IBM is looking to expand the reach of its foundational mainframe portfolio by adding new single frame and rack mounted versions of its Z and LinuxONE systems.

The IBM z17 portfolio adds a single frame and rack mount versions that bring mainframe capabilities into smaller, customizable footprints. The LinuxONE Rockhopper family gets a single frame and rack mount models, plus a new Express rack mount offering, that target new and smaller clients, according to Tina Tarquinio, chief product officer, IBM Z & LinuxONE.

Specifically, the new hardware includes:

• z17 single frame is a fully packaged box in an IBM rack with intelligent power distribution units, delivered as a complete enclosed unit ready to deploy at the edge or other strategically important customer sites.
• z17 rack mount lets customers install IBM Z components directly into their own industry-standard rack, with built-in flexibility for co-location with other technologies.
• LinuxONE Rockhopper 5 is a multi-drawer LinuxONE system for high-density workloads, with on-chip AI acceleration, confidential computing, and postquantum cryptography available in both single frame and rack mount configurations.
• Rockhopper 5 rack mount and Express offerings deliver enterprise-grade Linux, confidential computing, and on-chip AI acceleration in a compact 18U configuration. Designed for organizations supporting a smaller set of workloads, the offering provides a cost-efficient entry point that can scale as business grows, while prioritizing security, resiliency, and performance.

The new IBM z17 and IBM LinuxONE 5 Rockhopper configurations support up to 82 cores and 18 TB of memory across two processor drawers, representing about a 20% increase in core count and 12% increase in memory capacity over current systems, IBM stated. Single processor capacity of an IBM z17 ME2 provides full speed IBM z/OS configurations including 10% greater throughput per core than IBM z16 A02 with some variation based on workload and configuration, according to Tarquinio.

Both systems feature a 5.5 GHz IBM Telum II processor and a built-in AI accelerator that IBM says will let customers run more than 450 billion inferencing operations in a day with one millisecond response time. In addition, the 32-core Spyre AI accelerator is designed to handle all manner of AI workloads.

The idea is to bring the core strengths of IBM Z to a broader range of deployment models while offering the security, resilience, and performance enterprises depend on, Tarquinio said. 

“As always, we’re continuing to innovate to deliver more with less, including up to 20% more capacity than IBM z16 to help process transactions faster and support growing AI-driven workloads,” Tarquinio said.  “Even the newest and smallest member of the IBM z17 family delivers the performance, efficiency, and scalability organizations need as they balance growth ambitions with real-world resource constraints.”

The Linux-based system, Rockhopper 5 is for organizations that have moved past the evaluation question and are ready to consolidate a substantial portion of their x86 estate, said Marcel Mitran, IBM Fellow and CTO of IBM LinuxONE. 

Rockhopper 5 is designed to bring a smaller physical footprint and a software licensing model that reflects actual workload boundaries rather than physical server counts, Mitran said.

The LinuxONE 5 Express is a preconfigured system designed to get organizations running on LinuxONE quickly, with a defined bill of materials and a predictable starting cost, on the same architecture that the largest enterprises in the world depend on, Mitran said.

“It is built for organizations that want to consolidate a modest x86 estate, evaluate LinuxONE for the first time, or deploy a specific workload such as digital assets, AI-infused transaction processing, or confidential computing, without committing to the footprint of the larger model,” Mitran said.

Some of the mainframes’ software features were also bulked up. For example, IBM said that Post Quantum Cryptography security is now standard on the z17 and LinuxONE Rockhopper 5 systems letting customers start to utilize cryptography to protect core resources for the future.

The idea is to help customers protect long-lived, mission-critical data while reducing the cost and complexity of future cryptographic migration, IBM stated. 

In that vein, IBM said it was bringing Crypto Discovery & Inventory, which lets security teams see what has been encrypted across the enterprise. In addition, IBM announced an Infrastructure Management for Z and LinuxONE package that would let customers administer, monitor, automate, and provision IBM Z and LinuxONE systems from a central location.

IBM said it wants to reduce operational complexity for customers by making automating day-to-day operations to ultimately lower administrative costs and concerns. With the new flexible form factors, IBM continues to target hybrid and AI infrastructure buildouts with the Big Iron. In the AI world, the z17 is being utilized for AI inferencing, transactions, training, and key security applications such as fraud detection and insurance claims.

“Enterprise infrastructure is entering a new phase. Organizations need platforms that can support AI-driven growth while navigating resource constraints, evolving business requirements, and increasingly complex hybrid environments,” Tarquinio said. “They are being asked to deploy new AI capabilities while learning new skills, controlling operational costs, and maximizing the value of existing applications and infrastructure.”

A recent IBM Institute study on mainframe usage stated that embedding mainframe to support AI in executing transactions is not temporary: 75% of executives expect mainframe-based applications to remain central to digital transformation, and 60% say mainframe-based platforms are essential to enabling AI innovation.

”Mainframe-anchored systems of record are becoming systems of intelligent execution—not as general‑purpose AI platforms, but as environments where AI acts directly within transactions and in support of them,” the study reported.

Gartner wrote in its “The State of the IBM Mainframe in 2026” report that IBM’s willingness to make significant investments ensure the mainframe modernizes to remain a vital and thriving component of enterprise IT.  

“Most mainframe customers are now prioritizing the reduction of technical debt and adopting platform innovations to future-proof their mainframe environments for the coming decade,” Gartner wrote.

The new z17 single frame and rack mount configurations, LinuxONE Rockhopper 5, and LinuxONE 5 Express will all be available August 12, 2026. IBM Infrastructure Management for IBM Z and IBM LinuxONE will be available August 14.

IBM is looking to expand the reach of its foundational mainframe portfolio by adding new single frame and rack mounted versions of its Z and LinuxONE systems.

The IBM z17 portfolio adds a single frame and rack mount versions that bring mainframe capabilities into smaller, customizable footprints. The LinuxONE Rockhopper family gets a single frame and rack mount models, plus a new Express rack mount offering, that target new and smaller clients, according to Tina Tarquinio, chief product officer, IBM Z & LinuxONE.

Specifically, the new hardware includes:

• z17 single frame is a fully packaged box in an IBM rack with intelligent power distribution units, delivered as a complete enclosed unit ready to deploy at the edge or other strategically important customer sites.
• z17 rack mount lets customers install IBM Z components directly into their own industry-standard rack, with built-in flexibility for co-location with other technologies.
• LinuxONE Rockhopper 5 is a multi-drawer LinuxONE system for high-density workloads, with on-chip AI acceleration, confidential computing, and postquantum cryptography available in both single frame and rack mount configurations.
• Rockhopper 5 rack mount and Express offerings deliver enterprise-grade Linux, confidential computing, and on-chip AI acceleration in a compact 18U configuration. Designed for organizations supporting a smaller set of workloads, the offering provides a cost-efficient entry point that can scale as business grows, while prioritizing security, resiliency, and performance.

The new IBM z17 and IBM LinuxONE 5 Rockhopper configurations support up to 82 cores and 18 TB of memory across two processor drawers, representing about a 20% increase in core count and 12% increase in memory capacity over current systems, IBM stated. Single processor capacity of an IBM z17 ME2 provides full speed IBM z/OS configurations including 10% greater throughput per core than IBM z16 A02 with some variation based on workload and configuration, according to Tarquinio.

Both systems feature a 5.5 GHz IBM Telum II processor and a built-in AI accelerator that IBM says will let customers run more than 450 billion inferencing operations in a day with one millisecond response time. In addition, the 32-core Spyre AI accelerator is designed to handle all manner of AI workloads.

The idea is to bring the core strengths of IBM Z to a broader range of deployment models while offering the security, resilience, and performance enterprises depend on, Tarquinio said. 

“As always, we’re continuing to innovate to deliver more with less, including up to 20% more capacity than IBM z16 to help process transactions faster and support growing AI-driven workloads,” Tarquinio said.  “Even the newest and smallest member of the IBM z17 family delivers the performance, efficiency, and scalability organizations need as they balance growth ambitions with real-world resource constraints.”

For the Linux-based system, Rockhopper 5 is for organizations that have moved past the evaluation question and are ready to consolidate a substantial portion of their x86 estate, said Marcel Mitran, IBM Fellow and CTO of IBM LinuxONE. 

Rockhopper 5 is designed to bring a smaller physical footprint and a software licensing model that reflects actual workload boundaries rather than physical server counts, Mitran said.

The LinuxONE 5 Express is a preconfigured system designed to get organizations running on LinuxONE quickly, with a defined bill of materials and a predictable starting cost, on the same architecture that the largest enterprises in the world depend on, Mitran said.

“It is built for organizations that want to consolidate a modest x86 estate, evaluate LinuxONE for the first time, or deploy a specific workload such as digital assets, AI-infused transaction processing, or confidential computing, without committing to the footprint of the larger model,” Mitran said.

Some of the mainframes’ software features were also bulked up. For example, IBM said that Post Quantum Cryptography security is now standard on the z17 and LinuxONE Rockhopper 5 systems letting customers start to utilize cryptography to protect core resources for the future.

The idea is to help customers protect long-lived, mission-critical data while reducing the cost and complexity of future cryptographic migration, IBM stated. 

In that vein, IBM said it was bringing Crypto Discovery & Inventory, which lets security teams see what has been encrypted across the enterprise. In addition, IBM announced an Infrastructure Management for Z and LinuxONE package that would let customers administer, monitor, automate, and provision IBM Z and LinuxONE systems from a central location.

IBM said it wants to reduce operational complexity for customers by making automating day-to-day operations to ultimately lower administrative costs and concerns. With the new flexible form factors, IBM continues to target hybrid and AI infrastructure buildouts with the Big Iron. In the AI world, the z17 is being utilized for AI inferencing, transactions, training, and key security applications such as fraud detection and insurance claims.

“Enterprise infrastructure is entering a new phase. Organizations need platforms that can support AI-driven growth while navigating resource constraints, evolving business requirements, and increasingly complex hybrid environments,” Tarquinio said. “They are being asked to deploy new AI capabilities while learning new skills, controlling operational costs, and maximizing the value of existing applications and infrastructure.”

A recent IBM Institute study on mainframe usage stated that embedding mainframe to support AI in executing transactions is not temporary: 75% of executives expect mainframe-based applications to remain central to digital transformation, and 60% say mainframe-based platforms are essential to enabling AI innovation.

”Mainframe-anchored systems of record are becoming systems of intelligent execution—not as general‑purpose AI platforms, but as environments where AI acts directly within transactions and in support of them,” the study reported.

Gartner wrote in its “The State of the IBM Mainframe in 2026” report that IBM’s willingness to make significant investments ensure the mainframe modernizes to remain a vital and thriving component of enterprise IT.  

“Most mainframe customers are now prioritizing the reduction of technical debt and adopting platform innovations to future-proof their mainframe environments for the coming decade,” Gartner wrote.

The new z17 single frame and rack mount configurations, LinuxONE Rockhopper 5, and LinuxONE 5 Express will all be available August 12, 2026. IBM Infrastructure Management for IBM Z and IBM LinuxONE will be available August 14.

A new form of vendor lock-in is here. And it’s not proprietary languages or rigid enterprise software suites — it’s something more fundamental. It’s the very thing that writes the code.

JetBrains Research found that 74% of developers worldwide use AI tools. Claude Code, available only since May 2025, is now the most popular AI coding tool, followed by Gemini Code Assist and GitHub Copilot, according to Jellyfish’s 2026 State of Engineering Management Report.

The latter study also found that 91% of developers say their productivity has increased in the past 12 months. As coding output expectations are rewritten daily, the engineering world is becoming heavily reliant on paid external AI services.

Gartner predicts that by 2028 spending on AI coding tokens could exceed developer salaries. Yet, tokenmaxxing while vibe coding through a vendor’s cloud-based API feels like a far cry from the open foundations of free programming languages and open models, which many of today’s AI platforms now abstract.

“Open infrastructure will be the backbone of the AI era,” says Peter Farkas, CEO of Percona, a provider of open-source database solutions. “Right now, too many companies are building their entire AI strategy on top of proprietary platforms because the convenience is seductive.”

“It’s ‘three clicks’ to stand up a database or an AI service in a hyperscaler, and that convenience blinds people to the lock-in they’re signing up for,” he adds. “As AI workloads mature, organizations will realize that depending on one vendor for their data, models, runtime, and pricing is not a strategy.”

AI-assisted coding is democratizing software engineering for non-engineers and accelerating top performers. But if teams are always working within the confines of how one platform thinks the world should work, it could create locked-in toolsets at scale. And as AI platform costs rise, a fundamental question arises: will software developers consume AI on their own terms, or on someone else’s?

There’s a strong case that the long-term winners in tech will be built on open-source standards and foundations, similar to the history of cloud-native computing and the internet itself.

“Open always wins,” says Brian Alvey, CTO at WordPress VIP, a managed WordPress hosting platform. “Not because it’s a fancy ideology, but because it gives you total freedom to adapt, evolve, and stay in control.”

Open infrastructure avoids a future where developers perpetually rent. “For AI to be useful to people at large, it can’t be something you’re paying rent for the rest of your life,” says Manik Surtani, CTO and co-founder of the Agentic AI Foundation (AAIF), a vendor-neutral home for open-source agentic AI technologies. “And it can’t be concentrated in one particular corporation or a small handful of corporations, because we know how that goes.”

Pricey, closed, proprietary AI

AI development today is traveling two parallel paths. On one path, open-source AI is thriving and fueling tremendous growth in the number and variety of AI models and tools. Just take the thousands of open-weight models on HuggingFace, the community around the OpenClaw AI agent, or the many academic institutions publishing new breakthroughs.

“Open-source models and tooling are hot on the heels of state-of-the-art, with interesting and boundary-pushing work being shared by labs and researchers across the world,” says Austin Parker, director of AI strategy at Honeycomb, an observability platform provider, citing frontier open-source models like Mistral, DeepSeek, and Ai2’s OLMo as examples.

Others agree. “There’s unprecedented openness at the model and tooling layer, with open-source models, frameworks, and orchestration advancing at remarkable speed,” says Mark Collier, general manager of AI and infrastructure at the Linux Foundation.

On the other path, we’re seeing heavy reliance on proprietary AI systems controlled by Anthropic, Cursor, Google, Microsoft, OpenAI, and others. As Collier says, “Many platforms are wrapping those open components in closed, opinionated interfaces that trade short-term speed for long-term constraints.”

Open source and the AI tooling market don’t always mix well. LangChain’s Open Agent Platform, for instance, was open-sourced to much fanfare in 2025, but by 2026 had been deprecated, with the repository now recommending fully managed alternatives.

For Roman Shaposhnik, co-founder and CTO of Ainekko, provider of an open-source, composable AI stack, the current AI platform landscape is reminiscent of low-code and no-code platforms, which promised democratization of software development but often failed to deliver, becoming synonymous with platform lock-in and inflexibility.

“Honestly, it feels familiar,” Shaposhnik says. “We have incredibly powerful AI tools right now, but most of them come bundled as tightly controlled platforms.” This is a risk for AI, he says, because the infrastructure, models, and hardware are tightly coupled. “If those layers are closed, you lose flexibility fast.”

Some abstractions that sit on top of models, like routing and agent frameworks, tend to be tightly coupled and optimized for certain models. Other platforms take the walled garden concept quite literally. Anthropic, for instance, has repeatedly made headlines for blocking access to its Claude models over vague policy violations. The company recently shut off competitor xAI’s use and stonewalled OpenCode, drawing community backlash.

Moves toward increasingly closed systems don’t bode well for an AI economy already built on shaky economics. As Vikram Srivats, head of product experience at WaveMaker, provider of an agentic application development platform, adds, “Given the unit economics of AI tooling and pace of accelerated change to keep up, it seems obvious that some will evolve to more of a closed system to be able to monetize and gain ROI.”

Why openness matters in the AI era

Reliance on proprietary AI platforms can create long-term operational dependencies. As systems become less interoperable, organizations may be forced to standardize on a single stack across data pipelines, models, and decision logic, says the Linux Foundation’s Collier.

“As infrastructure consolidates, enterprises become more exposed when platforms change direction, raise prices, or fall behind technically,” he says. “If you can’t change platforms without re-architecting your AI systems, you’ve already given up too much control.”

“When you build on someone else’s platform, you have to live by their rules and those rules always change,” adds WordPress VIP’s Alvey. “We’ve all seen this before, businesses wasting time and money building to serve Google, Facebook, YouTube, and the App Store, instead of building to serve their customers.”

Platform lock-in can also create direct business risk. As Ainekko’s Shaposhnik says, “It usually shows up as higher costs, fragile systems, and growing risk when it’s time to change direction.”

At Ainekko, an internal group called the AI Plumbers focuses on back-end AI infrastructure like inference, scheduling, memory, and hardware integration. “Their view is simple,” says Shaposhnik. “If those layers are closed, everything above them becomes fragile.”

Open standards, interfaces, and infrastructure provide a necessary hedge against closed systems to prevent this sort of fragility. “In the AI era, open infrastructure gives enterprises control, portability, and choice at exactly the time they need it most,” says Percona’s Farkas.

It can cost upwards of $100,000 to migrate enterprise software, according to Cloudaware, making portability a major enterprise concern. From this perspective, procuring closed systems can become a costly architectural dependency.

Others argue that openness is a critical hedge against vendor concentration risks at large, especially if AI replaces human labor en masse. “If all of that economic value is now being concentrated in the hands of one or two companies,” says the AAIF’s Surtani, “that’s an order of magnitude bigger problem than we’ve seen in any other wave of computing.”

Instead, open foundations allow adaptability to evolving conditions so enterprises can swap out models, agents, data, hardware, and orchestration, as needed. “Open standards let those components change independently without breaking the system,” says Collier. 

Openness can also help future-proof businesses against economic upheaval. “Open everything will help build a cushion for businesses and users to survive and thrive after the almost-certain correction in the current hype cycle,” says WaveMaker’s Srivats.

Momentum toward open AI infrastructure

At the industry level, momentum toward open AI infrastructure is growing. The establishment of the Agentic AI Foundation, Anthropic’s donation of Model Context Protocol (MCP), and Block’s donation of its Goose agent are significant ecosystem-wide moves toward openness. Other advances include the donation of llm-d, a Kubernetes framework for LLM inference, to the Cloud Native Computing Foundation (CNCF).

For Parker, donations like this help ensure long-term support and care. “Open standards aren’t just the foundation of the internet, they’re the foundation of the AI space,” he says. “I predict that we’ll see these practices continue, especially as enterprise adoption increases in earnest,” he adds.

Still, some question whether this level of stewardship is enough for a rapidly evolving ecosystem. “The internet benefited early on from groups that helped keep vendors aligned,” says Shaposhnik. “In AI infrastructure, we don’t really have that yet.”

“All of us open source veterans are hopeful,” he says, “but we also need to adapt to this new reality in what we do regarding AI infrastructure.”

Beyond industry governing bodies, companies themselves are also spearheading open AI initiatives. Warp, an agentic development environment, recently went open source amid closed-source rivals. Arcade.dev, meanwhile, is pushing an open-source Agent Library for agentic memory.

Where openness matters most in the AI stack

While AI infrastructure can be open in many ways, a few layers stand out as especially important. First is the openness of the model itself. “Open-source models must be the foundation of future trust and value,” says WaveMaker’s Srivats.

“The forms of open infrastructure that reduce integration friction and accelerate adoption stand out,” adds Neeraj Abhyankar, VP of data and AI at R Systems, a global digital solutions provider. For him, open model representation formats, open orchestration and execution layers, open agentic protocols, and open governance and metadata standards are all essential for enterprise flexibility.

Others place more value on the connective tissue between AI components. “The most important forms of open infrastructure are the ones that connect systems together,” says Collier. “That includes open APIs, metadata standards, identity and policy frameworks, and protocols for how models and agents communicate.” 

Arguably, MCP has become the connective tissue between AI agents and the broader API ecosystem. “If we get MCP right we unlock the same level of interoperability between entities on the web and models driving them as we came to enjoy during the Web 2.0 era and the API-first boom,” says Shaposhnik. “If we don’t we risk massive proprietary lock-ins.”

Parker agrees that open protocols will underlie future AI progress. “We’ll see continued development and progress on AI agents which will rely on protocols like MCP and ACP [Agent Client Protocol] to interoperate with various clients and each other,” he says. Yet a gap remains around API conventions for models. “It would be nice if we could get a commitment from model providers to use a standard here.”

