “real breakage” in integrations, according to Fixify.

AI becomes more sophisticated over time

The good news is that AI automation improves over time, even if it might take a while. In hybrid systems, humans keep the most consequential changes under their own control, and iterative rejection and approval helps AI learn.

Over time, agents’ plans get leaner and they start to re-plan when conditions change, rather than pre-planning all kinds of scenarios that may never occur. “That’s a sign of sophistication,” the study said. “Adapting in the moment is a more advanced behavior than trying to pre-script every contingency.”

In turn, humans second guess the system less often and feel comfortable handing off more work. Instead, they control how agents behave, make high-impact decisions, and handle exceptions. “The hardest requests remain human-heavy, especially those that require repeated replanning or contextual judgment,” the study said.

How teams can adapt to AI agents

As agentic AI becomes embedded in more workflows — and at deeper levels — enterprises must evolve to accommodate, Fixify emphasized.

This means investing in clean identity data and building strong playbooks, review workflows, and reliable integrations.

Teams should judge agentic tools by their supervision loop and view rejections as a training process, Fixify advised. Analyst time, queues, and metrics should be built around reviewing proposals. Agent replanning can be seen as a routing signal: A single replan might indicate healthy adaptation, while repeated replanning means ambiguity, irrelevance, or unclear policies.

“Make the review surface easy to understand so analysts can assess proposed actions and make quick decisions about how to proceed,” the study advised. “This is where the analyst’s attention belongs.”

This article first appeared on Computerworld.

AI agents are performing roughly 1 in 3 actions in enterprise IT workflows (but that share is rising quickly), while human analysts are rejecting about one-quarter of AI-proposed actions (but that rate is falling), according to a new study of tens of thousands of human-AI interactions. Operational data, rather than underlying AI infrastructures, is often the culprit when things go wrong.

Human analysts are approving the most consequential actions, managing exceptions, and supervising and shaping agentic systems, while AI agents are carrying out routine tasks and executions, automation platform provider Fixify found in the study.

“That may sound less dramatic than replacing the help desk,” Matt Peters, Fixify’s co-founder and CEO, wrote in a blog post. “It’s also a much more credible path to changing how IT work gets done.”

Building scaffolding

Fixify identified four steps of agentic work: Planning, proposing, approving or declining, then acting on approved steps.

It analyzed nearly 18,000 plans and over 147,000 actions executed by agents across 40 companies over a three-month period, finding that agents are taking over one-third of IT actions, most notably in software, applications, security, and collaboration work where requests tend to be “repeatable and easy to reverse.”

Tasks that are well understood and that present low risk are best suited for the current generation of agents, Peters wrote. Human analysts remain closely involved in higher-stakes areas like identity verification, setting up and removing IT access (onboarding and offboarding), and hardware environments.

However, AI’s share of the work is increasing as feedback loops improve: Over the three-month period, human approval of AI-proposed actions rose from 23% to 41%, and rejection fell from 27% to 16%, Fixify found.

The company identified six types of actions in AI automation. Running a skill — actually doing something — accounted for 39.4% of all actions). Most of the rest were coordination: sending a message to the human requester (27.7% of actions), leaving an initial comment (13.2%), giving instructions to a human analyst (9.8%), or waiting (8.8%). Running entire workflows accounted for just 1.1% of actions.

AI is building “scaffolding” that wraps around meaningful changes, often planning far more scenarios than the agent will execute. Typically, agents map out 15 possible actions but run only two, Fixify said.

“The agent maps the paths a request could take, then walks down the path that makes the most sense as it meets reality,” the study said.

Peters pointed to one example where an AI agent identified which team needed access to process a high-volume type of ticket. Rather than fully automating the process, the agent did the initial triage, asked questions, then routed tickets to the team that had the information to act immediately.

“We didn’t need a world-ending hive mind,” he said. “We just needed to point a little conversational intelligence in the right direction.”

When AI breaks down

IT automation typically involves analyzing tickets and moving them along; in other words, low-risk tasks.

But agents do participate in areas like security (albeit only about 6%), most notably adding and removing people from groups or channels, unlocking accounts, resetting passwords, analyzing multi-factor authentication (MFA), provisioning (or deprovisioning) accounts, and assigning software licenses.

However, this identity-lifecycle work is where agents failed the most, particularly in onboarding and offboarding and identity-access management (IAM), the study found. “Hardware and connectivity changes rarely fail; identity-lifecycle changes fail three-to-nine times as often.”

Why AI breaks down

Thanks to human-in-the-loop controls, Fixify was able to analyze scenarios where agent recommendation diverged from human judgment. This occurred about 23% of the time.

The largest failure category (nearly 50%) was ‘target not found,’ meaning the agent couldn’t uncover what it needed. This typically comes down to poor data: A user, group, account, or resource was not where the system expected it to be. When people change teams, groups are restructured, accounts are renamed, or work has already been done but not reflected in the system, this is more of an identity hygiene problem than an AI problem. The system needs cleaner and more current data.

Invalid inputs accounted for around 29% of failures, followed by unhandled errors, denied permissions, or invalid operations or configurations. The latter signal “real breakage” in integrations, according to Fixify.

AI becomes more sophisticated over time

The good news is that AI automation improves over time, even if it might take a while. In hybrid systems, humans keep the most consequential changes under their own control, and iterative rejection and approval helps AI learn.

Over time, agents’ plans get leaner and they start to re-plan when conditions change, rather than pre-planning all kinds of scenarios that may never occur. “That’s a sign of sophistication,” the study said. “Adapting in the moment is a more advanced behavior than trying to pre-script every contingency.”

In turn, humans second guess the system less often and feel comfortable handing off more work. Instead, they control how agents behave, make high-impact decisions, and handle exceptions. “The hardest requests remain human-heavy, especially those that require repeated replanning or contextual judgment,” the study said.

How teams can adapt to AI agents

As agentic AI becomes embedded in more workflows — and at deeper levels — enterprises must evolve to accommodate, Fixify emphasized.

This means investing in clean identity data and building strong playbooks, review workflows, and reliable integrations.

Teams should judge agentic tools by their supervision loop and view rejections as a training process, Fixify advised. Analyst time, queues, and metrics should be built around reviewing proposals. Agent replanning can be seen as a routing signal: A single replan might indicate healthy adaptation, while repeated replanning means ambiguity, irrelevance, or unclear policies.

“Make the review surface easy to understand so analysts can assess proposed actions and make quick decisions about how to proceed,” the study advised. “This is where the analyst’s attention belongs.”

AI agents are performing roughly 1 in 3 actions in enterprise IT workflows (but that share is rising quickly), while human analysts are rejecting about one-quarter of AI-proposed actions (but that rate is falling), according to a new study of tens of thousands of human-AI interactions. Operational data, rather than underlying AI infrastructures, is often the culprit when things go wrong.

Human analysts are approving the most consequential actions, managing exceptions, and supervising and shaping agentic systems, while AI agents are carrying out routine tasks and executions, automation platform provider Fixify found in the study.

“That may sound less dramatic than replacing the help desk,” Matt Peters, Fixify’s co-founder and CEO, wrote in a blog post. “It’s also a much more credible path to changing how IT work gets done.”

Building scaffolding

Fixify identified four steps of agentic work: Planning, proposing, approving or declining, then acting on approved steps.

It analyzed nearly 18,000 plans and over 147,000 actions executed by agents across 40 companies over a three-month period, finding that agents are taking over one-third of IT actions, most notably in software, applications, security, and collaboration work where requests tend to be “repeatable and easy to reverse.”

Tasks that are well understood and that present low risk are best suited for the current generation of agents, Peters wrote. Human analysts remain closely involved in higher-stakes areas like identity verification, setting up and removing IT access (onboarding and offboarding), and hardware environments.

However, AI’s share of the work is increasing as feedback loops improve: Over the three-month period, human approval of AI-proposed actions rose from 23% to 41%, and rejection fell from 27% to 16%, Fixify found.

The company identified six types of actions in AI automation. Running a skill — actually doing something — accounted for 39.4% of all actions). Most of the rest were coordination: sending a message to the human requester (27.7% of actions), leaving an initial comment (13.2%), giving instructions to a human analyst (9.8%), or waiting (8.8%). Running entire workflows accounted for just 1.1% of actions.

AI is building “scaffolding” that wraps around meaningful changes, often planning far more scenarios than the agent will execute. Typically, agents map out 15 possible actions but run only two, Fixify said.

“The agent maps the paths a request could take, then walks down the path that makes the most sense as it meets reality,” the study said.

Peters pointed to one example where an AI agent identified which team needed access to process a high-volume type of ticket. Rather than fully automating the process, the agent did the initial triage, asked questions, then routed tickets to the team that had the information to act immediately.

“We didn’t need a world-ending hive mind,” he said. “We just needed to point a little conversational intelligence in the right direction.”

When AI breaks down

IT automation typically involves analyzing tickets and moving them along; in other words, low-risk tasks.

But agents do participate in areas like security (albeit only about 6%), most notably adding and removing people from groups or channels, unlocking accounts, resetting passwords, analyzing multi-factor authentication (MFA), provisioning (or deprovisioning) accounts, and assigning software licenses.

However, this identity-lifecycle work is where agents failed the most, particularly in onboarding and offboarding and identity-access management (IAM), the study found. “Hardware and connectivity changes rarely fail; identity-lifecycle changes fail three-to-nine times as often.”

Why AI breaks down

Thanks to human-in-the-loop controls, Fixify was able to analyze scenarios where agent recommendation diverged from human judgment. This occurred about 23% of the time.

The largest failure category (nearly 50%) was ‘target not found,’ meaning the agent couldn’t uncover what it needed. This typically comes down to poor data: A user, group, account, or resource was not where the system expected it to be. When people change teams, groups are restructured, accounts are renamed, or work has already been done but not reflected in the system, this is more of an identity hygiene problem than an AI problem. The system needs cleaner and more current data.

Invalid inputs accounted for around 29% of failures, followed by unhandled errors, denied permissions, or invalid operations or configurations. The latter signal “real breakage” in integrations, according to Fixify.

AI becomes more sophisticated over time

The good news is that AI automation improves over time, even if it might take a while. In hybrid systems, humans keep the most consequential changes under their own control, and iterative rejection and approval helps AI learn.

Over time, agents’ plans get leaner and they start to re-plan when conditions change, rather than pre-planning all kinds of scenarios that may never occur. “That’s a sign of sophistication,” the study said. “Adapting in the moment is a more advanced behavior than trying to pre-script every contingency.”

In turn, humans second guess the system less often and feel comfortable handing off more work. Instead, they control how agents behave, make high-impact decisions, and handle exceptions. “The hardest requests remain human-heavy, especially those that require repeated replanning or contextual judgment,” the study said.

How teams can adapt to AI agents

As agentic AI becomes embedded in more workflows — and at deeper levels — enterprises must evolve to accommodate, Fixify emphasized.

This means investing in clean identity data and building strong playbooks, review workflows, and reliable integrations.

Teams should judge agentic tools by their supervision loop and view rejections as a training process, Fixify advised. Analyst time, queues, and metrics should be built around reviewing proposals. Agent replanning can be seen as a routing signal: A single replan might indicate healthy adaptation, while repeated replanning means ambiguity, irrelevance, or unclear policies.

“Make the review surface easy to understand so analysts can assess proposed actions and make quick decisions about how to proceed,” the study advised. “This is where the analyst’s attention belongs.”

In “Micro and macro agents: The emerging architecture of the agentic enterprise,” I proposed a three-layer architecture for enterprise AI.

1. Micro agents execute specialized tasks.
2. Macro agents orchestrate end-to-end business processes.
3. Meta agents provide governance through monitoring, compliance, security, and human oversight.

As enterprises begin deploying thousands — and eventually tens of thousands — of autonomous agents, token costs have become a major concern. According to Gartner, rising token-driven AI spend is straining budgets and challenging cost justification.

To track this economic concern, meta agents should do more than simply being the governance agents.

They should become the economic intelligence layer of the enterprise.

Their responsibility is not only ensuring AI behaves responsibly.

It is ensuring AI creates measurable business value.

The missing economic model for AI

Every major technology revolution eventually develops its own economic framework:

• Manufacturing measured productivity.
• Cloud computing measured infrastructure utilization.
• Digital businesses measured customer acquisition costs and lifetime value.

The agentic enterprise now requires its own financial discipline. Every AI prompt. Every reasoning cycle. Every interaction between agents. Every autonomous workflow.