For the AAIF’s Surtani, opening up the protocol layer is the most important aspect. “I think it’s really important for interoperability, for choice,” he says. “It means you can bring your own agent, you can bring your own framework, you can bring your own harness, and pick what model you want.”

Open standards may also play a significant role within inference architecture. “As AI expands to the edge, developers need visibility into how models run, how memory is used, and how performance scales,” says Shaposhnik. Open systems could make it easier to optimize, debug, and adapt while helping enterprises avoid observability fragmentation.

Lastly, cloud-native architectural standards are a key ingredient for open AI infrastructure. “We’re seeing Kubernetes become the missing link for people who want the hyperscaler-style convenience without hyperscaler lock-in,” says Percona’s Farkas. For him, Kubernetes has become the de facto hybrid enterprise deployment option for data, workloads, and AI components.

History repeats itself

The 2026 State of Open Source Report found avoiding vendor lock-in to be the primary driver of open source adoption. But beyond being a strategic decision for a single company, open infrastructure provides a layer for entire industries to be built upon.

Arguably, the internet itself is evidence of this, where groups like the IETF and the IEEE were instrumental in defining the fundamental protocols. “Without open protocols we would’ve been in telco hell and without phenomenons like Google or Facebook,” says Shaposhnik.

Or, take the history of Linux as a parallel. “Linux became the default operating system because it offered a common, vendor-neutral foundation that everyone could build on,” says Collier. “In the AI era, open infrastructure will define the layers that organizations rely on for long-term continuity.”

At the infrastructure level, open standards have repeatedly underpinned major platform shifts, from Docker to Kubernetes. The question now is whether AI will develop a similarly durable standards layer.

For Parker, it’s too early to say, but the current growth of AI mirrors the early cloud. “Remember that it took many years before we saw the development and popularization of the open source cloud-native ecosystem,” he says. “I think it would be a mistake to extrapolate from the current trajectory towards a closed, proprietary future.”

Others agree the future must be rooted in openness. “I see open infrastructure becoming the foundation of enterprise AI,” says R Systems’s Abhyankar. “As systems become more distributed and agent‑driven, closed ecosystems simply won’t scale.”

The groundwork is being laid through open agentic protocols, open frameworks, and industry support intended to reduce fragmentation around proprietary standards.

“Ironically, the AI movement has mostly seemed to learn from the mistakes of the past and is starting off on a more open foot,” says Parker. “Over time, I believe we’ll see innovation and openness thrive.”

The ability for attackers to leverage automatic install script execution in npm will finally come to an end when expected changes arrive from GitHub in July. Coders will still be able to enable the function, but the default setting will block it. 

In V12, default settings are changing, GitHub said in its changelog, noting, “it turns an npm install behavior that runs automatically today into one you explicitly opt into.” 

Specifically, the post said, “allowScripts defaults to off: npm install will no longer execute preinstall, install or postinstall scripts from dependencies unless they are explicitly allowed in your project. This includes native node-gyp builds; a package with a binding.gyp and no explicit install script still gets blocked, because npm runs an implicit node-gyp rebuild for it. Prepare scripts from git, file, and link dependencies are blocked the same way.”

Analysts, consultants, and users generally applauded the change, but said that it would only narrow the exposure to supply chain attacks instead of eliminating it. 

Attacks likely to move elsewhere

Sonu Kapoor, maintainer for CVE Lite CLI in the OWASP Incubator Project, said that this change is likely to force the supply chain attacks that leveraged the automatic execution to move elsewhere.

“This does not eliminate npm supply chain risk, it removes a major automatic execution path,” Kapoor said. “Attackers can still move to other paths: malicious package code that runs at application runtime, compromised maintainer accounts, dependency confusion, typo-squatting, poisoned GitHub Actions workflows, malicious transitive dependencies, or stolen publishing tokens. This closes one very dangerous door, but it does not secure the whole house.”

Still, attacks leveraging the setting have been regularly used in supply chain attacks. 

However Alan Parkinson, director of secure medical device firm Threat Detective, said more sophisticated attackers have already moved beyond this hole. 

“The install script attack vector has been known for years,” Parkinson said. “Most security teams marked it as low risk and moved on to higher risk threats. What raised its profile wasn’t the technical exploitability changing, it was a run of high-profile victims and some threat actors openly chasing notoriety.”

He added, “the pre and post install scripts was never a clever attack vector to begin with. Running code from an install hook is crude and noisy, which is why it caused such visible damage. The more capable actors are already moving to other methods, so v12 mainly shuts the door on less sophisticated threat actors.”

Although GitHub declined an interview, Zach Steindler, a GitHub principal engineer, answered InfoWorld’s questions by email. He said the volume and pace of supply chain attacks forced the default settings change. 

“We’ve seen attackers target these capabilities to quickly propagate attacks from one compromised package to many. Years of security and usability research have shown that it’s not enough to make secure functionality available; the secure path has to be the default in order for it to be widely adopted,” Steindler said.

He added, “we believe that these changes are a great way to provide high impact secure defaults while still providing the option for some users to fall back on functionality they might need in some circumstances.”

Change overdue

Sanchit Vir Gogia, chief analyst at Greyhound Research, said that GitHub was the last of the repositories to make the setting default change. “Rivals moved first: Yarn, pnpm and Bun all block third party install scripts by default in their own ways,” Gogia said. “Npm is not inventing a new doctrine. It is finally adopting one.”

Steindler didn’t dispute Gogia’s comment. 

“It’s not easy being the stewards of the largest package repository in the world. Community consensus on what security capabilities should be standard, and when it’s okay to make breaking changes shifts over time. From our continual conversations with the community, it was clear it was time to make this change,” Steindler said.

“The recent attacks are alarming,” he noted, “but stewarding these package repositories is a multi-decade effort, not just a moment in time. As attacks evolve, so will our defensive security capabilities. We’re in this for the long haul.”

Gogia said that the change, although overdue, is a good one. 

“Npm is removing one of the most comfortable hiding places for software supply chain risk: code that executes the moment a developer types install,” Gogia said. “With npm v12, execution becomes something that must be approved, recorded in the project, and committed for review. That is not a design adjustment. It is a change in control philosophy.”

Bad defaults become infrastructure

Gogia had his own take on why GitHub waited so long.

“Npm waited because its risky default acquired a constituency. As far back as 2016, npm’s own position was that the convenience of install scripts outweighed the worm risk, with an opt-out flag for the cautious. The trade-off was a documented product decision, not an oversight,” he said.

“The trouble with bad defaults is that they become infrastructure,” he added. “Native module builds, browser installers such as Playwright and Cypress, Electron download flows and Husky hooks all grew around automatic execution. Turning it off became less a technical adjustment and more a constitutional reform.”

Liability changed hands

The real pressure for the change, however, came from regulators.

“The deeper answer is that the liability changed hands. Once regulation such as the EU Cyber Resilience Act and securities disclosure rules placed supply chain failure on corporate balance sheets, a documented unsafe default became indefensible,” Gogia said. 

Kapoor agreed that long-used procedures enabled this security hole to survive longer than it should have. 

“The reason this likely was not done long ago is compatibility,” he said. “Install scripts are not only used by attackers. Many legitimate packages use them to compile native modules, download platform-specific binaries, generate files, or complete setup steps. Changing the default breaks assumptions that have existed in the npm ecosystem for years. That is why these security changes often arrive slowly. The safer default is obvious from a security perspective, but painful from an ecosystem compatibility perspective.”

In addition, he noted, “the bigger point is that package managers are moving from implicit trust to explicit trust. That is the right direction. Developers should have to approve which dependencies are allowed to execute code during install. But approval cannot become a blind checkbox. Teams need visibility into which package wants to run a script, whether it is direct or transitive, why it is there, and whether it belongs in the project at all.”

Kapoor added that this change matters because install-time execution often happens in privileged environments with access to tokens, secrets, internal registries, build artifacts, or deployment paths. “Even if the script does not compromise production directly, it may be able to steal enough context to support the next stage of an attack,” he said.

Value in the pain

Cybersecurity consultant Brian Levine, executive director of FormerGov, agreed that the closing of this security hole is a very good thing. 

“It seems like virtually every major supply chain attack of the last decade has had the same original sin: code that ran automatically because the ecosystem let it. Npm finally closing that door by default is overdue, but it’s genuinely significant. This is the package manager for hundreds of billions of downloads a month,” Levine said.

“When npm changes its defaults, it changes the security posture of practically every enterprise dev environment on the planet. It may have been the last large code repository to still allow this kind of automated execution.”

Levine added that this change might not merely stop a security hole, but the new process may meaningfully improve security. 

“There’s actually something valuable buried in this migration pain. Having developers explicitly approve which packages can run code and commit that list to source control is a form of software supply chain governance that many organizations never had,” Levine said. “It creates an auditable record which is meaningful, especially for regulated industries.”

The ability for attackers to leverage automatic install script execution in npm will finally come to an end when expected changes arrive from GitHub in July. Coders will still be able to enable the function, but the default setting will block it. 

In V12, default settings are changing, GitHub said in its changelog, noting, “it turns an npm install behavior that runs automatically today into one you explicitly opt into.” 

Specifically, the post said, “allowScripts defaults to off: npm install will no longer execute preinstall, install or postinstall scripts from dependencies unless they are explicitly allowed in your project. This includes native node-gyp builds; a package with a binding.gyp and no explicit install script still gets blocked, because npm runs an implicit node-gyp rebuild for it. Prepare scripts from git, file, and link dependencies are blocked the same way.”

Analysts, consultants, and users generally applauded the change, but said that it would only narrow the exposure to supply chain attacks instead of eliminating it. 

Attacks likely to move elsewhere

Sonu Kapoor, maintainer for CVE Lite CLI in the OWASP Incubator Project, said that this change is likely to force the supply chain attacks that leveraged the automatic execution to move elsewhere.

“This does not eliminate npm supply chain risk, it removes a major automatic execution path,” Kapoor said. “Attackers can still move to other paths: malicious package code that runs at application runtime, compromised maintainer accounts, dependency confusion, typo-squatting, poisoned GitHub Actions workflows, malicious transitive dependencies, or stolen publishing tokens. This closes one very dangerous door, but it does not secure the whole house.”

Still, attacks leveraging the setting have been regularly used in supply chain attacks. 

However Alan Parkinson, director of secure medical device firm Threat Detective, said more sophisticated attackers have already moved beyond this hole. 

“The install script attack vector has been known for years,” Parkinson said. “Most security teams marked it as low risk and moved on to higher risk threats. What raised its profile wasn’t the technical exploitability changing, it was a run of high-profile victims and some threat actors openly chasing notoriety.”

He added, “the pre and post install scripts was never a clever attack vector to begin with. Running code from an install hook is crude and noisy, which is why it caused such visible damage. The more capable actors are already moving to other methods, so v12 mainly shuts the door on less sophisticated threat actors.”

Although GitHub declined an interview, Zach Steindler, a GitHub principal engineer, answered questions by email. He said the volume and pace of supply chain attacks forced the default settings change. 

“We’ve seen attackers target these capabilities to quickly propagate attacks from one compromised package to many. Years of security and usability research have shown that it’s not enough to make secure functionality available; the secure path has to be the default in order for it to be widely adopted,” Steindler said.

He added, “we believe that these changes are a great way to provide high impact secure defaults while still providing the option for some users to fall back on functionality they might need in some circumstances.”

Change overdue

Sanchit Vir Gogia, chief analyst at Greyhound Research, said that GitHub was the last of the repositories to make the setting default change. “Rivals moved first: Yarn, pnpm and Bun all block third party install scripts by default in their own ways,” Gogia said. “Npm is not inventing a new doctrine. It is finally adopting one.”

Steindler didn’t dispute Gogia’s comment. 

“It’s not easy being the stewards of the largest package repository in the world. Community consensus on what security capabilities should be standard, and when it’s okay to make breaking changes shifts over time. From our continual conversations with the community, it was clear it was time to make this change,” Steindler said.

“The recent attacks are alarming,” he noted, “but stewarding these package repositories is a multi-decade effort, not just a moment in time. As attacks evolve, so will our defensive security capabilities. We’re in this for the long haul.”

Gogia said that the change, although overdue, is a good one. 

“Npm is removing one of the most comfortable hiding places for software supply chain risk: code that executes the moment a developer types install,” Gogia said. “With npm v12, execution becomes something that must be approved, recorded in the project, and committed for review. That is not a design adjustment. It is a change in control philosophy.”

Bad defaults become infrastructure

Gogia had his own take on why GitHub waited so long.

“Npm waited because its risky default acquired a constituency. As far back as 2016, npm’s own position was that the convenience of install scripts outweighed the worm risk, with an opt-out flag for the cautious. The trade-off was a documented product decision, not an oversight,” he said.

“The trouble with bad defaults is that they become infrastructure,” he added. “Native module builds, browser installers such as Playwright and Cypress, Electron download flows and Husky hooks all grew around automatic execution. Turning it off became less a technical adjustment and more a constitutional reform.”

Liability changed hands

The real pressure for the change, however, came from regulators.

“The deeper answer is that the liability changed hands. Once regulation such as the EU Cyber Resilience Act and securities disclosure rules placed supply chain failure on corporate balance sheets, a documented unsafe default became indefensible,” Gogia said. 

Kapoor agreed that long-used procedures enabled this security hole to survive longer than it should have. 

“The reason this likely was not done long ago is compatibility,” he said. “Install scripts are not only used by attackers. Many legitimate packages use them to compile native modules, download platform-specific binaries, generate files, or complete setup steps. Changing the default breaks assumptions that have existed in the npm ecosystem for years. That is why these security changes often arrive slowly. The safer default is obvious from a security perspective, but painful from an ecosystem compatibility perspective.”

In addition, he noted, “the bigger point is that package managers are moving from implicit trust to explicit trust. That is the right direction. Developers should have to approve which dependencies are allowed to execute code during install. But approval cannot become a blind checkbox. Teams need visibility into which package wants to run a script, whether it is direct or transitive, why it is there, and whether it belongs in the project at all.”

Kapoor added that this change matters because install-time execution often happens in privileged environments with access to tokens, secrets, internal registries, build artifacts, or deployment paths. “Even if the script does not compromise production directly, it may be able to steal enough context to support the next stage of an attack,” he said.

Value in the pain

Cybersecurity consultant Brian Levine, executive director of FormerGov, agreed that the closing of this security hole is a very good thing. 

“It seems like virtually every major supply chain attack of the last decade has had the same original sin: code that ran automatically because the ecosystem let it. Npm finally closing that door by default is overdue, but it’s genuinely significant. This is the package manager for hundreds of billions of downloads a month,” Levine said.

“When npm changes its defaults, it changes the security posture of practically every enterprise dev environment on the planet. It may have been the last large code repository to still allow this kind of automated execution.”

Levine added that this change might not merely stop a security hole, but the new process may meaningfully improve security. 

“There’s actually something valuable buried in this migration pain. Having developers explicitly approve which packages can run code and commit that list to source control is a form of software supply chain governance that many organizations never had,” Levine said. “It creates an auditable record which is meaningful, especially for regulated industries.”

This article originally appeared on InfoWorld.

Walk into almost any boardroom this year, and the agenda is identical: How do we close the AI gap? Leaders are projected to spend billions to ensure their workforce doesn’t fall behind. They are confident. They are aggressive. And, in most cases, they’re failing.

According to Mercer’s 2026 Global Talent Trends study, 63% of executives view AI work redesign as their highest-return investment. But only 32% say their workforce is actually ready. The response to this disconnect is a predictable reflex: throw more money at training.

But training is a multiplier, not a foundation.

If you give an employee with the right foundational skills targeted instruction, the gap closes quickly. But if you give that same instruction to someone whose underlying behavioral profile doesn’t fit the redesigned role, you aren’t “upskilling.” You’re simply creating a person with an expensive certificate doing the exact same job they did yesterday.

The reason this cycle persists is that we are investing in the “how” without a clear picture of the “who.” Resumes are just history. Performance reviews reflect yesterday’s requirements. And AI “fluency surveys”? They mostly measure how a person feels about a tool they’ve likely only used three times.

None of these inputs tells a leader who has the adaptability or the learning orientation to thrive in a redesigned role. So, the training is rolled out indiscriminately, the results come back uneven and the C-suite is left wondering why the needle hasn’t moved.

The problem isn’t the training. It’s the sequence.

Consider a maintenance supply distributor I observed. They were under immense pressure to grow sales following a major acquisition. Rather than rushing into a massive training rollout for new account managers, they stopped to build a predictive model. They identified the specific behavioral patterns that separated their top performers from the rest.

When they eventually deployed the training, they didn’t do it blindly. They matched the coursework to the specific gaps they had measured. The results weren’t just “better,” they were transformative. That group drove 20% more in net sales, translating to an extra $89,000 in revenue per employee. That wasn’t a “new” investment. It was money already in the budget, being spent on the right people.

This is the step the majority of organizations are skipping. Mercer reports that nearly every executive (98%) is planning an org redesign in the next two years. Most of these will be drawn up in a vacuum, devoid of any real measurement of the people expected to execute them.

I’ve sat in rooms with HR leaders who are terrified of assessment because they fear it feels cold or clinical. But there is nothing colder than setting an employee up for failure by forcing them into a role that doesn’t align with their natural strengths. When we skip the diagnostic phase, we aren’t being people-first. We are being process-first. True empathy in the age of AI means knowing your people well enough to know exactly where they will shine, rather than asking them to guess.

The cost of this oversight isn’t just a line item on a P&L. It’s a trust killer. According to Mercer, workforce “thriving” is at a decade-long low. Employees are already anxious about AI. When we ask them to absorb redesigned work based on executive assumptions rather than evidence, we create a retention crisis before we see a productivity gain.

It is time to stop treating AI literacy as a spray-and-pray exercise.

Flip the script. Stop treating work redesign as a planning exercise that ends when the org chart is approved. Instead, measure first, redesign second, train third and communicate throughout.

And stop conflating technical skills with fit. A skills inventory tells you what people have done in a world that no longer exists. A soft skills assessment tells you who is built for the world that’s coming.

AI is forcing a pace of change that most companies are unprepared for. Spending heavily on training without first understanding the workforce being trained isn’t “moving fast.” It’s just expensive guesswork.

Before you sign off on your next round of role changes, ask: Have we actually measured the people we’re asking to change? If the answer is no, you’re just flipping a coin.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Every CIO I talk to — and I talk to a lot of them — agrees that skills-first hiring makes sense. And with AI now embedded in nearly every stage of the hiring process, from resume screening to candidate matching, many assume the technology will finally make it happen at scale.

It won’t. AI can accelerate hiring decisions, but it can’t fix the underlying systems that power those decisions.

Despite initial progress in removing college degree requirements from job postings, many organizations are still getting it wrong — and AI is giving them new ways to get it wrong faster. Agreeing on a principle isn’t the same as operationalizing one. Even when there’s a skills-first hiring strategy in place, execution fails if IT, HR and business leaders aren’t aligned on outcomes, accountability and measurement. When AI screening tools are layered on top of misaligned systems, the result isn’t smarter hiring; it’s automated bias with a veneer of objectivity.

Why skills-first hiring became a buzzword

The idea of prioritizing skills in hiring decisions isn’t new. Competency-based hiring has been discussed in talent management circles since the 1970s. Over the last two decades, the growing technology skills gap, the explosion of non-traditional learning pathways and the broader recognition of “degree inflation” pushed skills-based hiring into the mainstream. Large employers publicly dropped degree requirements. States followed. Everyone was buzzing about skills-first hiring.

But buzz doesn’t change systems. Data from Indeed showed a decrease in job postings with college degree requirements between 2019 to 2024, but by November 2025, the number swung back up, nearly erasing the gains of the previous five years. 

Meanwhile, the skills that matter most now — prompt engineering, AI tool fluency, the ability to scope and complete AI-augmented projects — are being developed outside traditional degree programs. That makes degrees an even worse proxy for career readiness.

Announcing that an organization is “skills-first” without redesigning the infrastructure that surrounds hiring — job descriptions, applicant screening, recruiter training, interview rubrics and onboarding frameworks — doesn’t change practices. A recent survey by the University of Phoenix found that 69% of hiring decision makers believe there’s still too much focus on college degrees, with little clarity on what they should evaluate instead.

The 3 most common failure points

From my experience in working with CIOs on their entry-level talent pipelines, skills-first initiatives tend to break down in one or more of these places: job descriptions, screening tools and internal skepticism.

First, take job descriptions. Hiring managers tend to default to historical templates — pasting in degree requirements and years-of-experience thresholds that were never validated against actual job performance and are even less relevant with AI in the mix.

Second, screening tools. Nearly 90 percent of companies are using some form of AI to screen candidates, expecting greater efficiency and less bias. But AI screening tools learn from existing hiring data — which, if biased, just means that bias is now automated. Patterns in successful candidates’ backgrounds get baked into future decisions, except now, these decisions appear “data-driven” and neutral instead of more obviously predicated on certain hiring managers’ preference for college graduates.

The third failure point is internal skepticism — and the training gap that feeds it. According to the survey by the University of Phoenix, one in four non-HR managers receives no training before interviewing job candidates, even when the final hiring decision is theirs. Without shared definitions of what “skills-first” means and clear accountability, the initiative collapses under the weight of individual discretion.

What CIOs see that others miss

CIOs are often closer to the consequences of a bad hire than anyone else in the C-suite. When a cybersecurity analyst freezes during an incident response, the CIO gets a front-row view of the damage a skills gap can cause.

CIOs are also watching AI redefine what “qualified” looks like in real time. The engineer who deploys an agentic AI system to automate monitoring, or the analyst who chains multiple AI tools into a custom workflow — these people deliver outsized value, and their qualifications often look nothing like what a traditional job description demands.

And CIOs have a keen understanding of issues with tech talent pipelines. Projects slip while niche technical roles sit open for six months or more, even as candidates from rigorous programs — people with the specific skills for the job — are filtered out.

How successful CIOs operationalize skills-first hiring

Successful CIOs get specific. They work with their teams to define exactly which skills matter for each role — and they validate those definitions against the performance of current, thriving employees.

Should that taxonomy include demonstrated experience with AI tools and platforms: Has the candidate built or deployed an AI agent? Can they work across multiple AI tools? Have they completed projects requiring AI-augmented problem-solving? These concrete, observable skills predict performance far more than a degree ever could.

Second, they establish shared metrics across IT and HR. Organizations that get this right track 90-day performance reviews, first-year retention and promotion velocity alongside traditional recruiting metrics. In its New Collar Program with Sentara Healthcare, TEKsystems worked with company leaders to fill open big data positions through a skills-based cohort model and achieved 80% retention one-year post-training.

Third, these CIOs build direct relationships with employer-aligned training pipelines before a role opens. Bank of America invested nearly $40 million in workforce development initiatives in 2025 alone and partnered with more than 600 nonprofits across the US.

At Per Scholas, our head of IT, Tyrone Washington, makes it clear that while technical skills might get you through the door, it’s “smart skills” — discernment, emotional intelligence, complex problem-solving and agility — that build a career in an AI-driven landscape.

What the data shows

Skills-first hiring, when paired with structured onboarding and development pathways, is not just a talent acquisition strategy — it’s a retention strategy. And higher retention contributes directly to the bottom line, as the fully loaded cost of replacing a technical employee ranges from one to two times their annual salary.

In one employer partnership deploying skills-trained talent, a TEKsystems client came out $238,000 ahead in the first year after accounting for program costs, with a projected annual return of over $1.2 million. IT leaders reported that skills-trained talent becomes productive measurably faster than early-career hires from conventional pipelines.

How CIOs can lead the Shift — even without owning HR

CIOs who are moving the needle are piloting skills-based hiring for one or two roles, tracking outcomes rigorously and using that data to make the case for broader adoption. They’re building external partnerships before they need them. Bank of America, a Per Scholas long-term partner, knows that our graduates are team players, lifelong learners and motivated employees; our graduates’ certifications (through CompTIA and Google) validates that they have the technical know-how.

Every quarter that technical roles sit open has a measurable impact on project delivery, team capacity and competitive positioning. Surfacing these costs — backed by data — is something CIOs are uniquely positioned to do.

The bottom line

Skills-first hiring will remain a well-intentioned abstraction unless CIOs treat it as an operating model — one that reflects how AI is reshaping the skills organizations need.

The candidates who can demonstrate hands-on experience in building and deploying AI agents, integrating multiple AI tools into a workflow or evaluating when AI can help are the ones who will drive value. But they’ll keep getting filtered out unless CIOs get specific about skill definitions, align IT and HR around shared metrics, and build employer-aligned pipelines. Bank of America and TEKsystems didn’t achieve their results by endorsing a principle — they achieved them by building systems.

Luckily, building systems is something that CIOs know how to do well.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Business email compromise (BEC) is still thriving even in organizations that have implemented multi-factor authentication (MFA). As security professionals, we often assume that MFA is the silver bullet for email security, but real-world incidents suggest otherwise. Attackers exploit human behaviors, process gaps and operational blind spots that MFA alone cannot address. In many modern BEC cases, no account is technically compromised at all, which places these attacks outside the protection boundary of MFA controls.

In 2019, Toyota Boshoku Corporation fell to a BEC attack with an employee transferring over $30m to scammers following a cloned email from a 3^rd party company with urgency citing the need for the transaction to be completed urgently so as not to slow down Toyota’s production line. There was no indication that the Toyota employee’s email had been compromised. Take also the 2024 case of Arup where attackers impersonated a senior manager using Deepfake voices and videos and convinced a member of the finance team to make payments totaling $25m. The compromise did not rely on stolen credentials but on carefully orchestrated social engineering, timing and the finance team’s procedural shortcuts.  The technical safeguards could have been strong, but human oversight proved to be the weakest link. In both cases, the failure occurred at the decision point, not at the authentication layer, exploiting trust, timing and established, convenient, approval habits.

Where security controls end and business risk begins

From experience, this scenario is all too common. Organizations often focus on deploying security technology without addressing human workflows and culture. This often includes shiny new EDR technology which are used to check boxes for audit and compliance purposes, and which CIOs are quick to sign off on to show stakeholders they are cyber resilient. This is not a failure of EDR itself, but of how security investments are scoped. Endpoint and identity controls protect systems, but they do not govern how financial approvals, vendor changes or executive requests are validated in practice.

MFA reduces risk but cannot replace the need for process controls, verification routines and continuous awareness training especially as there are now AITM phishing kits which bypass MFA in the wild. The operational blind spots being exploited sit in business workflows where speed, trust and authority override verification, particularly in finance and procurement processes.

These blind spots exist because business processes are optimized for speed and continuity, not verification. Finance teams are trained to keep operational lines moving, and attackers who have now taken cognizance of this, use this advantage to their own advantage by introducing urgency or invoking authority. When a request appears legitimate, time-sensitive and from someone with perceived authority, employees often follow familiar patterns rather than pause to challenge intent. This is not a failure of technology, but a failure of process design.

Practical steps for IT leaders include redesigning approval workflows so that high-value transactions require multi-step verification including out-of-band call to confirm, simulating BEC scenarios in realistic exercises to identify gaps in response and decision-making, embedding security awareness into daily routines using micro-learning and real incident reviews, and empowering teams to challenge unusual requests without fear of reprisal. Instances of successful attacks can also be shared with employees who distribute invoices, financial documents or oversee making decisions regarding transfers

Designing approval workflows that thwart BEC attacks

Redesigning approval workflows means explicitly defining what constitutes a high-risk request, such as first-time payments, changes to vendor banking details, sudden payment requests from an executive or requests that bypass standard procedures. These requests should require independent verification using known contact details, not information provided in the email itself.

When reviewing and redesigning approval workflows, organizations should begin by asking salient, hard, operational questions at the decision-making point. Does this request align with how payments are normally initiated/approved? Is the requester the typical communication channel and tone? Has this vendor or account been paid before, and under similar circumstances? Does the email tally with the one on the sender’s company website without alterations? Is there a different reply-to email visible? Can a quick call to confirm be made? Teams should also ask what assumptions are being made under time pressure, whether authority is being inferred rather than verified, and who is accountable if the decision turns out to be wrong. These questions force employees to slow down, recognize deviations from normal behavior and treat unusual requests as potential security events rather than routine business tasks.

Simulating BEC transcends phishing tests and should mirror real business scenarios, including urgent executive requests or supplier payment changes, allowing organizations to observe how staff respond to pressure and ambiguity. Effective simulations introduce urgency, impersonate authority figures with typosquatted emails and exploit realistic business contexts such as end-of-quarter payments, supplier changes and times of the year when attackers like to strike such as festive periods and before holidays. Participants are observed on how they verify requests, whether they escalate concerns and how quickly they move to execution without confirmation. The outcome is not a pass or fail score but can provide insight into where processes encourage compliance over caution. These simulations allow organizations to refine approval rules, reinforce escalation paths and normalize verification as part of everyday operations.

Empowerment must be formalized through policy, making it clear that pausing or escalating a suspicious request is expected behavior, not an obstacle to productivity. Staff who report suspicious requests also should be encouraged and used as good examples in internal communications where possible.

Using friction and alerts in workflows

Insights from cross-border operations is that attackers exploit time pressure and executive assumptions often seen in CEO/CFO themed fraud. Teams often follow cues from perceived authority, scoped by attackers from email flows and urgency often attached to making large payments, tying them to critical business needs. By implementing friction in critical workflows such as mandatory pauses for large transfers or automated anomaly alerts, organizations can reduce risk without hampering productivity

Effective friction does not mean indiscriminately grinding the business or its process to a halt. Mandatory pauses for large or unusual transfers create space for verification and reduce impulsive decisions and actions. During these pauses, specific actions should occur, such as email/signature checks, verbiage, secondary approval, independent confirmation or automated checks against historical payment behavior as stated above.

Automated anomaly alerts are only useful when they focus on deviations that matter and are tied to clear response expectations. Alerts should prioritize scenarios such as out-of-hours payment requests, changes to established vendor details or transfers that fall outside normal patterns. Ownership of BEC-related alerts should sit with teams that control financial decisions, such as finance operations, fraud risk units or cross-functional payment risk groups that combine security and business authority, rather than being routed exclusively to noisy SOC queues.

To reduce false positives also, the concept of enhanced monitoring for priority accounts should also be introduced. This can be made better by routing emails containing specific payment keywords to these risk groups to evaluate before landing in the intended inboxes.

What security leaders should change now

BEC continues to succeed because human decision points are rarely treated as security-critical systems. MFA, email filtering and endpoint protections remain necessary, but they do not control how people make decisions under pressure. Until financial and executive workflows are designed with the same rigor applied to technical systems, attackers will continue to exploit the impact of human behavior on cybersecurity with social engineering and human weaknesses at the top of the pile.

Added to this, there should also be clear ownership of BEC risk at the leadership level. If no single role is accountable for payment verification failures, responsibility defaults to frontline staff under pressure who often bear the brunt of being sacked or prosecuted following successful BEC attacks. Assigning ownership to finance leadership, risk committees or cross-functional governance groups ensures that process failures are treated as systemic issues rather than individual mistakes.

Although equally important, leaders should not measure success solely by the number of blocked phishing emails, but by how often verification steps are followed, how many payment requests are challenged and how quickly suspicious transactions are paused and reviewed.

In conclusion, security leaders who reduce BEC risk align people, processes and technology so that verification becomes routine, hesitation is acceptable and authority is never assumed without confirmation. In 2026 and beyond, business workflows should continue to be treated as a core part of the security architecture and not a peripheral component.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Sixty-six million years ago, an asteroid wiped out 75% of species on Earth. Octopuses survived, however, because of their ability to radically adapt their biology in hours, not eons. Today, SaaS companies face their own asteroid: AI. And the octopus points the way to survival.

We see the signs in the firms that are thriving today. When Upwork Senior Vice President Dave Bottoms rebuilt the company’s AI stack, he made a counterintuitive choice. Rather than optimizing for today’s best model, he architected for disposability.

“What we think is the best model today may not be the best model tomorrow,” Bottoms explains. His team built an “optionality layer” that lets them swap AI models like changing batteries.

As Bottoms recognized, AI is evolving faster than SaaS architectural cycles, and rigid AI implementations are becoming legacy systems the moment they ship.

Design for your customers’ jobs, not your technology

The fatal mistake many SaaS companies make with AI is starting with what the technology can do rather than what customers need it to do. Aarthi Ramamurthy, chief product officer at CommerceHub (now Rithum), begins differently. “I start with empathy,” she says. “I know what the retail ecosystem goes through and all the complexity in it.”

That empathy led CommerceHub to focus AI on a deceptively simple problem: supplier onboarding. When one company calls a sweater pink and another calls it fuchsia, manual matching creates friction.

But Ramamurthy’s team didn’t just throw AI at the problem. They mapped the specific “Jobs to Be Done”—such as getting suppliers connected faster with fewer errors—and then selected the right AI approach, starting with simple algorithmic matching before layering in machine learning for demand prediction.

Contrast this with an all-too-typical approach: We’ve got LLMs, let’s find somewhere to use them. Sushma Kittali-Weidner, former chief product officer at Rheaply, frequently sees this mistake. She explains: “People are looking for magic but not thinking enough about how AI can create efficiencies in existing processes.”

Enable octopus organizations

The most valuable thing SaaS companies can do with AI is enabled by the technology, but much bigger: Helping customers distribute intelligence and authority throughout their organizations. Allow them to be like the octopus, which has two-thirds of its neural tissue outside its central brain. Octopus organizations move faster and more responsively because decisions get made closer to the frontline.

SaaS company Movable Ink’s Da Vinci platform demonstrates this enablement. CEO Vivek Sharma built a system to mass-send hyper-tailored emails by combining vision models, generative AI, insight engines and prediction algorithms.

The platform pushes sophisticated personalization decisions to frontline marketers who previously needed executive approval for campaign variations. The system determines what stories are delivered to customers, which imagery and creative are used, and when, how often and where to deliver them.

This is authority devolution at scale. Each marketer becomes vastly more capable, teaming with AI to make thousands of micro-decisions that would have been impossible under traditional hierarchies. Movable Ink’s customers can now generate hundreds of thousands of email variations where they once created one.

Within one of the world’s largest commerce networks, CommerceHub’s 2.4 billion daily transactions create similar distributed intelligence, pushing supplier matching and inventory decisions to procurement teams. CommerceHub’s AI mines poorly structured data and surfaces patterns that enable frontline employees to act without escalation.

In short, winning SaaS products help customers become octopus organizations—distributed, adaptive and intelligent at every edge.

Break your own silos

The uncomfortable truth is that most SaaS companies can’t help customers become octopuses because they’re not octopuses themselves.

The octopus has a “neural necklace,” a ring of nerve bundles that connects all its arms, enabling instant information sharing among them without involving the central brain. But SaaS companies frequently have broken connections. Just look at customer success and product teams.

Customer success teams hear about where products fail, where workflows create friction and where latent needs go unmet. Product teams have usage telemetry and performance data. When this information flows freely between teams, you create extraordinary sensing capability. But typically, these teams have separate reporting lines. They exchange sanitized summaries while critical signals vanish.

CommerceHub’s Ramamurthy addressed this by starting AI deployment on internal insights dashboards before adding it to external features. This created shared understanding across functions. When customer success, product and engineering teams access the same AI-generated insights about customer behavior, they develop a common language and aligned priorities.

Build for continuous transformation

The octopus can reconfigure its RNA in hours, adjusting biological processes faster than evolution allows. This is how it’s survived for 300 million years without external defenses. SaaS companies need to adapt at a similar speed because AI capabilities shift weekly.

Kittali-Weidner experienced this. Her team at Rheaply was resource-constrained and couldn’t afford over-engineering, so they designed modular AI implementations that could evolve without massive refactoring. The research and prototyping process that once took weeks now happens in real-time co-creation sessions. That’s a true competitive advantage.

On-demand adaptation demands a new team composition. You need engineers who embrace disposable code, product managers who ship features knowing they’ll be replaced in months, and executives willing to deprecate yesterday’s breakthroughs for tomorrow’s improvements.

Design for the 80/20 rule

SaaS companies stumble by automating too little, leaving AI as a novelty or automating too much, triggering resistance. At Upwork, Bottoms has learned that “80% of the work can be automated, but the last 20% still requires human judgment.” Upwork’s AI, for example, generates job posts and proposals, but humans make the hiring decisions.

Similarly, Movable Ink succeeds by making AI suggestions initially optional and editable. Users see value while maintaining control. Only after establishing trust does the system shift toward AI-as-default.

Adapt for the future

The octopus teaches us that survival belongs to the adaptable.

Externally, your product must help customers become octopus organizations: Distributing intelligence, devolving authority and adapting rapidly. Internally, you must become an octopus yourself: Connecting information across silos, building for continuous transformation and balancing autonomy with coordination.

The AI asteroid is already here. Become an octopus and thrive.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Yet that is precisely how most organizations are deploying AI coding agents today. The prevailing narrative around “AI-powered development” frames these systems as productivity tools. Vibe-coding and agentic coding are considered something closer to a faster autocomplete or a more sophisticated IDE plugin. Flip the switch, the story goes, and suddenly your engineering organization becomes dramatically more efficient. Everyone is “all in” on the first hand of cyber-Texas Hold ’Em. That mental model is wrong.

AI coding agents are not tools. They behave far more like junior developers: Capable, energetic, sometimes brilliant, but absolutely capable of causing catastrophic damage if given autonomy before they understand and respect the environment they’re operating in.

The organizations that treat AI coding agents like tools will create and accumulate technical debt at unprecedented speed. The organizations that treat them like junior engineers by onboarding them as talent, pairing with them and teaching them context will unlock the productivity gains everyone is chasing. The difference between those outcomes is not the technology. It is the management model.

The lesson every engineer learns early

Midway through the DevOps phase of my career, I worked at the CME Group, where the exchange operates one of the most critical financial infrastructures on the planet. The CME processes roughly a quadrillion dollars’ worth of contracts annually and, at the time, ran across five datacenters with more than 10,000 servers, including racks of Oracle Exadata systems costing hundreds of thousands of dollars each. The biggest SIFI of SIFIs.

You did not get root access to that environment on day one.

Instead, you were paired with a mentor. Your mentor was part of a buddy system for onboarding new hires and was effectively a docent for the infrastructure. My mentor was a deeply technical manager named Matt, one of the most capable engineers I have ever worked with. His job wasn’t simply to show me which commands to run or where to find documentation. His job was to teach me how to ask the platform, a system of systems, meaningful questions.

When you’re managing infrastructure at that scale, every question returns thousands of answers.

• Are the matching engines pinned correctly to CPU cores?
• Are cgroups configured properly for workload isolation?
• Which RAID arrays are starting to show drive failures?
• Are firmware and BIOS versions aligned across production and QA?

None of this can be learned through a quick tutorial or a training video. You learn by doing. You learn by working through the ticket queue, performing dry runs, preparing rollback plans and executing changes within narrow maintenance windows (a few minutes per week).

The lesson wasn’t simply technical. It was epistemological. Engineering expertise is not about knowing commands. It is about knowing which questions matter and how to understand the response. And that knowledge only develops through mentorship, iteration and experience.

Why the pair-programming model matters

The software industry already solved this problem decades ago through a practice called pair programming. In agile teams, a senior developer pairs with a junior one. They work together on the same problem in real time. The junior developer contributes energy and fresh thinking, while the senior developer contributes experience and judgment. The result is faster capability development without sacrificing quality. At first, it might seem an expensive allocation of resources, but when you think it through, it is really a strong knowledge management technique.

AI coding tools are like a super smart baby, a nascent intelligence that is as eager as any recent college graduate, but without much in the way of real-life experience solving real-world problems because it cannot rely on a body of lived experience and hard-won lessons in software development, release engineering and debugging. That description should sound familiar. It is essentially the profile of a junior developer.

The implication is obvious once you see it: the most effective deployment model for AI coding agents is the same pairing model that works for human developers. Human plus agent.

Not a human supervising an agent after the fact. Not just a human reviewing pull requests from an automated pipeline. But genuine co-development, with contextual education on why the vulnerability should not be introduced in the first place. When that pairing works, the productivity gains are real. When it doesn’t, you ship vulnerabilities faster than your security team can ever hope to triage them.

What the agent gets wrong first

The first time I worked alongside a coding model on a real security problem, the mistake it made was subtle but revealing. I was experimenting with ways to harden an API without introducing latency or complexity on the client side. The goal was to produce a transparent security uplift that improved the API’s defensive posture without forcing developers to substantially change how they interacted with the service.

The model generated plausible suggestions quickly. Too quickly. Some of the techniques it proposed were technically correct but operationally obsolete. Others referenced security mechanisms that had been deprecated. Still others ignored non-functional requirements around compliance or performance. In other words, the model surfaced relevant information but lacked the judgment to distinguish wheat from chaff. 