Tokens have quietly become the operational currency of enterprise AI. Tokenomics is now a foundational part of enterprise AI architecture.

Yet today, most organizations measure only one thing: Cost. How many tokens were consumed? Which models cost the most? What was the monthly inference bill?

These are useful operational metrics.

They are not strategic business metrics. Boards rarely ask how much electricity a factory consumed. They ask how much value the factory produced.

Enterprise AI deserves the same conversation.

This is where I was thinking about the laws of physics.  Based on physics laws,  energy cannot be created or destroyed. It is transformed into another form. Electricity becomes light. Chemical energy becomes motion. Solar energy becomes electricity.

Enterprise AI offers a similar management lesson.

Intelligence must be transformed into value

Tokens are not valuable because they are consumed. They become valuable only when they are transformed into business outcomes. A faster loan application decision. A fraud detection. A better customer experience. Higher software quality. Greater employee productivity. A new business opportunity.

This leads to what I call return on tokens (ROT).

ROT measures how effectively an organization converts token consumption into measurable business value.

Instead of asking, “How many tokens did we consume,” leaders should ask, “How much enterprise value did every million tokens create?”

The Second Law of Thermodynamics tells us something equally important: Every energy transformation introduces inefficiencies. Although total energy is conserved, some inevitably becomes less useful for doing work.

Enterprise AI behaves similarly.

The second law: Every AI transformation creates friction

Not every token creates value. Some tokens are spent on repeated reasoning. Some generate redundant conversations between agents. Some support oversized context windows. Some produce hallucinations requiring correction. Some route simple tasks to unnecessarily expensive models.

The tokens are not lost. But they create very little useful business work.

I refer to this as token entropy. Token entropy represents the portion of AI activity that consumes intelligence without producing proportional business outcomes.

Every agentic enterprise will experience token entropy. The organizations that win will be the ones that continuously identify and reduce it.

Beyond energy: The importance of exergy

Thermodynamics offers another concept that is even more relevant. It is called Exergy.

Unlike energy, exergy measures the amount of energy that can actually be converted into useful work. Two systems may contain the same amount of energy while producing dramatically different levels of useful output.

The same principle applies to enterprise AI. Two organizations may consume exactly the same number of tokens.

One generates meeting summaries.

The other transforms loan  processing, accelerates software development, detects fraud, improves customer retention, and creates new revenue streams.

Their token consumption is identical. Their business impact is not.

Borrowing it as a management analogy, not claiming that AI tokens literally obey the thermodynamic definition of exergy. I think of this as token exergy. It’s not that AI tokens literally obey the thermodynamic definition of exergy. 

Token exergy measures how much of an organization’s AI intelligence is converted into useful business work. It is not enough to consume tokens efficiently. Organizations must convert those tokens into outcomes that matter.

The meta agent evolves

This is where meta agents become transformational.

Today we think of them as governance agents. Tomorrow they become economic governors.

Meta agents continuously monitor every interaction across the enterprise and answer questions such as:

• Which agents produce the highest ROT?
• Where is token entropy increasing?
• Which workflows generate the highest token exergy?
• Which models deliver the greatest business value per token?
• Which agents should use smaller models?
• Which prompts should be optimized?
• Which workflows require human intervention?
• Which autonomous processes should be redesigned?

Meta agents no longer simply supervise AI. They optimize its economics.

The economic intelligence layer

The architecture now becomes complete.

• Micro agents: Perform work.
• Macro agents: Coordinate work.
• Meta agents: OGovern, observe, optimize, and continuously improve the economics of intelligence.

Their objective is straightforward:

• Maximize return on tokens.
• Minimize token entropy.
• Increase token exergy.

This represents a shift from AI governance to AI economics.

The executive dashboard of tomorrow

The executive dashboard of the future will not focus solely on infrastructure metrics. It will measure intelligence performance.

Imagine a boardroom dashboard displaying:

• Return on tokens (ROT)
• Token entropy index
• Token exergy score
• Business value per million tokens
• Agent productivity index
• Cost per autonomous decision
• AI value by business unit
• Human escalation rate
• Model effectiveness score

These metrics move AI discussions beyond engineering. They make AI accountable for business outcomes.

A new responsibility for CIOs

The next generation of CIOs will not simply deploy AI. They will manage an economy of intelligence.

Their role will resemble that of a portfolio manager — allocating AI capacity where it creates the greatest enterprise value, reducing waste, and continuously improving the productivity of every autonomous workflow.

That responsibility cannot be fulfilled by dashboards alone. It requires an intelligent layer capable of observing, learning, and optimizing the entire agent ecosystem.

That is the emerging role of the meta agent.

The next competitive advantage

Every technological revolution rewards organizations that learn to measure what others overlook.

Factories measured productivity — not fuel consumption.

Digital businesses measured customer engagement — not server utilization.

The agentic enterprise will reward organizations that measure intelligence itself.

The winners will not be those deploying the largest models. Nor the most agents. Nor consuming the fewest tokens.

They will be the organizations that continuously maximize return on tokens, relentlessly reduce token entropy, and increase token exergy.

I believe this is the next evolution of the agentic enterprise.

Not simply governed intelligence, but economically optimized intelligence.

The AI adoption spending spree is over. Time to focus on value.

And in that future, meta agents will serve not only as the guardians of AI — but as the stewards of enterprise intelligence economics.

Through this framework I strongly believe that executives can easily remember the key measures for economic intelligence. 

• ROT (return on tokens): How much value did AI create?
• Token entropy: Where are we wasting AI intelligence?
• Token exergy: How effectively are we converting AI intelligence into useful business work?

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

In “Micro and macro agents: The emerging architecture of the agentic enterprise,” I proposed a three-layer architecture for enterprise AI.

1. Micro agents execute specialized tasks.
2. Macro agents orchestrate end-to-end business processes.
3. Meta agents provide governance through monitoring, compliance, security, and human oversight.

As enterprises begin deploying thousands — and eventually tens of thousands — of autonomous agents, token costs have become a major concern. According to Gartner, rising token-driven AI spend is straining budgets and challenging cost justification.

To track this economic concern, meta agents should do more than simply being the governance agents.

They should become the economic intelligence layer of the enterprise.

Their responsibility is not only ensuring AI behaves responsibly.

It is ensuring AI creates measurable business value.

The missing economic model for AI

Every major technology revolution eventually develops its own economic framework:

• Manufacturing measured productivity.
• Cloud computing measured infrastructure utilization.
• Digital businesses measured customer acquisition costs and lifetime value.

The agentic enterprise now requires its own financial discipline. Every AI prompt. Every reasoning cycle. Every interaction between agents. Every autonomous workflow.

Tokens have quietly become the operational currency of enterprise AI. Tokenomics is now a foundational part of enterprise AI architecture.

Yet today, most organizations measure only one thing: Cost. How many tokens were consumed? Which models cost the most? What was the monthly inference bill?

These are useful operational metrics.

They are not strategic business metrics. Boards rarely ask how much electricity a factory consumed. They ask how much value the factory produced.

Enterprise AI deserves the same conversation.

This is where I was thinking about the laws of physics.  Based on physics laws,  energy cannot be created or destroyed. It is transformed into another form. Electricity becomes light. Chemical energy becomes motion. Solar energy becomes electricity.

Enterprise AI offers a similar management lesson.

Intelligence must be transformed into value

Tokens are not valuable because they are consumed. They become valuable only when they are transformed into business outcomes. A faster loan application decision. A fraud detection. A better customer experience. Higher software quality. Greater employee productivity. A new business opportunity.

This leads to what I call return on tokens (ROT).

ROT measures how effectively an organization converts token consumption into measurable business value.

Instead of asking, “How many tokens did we consume,” leaders should ask, “How much enterprise value did every million tokens create?”

The Second Law of Thermodynamics tells us something equally important: Every energy transformation introduces inefficiencies. Although total energy is conserved, some inevitably becomes less useful for doing work.

Enterprise AI behaves similarly.

The second law: Every AI transformation creates friction

Not every token creates value. Some tokens are spent on repeated reasoning. Some generate redundant conversations between agents. Some support oversized context windows. Some produce hallucinations requiring correction. Some route simple tasks to unnecessarily expensive models.

The tokens are not lost. But they create very little useful business work.

I refer to this as token entropy. Token entropy represents the portion of AI activity that consumes intelligence without producing proportional business outcomes.

Every agentic enterprise will experience token entropy. The organizations that win will be the ones that continuously identify and reduce it.

Beyond energy: The importance of exergy

Thermodynamics offers another concept that is even more relevant. It is called Exergy.

Unlike energy, exergy measures the amount of energy that can actually be converted into useful work. Two systems may contain the same amount of energy while producing dramatically different levels of useful output.

The same principle applies to enterprise AI. Two organizations may consume exactly the same number of tokens.

One generates meeting summaries.

The other transforms loan  processing, accelerates software development, detects fraud, improves customer retention, and creates new revenue streams.

Their token consumption is identical. Their business impact is not.

Borrowing it as a management analogy, not claiming that AI tokens literally obey the thermodynamic definition of exergy. I think of this as token exergy. It’s not that AI tokens literally obey the thermodynamic definition of exergy. 

Token exergy measures how much of an organization’s AI intelligence is converted into useful business work. It is not enough to consume tokens efficiently. Organizations must convert those tokens into outcomes that matter.

The meta agent evolves

This is where meta agents become transformational.

Today we think of them as governance agents. Tomorrow they become economic governors.

Meta agents continuously monitor every interaction across the enterprise and answer questions such as:

• Which agents produce the highest ROT?
• Where is token entropy increasing?
• Which workflows generate the highest token exergy?
• Which models deliver the greatest business value per token?
• Which agents should use smaller models?
• Which prompts should be optimized?
• Which workflows require human intervention?
• Which autonomous processes should be redesigned?

Meta agents no longer simply supervise AI. They optimize its economics.

The economic intelligence layer

The architecture now becomes complete.

• Micro agents: Perform work.
• Macro agents: Coordinate work.
• Meta agents: OGovern, observe, optimize, and continuously improve the economics of intelligence.

Their objective is straightforward:

• Maximize return on tokens.
• Minimize token entropy.
• Increase token exergy.

This represents a shift from AI governance to AI economics.

The executive dashboard of tomorrow

The executive dashboard of the future will not focus solely on infrastructure metrics. It will measure intelligence performance.

Imagine a boardroom dashboard displaying:

• Return on tokens (ROT)
• Token entropy index
• Token exergy score
• Business value per million tokens
• Agent productivity index
• Cost per autonomous decision
• AI value by business unit
• Human escalation rate
• Model effectiveness score

These metrics move AI discussions beyond engineering. They make AI accountable for business outcomes.

A new responsibility for CIOs

The next generation of CIOs will not simply deploy AI. They will manage an economy of intelligence.

Their role will resemble that of a portfolio manager — allocating AI capacity where it creates the greatest enterprise value, reducing waste, and continuously improving the productivity of every autonomous workflow.

That responsibility cannot be fulfilled by dashboards alone. It requires an intelligent layer capable of observing, learning, and optimizing the entire agent ecosystem.

That is the emerging role of the meta agent.

The next competitive advantage

Every technological revolution rewards organizations that learn to measure what others overlook.

Factories measured productivity — not fuel consumption.

Digital businesses measured customer engagement — not server utilization.

The agentic enterprise will reward organizations that measure intelligence itself.

The winners will not be those deploying the largest models. Nor the most agents. Nor consuming the fewest tokens.

They will be the organizations that continuously maximize return on tokens, relentlessly reduce token entropy, and increase token exergy.

I believe this is the next evolution of the agentic enterprise.

Not simply governed intelligence, but economically optimized intelligence.

The AI adoption spending spree is over. Time to focus on value.

And in that future, meta agents will serve not only as the guardians of AI — but as the stewards of enterprise intelligence economics.

Through this framework I strongly believe that executives can easily remember the key measures for economic intelligence. 

• ROT (return on tokens): How much value did AI create?
• Token entropy: Where are we wasting AI intelligence?
• Token exergy: How effectively are we converting AI intelligence into useful business work?

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Black Hat 2026 is shaping up to be another AI-heavy conference, but this year’s announcements suggest the industry is moving beyond simply adding copilots to existing products.

Vendors are increasingly packaging AI into operational workflows, while pairing automation with governance, exposure management, and recovery capabilities aimed at making autonomous security more practical for enterprise environments.

Across this year’s launches, several themes stand out. Security vendors emphasize attack path analysis over raw vulnerability counts, integrating external threat intelligence directly into security and recovery workflows, and introducing purpose-built AI agents that promise to accelerate investigations without forcing customers to replace existing infrastructure.

Below is a running list of the announcements that stood out.

ArmorCode adds AI agents for vulnerability remediation

ArmorCode expanded its Agentic Control Plane with four new Anya AI agents and enhanced Context Risk Graph capabilities designed to help organizations prioritize and remediate vulnerabilities based on “real business risk” rather than raw CVE volume.

The new capabilities introduce attack path analysis, network reachability mapping, patch management integration, and support for compensating controls such as WAFs and EDR platforms. The company says the new AI agents can investigate exploitability, recommend mitigations, assess cloud exposures, and orchestrate patch rollouts while reusing shared security context to reduce redundant AI analysis and operational costs.

Cribl turns telemetry into AI observability

Cribl introduced a new AI Observability application alongside expanded detection engineering capabilities and stream-native detections. The AI Observability app promises enterprises visibility into AI model usage, token consumption, spending, and potential sensitive data exposure using telemetry they already collect.

The company also enhanced its detection engineering capabilities through its CardinalOps acquisition by mapping detections to MITRE ATT&CK, identifying coverage gaps, and applying AI-assisted workflows, while new stream-native detections aim to identify high-confidence threats directly from telemetry in motion without requiring another data platform.

CommVault brings Google Threat Intelligence into recovery workflows

CommVault announced an integration between its Threat Scan and Google Threat Intelligence to help organizations identify clean recovery points after cyberattacks.

The integration combines Google’s threat intelligence with CommVault’s backup validation workflows, while new inline file hash collection allows recovery points to be checked against threat indicators during backup operations. The company says the layered approach enables customers to validate recovery points faster before performing deeper malware or forensic analysis and strengthens its AI-enabled Synthetic Recovery capability. Availability is expected in the coming months.

SOCRadar focuses on identity exposure intelligence

SOCRadar is introducing People Intelligence, a new identity-focused offering within its Extended Threat Intelligence (XTI) platform.

The capability aggregates breached credentials, stealer logs, personally identifiable information, attacker telemetry, and other external identity exposure data into unified analyst records, allowing investigators to prioritize identity risks without integrating internal HR and IAM systems. Automated risk scoring and consolidated identity context are intended to reduce manual correlation work during investigations.

Arctic Wolf doubles down on cyber resilience

Arctic Wolf unveiled a new Cyber Resilience offering that bundles managed detection and response, exposure management, endpoint protection, incident response, and up to $3 million in warranty protection into a single package. The offering is available immediately through Arctic Wolf and its partner ecosystem.

Separately, Arctic Wolf also highlighted new milestones for its Aurora Agentic SOC, including processing more than 10 trillion security events per week, introducing a new Mean Time to Trusted Action (MTTA) metric, expanding its Swarm of Experts architecture, and enhancing customer visibility through updates to the Arctic Wolf Portal.

Additionally, the company announced a partner-focused Cyber AI Readiness Accelerator that combines Aurora Attack Surface Management with consulting and remediation services from channel partners. The 30-day assessment is designed to help organizations inventory exposed assets, identify attack paths, prioritize remediation, and establish broader cyber resilience programs.

Crogl pushes sovereign AI for the SOC

Crogl announced general availability of its Enterprise AI SOC Agent as a free download. Designed to run inside customer-controlled environments, including on-premises and air-gapped deployments, the autonomous investigation platform integrates with existing security tools without requiring new data pipelines or schema normalization. Crogl says the platform investigates alerts, performs threat hunts, documents investigative steps, and generates reports while allowing organizations to keep security data within their own infrastructure.

Tanium expands autonomous security platform

Tanium announced several additions to its Autonomous IT Platform spanning agentic AI, exposure management, and security operations. New Alas capabilities include background AI agents, agentic performance analysis, expanded automation, and an MCP server that exposes governed Tanium data to compatible AI assistants. The company also introduced External Attack Surface Management, Attack Path Mapping, Agent-Guided Threat Hunting, and a private preview integration with Google Threat Intelligence, extending its focus from endpoint management to coordinated autonomous security operations.

Projects are becoming more complex, with higher stakes and faster delivery times.

At the same time automation and AI are changing how projects are designed, managed, and delivered. Indeed, some pieces of project management are now routinely handled by machines.

Some may think that AI and automation will make project managers obsolete, or at least less critical to project success. Executives say that’s not the case. Project managers are as important now as they ever were to project success.

“As we move forward, the role of project manager is actually becoming increasingly important for finding the right things to invest in, defining scope, and staying focused on value,” says Noah Fletcher, a partner in the operations excellence practice at consultancy West Monroe. “As we continue to accelerate, their value is really about quality — quality of what you’re trying to accomplish.”

That doesn’t mean that the role of project manager is static. Rather, the role is evolving, with what it takes to be successful is changing to meet the needs of the moment.

To thrive, project managers need to hone a complex combination of technical, business, and interpersonal skills. The Project Management Institute attempts to decode what it takes to be a successful project manager with its PMI Talent Triangle, comprising Ways of Working, Power Skills, and Business Acumen.

Not surprisingly, there’s a lot packed into those three areas. Effective project managers must know how to define the scope of a project, identify necessary resources, and schedule those resources — all part of the technical aspect of the job. They must also manage stakeholders and ensure projects align with business goals — skills that fall under the other two talent buckets.

As lengthy as the PMI’s list of required skills is, experienced project leaders say that’s not enough to rise to the top of the profession; highly effective project managers today bring even more to their jobs.

They’re curious, flexible, and adaptive — and they learn from and know how to right their mistakes. They’re empathetic, persuasive, and visionary. They know how to play to their own and others’ strengths.

Leading project professionals say the most successful PMs are those who know the academic parts of the job — that is, the elements that are taught — but they also bring finesse to the work.

So, what characteristics distinguish the most effective project managers? Longtime project leaders list the following key traits and skills as vital to succeeding at a high level.

1. They serve as a strategic business partner

Top-level project managers are more than good managers. They have high-level strategic leadership skills and know how their projects fit within overall strategic goals, making them well equipped to make the right decisions for the project and the organization as a whole.

“A project exists because it responds to a need of the business. That might be due to trends impacting the business or a challenge in running the business, but without understanding that, it will be hard for the project manager to deliver a successful project,” says Karla Eidem, a Project Management Professional (PMP) and PMI’s global head of transformation and project delivery.

2. They know the business

The most effective project managers aren’t just great leaders; they’re also business-savvy.

“They understand strategy and business context,” Fletcher says. As they deal with shifting resources and changing market dynamics that happen during many projects, they focus on what work will bring business value — not merely what will tick off items on a task list. “That ability to work on the right thing is one of the most important things that a project manager can have,” Fletcher adds.

3. They’re strong technologists

Projects today nearly always involve technology, making it essential to have technology skills. But standout project managers are true technologists, too.

“Increasingly IT is touching so many different area, and we’re seeing systems and architecture getting more connected, so understanding how business and operations fit together is critical,” Fletcher says.

4. They’re financially astute

Project management always involved budget management, but the task today requires more than balancing the books. It also involves understanding how projects and the core components of any given initiative bring value to the business. That takes financial acumen and the ability to make smart decisions during project execution to ensure the business sees returns on its investment.

“The best project managers know the business drivers and can get depth on how the project impacts the business financially,” Fletcher says. “They have a good value management framework, that end-to-end process that can take the business case all the way through.”

5. They possess extraordinary organizational skills

Top-notch project managers are highly organized individuals. But it’s not just about making a list and sticking with it. They understand how project plans and resources are intertwined with other goings-on within the organization. That organizational capacity enables them to adjust their plans and resources when needed.

Lenka Pincot, chief of staff to the CEO at PMI, says today’s top-notch project managers are “orchestrators” who can pull together the complex components of modern projects and get them to work in harmony.

“Organizations need orchestrators who can synchronize all the changes happening so the results all make sense,” she says. She notes that orchestration takes systems thinking as well as the ability to identify and plan for unintended consequences.

6. They’re problem-solvers

The best project managers are good at delving into and solving for the “why” behind projects.

“They enjoy problem-solving,” Pincot says. “[As project managers], we’re not handed projects; we are handed problems to solve. So we need to get to the bottom of what’s not working. We need to ask questions and really listen for what someone’s true interests are.”

7. They thrive in fast-paced environments

Executives constantly talk about the speed of change today. Teams must work fast to keep up with shifting technology and business contexts, and project managers must be able to facilitate that, Fletcher says.

“The ability to quickly identify the right tools, assign the right resources, accelerate testing, and to move things forward fast without compromising quality is a huge thing today,” he adds.

8. They are flexible

Similarly, highly effective project managers are flexible, so they themselves aren’t flummoxed when project plans need adjustments — something that happens increasingly more often in the modern digital world.

“Adaptability is huge,” says Krista Phillips, a PMP holder and project management consultant. “Things are always going to change, priorities adjust, resources adjust, timelines change. Project managers must be able to successfully manage all that.”

9. They are persuasive

Project managers typically manage teams but aren’t the boss of any of them, meaning they must be capable of leading and workers without having to lean on any official authority, explains Julie Butcher, a fractional CIO work and transformation principal consultant with Butte Information Group. The best project managers are masters of this skill.

10. They have ‘extreme awareness’

Barry Cousins, a distinguished analyst and research fellow specializing in project portfolio management, project management, and organizational change management at Info-Tech Research Group, says top project managers possess what he calls “extreme awareness of resource capacity and utilization.”

“Savvy project managers in the modern era have immediate implicit awareness of the capacity around them, so then they’re going to know right off the bat when their projects are going to fall short,” Cousin adds. Furthermore, they’re more comfortable alerting business leaders to that situation because they’re able to quantify the shortfall.

Others agree, saying this all speaks to the need for project managers to have strong emotional intelligence.

11. They have highly tuned stakeholder management skills

Project managers work with numerous stakeholders from various departments within and outside their organizations, and those who manage those relationships best understand each stakeholder’s perspectives, say Te Wu, CEO and chief project officer at PMO Advisory.

Wu adds that stakeholders can now also include AI agents.

For example, some stakeholders may be more risk adverse than others, or more resistant to change, or more prone to panic when problems arise.

Veteran project leaders say managers who can identify and empathize with those perspectives can tailor their communications, plans, and training to address each stakeholder’s unique points of view.

12. They understand who has authority

Organizations today have distributed authority, so project managers must know who has say over what pieces — whether they’re dealing with 10 IT architects who each control a piece of the IT environment or 10 executives who have responsibilities for separate areas of the enterprise impacted by a project.

“The savvy project manager knows to give them all room to succeed,” Cousins explains. That means staying on top of what each person’s realm of authority needs for the project to succeed, identifying who has ownership for what pieces, and knowing which person has true authority and can get others to line up behind him or her.

“It often requires getting to know people who are at a layer of the company that you don’t play in,” Cousins says.

13. They can navigate office politics

In addition to being good at stakeholder management, elite project managers also know how to navigate office politics. That means navigating not only individual stakeholder’s needs and expectations but also understanding how those stakeholders interact with each other, who has influence over the others, and who has power to override the authority of others.

“They know when to apply what type of pressure to get something accomplished,” Wu adds.

14. They’re decisive

Given the speed, complexity and fluidity of project work today, project managers must be critical thinkers and decisive decision-makers. Otherwise, they risk falling into analysis-paralysis and bringing work to a halt.

Varun Bijlani, global managing partner for solutions and delivery at IBM Consulting, says the best project managers can confidently and consistently make good calls even in the face of ambiguity.

“IT projects are rife with it, even though everyone walks in expecting full clarity and specificity: requirements shift, priorities compete, expectations are unclear, unplanned technical issues arise,” he says. “AI can surface options and synthesize information fast, but it can’t apply the contextual judgment, reasoning, and organizational awareness needed to weigh trade-offs and commit to a direction when the path isn’t clear. That’s still a human call.”

15. They communicate effectively

Considering communication plays a significant role in managing projects, teams, and other stakeholders, it is one of the essential skills for effective project managers, according to longtime project managers.

Communication doesn’t just mean being a stellar facilitator, speaker, or writer; it requires good listening skills, too. As such, top managers actively listen to what’s said — and not said — and can take context into account.

These skills enable project managers to synthesize information and then clearly and concisely sharing that information back with all those involved, Pincot explains.