There is also a tendency to accept the legitimacy of the ask rather than questioning the assumptions and baseline parameters of the situation. The agent is not going to think outside the box (unless it is hallucinating a nonexistent function or package/library that solves the problem). It assumes that the question being asked for it to try to solve is a legitimate and valid question or problem to be solved.

Humans develop that discernment over time. It’s part of how we move from data to information to knowledge to wisdom. What information scientists have called the DIKW pyramid.

Models don’t struggle their way up that pyramid. They jump directly to conclusions. The struggle, however, is a messy process of trial, failure and iteration, but it is where human experience and knowledge form. That knowledge is then further refined and distilled into wisdom. When that process is skipped, real expertise never develops. This is why treating AI coding agents as tools is dangerous. Tools don’t need to exercise judgment. Junior developers do.

How trust actually develops

Think about the best junior engineer you ever worked with. How long did it take before you trusted them to work independently? Rarely less than months. Oftentimes a year or more.

Trust emerges gradually. It grows from observing how someone works through problems: how they document changes, how they write tests, how they think about rollback procedures and anticipating edge cases and race conditions. In my own teams, I’ve always preferred a management philosophy of 100% freedom and 100% responsibility (Netflix Manifesto circa 2001).

Engineers on my teams are expected to behave like owners of the company. They are indoctrinated to commit infrastructure changes as code. They document their reasoning. They attach testing artifacts to their pull requests. We track progress not just by time spent but by contributions: Commits, documentation, testing evidence and operational discipline.

That process shapes junior engineers into reliable junior engineers. The exact same logic applies to AI coding agents. Trust should expand progressively.

• At first, the agent proposes little code snippets and stanzas.
• Then it drafts functions and packages libraries.
• Eventually, it might implement entire features, but only after proving it understands the environment and the risk appetite of the company.

Skip those steps, and you aren’t accelerating development. You’re accelerating chaos being driven by FOMO and FUD.

Learning from more than one chef

Over the course of my career, I’ve worked across a wide range of industries: dot-com era web development in San Francisco, trading infrastructure in European financial markets, cloud transformations for legacy enterprises and large-scale infrastructure engineering.

Each environment changed how I thought about software and security. The dot-com era taught speed and experimentation. European financial institutions taught rigorous project governance (PRINCE2 anyone?). Large-scale options and commodity exchanges taught what real operational resilience looks like.

Those experiences fundamentally reshaped how I approach engineering problems. AI agents will benefit from the same diversity. Pairing them with multiple engineers and rotating pairings over time will expose them to different coding styles, architectural philosophies and security techniques. Best practices, but not monolithic best practices aggregated and homogenized by token prediction algorithms trained on millions and billions of lines of code. Just as aspiring chefs learn from multiple masters, agents improve faster when exposed to varied expertise.

A warning for CISOs

Many security leaders today are under pressure to reduce developer headcount because executives believe AI can absorb the workload. This assumption misunderstands both security and AI. If an organization already has strong security discipline with well-documented architectures, clear coding standards and mature review processes then AI agents will amplify that core mindset and culture.

But if the organization has weak security habits, AI will amplify those weaknesses even faster. Human knowledge is like sunlight. Large language models are more like moonlight. A mere reflection of that knowledge. You cannot build a thriving ecosystem entirely under moonlight. Sooner or later, you need the sun, despite what the vampires and werewolves howling at the moon might lead you to believe.

The real promise of AI development

None of this is an argument against AI coding tools. Used properly, they are extraordinary collaborators. They can surface patterns across massive codebases, accelerate documentation and help engineers explore alternative designs more quickly than ever before.

But unlocking that potential requires the right mental model. Not as a tool, but as a junior developer. Onboard them. Pair with them. Teach them your systems, regale them with your stories of isolating a bug or race condition that took weeks to pinpoint. Rotate them across your teams. Expand their responsibilities gradually as trust develops.

That investment phase is what transforms AI from a novelty into a genuine multiplier. And like every good mentorship relationship in engineering, the payoff compounds over time. Treat your AI coding agent like a disposable tool and you’ll get disposable code (aka slop).

Treat it like a junior developer and you might just raise up the best engineering partner you’ve ever had.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

A new report from SolarWinds finds that artificial intelligence is reshaping IT roles, with 80% of professionals reporting a shift away from hands-on operations toward overseeing automated systems and workflows.

IT practitioners are increasingly taking on orchestration responsibilities as organizations expand their use of AI-driven tools and automation, according to the 2026 SolarWinds IT Trends Report: The Human Side of Autonomous IT. The findings are based on a survey of 1,048 IT professionals examining the benefits and challenges of AI adoption in enterprise environments.

“Eight out of 10 IT practitioners agree that technical staff are moving from being operators to being orchestrators—less time executing tasks, more time governing the systems, workflows, and AI tools that execute on their behalf,” the report states.

The gap between perception and experience

The report identifies a disconnect between executive leadership and technical staff on AI readiness. Nearly half (47%) of C-suite respondents say their organizations are “extremely prepared” for AI-driven changes, compared with 13% of technical contributors.

At the same time, respondents report measurable benefits from AI in day-to-day IT operations:

• 65% cite reduced manual effort
• 61% report faster root-cause analysis
• 49% say AI improves decision-making confidence

Yet those gains are accompanied by increased demands. Seventy-one percent of respondents say AI has made their roles more demanding, driven in part by the need to verify AI-generated outputs and manage associated risks. And trust remains a key issue. The report finds that 71% of IT professionals need to double-check AI outputs, while 62% report difficulty trusting AI recommendations. AI adoption also varies across organizations. Half of respondents (34% somewhat, 16% fully) say their organizations have embraced AI, while 37% report resistance, often tied to infrastructure, budget, or complexity challenges.

The report indicates that IT roles are becoming more strategic and automation-driven, with 52% of respondents citing increases in both areas. Roles are also becoming more cross-functional (47%) and complex (41%), reflecting the integration of AI into broader business processes. AI is also affecting how IT teams allocate time. Respondents report spending more time on proactive activities such as strategizing and analyzing system performance, while some reactive tasks, including troubleshooting incidents, are decreasing.

Governance, training, and data challenges

The report highlights several areas organizations must address to support AI adoption. More than half of respondents (56%) say clearer AI policies and guardrails would help them adapt, while 50% point to the need for formal training.

Data quality is also a key factor. Eighty-three percent of respondents say AI effectiveness depends on the breadth and quality of the data available to it. Respondents also cite issues such as tool fragmentation and lack of integration as barriers to effective AI use.

Respondents said they expect AI and automation to play a larger role in IT operations. More than three-quarters (77%) say their organizations will become more proactive over the next two to three years, supported by increased automation and data-driven insights. At the same time, organizations expect to encounter challenges, including skills gaps, governance requirements, and ensuring the accuracy and reliability of AI-driven systems.

“AI is not making IT simpler—it’s making it more consequential,” said Krishna Sai, chief technology officer at SolarWinds, in a statement. “The teams thriving in this environment are not usually the ones with the most AI tools. Instead, those who are building the governance and structure to actually trust them are seeing the greatest results.”

Generative AI has revolutionized the space of software development in such a way that developers can now write code at an unprecedented speed. Various tools such as GitHub Copilot, Amazon CodeWhisperer and ChatGPT have become a normal part of how engineers carry out their work nowadays. I have experienced this firsthand, in my roles from leading engineering teams at Amazon to working on large-scale platforms for invoicing and compliance, both the huge boosts in productivity and the equally great risks that come with GenAI-assisted development.

With GenAI, the promise of productivity is very compelling. Developers who use AI coding assistants talk about their productivity going up by 15% to 55%. But most of the time, this speed comes with hidden dangers. To name a few, AI-generated software without good guardrails could open up security issues, lead to technical debt and introduce bugs that are difficult to detect through traditional code reviews. According to McKinsey research, while GenAI tools allow developers to be more productive at a higher level but also require rethinking of software development practices to maintain code quality and security.

The answer is not to abandon these awesome tools altogether. In fact, it is about combining them with reliable engineering practices that the teams already know and trust. In fact, the proper application of traditional Agile methodologies generates the precise guidelines that allow you to benefit from GenAI while also controlling its hazards. In this article, I consider the five basic Agile methodologies: Test-driven development (TDD), behavior-driven development (BDD), acceptance test-driven development (ATDD), pair programming and continuous integration together provide the guardrails to GenAI development, not just to make it quicker, but also of higher quality.

The GenAI code quality crisis: Real-world issues

Before we jump into solutions, it is worth naming the problem. The issues with AI-generated code aren’t theoretical. They’re appearing in production systems across the industry:

• Security vulnerabilities: In 2023, researchers at Stanford found that developers using AI assistants were more likely to introduce security vulnerabilities into their code, particularly injection flaws and insecure authentication mechanisms. A study published in IEEE Security & Privacy demonstrated that GitHub Copilot suggested vulnerable code approximately 40% of the time across common security-critical scenarios. At one major financial institution, an AI-generated SQL query bypassed parameterization, creating a critical injection vulnerability that wasn’t caught until penetration testing.
• Hallucinated dependencies: AI models sometimes generate suggestions for libraries, functions or APIs that don’t exist. A group from a healthcare company invested three days in finding the bug in their microservice compiling issue, only to learn that the AI had suggested a nonexistent AWS SDK method. The code seemed legitimate, went through the first review, but the method signature was completely made up.
• Subtly incorrect business logic: Most misleading of all are mistakes in the business logic that look good on the surface but have subtle defects in them. For example, we came across a line, item tax calculation on an invoice that was AI-generated, which looked perfect, but upon close inspection, it was discovered that rounding was applied at the level of each item rather than at the level of the subtotal. While a brief inspection of the logic indicated that it was correct, the difference in the sequence of rounding would have resulted in the final invoice totals being different from the legal requirements for tax reporting, thus leading to compliance risks and reconciliation errors from millions of transactions.
• Technical debt accumulation: AI tools focus on producing working code rather than maintainable code. They frequently recommend very nested conditional logic, duplicated code patterns and excessively complex solutions when simpler alternatives are available. Gartner research warned that without strong governance, early GenAI adopters can accumulate cost, complexity and technical debt.
• Compliance and licensing issues: AI models trained from public code repositories can, at times, generate code that is basically a copy of the code with certain licenses that are incompatible. For industries that are heavily regulated, such as healthcare and finance, this kind of situation poses very serious risks of noncompliance. A pharmaceutical company, as an example, came across AI-generated codes that were very similar to the GPL-licensed open-source software and if the company relies on such a platform, it would be legally exposed.

The root cause: Speed without clear specification

These problems arise from the same root, which is AI producing code based on patterns it has seen, without real understanding of requirements, context or whether the code is correct. It works on probability, for example, “what code pattern from the prompt is most likely” rather than correctness or suitability for the particular case.

Traditional code review, although essential, is not enough to protect against errors from AI-generated code. Most people find it difficult to spot subtle errors in code that looks legitimate and the volume of AI-generated code can easily overwhelm the review capacity. We must have automated, systematic methods that check correctness and not just quick visual inspection.

Agile practices as GenAI guardrails

One can find the answer in the methods that have been around for a long time, even before GenAI, and yet they are great at fixing its flaws. Every one of these methods provides a different type of safety net:

1. Test-driven development (TDD): The correctness validator

The TDD cycle, Red, Green, Refactor provides the most direct protection against incorrect AI-generated code. By writing tests first, you create an executable specification of correctness before the AI generates any implementation.

How it works with GenAI:

• Red: Write a failing test that specifies the exact behavior you need. This test becomes your requirement specification in executable form.
• Green: Ask the AI to generate code that makes the test pass. The AI now has a clear, unambiguous target.
• Refactor: Use AI to suggest improvements to the working code while ensuring tests still pass.

Real-world impact: We applied very strict TDD alongside GenAI-assisted development. Before developers accept any AI suggestions, they should write extensive unit tests that detail all the aspects. This caught a critical line-item tax calculation error, while the AI suggested a simple multiplication that “looked” correct, the test specifically checked for legal rounding requirements (rounding at the subtotal level rather than the line level). Because the test specified these precision requirements, the AI’s initial code failed immediately. Without TDD, this discrepancy would have reached production, resulting in significant compliance risks and revenue reconciliation failures.

Moreover, TDD solves the problem of hallucination of dependencies. For example, if AI offers a method or a library that does not exist, the test will not be able to compile or run, thus providing immediate feedback instead of finding out the issue after several days.

2. Behavior-driven development (BDD): The business logic guardian

BDD extends TDD by focusing on system behavior from the user’s perspective using Given-When-Then scenarios. This is particularly powerful for GenAI-assisted development because it creates human-readable specifications that bridge the gap between business requirements and code.

BDD scenarios serve two critical functions with AI-generated code:

First, they provide context-rich prompts for the AI. Instead of asking “write a function to calculate tax,” you provide a complete scenario: “Given a customer in California, when they purchase a $100 item, then the tax should be $9.25.” The AI has more context to generate correct code.

Second, they create executable business logic tests that catch subtle errors humans might miss. The scenarios are written in plain language by product owners and domain experts, then automated using frameworks like Cucumber or Cypress.

Real-world impact: Compliance platform processes invoices across multiple tax jurisdictions. When we started using AI assistance, we first created comprehensive BDD scenarios covering all tax rules, edge cases and regulatory requirements. These scenarios, written by our tax compliance specialists, became the specification for AI code generation. The AI-generated code that passed all BDD scenarios was correct 95% of the time, far higher than code generated from vague prompts.

3. Acceptance test-driven development (ATDD): The stakeholder alignment tool

ATDD involves customers and stakeholders early in defining automated acceptance tests before development begins. This practice is crucial when using GenAI because it ensures the AI is solving the right problem, not just generating plausible-looking code.

The ATDD workflow with GenAI:

• Specification Workshop: Product owners, developers and testers collaborate to define acceptance criteria in a testable format. This creates a shared understanding of “done.”
• Test Automation: Convert acceptance criteria into automated tests before writing implementation code. These tests represent the customer’s definition of success.
• AI Assisted Implementation: Use GenAI to implement features that satisfy the acceptance tests. The tests prevent the AI from drifting away from actual requirements.

Real-world impact: For a volume-based discount feature, we held ATDD workshops to define a specific requirement: “Buy 10, Get 10% Off” must apply only to the qualifying line items, not the entire invoice total. These became our automated acceptance tests. When developers used GenAI to implement the logic, the AI suggested a simple, global discount function that subtracted 10% from the final balance, a common coding pattern for retail, but incorrect for our B2B contractual rules. Because the ATDD test validated the discount at the line-item level, the AI’s “perfect-looking” code failed immediately. This prevented a logic error that would have resulted in significant over-discounting and lost revenue across thousands of bulk orders.

4. Pair programming: The human-AI collaboration model

Traditional pair programming involves two developers working together, often one writing tests and the other writing implementation. With GenAI, this model evolves into a powerful three-way collaboration: Developer A writes tests, Developer B reviews AI-generated code and the AI serves as a rapid implementation assistant.

The enhanced pair programming workflow:

• Navigator Role: One developer focuses on writing comprehensive tests and thinking about edge cases, security implications and architectural fit. They are not distracted by implementation details.
• Driver Role: The other developer works with the AI to generate implementation code, critically evaluating each suggestion. They serve as the quality filter for AI output.
• AI Assistant: Generates implementation suggestions based on tests and context, accelerating the coding process while the human pair ensures quality.

Real-world impact: A recent study by GitClear found that code quality metrics declined when developers used AI tools in isolation but improved when used in pair programming contexts. We recommend pair programming for any AI-assisted development of critical systems. The navigator catches security issues and architectural mismatches that the driver, focused on AI output, might miss. We have seen a 60% reduction in post-deployment bugs compared to solo AI-assisted development.

5. Continuous integration (CI): The automated safety net

Continuous integration runs automated test suites every time code is merged. It becomes even more critical with GenAI-assisted development. CI provides the final safety net that catches issues before they reach production.

Enhanced CI pipeline for GenAI code:

• Comprehensive test execution: Run all unit tests, integration tests, BDD scenarios and acceptance tests on every commit. AI-generated code must pass the entire suite.
• Static analysis: Include additional static analysis tools that check for common AI-generated code issues like security vulnerabilities, code complexity metrics and licensing compliance.
• Performance benchmarks: Automated performance tests catch AI-generated code that works correctly but performs poorly at scale.

Real-world impact: Our CI pipeline is configured with specialized checks designed to catch the unique risks of AI-assisted coding. For the invoicing platform, we integrated automated business-rule validators that specifically verify logic like tax rounding and discount applications.

The synergistic effect: Practices working together

The real power emerges when these practices work together. Each creates a different layer of protection:

• TDD ensures the code works correctly for specified inputs.
• BDD ensures it implements the right business behavior.
• ATDD ensures it meets stakeholder expectations.
• Pair programming ensures human oversight and critical thinking.
• CI ensures all these checks run automatically and consistently.

Consider a typical user story for an e-commerce platform: “As a customer, I want to apply discount codes so that I can save money on purchases.”

Without Agile practices, a developer might prompt an AI: “Write a function to apply discount codes to shopping carts.” The AI generates plausible-looking code, the developer briefly reviews it and it ships. Hidden issues might include: discount stacking vulnerabilities, floating-point rounding errors, failure to validate expiration dates or SQL injection in the discount code lookup.

With Agile practices:

• ATDD: Product owner, developer and tester define acceptance criteria: “Given a valid 10% discount code, When applied to a $100 cart, Then the total should be $90.”
• BDD: Business analyst writes scenarios covering edge cases: expired codes, invalid codes, maximum discount limits, combination rules.
• TDD: Developer pair writes unit tests first, including security tests for injection attacks, tests for decimal precision and tests for all edge cases.
• Pair programming: One developer writes tests, the other works with AI to implement, both review the generated code critically.
• CI: All tests run automatically on commit, plus static analysis for security issues, performance benchmarks and compliance checks.

This multi-layered approach catches issues at different stages: tests catch functional errors, pair programming catches architectural mismatches, CI catches regressions and security issues.

Implementation recommendations

Based on our experience implementing these practices across multiple teams, here are practical recommendations for organizations adopting GenAI development tools:

• Start with TDD as the foundation: Make test-first development non-negotiable when using AI assistance. This single practice prevents the majority of AI-generated code issues. Invest in training developers on TDD if they’re not already proficient.
• Enhance code review processes: Traditional code review checklists need updating for AI-generated code. Add specific review criteria: Does the code handle edge cases? Are there obvious security vulnerabilities? Does it match our architectural patterns? Is the complexity appropriate for the problem?
• Invest in test infrastructure: Strong CI pipelines become even more important. Ensure your pipeline can run comprehensive test suites quickly. Slow test execution discourages frequent commits and reduces the effectiveness of CI as a safety net.
• Create AI usage guidelines: Document when and how to use AI assistance. Some scenarios might be high risk (security-critical code, financial calculations) and require extra scrutiny. Others might be low-risk (boilerplate code, standard CRUD operations) and benefit most from AI acceleration.
• Measure and monitor: Track metrics specific to AI-assisted development, such as defect rates in AI-generated vs. human-written code, test coverage trends, time-to-production and post-deployment issues. Use data to refine your practices.

 

Conclusion: Speed with safety

Generative AI is a fundamental change in how we write software that can be compared to the introduction of high-level programming languages or integrated development environments. It brings real and huge productivity gains. But speed without quality is not progress; it is technical debt accumulation at an accelerated rate.

The great thing is that we don’t have to come up with new methods to make use of GenAI safely. The Agile methods that have been used for decades, such as TDD, BDD, ATDD, Pair Programming and CI, are exactly the safety measures we need. These methods have quality at their core through automation, collaboration and continuous verification. They are even more impressive with AI help because they provide objective, automated checks that don’t have the same pattern-matching biases as humans, who are poor at reviewing AI-generated code, have.

Companies that use GenAI tools but keep up with strict software development practices will get the best results. For example, faster development without sacrificing quality, reduced defect rates despite increased velocity and sustainable productivity gains that don’t create future maintenance issues.

Software development in the future is not about just humans or AI. It is humans and AI cooperating within established quality assurance that is protected by proven frameworks. The combination of AI’s speed and the safety of Agile methods allows us to do software development that is both really efficient and of high quality on a large scale.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The pursuit of artificial intelligence is filled with speculation and frenzy, akin to the Gold Rush in 1848. Organizations are taking large risks and heavily investing to overhaul culture and technology with the hope of accepting failure risks in exchange for potential market-redefining advantages.

But as the initial dust settles, the reality is stark. Prospectors —  companies pouring millions into unproven AI initiatives — are finding that the easily accessible gold is gone. Meanwhile, the ‘shovel sellers’ — the infrastructure and tool providers — are the only ones consistently thriving.

It is time for a complementary viewpoint. For the implementers and consumers of AI, we must shift our mindset from the exhaustion of a gold rush to the agility of a digital egg hunt.

Why the ‘egg hunt’ beats the ‘gold rush’

A gold rush is about urgency, scarcity and the risk of total failure. An egg hunt is about adventure, discovery and the thrill of the find. In an organization, the ‘eggs’ aren’t hidden in some far-off mountain; they are already tucked away in your operating procedures, technical limitations and daily decision-making.

By shifting to an egg hunt framework, we balance the frenzy of the AI era with disciplined discovery. We stop looking for one massive, mythical nugget of gold and start collecting dozens of high-value, low-risk eggs that, when gathered, drive massive cumulative value.

As a child, I had an approach to an egg hunt.  I would run through the yard as fast as possible, looking for eggs easy to find and placing them into my basket. As I found each egg, I would turn to my parents, sharing a moment of excitement before continuing the race for the next egg. Once I found all the easy-to-find eggs, I followed with a second pass seeking more difficult-to-find eggs. I would quickly expand my ability to discover as I learned new approaches my parents had for hiding the eggs behind a bush, on a tree limb or in a downspout. After confirming all the eggs are found, we would return inside to open the eggs.

Training the hunters: Identifying cognitive friction

We want to be a smart, disciplined egg hunter focused on creating maximum value by quickly learning approaches, accelerating our processes and generating value. The collective opportunities in the basket ensure our organization is running as efficiently as possible and all effort is translated into value with tangible, measurable, business outcomes with reduced risk of prospecting.

As AI takes on more technical execution, human-centered skills become a competitive advantage.  We must train our facilitators to look past traditional waste reduction and toward intelligence orchestration and cognitive behaviors.  Creativity, communication, emotional intelligence, resilience and lifelong learning are no longer soft skills. They are core skills in an AI-centric organization.

Research in the Harvard Business Review suggests that more than four in ten working hours are spent on manual transactions, the friction of coordinating people and aligning complex work. Researchers Sharma, Guan and Wilson posit that roughly one-third of these tasks can be fundamentally reinvented through AI agents.

The eggs in your environment are hidden in cognitive friction points. These include:

• Cognitive processing time: The thinking gap in a manual process.
• Cross-referencing: Switching between multiple systems to resolve ambiguity.
• Data scavenging: Gathering information from disparate, unorganized sources.
• Resolving ambiguity: resolving ambiguity or finding clarity on information as part of a process.

View these cognitive friction points as an opportunity to highlight non-value-added work on value stream maps. These maps are a lean management technique for analyzing the flow of materials, requirements and data associated with a given process, system or product. By setting performance expectations on cognitive steps, performance defects can be found, surfacing data quality issues or process ambiguity that can be resolved via governance.

Once processes are mapped, organizations should consider translating these to digital twins of the process. Sharma, Guan and Wilson state that digital twins of the process provide radical visibility to employees of the process. This will challenge legacy mental models of the process and provide complete visibility. Establishing this as a foundation enables users to simulate process changes and foster continuous experimentation.

To aid adoption, consider a training focus that incorporates:

• Practices to identify cognitive load and data friction in tasks that require judgment and logic.
• Pattern recognition for individuals to identify content creation that can be automated. This can leverage a prompt-as-a-process pattern.
• Shift from linear flow of process to incorporate feedback loops. This ensures that when transitioning to agentic AI, human-in-the-loop processes can be generated to govern agents.

Deliver a modern egg hunt through digital learning labs and hackathons

A digital egg hunt is best executed through curated learning labs and hackathons. These are not traditional training sessions; they are high-energy, two-to-three-day sprints designed to move participants from passive observers to active facilitators.

These are not merely a replacement for traditional training. Learning labs promote experimental resilience, providing safety to fail and shifts from what is learned to how participants think.

To run a successful lab:

• Partner across organizations to host the learning lab. It is important to ensure a critical mass of leadership is engaged and there is broad support across technological domains.
• Focus on generating ideas that generate direct, demonstrable business outcomes. Opportunities should be prioritized for adoption, focus on eggs that can produce provable ROI by streamlining a specific department or eliminating and reducing stuck costs.
• Curate the agenda to ensure success of the outcomes. Aligning like opportunities enables participants to focus on key learning points and maximize learning.
• Pre-stage and configure long-lead items to achieve ample speed to value. Basic things like account setups, security access, software installations should all be completed in advance. In addition, it would be helpful if a senior resource reviews and resolves risks.
• Communicate results of the workshop to provide participants with a chance to discuss learnings.
• Create a case study of activities to further communicate and expand future learnings.

This rapid generation of ideas with focus on business outcome lowers the total costs of development by driving to rapid prototyping and evaluation. Organizations can quickly identify what opportunities to take forward or kill.

Avoiding the post-event slump

The greatest risk to any innovation initiative is the post-event slump, where participants return to their desks and lose momentum. To realize full business outcomes, high-value eggs found during the lab must be fast-tracked into a 30-60-90-day roadmap.

To maximize ROI, consider these steps:

• Create an evaluation that measures participant work products for the ease of maturation, change effort and business value. Fast-track high-value items for completion in a near-term roadmap.
• Demo solutions to stakeholders to highlight learning and business outcomes.
• Have executives sponsor high-value ideas and partner with participants to bring them forward beyond the learning lab.
• Maintain a learning library that is available to other participants or facilitators.
• Extract reference patterns to be used as accelerators.

The bottom line

In the AI era, you can either mobilize your employees as desperate prospectors or empower them as energized hunters. By fostering a culture of the digital egg hunt — built on cognitive mapping, digital twins and rapid prototyping — you don’t just find value; you build an organization that is faster, smarter and far more resilient than those still digging for gold in empty hills.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

I’m walking back to the hotel after an early morning loop through Málaga, Spain, the kind of walk that clears your head before the city fully wakes up. I’m looking forward to one thing, coffee, a simple mission, a basic human requirement and the quiet satisfaction of returning somewhere that already feels familiar.

I cut past the port along Paseo del Parque, where the air tastes like salt, laced with that familiar perfume of diesel fuel. As I continue my walk, the harbor looks like it’s been rearranged overnight. A few yachts sit there as they arrived on silent feet, absurdly sleek, the kind €100M buys and they don’t so much dock as announce. They’re beautiful in the same way a private jet is beautiful, engineered, expensive, slightly unreal. I stand for a second longer than I meant to, watching the water lap against hulls that probably have their own power plant and their own security perimeter.

Then I turn inland and start making my way back toward my hotel. The city shifts as I move, from the soft green of the park to the formality of the boulevard. Paseo de Reding carries me like a corridor, a grand, historic promenade with 19th-century bourgeois architecture and broad sidewalks that feel designed for a slower era. And then the Jacaranda trees begin to tint the morning. Their purple canopy settles into the scene, shadows mixing overhead, cooling the light and changing the mood.

And then the gate appears.

The first thing you notice is the arch.

Not the city, not the sea, not even the morning light, that soft Málaga glow that makes white buildings look newly painted, even when they’ve been standing there longer than your assumptions. The first thing is the gate, the kind that doesn’t just say welcome, it says you are crossing a line.

“GRAN HOTEL MÁLAGA” curves overhead in bold letters, iron and authority, framed by palms that look like they’ve been patiently rehearsing this moment for a hundred summers. Thin strands of lights hang like quiet rainfall. They’re off, because it’s early, but they still feel present, like the place can change moods on command.

Entering through the gate, the world narrows into two options.

Two paths.

One that looks obvious, polished, expected.

And one that feels… less rehearsed.

I think of Robert Frost, not the poem’s fame, the moment inside it, that small internal turning where you choose a direction and accept that it will shape the story you tell later. I choose the one that feels less traveled by and I step in.

The perimeter is not the experience; it’s the beginning

As I follow the winding path after passing through the gates, the air changes.

Not dramatically, no cinematic gust, it’s subtler than that, like the temperature drops a degree and the sound drops two. The city’s edge softens, replaced by a pocket of green that feels almost impossible in the middle of a vibrant coastal capital, yet here it is thriving. Leaves layer themselves in ways that make you forget, for a moment, that traffic and schedules exist. Palms fan overhead. Dense shrubs and climbing vines pull the eye inward. The path curves and with every step, the hotel disappears and reappears through leaves like it’s teasing you, letting you approach only when you’re ready.

This is where I start thinking about data centers, which is probably not what most people do when they walk through a garden in Spain, but that’s the point of choosing the less obvious path. It changes what you notice.

Because the gate, in a data center, is where most conversations begin, fences, badges, cameras, guards, zero trust. We treat the perimeter like the story, when it’s really just the threshold. The true experience starts after the checkpoint, where design either welcomes you into coherence or drops you into chaos.

The best facilities, like the best places, don’t just stop bad things from getting in. They create a feeling of inevitability, this sense that everything inside has been thought through, aligned, maintained, respected.

I keep walking.

A palace disguised as a decision

Then the building reveals itself and it does not do it quietly.

The façade is bright, stately, symmetrical, the kind of white that holds light like marble holds a chisel mark. Over the entrance, the words “PALACIO MIRAMAR” sit with the confidence of a name that doesn’t need explanation or beg for attention. It assumes it.

I climb the steps and each one feels like a transition from the organic to the engineered, from garden to geometry, from wild growth to deliberate structure. The doors open and suddenly I’m inside a lobby that behaves like a cathedral built for light.

Columns rise and repeat. Arches curve and frame. A glass canopy overhead turns the ceiling into a soft grid of daylight. Chandeliers hang like captured constellations. The floor gleams, not flashy, just certain, solid marble, polished with intent.

And right there, under that ordered beauty, the metaphor lands hard.

A data center is a modern palace, whether we admit it or not.

Not because it’s luxurious, it often isn’t, but because it is the physical home of what our world now worships, computation, connectivity, availability, speed and the quiet miracle of “it just works.” We don’t bring tourists through them. We don’t wrap palms in lights at the entrance. We don’t let people feel what they’re entering.

Yet almost every part of modern life passes through those walls.

Healthcare decisions. Financial trades. Airline routes. Emergency response. Your photos. Your messages. Your business. Your identity. Your privacy. Your risk.

A data center is where the invisible becomes physical, where cloud becomes concrete, where “digital” becomes cables, switchgear, chilled water loops, batteries, generators and human beings who notice the faint sound that means something is about to break.

The path through the restaurant, the path through the stack

I don’t take the shortest route.

I let the hotel’s architecture guide me the way good choreography does, subtle cues, effortless flow, one space handing you to the next without ever feeling like you were told where to go.

I pass through Príncipe de Asturias and out toward the terrace and the space does that quiet thing great places do, it folds time.

I’m back at last night.

My wife and I had dinner on the terrace, the one that spills into the stairs leading down toward the pool. As you go down, the hotel doesn’t fall away, it swells behind you. With each step, the building grows more present, arches and balustrades rising in your peripheral vision like the place is reminding you who built it. Below, the pool sits framed by neat rows of loungers and folded blue umbrellas, everything arranged with the calm confidence of something that will work exactly as intended.

We split a bottle of 2017 Viña Ardanza Reserva, the kind of wine that slows your pace without asking permission. Our table was simple and perfect, white linen, black chairs, a balustrade between us and the sea. Beyond it, the Mediterranean stretched out in layered blues and later, after dinner, it turned dark and metallic, holding a thin band of moonlight like a path you could follow if you were willing to trust the dark.

I was in Málaga as my wife’s +1 for a conference and that first dinner was ours, quiet and unhurried. Nearby, a larger table was having a great time, laughter rising and falling with the clink of glasses, the kind of joy that travels easily across warm air and candlelight. It was the kind of evening you don’t plan. You just accept it.

And then you wake up and the same spaces play a different note.

This morning, I’m moving through that same architectural dance, this time with coffee on my mind and the stack in my head.

Port to boulevard to gate to garden to lobby to restaurant to terrace, each space a different layer, each layer changing what the next layer can be.

That’s the stack.

Data centers have stacks too, even when we pretend it’s all cloud and APIs:

• Perimeter and physical security: the gate.
• Facility design and resilience: the garden that hides complexity with calm.
• Power, cooling and structured cabling: the steps and stone, the unseen load-bearing decisions.
• Compute, storage, networking: the lobby, repeating columns of capability.
• Platforms and orchestration: the restaurant passage, where raw capacity becomes usable service.
• Applications and experience: the terrace and the sea, the point of it all.

The mistake we keep making is treating the stack like a parts list instead of a guided experience. We buy racks and megawatts, negotiate colocation contracts, argue about PUE, chase uptime and forget the only question that matters when everything is on the line:

What kind of path are we building for the people and systems that must rely on this place?

Coffee and the unexpected panel

I get the coffee. It’s exactly what it should be, strong, honest, restorative, no drama. The kind that doesn’t ask for attention, it just does its job.

I sit with the cup warm in my hands, the Mediterranean laid out in front of me like a calm, blue certainty. Then I put in my earbuds.

Not music.

Bloomberg.

The 2025 Qatar Economic Forum, Erik Schatzker moderating a conversation with Marcelo Claure, Jenny Lee and Steven Mnuchin. I wasn’t listening for macro debates. I was listening for how serious investors talk when they’re speaking to other adults who manage risk for a living, what they believe will still matter after the noise burns off.

Near the end, Mnuchin shifted from AI as a headline to AI as an appetite, physical, electrical, stubbornly real. The kind of demand curve that doesn’t live in slides, it lives in kilowatts, square footage, cooling loops and interconnects. He talked about data centers, not as a trend, but as the backbone that every AI strategy quietly assumes will exist.

Then he framed it in a way that felt almost old-fashioned and that’s why it worked.

Owning data centers in the U.S., for decades, isn’t something he described like a venture bet or a tech trade. He described it like patient capital, something you hold through cycles because the need doesn’t evaporate.

“We look at that as long-term bonds,” Steven said.

I paused, coffee halfway to my mouth.

Because that single phrase re-sorts the entire tech investment landscape.

Bonds, stocks, options and the infrastructure nobody gets to skip

Most people talk about technology like it’s all one asset class. It’s not.

Some bets behave like options, asymmetric upside, defined downside, but you’re paying for uncertainty. The future arrives, or it doesn’t.

Some behave like stocks, bigger upside if you pick the winners, but you’re underwriting competition, execution and timing. Great companies compound, until the market changes its mind.

But data centers, at least in the way Mnuchin described them, sit in a different category. More like long-term bonds, durable demand, real constraints, predictable necessity. Not because nothing changes, it will. Chips refresh. Architectures shift. Tenants renegotiate. Entire software paradigms come and go.

But the requirement doesn’t disappear.

Compute has to live somewhere.

And that somewhere has to be powered, cooled, secured and connected.

The tide behind compute feels less like a wave and more like a permanent pull.

The morning comes full circle

And that’s the point Mnuchin clarified for me, right there with a warm cup in my hands and the Mediterranean doing what it always does, being steady.

A truly great data center isn’t trying to be admired. It isn’t trying to be exciting. It’s trying to be certain. It lives behind fences and badge readers the way Miramar lives behind its arch, not to keep you out, but to keep the inside predictable. It turns physics into reliability, power into compute, compute into outcomes, quietly, consistently, without asking for attention.

That’s why the long-term bond metaphor works.

The longer I sat there, the more the sea started to feel like an argument for asset allocation. Because what Mnuchin was really saying wasn’t just data centers are attractive. He was saying they behave like duration, the kind of thing you own because you want stability in the mix, something you can hold while everything else rotates.

We spend a lot of time talking about technology like it’s one asset class. It isn’t. Some of it behaves like options, asymmetric upside, paid for with uncertainty. Some of it behaves like stocks, compounding if you pick the right winners, punishing if timing and competition turn. And some of it, if you believe the thesis, behaves like bonds, boring on purpose, quietly producing income because demand is persistent and the constraints are real.

So maybe the right question isn’t, are data centers the future?

Maybe it’s: where do they sit in the portfolio?

Because if a healthy portfolio has always balanced growth and stability, 70/30 or some variation of it, what’s the right mix for the infrastructure era? What’s our 70/30 now and are we building enough of the boring, the quiet, essential backbone, to make the rest of our bets survivable?

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Un año más la compañía de selección de personal Hays ha dado a conocer cuáles, según sus datos, son las tendencias laborales y, en concreto, de salarios para el año en curso en España. Los datos, referentes a 15 sectores productivos, aparecen en la Guía del Mercado Laboral 2026 que elabora la firma recopilando los datos de más de 7.400 salarios (la empresa especifica que para ello calcula la media de los salarios ofrecidos por sus clientes durante el último año, lo que le permite proyectar las tendencias para el siguiente período). Según la Guía, el sector de las Tecnologías de la Información (TI) experimentará un aumento del 6% en los salarios en 2026, siendo el tercer sector que más subirá los sueldos, solo superado por el sector de atención al cliente y administración y el de finanzas (los dos con un 7% de aumento) y seguido por el de la banca (5%). El porcentaje de incremento es destacable, pues tanto en 2024 como en 2025 este apenas alcanzaba el 2%.

En concreto, los datos de Hays prevén un aumento de la demanda de posiciones de mandos intermedios y directivos, con salarios superiores a 50.000 euros brutos anuales. “Las empresas, inmersas en procesos de contratación permanente, buscan profesionales de alto nivel, mientras que para roles menos críticos optan por la externalización o soluciones en otros países”, reza el informe.

Los perfiles más solicitados serán los de desarrollador de .NET, desarrollador de Java/J2EE, product owner (software/SaaS/mobile), desarrollados de IA, consultor de ciberseguridad y auditor de TI, ingeniero cloud e ingeniero DevOps, mientras que los menos solicitados serán los desarrolladores de PHP y de Ruby On Rails.

¿Cuánto cobrarán los directivos de TI en 2026?

Según la tabla salarial que incluye la edición de 2026 de la Guía de Hays, y que analiza las cinco mayores provincias españolas, estos serán los sueldos de los principales directivos de TI:

• Un CIO (director de sistemas de información) de una empresa multinacional, con perfil internacional, capacidad de gestión de presupuesto y a nivel estratégico y con una experiencia de más de cinco años cobrará de media en 2026 unos 175.000 euros en Madrid y Barcelona; un sueldo que se reduce a los 140.000 euros en Valencia y a 135.000 euros en el caso de ciudades como Bilbao o Sevilla.
• Por su parte, un director de TI (IT director) de una empresa cliente final, con capacidad de gestión presupuestaria y estratégica y de administración de proyectos y con una experiencia de más de cinco años percibirá unos 100.000 euros en Madrid y Barcelona, 80.000 euros en Valencia y 75.000 euros en Bilbao o Sevilla.
• Un gerente de TI o IT manager, es decir, aquel que trabaja para una pyme, gestionando infraestructura, proveedores y proyectos, y con más de cinco años de experiencia, contará con un sueldo de 80.000 euros en Madrid, Barcelona, Bilbao y Sevilla, y de 65.000 euros en Valencia.
• Un CTO (director de tecnología) experimentado (más de cinco años) que trabaje para una startup o empresa tecnológica, realizando gestión técnica y presupuestaria percibirá un sueldo medio de 180.000 euros en Madrid y Barcelona, y 135.000 euros en Valencia, Bilbao y Sevilla.
• Un CISO (director de seguridad de la información) con más de cinco años de experiencia cobrará unos 135.000 euros en Madrid y Barcelona, y 95.000 euros en Valencia, Bilbao y Sevilla.
• Un CDO (Chief Data Officer o director de datos) experimentado percibirá un salario medio de 135.000 euros en Madrid y Barcelona, y 125.000 euros en Valencia, Bilbao y Sevilla.

Adiós a la burbuja laboral del sector tecnológico

El informe también analiza el comportamiento del empleo el pasado 2025. Respecto al vertical de TI, resalta que el pasado fue un año sin un incremento significativo en la creación de empleo, pero en el que la digitalización ha avanzado con mayor intensidad en empresas de los sectores logístico, financiero y farmacéutico, frente a otros donde el negocio online tiene menor peso. Respecto al ecosistema de startups, según el informe, el crecimiento también ha sido discreto, “manteniendo estrategias orientadas a recuperar la inversión realizada”.