“They have to be able to translate business needs to technology teams and explain how technology creates value for the business so that everyone can understand and trust that information,” she adds.

16. They build community

“I believe the ‘P’ in PM is for the people: You can’t do a project without a team. And the team might not report to the project manager, so you have to have collaborative leadership, problem-solving, and communication skills to activate your team. Without that you can’t really move the needle,” Eidem says. “But in a project, you’re working with people who might have different priorities and different understanding of the goals of the project, so it’s the project manager’s responsibility to make sure everyone is aligned and knows where they’re going.”

Butcher agrees, saying that the best project managers know how to build a sense of community among the teams as well as with the workers on the periphery of projects so that everyone is willing to work toward a shared objective.

17. They build rapport

Top project managers are also skilled at developing strong rapport with those around them — even for short-lived projects — knowing that good connections and solid relationships lead to success.

“When you build rapport, there’s a shared understanding,” Phillips says. That shared understanding pays dividends. Project managers who take time to build up relationships are more likely to have others share information that could impact their projects, and they’re more likely to get help from others if they make difficult requests — such as staying late or coming in on a weekend to catch up.

18. They’re confident leaders

According to Wu, effective project managers must possess confidence.

“They have a can-do attitude, and that attitude needs to be a bit infectious,” he says. “They don’t have the be cheerleaders, but they do have to have a mindset that sees what’s possible and not just the issues and what’s at risk.”

That allows them to present an optimistic attitude that can propel teams forward even during difficult stretches, Butcher adds. Project managers who possess such confidence are those with a track record of success and are competent in foundational project management skills such as planning and team-building, she says.

19. They serve as change agents

Change is inevitable and can be highly disruptive to all areas of business and personal life; project management is no exception. Highly effective project managers understand this, embrace it, and build elements of uncertainty into their project plans. They also recognize the need to work closely with change management experts to help stakeholders adapt to change and better prepare for the future state of things.

20. They possess an even-keeled demeanor

Even well-planned projects run into problems, and even highly skilled project managers can hit significant setbacks. But the best project managers don’t display panic, anger, or despair even under pressure; they keep their cool.

“Projects can create a lot of pressure, and there can be seemingly conflicting priorities, so staying calm is an essential trait for project managers,” Pincot says.

More on project management:

• Top 20 project management methodologies
• Project management guide: Tips, strategies, best practices
• What is a project manager? The lead role for project success
• Top 15 project management certifications
• 7 must-have project management skills

The next AI infrastructure crisis may come from unmanaged inference capacity. For the past several years, the AI infrastructure conversation centered on one question: how do we get more compute?

That made sense. Enterprises needed GPUs, cloud capacity, foundation models and room to experiment. Compute became shorthand for AI readiness.

Production AI changes the operating discussion. Utilization, routing, latency, throughput, cost control, policy, privacy and governance now need to be managed together. A GPU that sits idle creates no business value. A model endpoint with unpredictable latency frustrates users. An inference stack that cannot be measured end-to-end becomes difficult to defend when usage grows and finance asks where the money is going.

CIOs need governed capacity.

Governed capacity means operating AI infrastructure as a production system rather than a collection of disconnected resources. They need to know how much useful output their infrastructure produces, where that output runs, why it runs there, what it costs, how it performs, what policy applies and whether the system can be controlled as demand changes.

Enterprises buy AI infrastructure to deliver answers, summaries, recommendations, software code, customer interactions, analysis, automation and agent workflows. Those outputs need to be reliable, measurable and affordable enough to keep running.

The pilot-era stack is reaching its limit

The first wave of enterprise AI rewarded speed. Teams bought GPUs, reserved cloud capacity, tested APIs, adopted open-source models and assembled whatever stack helped them move.

Infrastructure inefficiency then becomes a business issue.

The symptoms are familiar: more systems to manage, more vendors to coordinate, more integration work and less visibility into what drives cost and performance.

That creates friction across the organization. IT teams support AI workloads that behave differently from traditional enterprise applications. AI teams need speed, but often lack the infrastructure control to tune cost, latency, utilization and performance together. Finance teams want predictable unit economics, but the stack was assembled under pressure and is hard to measure end to end.

Most teams can now get access to models and compute. Fewer can show how each workload is performing, where it runs and what it costs.

Capacity needs control

Extra capacity can still leave teams with idle infrastructure, uneven latency and unclear unit costs.

The useful questions are operational. Can the organization see utilization across teams, tenants, models and infrastructure pools? Can it route workloads based on cost, latency, privacy, availability and service objectives? Can it measure cost per token, cost per inference, cost per user interaction or cost per business workflow?

Inference behavior changes constantly. Demand fluctuates. Longer contexts increase cost. Model choice affects latency and output quality. Utilization varies across workloads. A customer-facing assistant may prioritize response time. A batch workflow may prioritize throughput and cost.

A procurement-led AI strategy cannot manage that complexity on its own. CIOs need an operating model for production inference.

Enterprise Linux offers a useful analogy. Linux gave companies flexibility and attractive economics, but enterprises needed a trusted operating layer and support model before using it for business-critical systems. AI infrastructure is reaching a similar stage. The models, hardware and software components already exist. Many organizations now need a way to operate them consistently and economically in production.

Token economics is becoming a management discipline

The useful output of many AI systems is delivered through tokens. That makes token economics a practical operating metric.

Token volume needs context. A token that helps complete a task, answer a question or resolve a customer issue creates value. A token generated through poor routing, excess latency or an unnecessarily expensive model adds cost without improving the outcome.

How much useful output are we getting per dollar? How much per watt? How much per GPU? How much per workload? How much per unit of latency? How much per business outcome?

Manufacturing leaders do not only ask how many machines they own. They ask what those machines produce, how often they sit idle, how much waste they create, how much energy they consume and how efficiently raw materials become finished goods.

AI infrastructure needs the same operating discipline: utilization, throughput, reliability, cost control and visibility into what the infrastructure is producing.

Enterprises need usability and control

Serverless AI APIs are fast to start and easy for developers. They work well for many use cases. As usage grows, economics can become harder to control and visibility into infrastructure behavior is limited.

Self-managed infrastructure gives teams more control and can improve long-term economics for persistent workloads. It also adds operational burden. Teams have to manage deployment, scaling, routing, model serving, monitoring, reliability, performance tuning, security, isolation and utilization.

Enterprises want the simplicity of managed services without giving up visibility and control. Developers should be able to access AI services without managing the underlying stack. Infrastructure, security and finance teams still need to see placement, cost, latency, utilization, tenant policy, service levels and risk.

That is the role of an inference operating layer: turning fragmented infrastructure into governed, measurable capacity that teams can manage as demand changes.

Beyond procurement

The more successful an AI application becomes, the more inference it consumes. As inference grows, cost, latency, utilization and governance determine whether the application can scale.

AI can repeat the cloud-cost pattern many CIOs already know. A service begins as an innovation accelerator, usage expands across teams and the bill grows faster than governance. By the time the organization tries to regain control, the architecture, workflows and vendor dependencies are difficult to unwind.

GPUs remain essential. Models remain essential. Data remains essential. Production AI also needs an operating layer around those assets.

The next generation of AI leaders will ask a harder question:

How much useful intelligence can we produce from our infrastructure, at what cost, with what reliability, under what policy and under whose control?

The answer will determine whether AI becomes a controlled production capability or another expensive system the business struggles to explain.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The next AI infrastructure crisis may come from unmanaged inference capacity. For the past several years, the AI infrastructure conversation centered on one question: how do we get more compute?

That made sense. Enterprises needed GPUs, cloud capacity, foundation models and room to experiment. Compute became shorthand for AI readiness.

Production AI changes the operating discussion. Utilization, routing, latency, throughput, cost control, policy, privacy and governance now need to be managed together. A GPU that sits idle creates no business value. A model endpoint with unpredictable latency frustrates users. An inference stack that cannot be measured end-to-end becomes difficult to defend when usage grows and finance asks where the money is going.

CIOs need governed capacity.

Governed capacity means operating AI infrastructure as a production system rather than a collection of disconnected resources. They need to know how much useful output their infrastructure produces, where that output runs, why it runs there, what it costs, how it performs, what policy applies and whether the system can be controlled as demand changes.

Enterprises buy AI infrastructure to deliver answers, summaries, recommendations, software code, customer interactions, analysis, automation and agent workflows. Those outputs need to be reliable, measurable and affordable enough to keep running.

The pilot-era stack is reaching its limit

The first wave of enterprise AI rewarded speed. Teams bought GPUs, reserved cloud capacity, tested APIs, adopted open-source models and assembled whatever stack helped them move.

Infrastructure inefficiency then becomes a business issue.

The symptoms are familiar: more systems to manage, more vendors to coordinate, more integration work and less visibility into what drives cost and performance.

That creates friction across the organization. IT teams support AI workloads that behave differently from traditional enterprise applications. AI teams need speed, but often lack the infrastructure control to tune cost, latency, utilization and performance together. Finance teams want predictable unit economics, but the stack was assembled under pressure and is hard to measure end to end.

Most teams can now get access to models and compute. Fewer can show how each workload is performing, where it runs and what it costs.

Capacity needs control

Extra capacity can still leave teams with idle infrastructure, uneven latency and unclear unit costs.

The useful questions are operational. Can the organization see utilization across teams, tenants, models and infrastructure pools? Can it route workloads based on cost, latency, privacy, availability and service objectives? Can it measure cost per token, cost per inference, cost per user interaction or cost per business workflow?

Inference behavior changes constantly. Demand fluctuates. Longer contexts increase cost. Model choice affects latency and output quality. Utilization varies across workloads. A customer-facing assistant may prioritize response time. A batch workflow may prioritize throughput and cost.

A procurement-led AI strategy cannot manage that complexity on its own. CIOs need an operating model for production inference.

Enterprise Linux offers a useful analogy. Linux gave companies flexibility and attractive economics, but enterprises needed a trusted operating layer and support model before using it for business-critical systems. AI infrastructure is reaching a similar stage. The models, hardware and software components already exist. Many organizations now need a way to operate them consistently and economically in production.

Token economics is becoming a management discipline

The useful output of many AI systems is delivered through tokens. That makes token economics a practical operating metric.

Token volume needs context. A token that helps complete a task, answer a question or resolve a customer issue creates value. A token generated through poor routing, excess latency or an unnecessarily expensive model adds cost without improving the outcome.

How much useful output are we getting per dollar? How much per watt? How much per GPU? How much per workload? How much per unit of latency? How much per business outcome?

Manufacturing leaders do not only ask how many machines they own. They ask what those machines produce, how often they sit idle, how much waste they create, how much energy they consume and how efficiently raw materials become finished goods.

AI infrastructure needs the same operating discipline: utilization, throughput, reliability, cost control and visibility into what the infrastructure is producing.

Enterprises need usability and control

Serverless AI APIs are fast to start and easy for developers. They work well for many use cases. As usage grows, economics can become harder to control and visibility into infrastructure behavior is limited.

Self-managed infrastructure gives teams more control and can improve long-term economics for persistent workloads. It also adds operational burden. Teams have to manage deployment, scaling, routing, model serving, monitoring, reliability, performance tuning, security, isolation and utilization.

Enterprises want the simplicity of managed services without giving up visibility and control. Developers should be able to access AI services without managing the underlying stack. Infrastructure, security and finance teams still need to see placement, cost, latency, utilization, tenant policy, service levels and risk.

That is the role of an inference operating layer: turning fragmented infrastructure into governed, measurable capacity that teams can manage as demand changes.

Beyond procurement

The more successful an AI application becomes, the more inference it consumes. As inference grows, cost, latency, utilization and governance determine whether the application can scale.

AI can repeat the cloud-cost pattern many CIOs already know. A service begins as an innovation accelerator, usage expands across teams and the bill grows faster than governance. By the time the organization tries to regain control, the architecture, workflows and vendor dependencies are difficult to unwind.

GPUs remain essential. Models remain essential. Data remains essential. Production AI also needs an operating layer around those assets.

The next generation of AI leaders will ask a harder question:

How much useful intelligence can we produce from our infrastructure, at what cost, with what reliability, under what policy and under whose control?

The answer will determine whether AI becomes a controlled production capability or another expensive system the business struggles to explain.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Projects are becoming more complex, with higher stakes and faster delivery times.

At the same time automation and AI are changing how projects are designed, managed, and delivered. Indeed, some pieces of project management are now routinely handled by machines.