La Guía también apunta que en el sector tecnológico se ha desinflado con fuerza la burbuja que había caracterizado a este vertical en los últimos años. Es más, indica que el número de ofertas rechazadas ha caído de forma rotunda, de modo que es habitual encontrar profesionales del ámbito digital en situación de desempleo temporal, un escenario, según los expertos de Hays, “difícil de imaginar no hace tanto tiempo”.

Pese a este contexto, la Guía subraya que los perfiles especializados en TI continúan ocupando un lugar clave en las estrategias corporativas. “Los perfiles IT siguen siendo esenciales para las organizaciones y mantienen un alto reconocimiento, con una especialización creciente impulsada por la consolidación de la inteligencia artificial en todos los niveles”, apunta.

Las grandes tendencias del sector TI en 2025 en materia laboral han sido, dice la guía, el aumento salarial en perfiles con experiencia (senior) y la actualización masiva de descripciones de puestos, un elemento impulsado por el impacto transversal de la inteligencia artificial en todas las funciones tecnológicas.

La IA generativa impacta con fuerza en el mercado de trabajo español

El informe de Hays también analiza el impacto de la IA, y en concreto de su sabor generativo, en el mercado laboral general, donde, afirma, esta tecnología se está consolidando como una herramienta cotidiana en el trabajo.

Según el documento, en España, el 62% de los profesionales ya utiliza IA en su día a día, frente al 34% en 2024, lo que supone un fuerte aumento de uso. El 52% de las empresas reconoce fomentar el uso de esta tecnología de forma activa. Una tendencia que, según el director para el Sur y Oeste de Europa de Hays, Christopher Dottie, “está transformando la forma de trabajar, las habilidades que son clave y los perfiles más demandados, generando una brecha que va creciendo con el tiempo entre aquellos que dominan estas herramientas y quienes aún no se han adaptado”.

A pesar de este auge de la IA, la mayoría de las empresas (81%) prevé contratar a más profesionales en 2026. No obstante, la dificultad para encontrar talento cualificado sigue siendo, para el 93% de las empresas, un desafío. Precisamente para hacer frente a este, muchas organizaciones se están planteando opciones que motiven a los empleados como pagar más por habilidades específicas (lo que se llama ‘skills-based pay’).

La vuelta a la presencialidad y el ‘quiet thriving’ como tendencia

El informe también destaca otras tendencias que vive el mercado laboral español. Una es la vuelta a la presencialidad, con muchas compañías obligando a sus empleados a volver a la oficina. El informe indica, de hecho, que el 50% de las empresas ya opera de forma totalmente presencial, frente al 38% registrado en 2025. No obstante, indican desde Hays, que “las empresas siguen buscando equilibrio entre flexibilidad, productividad y cohesión de los equipos”.

Por otro lado, tras el fenómeno de la renuncia silenciosa, el famoso término de ‘quiet quitting’ en inglés, que caracterizó a 2023, en 2026, dice la guía, gana fuerza todo lo contrario: el ‘quiet thriving’ o prosperar de forma silenciosa, con el que se describe una situación en la que el empleado realiza pequeños cambios personales o laborales para mejorar el bienestar, la motivación y la satisfacción que tiene en el trabajo; una tendencia que puede hacer que los empleados reduzcan incluso su intención de cambiar de empresa incluso en un mercado lleno de oportunidades. En este sentido, el informe asegura que en la actualidad casi siete de cada diez trabajadores se declara satisfecho con su empleo.

The market for networking and security skills is shifting as AI implementations move from experimental to operational and enterprise organizations deploy more sophisticated IT architectures.

So, which skills are commanding the highest premiums? And which skills are no longer in great demand? Foote Partners’ latest IT Skills and Certifications Pay Index shows a clear pattern: Premium pay is moving away from execution-level work and monitoring tasks toward higher-level engineering, architecture, and risk ownership roles that require judgement and critical thinking.

“Companies will no longer pay premiums for what technology can do, but they’ll pay for who can control it,” says David Foote, chief analyst at Foote Partners. “The interest, the demand, and the pay are going to flow to professionals who can control intelligent systems operationally, economically, and legally, rather than simply build them.”

The IT Skills and Certifications Pay Index is based on compensation data from 491,050 technology professionals at 5,012 U.S. and Canadian employers. Across the board, average cash pay premiums have been declining for two years for the 746 noncertified IT skills and 650 IT certifications that Foote Partners tracks. Yet, there are 100 noncertified IT skills that still earn workers bonuses equivalent to between 17% and 24% of base pay, and 44 IT certifications are averaging 10% to 15% cash bonuses.

IT jobs that involve assessing risks and identifying cybersecurity threats are among those that garner the biggest bonuses. On the flip side, roles that are vulnerable to automation, such as network operations center (NOC) monitoring or firewall administration, are losing ground.

Security architecture and risk skills lead the pack

Security architecture and risk management skills dominate the top tier, with cash bonuses ranging from 19% to 24% of base salary.

At the very top are risk analytics/assessment skills, which command a 24% premium—meaning employees with these skills say they’re earning cash bonuses equivalent to 24% of their base salary. Since the last Foote Partners pay index was published, the value of bonuses for these skills has climbed significantly (up 26.3% in the past six months).

Smart contracts skills rank next, with cash bonuses worth 23% of base salaries (up 21.1% in the past six months), followed by security architecture and models with cash bonuses worth 21% of base salaries (up 10.5%). Threat detection/modeling/management skills earn 20% premiums, according to Foote Partners.

Other high-value security skills include cyber threat intelligence (19% premium), security testing (19% premium), and security auditing (19% premium). Cryptography and e-discovery both command 17% premiums.

“Employers are paying a premium for skills that involve judgment, risk ownership, and architectural thinking,” Foote explains. “The market has shifted dramatically away from execution-level work that can be automated.”

AI operations reshape the landscape

Foote Partners now tracks 144 certified and noncertified AI-related skills, up from 57 just eighteen months ago. Twenty-four AI certifications are outperforming their 100 noncertified counterparts: Certification premiums rose nearly 6% in the past year, while noncertified AI skills declined 1%, according to Foote Partners. Noncertified AI skills still earn higher bonuses, averaging 14.5% of base salary compared to 8.3% for AI certifications.

Top AI and automation skills include Artificial Intelligence for IT Operations (AIOps) at 23% premium, AI engineering at 23% premium, and AI productivity at 22% premium. Azure AI/ML services pay a 20% premium, as do Large Language Model Optimization (LLMOps), machine learning, MLOps, neural networks, and prompt engineering.

Platform engineering and observability skills also command significant premiums. Dynatrace platform (20% premium), Splunk (20% premium), Event-Driven Architecture (20% premium), and PagerDuty (18% premium) reflect the shift toward intelligent operations and automated incident response, according to Foote Partners.

Network skills evolve beyond traditional admin

Traditional network administration roles are seeing declining premiums as automation takes hold, but architectural and engineering skills remain in high demand, the research reveals. Network architecture commands an 18% premium, while skills involving network design, security architecture, and cloud migration strategy continue to show strong value.

Certain data management and engineering skills also perform well, including data strategy (21% premium), data architecture (20% premium), DataOps (20% premium), and data modeling (18% premium). Apache Iceberg commands a 19% premium, reflecting growing demand for modern data lake architectures.

The systems/networking category showed a 1.9% decline in average premiums this quarter, with the steepest drops in monitoring and operations roles being automated by AIOps platforms. Level-1 NOC monitoring, basic network configuration, and manual security monitoring are all seeing reduced demand as intelligent automation takes over routine tasks, Foote says.

Top-paying security certifications

Among certifications, security credentials dominate, with premiums ranging from 10% to 15% of base salary. The Certified Artificial Intelligence Scientist (CAIS) leads at 15% premium (up 50% in six months), followed by Artificial Intelligence Engineer certifications at 13% premium (up 18.2% in the past six months).

Check Point certifications showed dramatic gains: Certified Security Master (CCSM) earns an 11% premium (up 40% in the past six months), while Certified Security Expert (CCSE) pays an 11% premium (up 37.5% in the past six months). Check Point Certified Security Administrator (CCSA) earns a 10% premium (up 11.1% in the past six months).

Other top-paying certifications include Certified Cloud Security Professional (CCSP) at 10% premiums, Certified Information Security Manager (CISM) at 10% premiums, Certified Information Systems Auditor (CISA) at 10% premium, and GIAC Experienced Cyber Security (GX-CS) at 10% premium. Project management certifications also retain strong value, with PMI Portfolio Management Professional (PfMP) and Program Management Professional (PgMP) both earning 10% premiums, according to Foote Partners.

Skills pay volatility continues at elevated levels, with 386 of 1,396 skills and certifications (28%) changing in market value during Q4 2025, representing a 25% increase from one year ago. This heightened volatility reflects the rapid pace of technology adoption and shifting employer priorities. Categories experiencing the most volatility include data/database skills (56.3% changed value), management/methodology/process (46.9% changed value), applications development (43.6% changed value), and operating systems (33.3% changed value). Noncertified IT skills showed significantly higher volatility (36.8% changed value) than certifications (17.9% changed value).

“We’re seeing unprecedented churn in skills valuations,” Foote says. “As AI shifts from experimental to operational, employers are thinking about jobs more as tasks mapped to specific skill combinations that are constantly changing.”

Skills losing ground to automation

Several traditional networking and operations roles are seeing declining premiums as automation takes hold. Level-1 NOC monitoring roles are being replaced by observability platforms and AIOps that reduce the need to monitor dashboards. Foote also explains that basic network configuration work is being automated through infrastructure as code and software-defined networking.

The research also found that manual security monitoring is declining as security information and event management (SIEM) platforms incorporate AI correlation and automated response. Traditional firewall administration is facing pressure from cloud-native security architectures and Secure Access Service Edge (SASE) approaches that reduce hands-on security configuration work.

Foote says there is a consistent pattern across categories: Execution-level work is being automated, while premium pay migrates to roles involving architecture, engineering, risk assessment, and strategic decision-making. The data reveals several strategic implications for networking and security professionals:

• Architectural thinking pays: Skills involving system design, risk assessment, and strategic planning command 18% to 24% premiums.
• AI augmentation is essential: High-tech pros must learn to work alongside AI tools rather than resist them.
• Platform expertise matters: Deep knowledge of key platforms (Splunk, Dynatrace, PagerDuty) carries significant value.
• Advanced certifications retain value: Entry-level credentials see declining premiums.
• Cross-skilling is critical: Combining networking with security, cloud, or automation increases market value.

“The professionals thriving in this market combine deep technical expertise with architectural thinking and the ability to work with AI tools,” Foote observes. “It’s not enough to know how to configure a firewall—you need to understand how it fits into an overall security architecture and risk framework.”

High-tech skills going forward

The gap between certified and noncertified IT skills premiums has widened to its largest margin in nearly two decades, Foote says, with noncertified skills earning an average 3% of base salary more than certifications. This reflects the market’s growing emphasis on demonstrated ability to handle complex, ambiguous problems over credentials alone.

For professionals looking to maximize market value, the path is clear: move up the value chain from execution to engineering to architecture, embrace AI augmentation, and develop expertise in risk assessment and strategic decision-making. As organizations continue their AI transformation and security threats grow more sophisticated, those who make this transition successfully will find themselves well-positioned in a market where top skills can command premiums of 20% or more above base salary.

“Over the next few years, everyone in tech will have to decide: Stay and evolve with AI, move into a different part of the field, or leave it altogether,” Foote says.

Zero Trust has been the industry’s North Star for a decade, yet most enterprises still struggle to operationalize it. The principle “never trust, always verify” is easy to say, hard to do.

According to Gartner, 63% of organizations worldwide have implemented some form of zero trust strategy, yet only a small fraction report applying its principles consistently across all environments. Meanwhile, a 2024 Ponemon–Entrust study found that just 18% of organizations have fully operationalized zero trust while 68% are still in the planning or early execution stage. For most CIOs, zero trust remains more in an aspiration stage than in their architecture.

At Now & Next Miami 2026, IGEL will show how that’s changing. Through integrations with Zscaler, Palo Alto Networks, and Omnissa, IGEL is helping enterprises move zero trust from theory to enforcement, not in policies or dashboards, but at the endpoint layer itself. Together, these partnerships turn the endpoint into a place where zero trust becomes measurable, reportable, and real.

For CIOs, this means a shift from theoretical compliance to tangible control across the enterprise, and Now & Next 2026 is where the conversations are happening.

The resilience imperative

Resilience has quietly overtaken uptime as the defining metric of digital readiness. The modern enterprise isn’t measured by how well it prevents disruption, but by how fast it recovers when—not if—disruption occurs.

At Now & Next Miami, General (Ret.) Paul Nakasone, former Commander of U.S. Cyber Command and Director of the NSA, will lead a discussion on national cyber resilience. His perspective focuses on an important truth: Endpoint strategy has become inseparable from organizational and national security strategy.

When resilience is embedded at the endpoint, the enterprise moves from surviving change to thriving through it with minimal operational disruptions.

Join the movement: Now & Next Miami 2026 

IGEL Now & Next 2026, taking place March 30-April 2 at the Fountainebleau Miami Beach, is where the future of secure digital work comes into focus.

For CIOs, CISOs, and IT leaders, Now & Next Miami offers more than insight—it’s a front-row seat to the next era of secure, sustainable, and adaptive computing. See what’s next. Build what comes after. Be part of the conversation.

Learn more about IGEL Now & Next 2026

CIOs must do more with technology than ever before, and in challenging circumstances. As reported last year, digital leaders are being told to spend less on IT, but are still expected to drive innovation and keep the business thriving — a tough combination to achieve in an era when rapid AI-enabled transformations have become new norms.

Gartner reports that more than half of CIOs face pressure to improve productivity, and 52% are being asked to reduce costs. The message is clear that IT leaders must be radically outcome-focused, prioritizing initiatives that align with C-suite goals to deliver measurable impact.

Pioneering executives recognize that AI can help organizations reach these goals. Diana Schildhouse, chief data and analytics officer at Colgate-Palmolive, is focused on developing deep enterprise connections to ensure the solutions her team creates, whether through gen AI, advanced analytics, or something else, are tied to business requirements.

“We find key pain points of the business and then consider how we can help,” she says. “So it’s not a tech-first approach we’re taking. It’s about looking at the business, its processes, what people are doing, and exploring how we can apply our new technologies to the challenges they face.”

For Gartner, this focus on business value is a shortcut to success and suggests CIOs who implement strategic cost optimization, and strategically manage expenses to maximize business value and not just cut costs, will be 65% more successful in elevating their contribution to the organizational mission.

The challenge now is for CIOs to deliver long-term value from their AI and data investments, and evidence points to cost-optimized digital leaders creating a competitive advantage will concentrate on three key areas.

1. Shifting spend management tactics

Paul Neville, director of digital, data, and technology at UK agency The Pensions Regulator (TPR), says the importance of focusing on cost optimization shouldn’t be underestimated. IT departments don’t always have the best reputation for creating value from their technology investments, and that’s something that must change in an age of AI.

“I think, generally, digital leaders in the past have tended to talk about ‘the thing’ rather than the outcome they’re trying to achieve,” he says. “We haven’t been our own best friend, and I’m sure I made that mistake in the past. I’ve tried to learn that lesson.”

Neville has honed his cost-optimization capabilities during his digital leadership career. After working in the commercial sector at blue-chip companies such as Sky and BT, Neville decided to apply those skills for public benefit, working as a consultant for two major charities before taking on IT chief roles in local government.

In collaboration with the London Office of Technology and Innovation, he developed a toolkit of guidelines, templates, and best practices for digital leaders to navigate obstacles that prevent optimized technology procurement. And at TPR today, Neville continues to ensure users who demand emerging technologies ask the right questions.

“My job is to ask what are you trying to achieve,” he says. “By doing so, technology becomes part of the solution. Yes, emerging technology offers new opportunities, but we need to talk about those in business terms.”

For Lenovo CIO Art Hu, optimization involves managing a funnel of business-focused ideas. His company’s portfolio-based approach to AI includes over 1,000 registered projects across all business areas. Hu has established a policy for AI exploration and optimization that allows thousands of flowers to bloom before focusing on value.

“It’s important I don’t over-prioritize on quality initially, because we have so many projects,” he says. “If you’re too focused on the quality of every project, I think it slows things down. Then, when we’ve got projects to a certain scale, or we can combine them in certain ways that they can absorb true capital deployment in the millions or tens of millions at the group level, that’s when we think about quality.”

Lenovo supports a mix of AI initiatives that use off-the-shelf and bespoke models. Key use cases include conversation summarization to assist support specialists, applying agentic AI to enterprise-grade software engineering, and using gen AI to create marketing collateral. Hu says the key to harvesting the right projects is to manage risk and balance capital allocation.

“AI is no different than any other tool; it’s an additional parameter,” he adds. “You’ll have a budget, and you’ll want speed to market, but you have compliance, security, and other issues to deal with. AI is just one more thing to consider, but then it’s so high-profile that the challenge is accentuated right now.”

2. Integrating technologies

Even once you’ve created a longlist of AI projects, there’s no guarantee you’ll find gold. Careful guidelines for projects can help CIOs and their business peers identify use cases. However, turning AI explorations into valuable production services can be a challenging task that requires a focus on integration to ensure costs don’t spiral upward.

Fausto Fleites, VP of data intelligence at gardening specialist ScottsMiracle-Gro, has prioritized underlying foundations. His work at the company, which began in 2023, has involved deploying AWS technologies, Google services, and deep-learning models to create decision-making insights for the executive team.

Over the past year, Fleites has explored customer-focused use cases for generative and agentic AI. AI-enabled search, for example, runs via a RAG application in Google Vertex AI, where customers can use natural language to find answers to their questions. The company is also working with tech specialist Sierra to improve conversations in its web-based chat agent.

In addition, Fleites is exploring how staff can use AI as a copilot for work tasks. His organization has developed a production service, known as Email Rewrite, which takes text from internal Salesforce knowledge articles and creates coherent responses in seconds. Fleites says these kinds of initiatives can deliver high ROI, but integration is crucial to success.

“Right now, back-office automation isn’t a question of data,” he says. “If you look at an agent, for example, it’s an LLM that has instructions, but it needs access to tools to act. So to re-envision processes, that layer of tools is where the scalability needs to happen. The difficult part is integration with enterprise systems, such as ERP. That layer needs to grow.”

Research suggests integration is a common concern. Gartner reported last year that 77% of engineering leaders identify AI integration as a major challenge. Rupal Karia, SVP for North America, UKI, and MEA at technology firm Celonis, recognizes the importance of integration for cost-optimizing CIOs who aim to deliver valuable AI services.

“There’s a technology thing, where you probably need multiple types of models and tools to work together,” he says. “So Microsoft or OpenAI on their own probably won’t do very well. However, when you combine Databricks, Microsoft, and your agents, then you get a solution.”

That’s a suggestion that chimes with David Walmsley, chief digital and technology officer at jewelry specialist Pandora. He suggests the key to unlock value from AI-enabled services is the orchestration between different packages.

“You can sit with any one of these tech companies and they’ll tell you their version of AI,” he says. “But I’m not going to base my business around that vision. I need to consider how their technology works with all my systems.”

3. Achieving business value

Walmsley works with Pandora’s senior leadership team and its vendor partners, including Salesforce, SAP, and Microsoft, to develop use cases for emerging technologies. His key lesson for other CIOs is straightforward: focus on your points of competitive advantage.

Pandora is making three big bets in AI. The first is using agentic AI to improve customer service. The company has developed a partnership with Salesforce to use its Agentforce technology to manage an increasingly large proportion of online customer service requests. The second is new product development, says Walmsley.

“So how do we apply AI, tooling, thinking, and whatever machinery to how we take new products to market?,” he asks. “Then there’s automation across the whole back end of the organization, and what it can do in terms of shaping the operating model. For me, exploiting AI optimally is about creating a smarter business.”

At Colgate-Palmolive, Schildhouse has developed a framework to ensure the organization focuses its AI endeavors effectively. The framework includes horizontal elements, which are the tools and foundations that power AI efforts, and vertical elements, the organization’s priority areas for exploration, including innovation.

But another key area is revenue growth management. Schildhouse’s team has developed an in-house diagnostic and predictive tool to help employees make pricing decisions quicker. They tracked usage to ensure the technology was effective, and the tool was scaled globally. This success has sponsored AI-powered developments in related areas, such as promotion and calendar optimization technology.

“Scale is important at a company the size and breadth of Colgate-Palmolive, because one-off solutions in individual markets aren’t going to drive that value we need,” she says. “I travel around to our key markets, and it’s nice to be in India or Brazil and have the teams show how they’re using these tools, and how it’s making a difference on the ground.”