Some may think that AI and automation will make project managers obsolete, or at least less critical to project success. Executives say that’s not the case. Project managers are as important now as they ever were to project success.

“As we move forward, the role of project manager is actually becoming increasingly important for finding the right things to invest in, defining scope, and staying focused on value,” says Noah Fletcher, a partner in the operations excellence practice at consultancy West Monroe. “As we continue to accelerate, their value is really about quality — quality of what you’re trying to accomplish.”

That doesn’t mean that the role of project manager is static. Rather, the role is evolving, with what it takes to be successful is changing to meet the needs of the moment.

To thrive, project managers need to hone a complex combination of technical, business, and interpersonal skills. The Project Management Institute attempts to decode what it takes to be a successful project manager with its PMI Talent Triangle, comprising Ways of Working, Power Skills, and Business Acumen.

Not surprisingly, there’s a lot packed into those three areas. Effective project managers must know how to define the scope of a project, identify necessary resources, and schedule those resources — all part of the technical aspect of the job. They must also manage stakeholders and ensure projects align with business goals — skills that fall under the other two talent buckets.

As lengthy as the PMI’s list of required skills is, experienced project leaders say that’s not enough to rise to the top of the profession; highly effective project managers today bring even more to their jobs.

They’re curious, flexible, and adaptive — and they learn from and know how to right their mistakes. They’re empathetic, persuasive, and visionary. They know how to play to their own and others’ strengths.

Leading project professionals say the most successful PMs are those who know the academic parts of the job — that is, the elements that are taught — but they also bring finesse to the work.

So, what characteristics distinguish the most effective project managers? Longtime project leaders list the following key traits and skills as vital to succeeding at a high level.

1. They serve as a strategic business partner

Top-level project managers are more than good managers. They have high-level strategic leadership skills and know how their projects fit within overall strategic goals, making them well equipped to make the right decisions for the project and the organization as a whole.

“A project exists because it responds to a need of the business. That might be due to trends impacting the business or a challenge in running the business, but without understanding that, it will be hard for the project manager to deliver a successful project,” says Karla Eidem, a Project Management Professional (PMP) and PMI’s global head of transformation and project delivery.

2. They know the business

The most effective project managers aren’t just great leaders; they’re also business-savvy.

“They understand strategy and business context,” Fletcher says. As they deal with shifting resources and changing market dynamics that happen during many projects, they focus on what work will bring business value — not merely what will tick off items on a task list. “That ability to work on the right thing is one of the most important things that a project manager can have,” Fletcher adds.

3. They’re strong technologists

Projects today nearly always involve technology, making it essential to have technology skills. But standout project managers are true technologists, too.

“Increasingly IT is touching so many different area, and we’re seeing systems and architecture getting more connected, so understanding how business and operations fit together is critical,” Fletcher says.

4. They’re financially astute

Project management always involved budget management, but the task today requires more than balancing the books. It also involves understanding how projects and the core components of any given initiative bring value to the business. That takes financial acumen and the ability to make smart decisions during project execution to ensure the business sees returns on its investment.

“The best project managers know the business drivers and can get depth on how the project impacts the business financially,” Fletcher says. “They have a good value management framework, that end-to-end process that can take the business case all the way through.”

5. They possess extraordinary organizational skills

Top-notch project managers are highly organized individuals. But it’s not just about making a list and sticking with it. They understand how project plans and resources are intertwined with other goings-on within the organization. That organizational capacity enables them to adjust their plans and resources when needed.

Lenka Pincot, chief of staff to the CEO at PMI, says today’s top-notch project managers are “orchestrators” who can pull together the complex components of modern projects and get them to work in harmony.

“Organizations need orchestrators who can synchronize all the changes happening so the results all make sense,” she says. She notes that orchestration takes systems thinking as well as the ability to identify and plan for unintended consequences.

6. They’re problem-solvers

The best project managers are good at delving into and solving for the “why” behind projects.

“They enjoy problem-solving,” Pincot says. “[As project managers], we’re not handed projects; we are handed problems to solve. So we need to get to the bottom of what’s not working. We need to ask questions and really listen for what someone’s true interests are.”

7. They thrive in fast-paced environments

Executives constantly talk about the speed of change today. Teams must work fast to keep up with shifting technology and business contexts, and project managers must be able to facilitate that, Fletcher says.

“The ability to quickly identify the right tools, assign the right resources, accelerate testing, and to move things forward fast without compromising quality is a huge thing today,” he adds.

8. They are flexible

Similarly, highly effective project managers are flexible, so they themselves aren’t flummoxed when project plans need adjustments — something that happens increasingly more often in the modern digital world.

“Adaptability is huge,” says Krista Phillips, a PMP holder and project management consultant. “Things are always going to change, priorities adjust, resources adjust, timelines change. Project managers must be able to successfully manage all that.”

9. They are persuasive

Project managers typically manage teams but aren’t the boss of any of them, meaning they must be capable of leading and workers without having to lean on any official authority, explains Julie Butcher, a fractional CIO work and transformation principal consultant with Butte Information Group. The best project managers are masters of this skill.

10. They have ‘extreme awareness’

Barry Cousins, a distinguished analyst and research fellow specializing in project portfolio management, project management, and organizational change management at Info-Tech Research Group, says top project managers possess what he calls “extreme awareness of resource capacity and utilization.”

“Savvy project managers in the modern era have immediate implicit awareness of the capacity around them, so then they’re going to know right off the bat when their projects are going to fall short,” Cousin adds. Furthermore, they’re more comfortable alerting business leaders to that situation because they’re able to quantify the shortfall.

Others agree, saying this all speaks to the need for project managers to have strong emotional intelligence.

11. They have highly tuned stakeholder management skills

Project managers work with numerous stakeholders from various departments within and outside their organizations, and those who manage those relationships best understand each stakeholder’s perspectives, say Te Wu, CEO and chief project officer at PMO Advisory.

Wu adds that stakeholders can now also include AI agents.

For example, some stakeholders may be more risk adverse than others, or more resistant to change, or more prone to panic when problems arise.

Veteran project leaders say managers who can identify and empathize with those perspectives can tailor their communications, plans, and training to address each stakeholder’s unique points of view.

12. They understand who has authority

Organizations today have distributed authority, so project managers must know who has say over what pieces — whether they’re dealing with 10 IT architects who each control a piece of the IT environment or 10 executives who have responsibilities for separate areas of the enterprise impacted by a project.

“The savvy project manager knows to give them all room to succeed,” Cousins explains. That means staying on top of what each person’s realm of authority needs for the project to succeed, identifying who has ownership for what pieces, and knowing which person has true authority and can get others to line up behind him or her.

“It often requires getting to know people who are at a layer of the company that you don’t play in,” Cousins says.

13. They can navigate office politics

In addition to being good at stakeholder management, elite project managers also know how to navigate office politics. That means navigating not only individual stakeholder’s needs and expectations but also understanding how those stakeholders interact with each other, who has influence over the others, and who has power to override the authority of others.

“They know when to apply what type of pressure to get something accomplished,” Wu adds.

14. They’re decisive

Given the speed, complexity and fluidity of project work today, project managers must be critical thinkers and decisive decision-makers. Otherwise, they risk falling into analysis-paralysis and bringing work to a halt.

Varun Bijlani, global managing partner for solutions and delivery at IBM Consulting, says the best project managers can confidently and consistently make good calls even in the face of ambiguity.

“IT projects are rife with it, even though everyone walks in expecting full clarity and specificity: requirements shift, priorities compete, expectations are unclear, unplanned technical issues arise,” he says. “AI can surface options and synthesize information fast, but it can’t apply the contextual judgment, reasoning, and organizational awareness needed to weigh trade-offs and commit to a direction when the path isn’t clear. That’s still a human call.”

15. They communicate effectively

Considering communication plays a significant role in managing projects, teams, and other stakeholders, it is one of the essential skills for effective project managers, according to longtime project managers.

Communication doesn’t just mean being a stellar facilitator, speaker, or writer; it requires good listening skills, too. As such, top managers actively listen to what’s said — and not said — and can take context into account.

These skills enable project managers to synthesize information and then clearly and concisely sharing that information back with all those involved, Pincot explains.

“They have to be able to translate business needs to technology teams and explain how technology creates value for the business so that everyone can understand and trust that information,” she adds.

16. They build community

“I believe the ‘P’ in PM is for the people: You can’t do a project without a team. And the team might not report to the project manager, so you have to have collaborative leadership, problem-solving, and communication skills to activate your team. Without that you can’t really move the needle,” Eidem says. “But in a project, you’re working with people who might have different priorities and different understanding of the goals of the project, so it’s the project manager’s responsibility to make sure everyone is aligned and knows where they’re going.”

Butcher agrees, saying that the best project managers know how to build a sense of community among the teams as well as with the workers on the periphery of projects so that everyone is willing to work toward a shared objective.

17. They build rapport

Top project managers are also skilled at developing strong rapport with those around them — even for short-lived projects — knowing that good connections and solid relationships lead to success.

“When you build rapport, there’s a shared understanding,” Phillips says. That shared understanding pays dividends. Project managers who take time to build up relationships are more likely to have others share information that could impact their projects, and they’re more likely to get help from others if they make difficult requests — such as staying late or coming in on a weekend to catch up.

18. They’re confident leaders

According to Wu, effective project managers must possess confidence.

“They have a can-do attitude, and that attitude needs to be a bit infectious,” he says. “They don’t have the be cheerleaders, but they do have to have a mindset that sees what’s possible and not just the issues and what’s at risk.”

That allows them to present an optimistic attitude that can propel teams forward even during difficult stretches, Butcher adds. Project managers who possess such confidence are those with a track record of success and are competent in foundational project management skills such as planning and team-building, she says.

19. They serve as change agents

Change is inevitable and can be highly disruptive to all areas of business and personal life; project management is no exception. Highly effective project managers understand this, embrace it, and build elements of uncertainty into their project plans. They also recognize the need to work closely with change management experts to help stakeholders adapt to change and better prepare for the future state of things.

20. They possess an even-keeled demeanor

Even well-planned projects run into problems, and even highly skilled project managers can hit significant setbacks. But the best project managers don’t display panic, anger, or despair even under pressure; they keep their cool.

“Projects can create a lot of pressure, and there can be seemingly conflicting priorities, so staying calm is an essential trait for project managers,” Pincot says.

More on project management:

• Top 20 project management methodologies
• Project management guide: Tips, strategies, best practices
• What is a project manager? The lead role for project success
• Top 15 project management certifications
• 7 must-have project management skills

Enterprises have spent decades learning how to audit people and software. Agentic AI creates a third category: systems that interpret instructions, call tools and act across workflows without a mature assurance model built around them.

In my work as a leader and investor across technology-enabled businesses, I have spent years around automation, cybersecurity, compliance, workflow design and board reporting. I have watched management teams gain confidence from dashboards, policies and approval records, then face a harder question when a board member, auditor or regulator asks whether the controls performed as intended.

Agentic AI complicates that question because a single outcome may pass through several systems. An agent can collect information, choose a tool, produce code, route a request and hand work to another agent before a person approves the result. No single manager may have observed the full path.

Executive accountability remains human even when the operating activity becomes more autonomous. The CIO may have to explain who authorized the activity, whether the agent stayed within its approved purpose and what evidence supports management’s answer.

In a recent framework for frontier AI, Google DeepMind CEO Demis Hassabis proposed an independent standards body that could evaluate advanced models before deployment and address critical vulnerabilities after release. His proposal focuses on frontier models, but the principle carries into the enterprise: expanding autonomy creates a corresponding need for independent assessment.

My rule for this stage of adoption is straightforward: no agent should gain more autonomy than the company can verify.

The enterprise audit model was built for people and software

Companies have spent decades building controls around people. Employees have job descriptions, reporting lines, approval limits and access rights. When someone leaves, an established process removes access and transfers responsibility.

Traditional software also fits a familiar structure. A program follows defined instructions inside systems with owners, release procedures, test records and change controls. Complexity can make review difficult, but the accountability chain is usually visible.

An AI agent sits between those categories. It operates through software while interpreting instructions with room to choose a path. Its behavior may change when the model, prompt, connected data, available tools or surrounding workflow changes. A control approved during deployment can weaken months later without an obvious change to the application.

Standards are still developing as adoption accelerates. In February 2026, NIST launched an ⁠AI Agent Standards Initiative focused on secure operation and interoperability for agents capable of autonomous action.

Gartner predicted that 40% of enterprise applications would include task-specific agents by the end of 2026, up from less than 5% in 2025. More than 40% of agentic AI projects could be canceled by the end of 2027 because of escalating cost, unclear business value or inadequate risk controls.

IBM’s 2025 Cost of a Data Breach research found that ⁠13% of surveyed organizations reported breaches involving AI models or applications. Among that group, 97% reported inadequate AI access controls. 63% of organizations in their study lacked governance policies for managing AI or preventing shadow AI.

One team may approve an agent, another may connect it to data and a third may own the workflow. Management still carries responsibility when the agent exposes information, produces an error or acts outside its approved purpose.

Two-thirds of CIOs and CTOs surveyed were being held ⁠accountable for AI systems they did not fully control. Seventy percent said technology was spreading across the business faster than IT could track it, while 77% said adoption was outpacing governance capabilities.

The survey findings expose the boardroom gap: management carries accountability while control remains distributed across teams, systems and workflows. An assurance model must provide more than a statement of intent.

Assurance must prove where the boundary held

Policies, dashboards and logs help establish control. Assurance begins when the company tests whether an agent stayed inside the conditions management approved.

Before deployment, management should document the agent’s business purpose, accountable owner, systems touched, allowed actions and stop conditions. Testing should then determine whether the agent can reach information outside its scope, call an unapproved tool, continue after a stop condition or carry an incorrect assumption into another system.

I would treat an agent’s autonomy as a renewable license because its operating condition will change after launch. Renewal should follow any material change to the model, connected data, available tools, workflow or authority. NIST’s work on the challenges of monitoring deployed AI systems identifies drift, fragmented logging and immature standards as barriers to post-deployment oversight, while the World Economic Forum recommends scaling safeguards with an agent’s autonomy, authority and complexity. A change-triggered review ties assurance to the version of the agent and workflow in use, giving the CIO a defensible basis for continued authority.

Consider a coding agent that begins by drafting test cases, then gains access to repositories, tickets, CI/CD tools and production documentation. A production change could involve an instruction, code, a tool call, an automated test, a ticket update and human approval. Assurance must show how the result was produced, which systems participated, whether the agent crossed a boundary and how exceptions were handled.

For every agent with meaningful operating authority, I would expect four connected records: the approved baseline, boundary-test results, a history of behavioral drift and an account of exceptions and interventions. Together, they give management a record that can support a board discussion, audit or regulatory response without depending on the technical team’s memory.

Autonomy should scale only as fast as assurance

Internal teams will remain responsible for designing controls and operating the environment. At board-level scale, management also needs review independent from the people who built and run the agent.

I have seen management ask auditors or other independent certified professionals to sign off on a system. They cannot sign when they have not completed the work required to support that opinion. Leadership wants confidence, the board wants an answer and the independent party needs a body of evidence that can be tested.

Agentic AI will make that evidence harder to assemble after an incident. Records have to be produced while the work occurs. Once an agent has acted across several systems, reconstruction may depend on logs created by different vendors, teams and tools. Missing context can turn a clear technical event into an uncertain management explanation.

CIOs should design assurance into the workflow. The operating record needs to capture approved purpose, tested boundaries, material changes, exceptions, human interventions and unresolved findings. Independent review can then examine whether the control operated during the period management is being asked to discuss.

The operating record gives executives a basis for changing an agent’s authority. Broader responsibility should follow tested boundaries and a clean exception history. Drift or repeated intervention should pause expansion until the cause is understood.

Before approving broader use, I would ask:

• What authority has the company granted?
• Which tests show the boundary holds?
• What record will remain available months later?
• Who carries accountability when the record shows a failure?

Those questions create a management standard for deciding whether an agent is ready to move from a limited workflow into broader enterprise operations.

Enterprises have spent decades learning how to audit people and software. Agentic AI creates a third category that requires its own assurance model. The next discipline for the enterprise is auditing autonomy through approved behavior, tested boundaries, monitored change and documented intervention.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Most folks seem happy to let AI write their LinkedIn posts for them. Others, myself included, have AI draft their work memos or slide decks. And some, according to recent survey data highlighted by AI Secret, are happy to let AI do their grocery shopping for them (28%), but not handle luxury goods or banking (6%). In trying to uncover a guiding principle for when mere mortals are willing to cede control to robots, AI Secret’s authors offered a cutting interpretation of our willingness to buy food but not financial products through AI: “That ranking isn’t trust, it’s a map of what people have stopped caring about.”

While this feels true-ish, the “ish” is important. For example, based on the garbage we regularly wade through on LinkedIn, AI slop feels like an attempt to care about something we’re told we should care about, but don’t. If we did, we’d take the time to write it. Or maybe it’s simply an acknowledgment that many people don’t have the skill to write well, so they entrust AI to do it better than they could. (It doesn’t.)

Maybe it’s both. As for the willingness to shop for groceries, it’s not that we don’t care about the milk in our fridge—we clearly do—but perhaps we don’t care about how it gets there. We care about the outcome, in other words, but not the process.

That feels like the right way to think about AI, and maybe, just maybe, it offers a clue as to when and how you and I should use AI.

LinkedIn discovers slop

Last week, LinkedIn introduced a button that lets users flag a post as “seems like AI slop.” It also pulled its own “enhance your post” feature, which contributed to the AI slop deluge by using AI to help compose posts, and replaced it with a proofreader designed not to change the author’s voice.

It’s a welcome change. I’ve been happily “seems like AI slopping” ever since.

Still, you have to ask, why are people producing these posts in the first place? My guess is that many don’t value posting but feel obliged to do it because “thought leadership” and “career.” Or maybe, as I did this past week, they used AI to ask, “What are my top-performing posts over the past 10 years and what’s the best strategy for replicating that success?” In addition to telling me to post three times a week (LinkedIn’s algorithms like that), it also told me something I already knew: “Your best posts were personal and opinionated.” In other words, exactly the sort of thing that AI can’t write for me.

Yes, AI can produce 500 words on how coaching your daughter’s soccer team taught you seven lessons about enterprise procurement. (“Let that sink in.”) The post will be polished and may even be popular. It will also sound like everything else in others’ feeds because you and every other person outsourced the one thing readers want most: a personal point of view. Something that makes us human.

This doesn’t make all AI-assisted writing bad. Far from it. AI can help a non-native English speaker express an original idea or turn dictated thoughts into a coherent draft. It can also challenge an argument, find missing evidence, or suggest a better structure. I use it for all those things.

But if you have nothing to say, AI isn’t going to give you a voice. Not a real one.

Just because you can…

A couple of years ago, a friend who ran product marketing at a very large technology company told me he was going to start generating sales collateral with AI. First-call decks, email templates, etc. His logic was sound and, honestly, kind of brutal. The collateral his team produced by hand was pulling a few dozen downloads from a sales force numbering in the thousands. If almost nobody wanted it, why pay a junior product marketer to make it? Let the machine publish into the void.

Sure, I said. That seems smart. Except it wasn’t. He hadn’t solved the foundational issue.

I didn’t know what that issue was, but then neither did he. After all, those low download numbers could suggest any number of things. Maybe the sellers couldn’t find it. Maybe the material wasn’t useful at scale, but perhaps a few dozen people used it to close enormous deals. Perhaps it was simply the wrong collateral for a pressing need, which the sellers resolved on their own. Or maybe, just maybe, that thing that every product marketing team does… doesn’t need to be done.

AI makes it easier not to wrestle with the problem. The deck costs almost nothing, so we keep making the deck, rather than addressing whether it needs to be created at all. Similarly, because the weekly report takes only minutes, we opt to keep publishing it. The knowledge base fills with pages no one reads because stopping a process requires a decision. Automating it merely requires a prompt.

We’re letting AI kick the can down the road for us, rather than making the hard, human decisions we’re ostensibly paid to make.

I’ve made a version of this argument about software. App creation is way up, but app adoption isn’t. Building was never the only constraint. Getting anyone to care is the constraint, and AI doesn’t solve that. It just removes our last excuse for not noticing.

Two kinds of low-value work

This isn’t a case against automating boring things. We should totally do that, and immediately. But “low-value work” hides two very different things, and they deserve opposite treatment.

The first is a low-value process attached to a valuable outcome, like my milk example. Take expense reports, backups, etc. These aren’t exciting things to do, but they must get done. AI gives us the chance to hand off as much of the process as we safely can, check the result, and move on.

The second is a low-value process attached to no discernible outcome, like the sales collateral or a LinkedIn post with no personality or real point of view. Automating this feels like a win because the cost drops, but cost is not the core problem. The real problem is that the output has no audience. It doesn’t need to exist.

If you can’t name a useful outcome that would be lost if the output stopped existing, you don’t have an automation opportunity. You have a cancellation opportunity.

I use AI where I care most

Now for the part that complicates my own argument, because the inverse is also true. The work where I use AI most aggressively is often the work I care about most.

I wrote last week about asking Claude to read four 18th-century probate wills as part of a 20-year hunt for the parents of a fourth-great-grandfather. It fabricated an entire emigrant ancestor. It was clean, plausible, and completely invented. I only caught it by clicking through to the high-resolution images and reading the documents myself, line by line.

I’ve been thinking about that experience differently this week. The model excused its behavior as “hopeful reading.” OK. But the reason I caught it is duller and more important than anything about the model: I caught Claude’s error because I cared. Twenty years of caring made me open the originals. It really, really, really mattered to me that it be right.

Nobody wants to proofread the deck they never wanted to make in the first place.

The same pattern holds at work. I use AI constantly for executive memos, compressing a sprawling pile of data and argument into context, recommendation, and ask. This is high-stakes work with a real reader, a real decision, and my name on it. So I read every line. I challenge the output. I edit (a lot). The AI doesn’t replace my investment in the work, but it does do 90% of the early legwork for me so that I can focus on the critically important last 10%.

I’ve called this AI’s trust tax: You pay the verification cost up-front, or someone else pays it later when the answer causes damage. The tax gets paid most reliably when somebody cares about the outcome. When nobody cares, AI can make bad work look finished enough to ship and presentable enough to glance at without reviewing carefully.

AI slop, then, really isn’t a model problem; it’s a question of caring, which manifests in how we choose to use it.

Maybe just stop

I wish I had a clear, guiding principle to offer here, but I don’t. Here are two questions that help, though.

1. What useful outcome disappears if this work stops?
2. If that outcome matters, where is human judgment still needed?

If there’s no meaningful outcome, stop doing the work, whether AI-powered or human-powered. If the outcome matters but much of the process doesn’t, hand the process to AI. Let AI buy the groceries, search the archive, assemble the first draft, or build the sales deck that sellers have said they actually need. Then keep a person accountable for the result.

AI is extremely good at making more things. We don’t need more things, and making them cheaper won’t make them useful. Humans, by contrast, are extremely good (or need to be) at determining which things need to be made. That’s your job, and mine, and no prompt can take it away from us.

Not long ago, I worked with an enterprise that believed it had done everything right. The company had spread workloads across multiple regions, replicated key data stores, documented failover procedures, and invested heavily in automation. On paper, it looked like a mature cloud deployment. Then a control-plane issue hit one of its core providers. The infrastructure itself was not entirely gone, but the management layer became unstable enough that teams could not make timely changes, trigger the recovery actions they expected, or trust the environment’s state in real time. What failed was not simply compute or storage. What failed was the company’s assumption that the cloud’s control mechanisms would always be there.

That experience gets to the heart of a growing problem. Cloud reliability is under renewed scrutiny because more outages are now being tied to control-plane failures rather than isolated infrastructure faults. An Uptime Institute report recently highlighted that shift, and it should get the attention of every serious architect. When the management layer becomes the problem, the blast radius can be much broader than most organizations anticipate.

For years, the industry has talked about resilience primarily in terms of infrastructure. We focus on zones, regions, backups, and service redundancy. Those things still matter, of course. However, they do not tell the whole story anymore. The cloud is not just a collection of servers, storage systems, and networks. It is also a massive operating model built around APIs, orchestration layers, identity systems, policy engines, service controllers, and automation frameworks. When that higher-order control structure breaks or becomes impaired, your recovery plans can unravel very quickly.

Another architecture problem

To begin with, architects need to accept that the control plane is no longer some invisible layer they can safely assume will remain stable under all conditions. It is now part of the architecture problem because it is part of the failure domain. If your workloads, scaling logic, network policies, failover actions, service permissions, and operational decisions all depend on that layer functioning normally, then a control-plane failure can compromise much more than a single application or regional deployment.