Enterprise agentic AI is rapidly moving from assistive to autonomous. Large language models are now wrapped in agents that can route customer claims, draft contracts, trigger payments, change configurations, or decide which alerts deserve human attention—or the attention of another agent.  

Today, 13% of major enterprises globally are substantially on this path, with more than ten agentic workflows operating in the mainstream across their organizations, according to EDB’s 2025 Sovereignty Matters research. These organizations generate 5x the ROI of their peers. They are sovereign in their AI and data, highly hybrid, and innovating with 2.5x greater confidence than other enterprises.

However, when those systems go wrong—denying a loan unfairly, leaking sensitive data, hallucinating a compliance obligation, or escalating a customer into the wrong workflow—the question every CIO eventually faces is painfully simple: Who is responsible?

Right now, the answer is often unclear. And that uncertainty is becoming a business risk. As agentic AI systems learn from new data, adapt to new contexts, and behave in ways even their makers can’t always fully predict, they create a modern responsibility gap: harm occurs, but accountability is hard to pin to a single human decision.  

Traditional legal frameworks aren’t helping much. Product liability is built for products that behave like they did when they left the factory. Agentic AI does not. It can be fine-tuned, connected to tools, updated weekly, and reshaped by prompts and proprietary data long after it’s deployed. 

At the same time, ideas like AI legal personhood are too abstract for enterprise governance—and worse, risk becoming a convenient shield for the humans and firms that profit from deployment. 

There’s a more practical model hiding in plain sight.

Agentic AI behaves more like a trained animal than a manufactured tool

If you’re a CIO, you already know the uncomfortable truth: agentic AI isn’t “programmed” in the classic if-then sense. It’s trained. That’s not just semantics—it’s a governance clue.

Dogs have agency. They act independently, sometimes unpredictably. Yet they are not legal persons. That combination—agency without personhood—is exactly where today’s agentic AI systems sit. 

Training is closer to shaping behavior than specifying it. Like a dog, an agentic AI system can generalize from experience, respond unexpectedly to a novel stimulus, and develop bad habits if rewarded for them. And like dog breeders, developers can create systems with strong baseline “temperament”—but they can’t perfectly foresee behavior in every new environment.

Dog ownership law generally starts from a simple premise: if you choose to bring a potentially unpredictable actor into society for your benefit, you bear the risk of what it does. In other words, the owner becomes the risk-bearer.

That legal posture doesn’t absolve breeders or deny victims recourse. It simply puts the default burden on the party with day-to-day control. 

Across jurisdictions, this plays out in two familiar ways:

• Negligence standards, including the classic “one-bite rule,” where prior knowledge of danger matters
• Strict liability, where the owner may be responsible even without proving negligence

Both approaches drive the same outcome: owners are incentivized to train, contain, and supervise responsibly. You choose the dog, the environment, the leash, and the level of supervision. The law nudges you to do those things well.

In enterprise AI, the environment is the liability surface

In agentic AI, the “environment” is largely determined by the enterprise:

• Which tools the agent can access
• What data it can retrieve
• What actions it can take
• What guardrails constrain it

CIO organizations increasingly decide whether agentic AI is behind a fence (sandboxed), on a leash (limited permissions and approvals), or off-leash (fully autonomous execution). 

Shift liability from the “breeder” to the “owner”

Product liability has a role, but it cannot be the only answer. 

Developers shouldn’t automatically be on the hook for every downstream use of a flexible agentic AI system—especially when customers fine-tune it, connect it to proprietary data, or direct it into high-stakes workflows the developer never intended.

Taking the “dog model” a step further offers a cleaner default: the entity that reaps the economic benefit of agentic AI should also insure against its potential harm. This aligns responsibility with control and creates practical incentives. For example:

• If you deploy an agentic AI system to triage medical advice, you should “own” the risk of that choice.
• If you use agentic AI to move money, approve claims, or generate regulatory filings, you should carry the burden of ensuring it behaves safely in those contexts.

Just as dog owners choose breeds for specific tasks, enterprises should be incentivized to choose models and architectures best suited for sensitive work—systems with strong evaluation evidence, better controllability, and proven failure containment.

What “Digital Leash Laws” could look like in a sovereign AI enterprise

There are already clear lessons from the 13% thriving with their agentic AI across their enterprises. They accept—in fact, embrace—the responsibility, designing for it at 1.25x the intensity of their peers. They start with a sovereign AI and data foundation—building their own AI and data platforms and effectively fencing agentic AI into a controllable environment.

You can assess how close your enterprise is to this model at: https://www.enterprisedb.com/sovereignty-matters

Enterprises don’t need to invent a new category of electronic personhood to govern agentic AI.

We already know how to manage non-human agents that act unpredictably. We place responsibility on the humans and organizations that choose to bring them into the world, decide how they’re trained, and control where they’re allowed to roam.

That model has worked before. It can work again—if enterprises are willing to own what they unleash.

To learn more, visit here.

Today, the conversation in every boardroom is most likely centered on a single, transformative force: artificial intelligence (AI). Many see it as the engine for unprecedented growth, efficiency, and innovation. And, while this belief is justifiable, the entire revolution is being built on a fragile foundation of trust — an already fragile ground that is about to shift even further.

As AI systems begin to manage supply chains, deploy code, and execute financial transactions, the nature of risk changes entirely. The primary threat becomes the catastrophic cost of disruption to the intelligent systems that form the central nervous system of modern business.

To harness AI’s promise while mitigating its existential risks, we already know that leaders must move beyond a defensive security posture. To be effective, leaders must also fundamentally shift how they view security as a whole. They must view it as the foundation that innovation is built on, not as a barrier to progress. To do this, we, as a collective, must build a proactive strategy based on three core pillars of trust.

1. Engineering for trust

Trust cannot be an afterthought; it must be an engineering outcome. In the past, security was often a gate that slowed progress. Today, that model is inverted. A modern, unified security platform with trust built in by design now serves as a powerful strategic accelerator.

Automated security, when treated as a native component of the AI development lifecycle, eliminates the traditional brakes on progress. This enables our teams to innovate and deploy new models with the speed and confidence that delivers a direct, quantifiable competitive advantage. This transition from a reactive posture to one that ensures innovation velocity is key.

The “engineering for trust” approach also allows us to address a silent liability plaguing many organizations: decades of accumulated security debt. A patchwork of disconnected point products creates a complex and vulnerable attack surface, a problem now amplified by the cloud. Our exclusive internal research found that a majority of cloud databases related to AI development are not properly secured, lacking basic encryption or access controls.

Moving to a unified, trustworthy platform is akin to refinancing this debt — a solution that any board member would be amenable to. This type of platform simplifies operations, reduces long-term risk, and frees up our most valuable resources to focus on growth instead of just defense.

2. Cultivating cultures of trust

A single human error can undermine even the most perfectly engineered system. While technology provides the foundation, a vigilant and security-conscious culture forms the crucial human layer of the trust stack.

In an era of AI-powered phishing and sophisticated social engineering, every employee must become a steward of their organization’s security. This challenge is magnified by the rise of shadow AI. Our latest research on SaaS risks reveals that the use of unsanctioned third-party AI tools in the enterprise has skyrocketed, creating a massive blind spot where sensitive corporate data is regularly fed into untrusted models. That is why this pillar demands more than annual training videos. It requires a deep-seated culture of awareness where people are empowered to question anomalies and act as the first line of defense.

The value of this culture extends far beyond risk mitigation. A strong culture provides the ethical guardrails that ensure AI is used responsibly, protecting the brand and maintaining customer confidence that is so difficult to earn and so easy to lose. Its essential, human-driven process protects the organization from the inside out.

3. Governing for trust

The speed and scale of modern AI demand a new governance model built on two key principles: unwavering human control and radical industry-wide cooperation.

First, we must design systems that guarantee human oversight. Robust, human-in-the-loop governance is the ultimate safeguard against the catastrophic business disruption that autonomous systems could otherwise trigger. It is the board-level guarantee that our most valuable tools remain under our command, operating as intended.

Second, we must recognize that we cannot face this new threat landscape alone. AI-powered attacks are an ecosystem-wide problem that demands an ecosystem-wide defense. Sharing threat intelligence and best practices across companies and industries is a core business necessity for our collective survival and stability.

Trust as the ultimate ROI

To lead in the age of AI, our strategy must be clear. We need well-engineered systems that accelerate the business, a vigilant culture that protects it, and a robust governance that ensures its resilience. The goal of a modern security strategy has fundamentally changed, shifting from merely preventing incidents to actively creating and protecting value.

In the AI-first world, thriving organizations will understand that trust is the most valuable asset on their balance sheet and the ultimate driver of their success.

Curious what else Ben has to say? Check out his other articles on Perspectives.

After much fuss, speculation, and leaks, the European Commission presented its new proposals on simplifying regulations in the digital area last week. The package is a small buffet of measures, with the most notable ones being changes to the EU’s controversial AI regulation and amendments to the GDPR.

The background is of course the strong concern that the EU is falling behind in the global tech rally, with reduced innovation and competitiveness as a result. A concern that is justified, given that just a year ago former ECB President Mario Draghi presented his horror report on the situation in the EU, which became a blowtorch. During the Commission’s press conference for last week’s proposal, Draghi was referred to several times.

“It’s now or never, Mario Draghi said in his report a year ago. Now it’s even more now or never,” said Tech Commissioner Henna Virkkunen at the press conference.

Despite the rhetoric, the new measures may not offer the turnaround for the EU one might expect. Most legislation remains in place. A heavy part of the AI ​​regulation concerning so-called high-risk AI is being postponed for at least a year, but that creates more uncertainty rather than less. The GDPR is being amended to make it clear that personal data can be used to train AI, but according to the Commission, this is only in line with what the European Court of Justice has already stated. (The Swedish Authority for Privacy Protection (IMY) calls the changes “substantial.”)

Added to this are measures such as simplified data rules, simplified cybersecurity reporting, and a digital corporate wallet that will reduce administration for companies that want to operate in several EU countries. And there will be fewer cookie pop-ups on the web, something that will certainly please many citizens but that will not have a significant impact on the EU’s competitiveness.

The proposals have of course already attracted criticism. The EU is giving in to “big tech,” it has been said. Yet it didn’t take many seconds after the announcement before an email from the lobby group CCIA, which represents Google, Amazon, Apple, and Meta, came in, saying the measures were far too weak. 

“There will be many stakeholders who say this is not enough, and some may say it is too much, so I think we have a balanced package,” Henna Virkkunen said at the press conference.

A broader crisis for EU tech

I personally find it interesting to read the Commission’s new proposal in parallel with another report that came out this week, the annual State of European Tech from Niklas Zennström’s venture capital company Atomico. A report that this year has turned into something of a political rallying cry in addition to the interesting statistics about the European startup sector it always contains.

Atomico’s most important points for building a stronger tech ecosystem are not at all about legislation at the AI ​​Act or GDPR level. The concrete legislation most in demand is the more or less promised “28th Order” that simplifies rules and administration for startups and makes it less risky for innovative companies to fail.

Data and AI regulatory burden is far down the list of obstacles startup stakeholders note when polled by Atomico. Things like market fragmentation, tax regulations, access to capital, and labor regulations all rank higher. And for investors, there is of course the limited opportunities to make an exit.

Focusing too much on “tech-specific” legislation as a cure for EU digital competitiveness is a risk when there are so many other issues that have at least as much impact.

One such issue that Atomico highlights, and which I have written about before, is Europe’s low self-confidence. Despite the continent’s tech scene being stronger than ever and the optimism in the tech community being at its highest in a decade, there are still too few who believe in a thriving tech future for Europe.

“This is a sign of something structural. Europe has yet to fully convince its own stakeholders — founders, investors, and public and private financiers — that it is the best place to build world-leading companies. Collective self-confidence is essential, and without it, even the most audacious ambitions can only go so far,” writes Atomico.

I don’t know if the Commission’s new package will do much to change that. But of course, you have to start somewhere.

Is AI really ready to replace all those time-tested, human-powered service processes in the world’s companies? Business headlines would certainly suggest so.

After all, an IDC-Microsoft global survey of 2,000 C-suite business leaders said that AI is already driving performance and saving time — realizing $3.50 to $8 in ROI for every $1 they invested in the tech. PwC’s 28th Annual Global CEO Survey backed up that sentiment, with 1 in 3 CEOs agreeing that generative AI increased revenue and profitability at their companies in 2025, and 50% of those surveyed said that they expect profit increases by 2026 because of their AI-driven projects.

With a hype cycle like this, IT leaders across the business spectrum are feeling the pressure to jump on the AI bandwagon. In fact, Gartner predicts that by 2027, 50% of business decisions will be augmented or automated by AI agents.

Why, then, is the decision to invest in AI going wrong for so many companies? For every news story touting AI’s success, you see another, like a 2025 analysis by MIT that showed only 5% of AI projects succeed.

The problem is clear. AI, at this moment, is failing to live up to its full potential. The reason isn’t because AI is removing human effort from work. It’s because we haven’t been using AI to make our processes more human-focused.

AI and the innovation paradox

AI and BI are supposed to supercharge productivity and the quality of output. But something happens when you get that shiny new dashboard, fresh cloud AI license, or that nimble chatbot. Initially, you might see some immediate gains, like customer service times decreasing, for instance. But soon, AI starts to multiply the work in ways you wouldn’t expect, setting your AI launch at a distinct disadvantage.

Some costs don’t show on a dashboard, and soon your organization may experience roadblocks such as these:

• Cognitive load migrating, with agents spending less time clicking and more time adjudicating edge cases — harder work that needs context and coaching.
• Apprenticeship moments shrinking, with bots unintentionally erasing opportunities for new hires to watch seasoned pros defuse tricky conversations.
• Customer belonging eroding when the first customer touch feels like a robot trying to contain their request, instead of a human listening and fully appreciating their problem.
• Employees becoming disenfranchised as they worry about losing their jobs to AI, or technology changes being forced that will make it impossible to do their job well.
• Errors piling up and processes lengthening as employees have to step up to correct miscommunications that arise from faulty results and data processes generated by AI.

These are some of the reasons why 88% of AI pilots never reach production, according to CIO.com’s own reporting. So, it’s no surprise that CIO Dive says that 42% of companies have now scrapped the majority of their AI initiatives.

The root causes aren’t technical. Neither are the solutions. All the data chaos, strategy misalignment and leadership inertia surrounding AI can be fixed by putting humans at the center of a company’s framework from day one.

How the most successful companies are thriving with AI

Human-powered use cases are the key to successful results for AI. Here are examples of how enterprise-level companies have gained market advantage by being early AI adopters—and putting both internal and external customer experience at the heart of their AI strategy.

Company/case study link	Results
General Motors	GM got interviews on calendars in 29 minutes using conversational scheduling, so recruiters could spend time with people — not logistics.
[7-Eleven]	7Eleven freed 40,000 hours/week for store leaders by automating screening, FAQs and scheduling with a conversational assistant.
Captain D’s	Captain D’s cut turnover 75% by pairing a conversational application tracking systems with personality assessments to hire for fit.
Tata Communications	Tata Communications increased women hires 19% with skills-based AI matching and masked profiles to curb bias.
Bank of America (Erica)	BofA’s Erica logged 3-plus billion interactions with a >98% find rate, shifting agents to higher-value, human conversations.

5 principles of human-first AI automation

The companies cited previously are mostly enterprise-level, but overall, AI affordability means that companies of all sizes can access AI, from SaaS tools like Microsoft Copilot to more customized bots and protocols. With so much competitive pressure to retool your company with AI, it’s tempting to research and purchase tools, then let your staff figure out how to use them. But if you want to create AI processes that have an impact on your business, it pays to think differently about how you’re implementing AI.

Here are my top five suggestions for how to achieve the right mindset for an AI-forward IT strategy.

Principle no. 1: Automate service for moments, not for tickets

Most AI service runbooks are ticket-centric: “if category = X, do Y.” The better question is, “What human moment am I in right now?” Anxiety after an outage is a different moment than curiosity about a new feature, for instance. This creates the perfect opportunity to build AI systems that respond to your customers’ feelings and needs, with strategies such as these:

• Adding intent and sentiment signals at event intake, so AI can handle simple inquiries, while more complex or high-emotion tasks are handled by your expert service staff immediately.
• Designing meaningful and specific first replies for first contact, acknowledging the exact request and telling customers what’s going to happen next.
• Close the loop with ticket notes that teach. When bots act, have them leave a short, human-readable note‑ in the service ticket: what was detected, what changed, how to reverse it. That single habit reduces repeat contacts and upskills the team.

Principle no. 2: Make ‘human-in-the-loop’ a feature, not a fallback

Customers don’t resent automation. They resent confusion, which happens when a system fights to finish a job it shouldn’t. Your best defense is a clear contract between humans and machines.

When putting together new processes for AI, there are three explicit guardrails to consider:

1.  Handoff rules. Define the thresholds for uncertainty, risk and emotion that trigger a human. (“If confidence < 0.8, or ‘urgent + billing’ intent, or negative sentiment twice → escalate.”)
2. Audit trail + explainability. Require bots to leave plain language‑ reasoning in the ticket: why a step happened, what changed. This protects customers, agents and compliance.
3. Two-way interrupts‑. Give agents a “pause/override” and customers an “opt‑out to human” that always works. Make these options visible in every channel.

Designing these from the start reframes automation as a service teammate with defined responsibilities, not a black box that occasionally misbehaves.

Principle no. 3: Lead with use cases, not tools

If you begin with tools, you’ll automate what’s easy. If you begin with use-cases, you’ll automate what matters. A simple discipline borrowed from business intelligence‑ programs helps here: force yourself to answer why, who and, what data before you build anything. (This mirrors the way data teams vet dashboards: define value, access and governance first, then invest)

Four questions to answer before writing a single rule:

1. Which outcome are we buying? Shorten time-to-reassurance? Reduce repeat contacts? Increase first-contact resolution for one class of issues?
2. Who gets access—and who doesn’t? Licenses, least privilege roles, sensitive data your automations may touch.
3. What are the regulatory side effects? If your automations surface or move protected data, how will you document consent, logging and retention?
4. How will we amortize ROI over time? Choose a use case that pays for itself within an acceptable amount of time, which then compounds as you reuse building blocks across adjacent workflows.

Tip: Write a one-page “use-case charter” for each automation. It should name the human moments involved, the experience metrics you’ll watch, the handoff rules you’ll enforce and the data boundaries you’ll respect. You’ll ship fewer experiments — but you’ll keep more of them.

Principle no. 4: Design data governance as your bedrock

Every helpful workflow you build is, at heart, a data flow with identities verified, privileges scoped, actions logged and outcomes auditable. If those foundations aren’t built safely, trust erodes quickly, inside and outside your company.

Make these non-negotiables‑ explicit:

• Identity and least privilege. Treat every bot, service account and integration as a first-class identity with the minimum scope required. Rotate secrets, expire tokens and separate duties so no single person can both decide and execute on sensitive changes.
• Zero trust by design. If your agents must reauthenticate for elevated actions, your automations should too. Think of continuous verification not as friction, but as a feature that preserves client trust and cleanly documents who (or what) did what, when and why.
• Data boundaries. Map which workflow touches protected data and encode red lines (no copying to external systems; redact personally identifiable information in notes; minimize retention for transient artifacts).
• Explainability plus audit. Require every automation to leave a plain language rationale in the record. This is how you pass audits and keep your humans in the loop with context that teaches.

If this sounds more like BI or security hygiene than “support,” that’s the point. The same discipline that makes analytics trustworthy makes automation trustworthy, because both are just governed movement of data.

Principle no. 5: Measure what matters to humans

Dashboards rarely show the dissatisfaction of your customer/audience. To catch and fix it, you need a paired scorecard that values experience alongside efficiency.

A balanced set we use at Integris:

• Operational key performance indicators: such as time‑to-reassurance, time-to‑first-response, first contact resolution by intent, repeat contact rate, or change failure rate for auto actions.
• Human experience: such as client sentiment deltas from first touch to resolution; deflection with‑ satisfaction (did the “self-serve” path still earn a high satisfaction narrative?)
• Apprenticeship minutes: such as how often automations leave notes that actually help a Level‑1 learn or improve an agent’s sense of autonomy pulse.

This is where the research is clear: poor automation design can degrade autonomy and informal learning. Make those risks measurable, or they’ll grow silently.