I have seen many organizations convince themselves they are resilient simply because they have redundancy in place. That is not enough. Redundancy below the control plane does not fully protect you from a failure above it. You may have healthy infrastructure underneath and still find yourself unable to make the necessary adjustments to keep critical systems operating correctly. That is the architectural blind spot, and it is becoming more obvious as these incidents gain visibility.

Multiregion design is not enough

One of the most common reactions is that multiregion architecture is the answer. It is part of the answer, but it is not the complete answer. If both regions remain dependent on the same provider control mechanisms, the same identity systems, or the same operational APIs, then you still have a shared dependency that can become a common point of failure.

This is where architects need to become much more precise. Geographic separation is useful, but it is not the same thing as operational independence. A design that survives a local infrastructure problem may not survive a management-layer disruption. A design that can replicate data between regions may still fail if the orchestration required to redirect traffic or re-establish service health depends on the same impaired control systems.

I keep pushing architects to think beyond the usual checklist. Do not just ask whether your workloads are distributed. Ask whether your recovery assumptions remain valid when the provider’s management plane is unstable. That is a harder question and, in many cases, the answer is uncomfortable.

Assume degraded control

Most failover plans are written as though the environment will remain manageable during a crisis. They assume the dashboards will be available, the APIs will function, the automation scripts will still execute, and the service states will stay reliable enough to support rapid decisions. Those are fine assumptions during normal operations. They are dangerous during a control-plane event.

I have worked with teams that had detailed disaster recovery plans that looked excellent in review meetings and failed under real pressure because too much of the recovery logic still depended on the platform that was affected. This is more common than many organizations want to admit. They mistake documentation for resilience. They mistake automation for independence. They mistake configuration complexity for architectural maturity.

If you want a realistic failover strategy, you need to plan for degraded control. That means pre-positioned recovery paths, simpler decision trees, fewer dependencies on real-time reconfiguration, and clearer operational boundaries. It also means testing for scenarios where you cannot rely on the provider management layer the way you normally do. Until you test that, you do not really know your recovery capability.

Should you go multicloud?

I am not arguing that every organization should rush into multicloud. In many cases, that would add cost and complexity without delivering enough value. However, I am arguing that dependence on a single provider’s management layer should now be treated as a strategic risk, not just an implementation detail.

If your observability, policy enforcement, deployment controls, identity dependencies, and recovery workflows are all deeply tied to one provider’s management model, then you need to understand the implications clearly. You may have concentrated far more risk than you realize. This does not always require abandoning the provider. Often it means designing with more independence, more external visibility, and more realistic assumptions about what can fail.

Architects have spent years optimizing for speed, convenience, and service richness. Now we need to rebalance around control, resilience, and recovery realism. That is not a step backward. It is a sign that cloud architecture is finally maturing.

Resilience above the platform

The old belief was that once you deployed correctly inside a major cloud, the platform would absorb most of the complexity for you. In many ways, that is still true. The large providers deliver incredible engineering and operational discipline. But that does not remove the need to design for shared dependencies that sit above the infrastructure layer.

Control-plane failures remind us that cloud reliability is no longer just about where workloads run. What coordinates them? What manages them? What are your options when that coordination layer becomes unreliable? This topic matters so much right now because it forces architects to rethink resilience.

If there is one takeaway here, it is this: Stop assuming your management layer is always outside the scope of failure planning. It is not. It is central to it. Once you understand that, your approach to multiregion design, failover planning, and provider dependency starts to change in the right ways.

More than 30 Minnesota community water systems were hit by coordinated cyber activity against their operational technology on July 26 and 27; several lost remote control or deliberately cut it while operators contained the intrusion. The reporting since — including CSO’s own news analysis — has rightly chased two open questions: Who did it, and whether a shared weakness in Rockwell Automation MicroLogix 1400 controllers tied dozens of small utilities together. Both questions matter. Neither changes what operators must do this week. Attribution is the investigators’ problem. Exposure is yours — and the advisories published since July 30 contain considerably more actionable detail than most coverage has extracted from them.

Key takeaways

• Assume the attackers have your control logic. CISA’s advisory AA26-097A documents exfiltration of PLC project files. Rockwell’s recovery notice for locked-out MicroLogix 1400s requires a current offline project file to restore operations — an artifact many small utilities cannot produce. Where both are true, the adversary may hold the only current copy of the plant’s logic.
• You cannot Shodan your own cellular exposure. Researchers found little internet-facing Minnesota water infrastructure precisely because these utilities connect over cellular. The same opacity blinds defenders’ self-assessments. Enumerate SIM-equipped OT devices from carrier invoices, not from network scans.
• Your integrator is part of your attack surface. If a shared systems integrator or communications architecture connected the victims, the unit of compromise is not the utility — it is the integrator’s customer fleet. Ask yours which other customers share your remote-access design.
• Recovery is not resilience. Braham was back in roughly two hours; Plymouth ran manually while cellular links were rebuilt. Time-to-manual is a testable metric, not an assumption. Test it.
• The first hardening steps are configuration, not procurement. RUN mode at the keypad, the strongest password protection the firmware supports, HTTP server off, no public IP. The gap exposed in Minnesota is not knowledge. It is execution order under pressure.

The asymmetry nobody is naming

The most consequential sentence of the past week is buried in Rockwell’s July 30 notice SD1790. It is not a vulnerability disclosure — there is no CVE. The attackers did not exploit a flaw; they used the controller’s intended functionality. Changing an IP address is an administrative operation, and setting a password is a security feature — the malicious element was never the command, only who issued it, from where and against which physical process. What SD1790 actually is, is a recovery procedure for operators locked out of their own MicroLogix 1400s: Power the controller off, disconnect the battery, power-cycle into a fault state, reconnect. That sequence erases the program, the data and the IP configuration. Then, the notice says, redownload your project file.

That instruction presumes you have one. Current. Offline. Matching what actually runs in the field after fifteen years of undocumented tweaks by three generations of technicians and two integrators. In my project work across energy and manufacturing, that assumption fails more often than any firewall — in one plant assessment, the only person who could have restored a controller had left the integrator two years earlier, and the project file left with him.

Now cross-reference the federal advisory. AA26-097A has tracked this campaign since March; its July 22 update expanded the target set beyond Rockwell to Schneider Electric and Siemens devices, documented exfiltration of PLC project files for the first time and added detection guidance for manipulated reusable code modules embedded in PLC programs. No one has publicly confirmed exfiltration at the Minnesota utilities themselves — which is exactly why it belongs in your planning assumptions rather than your press statements. Read those two documents together and the strategic picture inverts: An adversary who may be able to study — or quietly modify — control logic that the owner cannot even restore.

The countermeasure costs nothing but discipline. Treat control logic like source code. Every controller gets an offline, versioned, hash-verified project archive. Verification means uploading the running program and comparing it against the archive — not assuming the file on the engineering laptop is current. And widen the definition of backup: A rebuild-ready package includes firmware versions, HMI configuration, I/O lists, the vendor software with valid licenses, the right cable and a record of the last authorized change. NIST’s OT Backup Quick Start Guide, SP 1339, published in June, makes the same point in two pages: Create, test and review backups inside change management — otherwise they are storage, not capability. Schedule it like instrument calibration, not like an IT backup job, because that is the operational category it belongs to.

You can’t Shodan a SIM

One detail from the investigation deserves more attention than it received: Researchers scanning Minnesota’s public IP space found little obviously exposed water infrastructure. One plausible explanation, offered by researchers quoted in the initial coverage, is that many of these utilities communicate over cellular links — Plymouth’s disconnection of cellular-connected equipment confirms at least part of that picture — and cellular paths are far harder to enumerate from outside than internet-facing systems.

Operators have drawn comfort from the wrong conclusion. Cellular opacity did not protect the victims; it merely hid the exposure from everyone, including themselves. If a security researcher cannot see your cellular attack surface, neither can your own assessment — and that is precisely the population that got hit.

There is a mundane fix, and it is the one I run in my own asset-inventory workshops: Pull the carrier bill. Every modem generates an invoice line whether or not it appears on any diagram, and the invoice regularly surfaces devices that three network revisions missed. Reconcile every SIM against a named device, a named owner and a documented purpose. CISA’s July 30 alert told water utilities to check for undocumented cellular modems installed by operators, vendors or system integrators — and the word undocumented is the tell: The agency assumes your architecture diagram is wrong. Then move what remains behind a private APN or VPN termination, strip every public IP and port-forwarding rule and restrict management access to known engineering workstations.

Your integrator is your blast radius

The distributed character of this campaign is its most important feature. Dozens of geographically clustered utilities, hit in a two-day window, with neighboring infrastructure apparently untouched, points toward some common technical thread — a shared systems integrator, a shared communications architecture, a shared remote-access design.

If that hypothesis holds, the defensive unit is no longer the individual utility. It is the integrator’s customer fleet. A standing vendor tunnel, replicated with the same design across forty small customers, converts one compromised contractor into forty compromised water systems.

Here are the three questions I put to integrators in my own projects — ask yours this week: Which of your other customers share my remote-access architecture? Who at your firm can reach my controllers today, and are those individual identities or a shared account? Can I pull the session logs myself? Then change the model: Replace standing tunnels with just-in-time access — request-scoped, time-boxed, individually authenticated with a second factor, brokered through a jump host you control, recorded. And put a notification clause in the contract: If the integrator is compromised, you hear about it in hours, not from the FBI.

Minnesota’s fast recoveries were earned, not lucky

Braham’s water plant was back under operator control in roughly two hours, with no boil-water order. Plymouth’s operators switched to manual operation and disconnected the compromised cellular equipment at two water towers and fourteen lift stations, keeping service running until communications were restored. None of that was produced by a security product; it was produced by operating capability that existed before the attack needed it. Restoring the screens is not the finish line, either: After an unauthorized hand has changed a controller’s configuration, the first recovery question is not whether the HMI is back online but whether you can trust what it is telling you — which means verifying levels, pressures and pump states against local indicators before the display regains its authority.

Manual operation is a designed capability, not a folk memory. It requires procedures that exist on paper — literally on paper, because the HMI may be what you just lost — people trained on them, and decision rights assigned in advance. The sector had, in fact, just rehearsed this: EPA’s 2026 National Cyber Drill on July 8 — 18 days before Minnesota — put utilities through precisely that scenario, operating with SCADA remote connectivity, cloud services and communications degraded or unavailable. Whether that capability actually exists at your site is testable: I’ve published a free, browser-based Island Mode 72-hour stress test — one of six no-signup companion tools I maintain openly on GitHub — that walks a site through exactly this question, from credential caches to offline backups. Joint guidance issued by CISA with its Australian, British and Canadian counterparts in late July makes the same point at doctrine level: Maintain isolation and recovery plans so essential services continue under degraded conditions, through manual or alternative SCADA paths.

The decision-rights half is the part most plans skip. Which systems may a SOC or an MSSP isolate unilaterally, and which require the operator who understands the process? That is the containment paradox I wrote about in these pages two weeks ago, and the water-sector version is identical: The artifact is one page, the conversation that produces it takes an afternoon, and the absence of it is what turns a two-hour incident into a two-day one.

The response calendar

Within 72 hours: Kill every direct external path and public IP, pull the carrier bill and flag every SIM you cannot map to a device, preserve gateway and engineering-workstation logs, verify the physical process against local indicators and upload the running logic from each critical controller to compare against your archive.

Within 30 days: Finish the SIM-to-asset reconciliation, rotate every credential that ever traveled through an exposed path, give every third party an individual identity with session logging and assemble a rebuild-ready package — project file, firmware version, HMI configuration, software, cable — for each critical controller.

Within one quarter: Run a factory-reset recovery drill on a representative controller, measure time-to-manual in a live exercise, replace the last standing vendor tunnel with just-in-time access, put the notification clause into integrator contracts and get the containment matrix — who may isolate what — signed.

5 numbers to know by Friday

1. SIM-equipped OT endpoints on your carrier invoice versus devices in your asset register. Any delta is unmanaged attack surface.
2. Controllers still running default, blank or shared passwords. After this month, that number is a decision, not an oversight.
3. Days since the last verified offline project-file backup, per controller. Verified means uploaded and compared — not assumed.
4. Tested time-to-manual, per site. Measured in a drill, with the people actually on shift, not estimated in a workshop.
5. Third parties with standing access paths into your OT. The target is zero. Everything else becomes just-in-time.

Attribution may firm up, or the ambiguity may itself be the point — it serves the attacker either way. The five numbers above will not tell you who attacked Minnesota. They tell you how much room the next attacker has inside your plant. The next campaign gets to learn from this one. Attribution can wait. Your exposure math cannot.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Enterprises have spent decades learning how to audit people and software. Agentic AI creates a third category: systems that interpret instructions, call tools and act across workflows without a mature assurance model built around them.

In my work as a leader and investor across technology-enabled businesses, I have spent years around automation, cybersecurity, compliance, workflow design and board reporting. I have watched management teams gain confidence from dashboards, policies and approval records, then face a harder question when a board member, auditor or regulator asks whether the controls performed as intended.

Agentic AI complicates that question because a single outcome may pass through several systems. An agent can collect information, choose a tool, produce code, route a request and hand work to another agent before a person approves the result. No single manager may have observed the full path.

Executive accountability remains human even when the operating activity becomes more autonomous. The CIO may have to explain who authorized the activity, whether the agent stayed within its approved purpose and what evidence supports management’s answer.

In a recent framework for frontier AI, Google DeepMind CEO Demis Hassabis proposed an independent standards body that could evaluate advanced models before deployment and address critical vulnerabilities after release. His proposal focuses on frontier models, but the principle carries into the enterprise: expanding autonomy creates a corresponding need for independent assessment.

My rule for this stage of adoption is straightforward: no agent should gain more autonomy than the company can verify.

The enterprise audit model was built for people and software

Companies have spent decades building controls around people. Employees have job descriptions, reporting lines, approval limits and access rights. When someone leaves, an established process removes access and transfers responsibility.

Traditional software also fits a familiar structure. A program follows defined instructions inside systems with owners, release procedures, test records and change controls. Complexity can make review difficult, but the accountability chain is usually visible.

An AI agent sits between those categories. It operates through software while interpreting instructions with room to choose a path. Its behavior may change when the model, prompt, connected data, available tools or surrounding workflow changes. A control approved during deployment can weaken months later without an obvious change to the application.

Standards are still developing as adoption accelerates. In February 2026, NIST launched an ⁠AI Agent Standards Initiative focused on secure operation and interoperability for agents capable of autonomous action.

Gartner predicted that 40% of enterprise applications would include task-specific agents by the end of 2026, up from less than 5% in 2025. More than 40% of agentic AI projects could be canceled by the end of 2027 because of escalating cost, unclear business value or inadequate risk controls.

IBM’s 2025 Cost of a Data Breach research found that ⁠13% of surveyed organizations reported breaches involving AI models or applications. Among that group, 97% reported inadequate AI access controls. 63% of organizations in their study lacked governance policies for managing AI or preventing shadow AI.

One team may approve an agent, another may connect it to data and a third may own the workflow. Management still carries responsibility when the agent exposes information, produces an error or acts outside its approved purpose.

Two-thirds of CIOs and CTOs surveyed were being held ⁠accountable for AI systems they did not fully control. Seventy percent said technology was spreading across the business faster than IT could track it, while 77% said adoption was outpacing governance capabilities.

The survey findings expose the boardroom gap: management carries accountability while control remains distributed across teams, systems and workflows. An assurance model must provide more than a statement of intent.

Assurance must prove where the boundary held

Policies, dashboards and logs help establish control. Assurance begins when the company tests whether an agent stayed inside the conditions management approved.

Before deployment, management should document the agent’s business purpose, accountable owner, systems touched, allowed actions and stop conditions. Testing should then determine whether the agent can reach information outside its scope, call an unapproved tool, continue after a stop condition or carry an incorrect assumption into another system.

I would treat an agent’s autonomy as a renewable license because its operating condition will change after launch. Renewal should follow any material change to the model, connected data, available tools, workflow or authority. NIST’s work on the challenges of monitoring deployed AI systems identifies drift, fragmented logging and immature standards as barriers to post-deployment oversight, while the World Economic Forum recommends scaling safeguards with an agent’s autonomy, authority and complexity. A change-triggered review ties assurance to the version of the agent and workflow in use, giving the CIO a defensible basis for continued authority.

Consider a coding agent that begins by drafting test cases, then gains access to repositories, tickets, CI/CD tools and production documentation. A production change could involve an instruction, code, a tool call, an automated test, a ticket update and human approval. Assurance must show how the result was produced, which systems participated, whether the agent crossed a boundary and how exceptions were handled.

For every agent with meaningful operating authority, I would expect four connected records: the approved baseline, boundary-test results, a history of behavioral drift and an account of exceptions and interventions. Together, they give management a record that can support a board discussion, audit or regulatory response without depending on the technical team’s memory.

Autonomy should scale only as fast as assurance

Internal teams will remain responsible for designing controls and operating the environment. At board-level scale, management also needs review independent from the people who built and run the agent.

I have seen management ask auditors or other independent certified professionals to sign off on a system. They cannot sign when they have not completed the work required to support that opinion. Leadership wants confidence, the board wants an answer and the independent party needs a body of evidence that can be tested.

Agentic AI will make that evidence harder to assemble after an incident. Records have to be produced while the work occurs. Once an agent has acted across several systems, reconstruction may depend on logs created by different vendors, teams and tools. Missing context can turn a clear technical event into an uncertain management explanation.

CIOs should design assurance into the workflow. The operating record needs to capture approved purpose, tested boundaries, material changes, exceptions, human interventions and unresolved findings. Independent review can then examine whether the control operated during the period management is being asked to discuss.

The operating record gives executives a basis for changing an agent’s authority. Broader responsibility should follow tested boundaries and a clean exception history. Drift or repeated intervention should pause expansion until the cause is understood.

Before approving broader use, I would ask:

• What authority has the company granted?
• Which tests show the boundary holds?
• What record will remain available months later?
• Who carries accountability when the record shows a failure?

Those questions create a management standard for deciding whether an agent is ready to move from a limited workflow into broader enterprise operations.

Enterprises have spent decades learning how to audit people and software. Agentic AI creates a third category that requires its own assurance model. The next discipline for the enterprise is auditing autonomy through approved behavior, tested boundaries, monitored change and documented intervention.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

There is a lot of talk about the coming enterprise AI reality, in which AI finally arrives in production systems. You might not know it, but this reality—or nightmare, depending on how you handle it—is already happening.

It all starts with a “pilot,” a “prototype,” or a “side project.” Maybe someone builds an internal dashboard with an agent. The dashboard quickly becomes indispensable, and all of a sudden the experiment becomes production. Along the way, no one thought to ask the boring, inconvenient questions: What exactly was pulled from npm, PyPI, or Docker Hub? How is (or was) authentication configured? Is anyone watching for supply chain attacks against the tools and libraries the agents chose?

And it’s not just a one-off project here or a couple of applications there. AI is enabling organizations to generate more code and ship more products and projects, more quickly, than ever before. By the time security teams get a look, the business is hooked and there’s no turning back. An actual nightmare has begun.

There are three major problems that make the nightmare real.

Components you never explicitly chose

When you ask an AI agent to build an app, it doesn’t just spit out a single script. It quietly assembles an entire ecosystem around whatever problem you’ve described to it. It pulls in a web framework, grabs a bunch of libraries, stands up databases, and then it potentially builds everything on dependencies in container images.

From a productivity perspective, this is awesome. However, from a security standpoint, it’s worrisome, to say the least. When I’ve built apps like this myself, I couldn’t begin to tell you all of the components that were being used unless I went back and asked the agent to explain itself.

We live in a world where anyone can publish to npm or PyPI, and we’ve seen attackers slip malicious packages into those ecosystems or compromise ones that are widely used. Some of the recent incidents have involved security and devops tools themselves pulling a compromised dependency, running it as part of CI/CD with elevated privileges, and quietly exfiltrating secrets or tampering with builds. I personally experienced this type of compromise a couple of months ago, and had to update all of my credentials in GitHub.

Pulling unvetted code is bad; now layer AI agents on top of that. They default to whatever is easiest to discover and integrate. If a package solves a problem in front of the agent, the agent will add it. This is the old “download a random library from the Internet” problem, but now it’s on autopilot, at scale, and moving at a pace we’ve never seen before.

To solve this problem, we must provide the agents with an innate sense of our risk tolerance, an approved components list, our desires around logging, etc. We can do this with spec files and what the industry calls constitutions. Collectively, this is called harness engineering, which we will talk more about later.

Skills shifting from code to architecture

There has been a lot of hand-wringing about whether junior developers will ever really learn to code if AI is doing all of their coding for them.

That’s not what worries me.

I think it’s fine to let an agent spit out code. It’s a job they are really good at. What they are not really good at is identifying and avoiding problems in code.

I haven’t written code in quite some time. I can, but it doesn’t make sense for me to do so. What is worth my while is noticing when an agent suggests something dumb or even dangerous (or both).

For example, while working on a recent personal project, an agent proposed exposing a memory server on the public Internet with no authentication. The agent wired things up so smoothly that, at first glance, everything looked fine and just worked. But then I paused and asked, “Wait, how is this actually authenticating? Where’s the password, secret token, or OAuth in this flow?” Turns out it wasn’t authenticating and there was no password. If I hadn’t taken that beat—and then argued with the agent for a while—the app would have gone live with no protection.

So, the skills issue isn’t about whether we will lose the ability to code but rather whether we have the ability to ask questions and be discerning, and whether we have the understanding to know when something doesn’t look or even feel right. Do organizations have people who know what a dangerous software pattern looks like when the agent suggests it? You need people who can recognize when an authentication flow is too permissive, when a data store should never be exposed beyond a certain boundary, and when an architecture has become such a steaming pile of technical debt that the right answer is to throw away a whole layer and rebuild it.

You need people who know that “what works” isn’t the same as “what’s safe” or “what’s right” and who can argue back with the agent when the former doesn’t line up with the latter.

It’s not about syntax. It’s about architecture, supply chain awareness, and the willingness to say, “We’re tearing this down and doing it right,” even when the prototype looks good on the surface. Teach your AI-assisted coders basic security principles, basic architectural patterns. The AI will teach them the more advanced stuff, as long as they keep asking questions.

Agents with no harness

The third problem is that we’ve unleashed some very capable agents into our development workflows without treating them like first-class actors that need governance.

Many organizations are wiring AI assistants into a repo or IDE and letting them scaffold projects and pipelines. Maybe they bolt on a security scanner and declare “AI enablement.” That’s not a governance model, that’s optimism (and not even cautious optimism).

Indeed, a code-generating agent with broad access to your repos, your CI/CD pipeline, and your artifact registries is effectively a hyper-productive and not-very-well-trained junior developer with access to the Internet and no ingrained sense of organizational policies. It can introduce new tools, new dependencies, and new patterns faster than your review processes can handle.

In my personal projects, I’ve started to think of this as what AI coders call a harness-engineering problem. For every agent that’s responsible for building or wiring code, I try to put other agents in the loop that are responsible for tearing it down, at least conceptually. For example, one agent focuses on security and looks for obvious vulnerabilities and bad practices. Another looks at architecture and points out when the app design is veering into unmaintainable territory. A third looks at performance and reliability issues, which are themselves a kind of security concern when you think about things like denial of service and resource exhaustion. Pair this with constitutions that give the agents first principles on architecture, security, and design, and this is no longer vibe coding, it’s harness engineering at scale for all of your projects.

What I am doing isn’t perfect; there is no perfect in this space, because these are non-deterministic, statistical tools. But, many organizations aren’t even doing this. In effect, their agents are freelancing. They’re vibe coding. They’re not constrained to trusted registries or hardened base images. They’re not required to log their decisions in a way that security can audit. No one owns the harness, and that means a lot of implementation decisions have fully shifted from humans to systems that no one is really watching.

New problems require new thinking

The enterprise AI nightmare is not a killer robot; it’s the erosion of our ability to see and control what’s running in our own environments at the exact moment our velocity is exploding. The danger is in ceding your agency. It’s in shipping applications that internal and external customers love—and don’t want to give up—but inherently aren’t safe. Right now, someone in your organization is using AI to build a capable app, pulling in who knows what from who knows where and adding it to your infrastructure.

The good news is that these problems are identifiable. They are also solvable, although it will take a new form of thinking than what solved problems in the past. You must think statistically, and declare constitutions with first principles. You can standardize trusted stacks and registries. You can retrain people around architectural security rather than just “secure coding.” You can start treating agent harnesses as systems that deserve design reviews and edits.

But, none of that can happen until the enterprise is willing to admit that the nightmare is already here.