AI that lives up to its promise, now and in the future

If you want good front-end results with AI, the answer lies in having good systems and processes at the foundation, in addition to good data hygiene. That calls for company-wide planning before you design, purchase and implement new AI solutions. Identify the departments that will be affected by the new technology and execute departmental committees to conduct discovery sessions to decide what data sets your AI will access.  You can then brainstorm how their actions with AI should be stored and monitored. This will help sort out issues of process and document ownership, so you can build proper data governance guardrails.

Remember, your AI initiative is only as good as the preparation, governance and people behind it. Now’s the time to step up with the IT leadership that can take your organization’s productivity and customer satisfaction to the next level.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

CIOs are under pressure to deliver on AI’s promise. Yet history shows that many digital transformations have underdelivered — not because of strategy, process or technology, but because of people. Without engaged, enabled and aligned employees, even the most promising AI initiatives will stall. Models may be built, but they won’t be trusted or adopted. Workflows may be reengineered, but without buy-in, they’ll sit unused.

At Metis Strategy, our work alongside technology leaders, driving some of the world’s most complex transformations, has resoundingly taught us that success is always people first. The same lessons apply today as organizations pursue AI-powered transformations: those that succeed put people and culture at the center. Culture shapes every element of the operating model — what decisions are made, how decisions are made, how resources are prioritized and how quickly the company adapts.

Common pitfalls of digital and AI transformations

Despite strong intentions and significant investments, many transformations falter because leaders misjudge where the true risks lie. A common failure pattern is over-indexing on technology or process while neglecting people. New AI platforms or workflows are often launched with great fanfare, but without engagement, enablement and alignment, employees struggle to adapt and value goes unrealized.

As the ADKAR framework highlights, sustainable change requires more than a solution — it requires awareness, desire, knowledge, ability and reinforcement at the individual level.

Another pitfall occurs when transformations become process exercises rather than engines of business value. When initiatives are framed as IT-only or designed around governance for its own sake, they lose relevance and fail to inspire the commitment needed for lasting change.

Transformations also stall when priorities are scattered or poorly communicated. Without enterprise-wide alignment, programs become optional, teams are spread too thin and execution suffers. In these cases, even well-designed AI strategies cannot deliver impact.

Finally, cultural resistance or a lack of trust can quietly derail transformations. Employees who do not see how AI initiatives align with their own incentives may disengage, breeding fatigue and undermining momentum. Without trust in data, models and leadership, adoption falters no matter how advanced the technology.

For CIOs, avoiding these patterns is essential. The organizations thriving in the AI era are those that design transformations with people and culture at the center from the very beginning. Through our client work, we’ve identified four cultural elements that consistently shape transformation outcomes — and four actions leaders can take today to strengthen them.

Anchor strategy in customer centricity

Successful transformations align operating models with customer needs. Too often, companies define themselves as “sales-led” or “product-led” and allow that orientation to drive key decisions. While this can create enterprise clarity, it risks sidelining customers or alienating parts of the organization.

In contrast, enterprises that adopt a true customer-first approach build resilience and agility across functions. Their operating models align incentives, prioritize experiences and ensure teams move in step with market needs. As explored in Achieving product success: A five-step framework for customer-centric design, an article written by Metis Strategy’s own Andre Lopes de Carvalho, organizations that embed customer centricity into their design and delivery processes create more value and are better equipped to sustain transformation.

Action for CIOs

Revisit your mission, values and incentive structures. Ensure they reinforce a culture where the customer is the anchor for decision-making at every level and for every department.

Build engagement through learning and development

Digital and AI transformations are demanding. Employees must adapt to new ways of working, acquire new skills and deliver against rising expectations — all while managing day-to-day responsibilities. Without meaningful investment in people, fatigue and disengagement set in, jeopardizing transformation success and putting millions of dollars of investment at risk.

Leading organizations counter this by embedding continuous learning into their cultures. Targeted learning and development (L&D) programs, aligned with transformation priorities, not only upskill employees but also strengthen commitment to shared goals. The best programs address both business outcomes and personal growth — answering “what’s in it for me” alongside company goals.

Action for CIOs

Provide protected time and resources for development. Tie L&D investments directly to transformation outcomes to ensure employees are motivated and equipped to deliver. Acknowledge that meaningful learning requires space — even during working hours.

Accelerate agility with distributed decision-making

Leadership sets direction, but decision-making structures determine speed. Transformations falter under traditional command-and-control models, where approvals and escalations slow progress. The fewer people responsible for making decisions, the slower progress will be made.

Our experience shows that pushing decisions closer to the problem accelerates execution, improves accountability and fosters innovation. Empowered teams make better, faster choices — particularly when leaders set clear guardrails and reinforce trust. A decision-making framework, for example, clarifies which choices can be made locally and which warrant escalation, enabling faster, distributed decision-making.

Action for CIOs

Reduce layers of approval and empower small, cross-functional teams with decision rights. Ensure leadership behaviors reinforce empowerment, not control.

Drive innovation with test-and-learn practices

No transformation follows a straight path. Markets shift, technologies evolve and customer expectations change. AI adoption in particular requires experimentation — testing models, validating outcomes and adapting quickly to advances. Thriving organizations build cultures of experimentation where teams are encouraged to test, learn and adapt at speed.

We’ve seen this approach succeed when companies create the time and structure for experimentation, whether through dedicated capacity, lightweight governance or innovation programs. Not all experiments can succeed, so rather than penalizing failures, promote a culture that encourages learning from them. The result is not just innovation but resilience — a workforce confident in navigating uncertainty. As Jamie Engstrom emphasized in Technology, talent and transformation at caterpillar, curiosity and collaboration ensure experimentation is both grounded in business value and disciplined execution.

Action for CIOs

Normalize test-and-learn practices across teams. Protect capacity for experimentation, ensure lessons are shared and reward adaptability as much as execution.

People as the transformation differentiator

Every transformation involves new strategies, processes and technologies. What ultimately determines success or failure is whether leaders place people and, by extension, culture, at the center. People shape decision-making, innovation and execution; they are the connective tissue of the operating model. CIOs who recognize culture as a true differentiator are better positioned to navigate complexity, make effective decisions and deliver sustained impact.

A case in point: Wolters Kluwer

Wolters Kluwer’s ongoing transformation from a traditional publishing business to a cloud-first, AI-driven enterprise illustrates how people and culture drive successful AI-powered transformations. When we spoke with CIO Mark Sherwood, he discussed how customer centricity is reinforced through business relationship managers (BRM) who bridge technology and business units, ensuring digital investments are aligned with customer and market needs.

Learning and development are emphasized as employees build new skills in cloud, AI and data governance, enabling them to adapt to rapidly evolving technologies. Distributed decision-making is strengthened by embedding BRMs to bring tech and business closer together, ensuring alignment and enabling smarter choices on priorities and resources. Agility is fueled by a test-and-learn mindset, with experimentation balanced by strong ethical AI practices and disciplined measurement.

By maintaining a strong culture and people-first approach, Wolters Kluwer has accelerated its evolution and positioned itself as a leader in delivering trusted, technology-enabled solutions across industries.

Building people-first digital and AI transformations

CIOs today face constant change — none more urgent than the rise of AI. Shifting customer expectations, new competitive threats and accelerating disruptions are magnified in the AI era. Anchoring transformation in people and culture is what turns volatility into opportunity and lasting advantage.

For CIOs, the mandate is clear: build operating models that not only work today but also adapt continuously for tomorrow. That requires embedding four cultural practices at the center of every digital and AI transformation:

1. Anchor strategy in customer centricity so that every decision reinforces value creation for the end user.
2. Invest in learning and development to equip employees with the skills, confidence and engagement required to sustain change.
3. Accelerate agility with distributed decision-making by empowering teams closest to the work with clear authority and trust.
4. Drive innovation with test-and-learn practices to normalize experimentation, build resilience and ensure lessons are rapidly applied.

When CIOs champion these actions, they move beyond technology deployment to transformation that is embraced, scaled and sustained. Put people first and digital and AI transformations become not only achievable, but sustainable.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Global industrial competition has entered an era in which “whoever controls semiconductors controls the future.” According to a Gartner forecast, the global semiconductor market is expected to reach a record high of $733 billion in 2025, and semiconductors are at the core of a variety of cutting-edge technologies, including AI, electric vehicles, space development, and quantum computing. Semiconductors are no longer simply components; they have become “strategic materials” that form the foundation of national security, industrial infrastructure, and technological supremacy.

Japan was once at the forefront of this global competition. From the late 1980s to the early 1990s, Japan’s semiconductor industry held more than half of the global market, ushering in a golden age known as “Hinomaru Semiconductor.” In 1986, Japanese companies dominated the top three spots in the Gartner’s semiconductor rankings, with NEC in first place, Hitachi in second, and Toshiba in third, and six companies in the top ten.

However, this glory is rapidly fading due to flaws in institutional design and structural rigidity. In Gartner’s 2024 forecast, not a single Japanese company was ranked in the top ten.

To learn more about out why Japan’s semiconductor industry has fallen into decline, we spoke with Kazukazu Sekiguchi, one of Japan’s leading IT journalists and chief researcher for the Japan Public Relations Association’s special study group, the “Lost 30 Years Verification Study Group.”

Japan dominated the global semiconductor market in the 1980s. What was the reason for this?

Kazukazu Sekiguchi: The background to Japan’s ability to lead the world in the semiconductor industry was its advanced manufacturing technology and a management style based on a general electric company model. Semiconductor technology was originally developed in the United States, but in Japan, general electric manufacturers such as NEC and Toshiba entered the market in earnest. A major advantage of Japanese companies in particular was that they had in-house product groups with clear uses (exits), such as home appliances and personal computers. This clarity of exit strategy made it easy to forecast demand and enabled efficient operation through a vertically integrated management structure, from design to manufacturing and sales.

Another factor in our success was that the scale of semiconductor investment in Japan at the time was still small, allowing flexible and swift investment decisions to be made at the business division manager level. In addition, the emergence of highly competitive semiconductor manufacturing equipment and material manufacturers in Japan allowed us to establish a system that could handle everything from design to manufacturing and sales, enabling us to establish an international advantage. At the time, semiconductors were manufactured by general electronics manufacturers in Japan, and we were fortunate that we had in-house suppliers of semiconductors for home appliances and personal computers.

Why did Japan’s semiconductor industry, which dominated the world until the early 1990s, decline? What are the fundamental causes of this? Technology, policy, or corporate culture?

The loss of competitiveness in Japan’s semiconductor industry is not due to a single cause, but rather to a complex interplay of multiple factors. The biggest turning point was the policy failure symbolized by the Japan-US Semiconductor Agreement. Initially, the US held an overwhelming share of the semiconductor market, but Japanese companies rapidly improved their technological capabilities and production capacity, strengthening their presence in the global market. However, for the US, semiconductors are also the core of the national defense industry, and from a security perspective, there was growing wariness about Japan taking the lead. In response to this growing public opinion, the US government began to strongly urge Japan to open its market.

On the other hand, Japan, with its general electric management style, promoted mass production driven by internal demand. This led to an expansion of market share, but intensified price competition led to what was perceived as dumping. In addition, Japanese companies had a strong tendency to be self-sufficient and were reluctant to actively adopt American-made semiconductors in their products.

It was under these circumstances that the first phase of the Japan-US Semiconductor Agreement, concluded in 1986, included a “side letter” (confidential document) in which the Japanese government promised to raise the market share of foreign-made semiconductors to 20%. This was effectively market intervention and had a major impact on the domestic industrial structure. Furthermore, the second phase of the agreement made this market opening share target explicit, intensifying pressure for structural transformation of Japan’s semiconductor industry. This gradually weakened the competitiveness of Japanese companies and led to a decline in their position in the global market.

Were there any technical biases or corporate culture issues?

In the late 1980s, Japan accounted for over 50% of the global semiconductor market. However, much of that was DRAM, and the vertically integrated model meant Japan was slow to shift to logic used for logical operations and ASICs (application-specific integrated circuits). As a result, profit margins became harder to obtain, and the business lost its appeal. Furthermore, as DRAM capacity increased, the scale of capital investment also ballooned. While investment decisions were initially made at the division manager level, as the scale grew, company-wide decision-making became necessary, and decisions were delayed when the top management was not an expert. The strengths of a general electric company actually became a hindrance. Meanwhile, overseas, there was a shift toward a horizontal division of labor that separated design and manufacturing, leading to the emergence of giant foundries (contract manufacturing companies). Japan’s insistence on vertical integration meant that it was no longer possible to make timely investments as investment amounts increased, significantly undermining its competitiveness.

Some have pointed out that Japanese companies had difficulty adapting to the silicon cycle. What do you think?

The silicon cycle is highly volatile, and for a general electric manufacturer, the impact on business performance is too great. That’s why they tried to separate the semiconductor business. Takashi Kitaoka, who was then president of Mitsubishi Electric, made this decision at an early stage, and there was a lot of criticism at the time. However, I think it turned out to be the right decision in the end.

Hasn’t the rise of overseas semiconductor manufacturers, including Samsung Electronics, also accelerated the decline of Japan’s semiconductor industry?

I think the emergence of new players, symbolized by South Korea’s Samsung Electronics, was a major factor. Samsung is owner-managed, so it makes decisions quickly. It can also make large-scale investments quickly. Japan has a strong culture of vertical division and horizontal alignment, which prevented it from shifting to a horizontally separated model. The vertical integration model was effective in the initial phase of semiconductors, but as the scale expanded, it lost flexibility and was unable to respond quickly, which I think was the problem.

Why has Samsung become so powerful so quickly?

I think a big factor was the collapse of Japan’s bubble economy after the 1990s, which led Japanese manufacturers to refrain from investing. Also, restructuring and retirement age systems at Japanese companies forced a large number of engineers to retire, which led to Korean companies hiring them at high prices. As a result, there was an outflow of Japanese technological brains. This has in part led to a decline in the competitiveness of Japanese manufacturers and an increase in Korean competitiveness.

The rise of overseas companies was probably also due in large part to the strong yen at the time.

After the Plaza Accord in 1985, the yen rapidly appreciated. This was also the time when the Japan-US Semiconductor Agreement was concluded in 1986, and Japan entered a recession due to the strong yen, making it difficult to sell goods overseas. Furthermore, in 1990, the real estate bubble burst due to quantitative restrictions, and corporate investment appetite suddenly cooled. This had a major impact on the semiconductor industry. The previously “aggressive, aggressive investment” was no longer possible.

The Ministry of International Trade and Industry (now the Ministry of Economy, Trade and Industry) tried to restructure the semiconductor industry in order to revive it, but it seems that it did not work out.

The Ministry of International Trade and Industry (MITI) used the reorganization of the mainframe era into the three major computer groups (Fujitsu + Hitachi, NEC + Toshiba, Mitsubishi Electric + Oki Electric) as a model for grouping the semiconductor industry. Subsequently, the government led the formation of “Hinomaru Alliances,” resulting in the creation of companies such as Elpida Memory, which merged the DRAM businesses of NEC, Hitachi, and Mitsubishi, and Renesas Technology, which merged the system LSI businesses of Hitachi and Mitsubishi. However, because these were alliances formed by spinning off companies from the original companies, decision-making was slow and responsibilities unclear. In the end, Elpida was acquired by Micron Technology of the United States, and Japan’s semiconductor industry was swallowed up by global competition. A similar failure occurred in the LCD field. When parent companies are too concerned with face, flexible reorganization becomes impossible.

While most of Japan’s major vertically integrated semiconductor manufacturers have disappeared, material manufacturers and the equipment industry are still thriving. Doesn’t this mean that Japan’s semiconductor industry will be reborn?

Semiconductor manufacturers require huge investments in domestic manufacturing processes, but equipment and material manufacturers can expand into overseas markets, so even if the domestic market is deteriorating, business can be sustained as long as there is demand. However, it is also true that manufacturers in countries such as Korea have gained strength as a result of supplying these equipment and materials overseas for many years. While Korea has strengths in finished semiconductors, it still relies on Japan for many of its parts and materials. On the other hand, however, it could be said that the birth of Lapidus and the entry of TSMC into Japan, which hold the key to the future rise and fall of Japan’s semiconductor industry, were made possible precisely because there were excellent equipment and material manufacturers remaining in the country.

What does Japan need to do to revive its semiconductor industry in the future?

The impact of COVID-19 has led to a global shortage of semiconductors and disrupted supply chains. As a result, even semiconductors for industrial machinery like automobiles cannot be supplied reliably. Until now, Japan has relied on overseas markets, following a procurement policy that said, “Buy parts wherever they’re cheapest.” This global procurement approach is probably the right decision when the global economy is functioning well, but it won’t work in times of crisis. It is essential to maintain a certain level of manufacturing capacity domestically. Semiconductors are not just parts; they can be considered the nervous system of the entire industry. In order to protect Japan’s industrial competitiveness, I believe it is extremely important to rebuild Japan’s semiconductor manufacturing and supply system domestically.

This article originally appeared on CIO Japan.

While private sector CIOs debate the merits of container adoption and worry about Kubernetes complexity, an unexpected leader has quietly emerged in the enterprise technology landscape: government. Recent research from Nutanix reveals a startling reality that challenges every assumption about public sector innovation — 96% of government organizations are actively containerizing its applications, significantly outpacing adoption rates across most private industries.

Even more remarkable, 83% of public sector organizations deploy multiple Kubernetes environments compared to just 78% globally. Meanwhile, VMware research shows private sector organizations are still split on container preferences — 33% prefer private cloud, 34% public cloud and 33% want both — while government agencies have moved beyond preference to production, running GenAI applications on containers at a 68% rate.

This reversal defies conventional wisdom. The government is supposed to be slow, risk-averse and technology-laggard. Yet after 11 years building enterprise systems — from VMware’s hybrid cloud solutions to architecting F5’s BIG-IP management plane — I’m seeing something fascinating: The very characteristics that make governments “slow” are producing superior container implementations.

The question isn’t whether containers work in government. It’s what private sector CIOs can learn from how the government is getting Kubernetes right.

The government’s quiet container revolution

What the research reveals isn’t just surprising — it’s a complete inversion of technology adoption patterns. The Nutanix study, based on surveys of 448 IT professionals across federal, state, local and public healthcare organizations, shows the government isn’t just keeping pace with container adoption. They’re leading it.

The 96% containerization rate across all public sectors outpaces most private industry benchmarks I’ve tracked. But the real story emerges when you examine what they’re containerizing. GenAI applications top the list at 68% adoption in the public sector, compared to lower rates in private enterprise. Development and test applications follow at 59%, with federal and central government agencies pushing GenAI containerization even higher at 76%.

These aren’t toy implementations. When 83% of public sector organizations deploy multiple Kubernetes environments — compared to 78% globally — you’re looking at serious, production-scale container operations. In my experience supporting enterprise deployments at F5, managing multiple Kubernetes environments represents significant operational maturity.

The subsector breakdown reveals even more interesting patterns. Federal and central governments lead GenAI containerization at 76%, while state and local government agencies show strong adoption across all application types. Public healthcare organizations demonstrate 66% GenAI containerization, which is remarkable when you consider the regulatory complexity these organizations navigate.

What strikes me most about these numbers is what they say about organizational readiness. During my time at VMware, we often struggled with private sector customers who wanted to move fast but lacked the governance frameworks to implement complex technologies sustainably. Government organizations approach container adoption differently. Their built-in compliance requirements, standardization mandates and risk management processes create natural guardrails that private sector organizations often have to retrofit.

Container adoption as a strategic and disciplined approach

The 91% of public sector respondents who agree their organizations benefit from cloud-native applications isn’t just a statistic — it’s validation of a strategic approach. These organizations aren’t adopting containers because they’re trendy. They’re adopting them because containers solve real problems: standardization across diverse IT environments, improved security through isolation and operational efficiency under budget constraints.

But here’s what the numbers don’t show: the disciplined approach that makes this adoption successful. Government procurement processes, despite their reputation for being slow, force organizations to think through the full life cycle of technology decisions. When you have to justify every purchase through multiple approval layers and demonstrate long-term value, you develop better evaluation criteria.

This systematic approach to container adoption is producing results that many private sector organizations struggle to achieve. VMware’s research shows that 84% of organizations now use private cloud for both traditional and modern applications, indicating that the disciplined, workload-specific approach the government has mastered is becoming essential across all sectors. While enterprises often implement containers reactively — solving immediate problems without considering long-term implications — government organizations are building container strategies that scale.

The four critical challenges public sector is actually solving

The Nutanix research reveals something fascinating about how government organizations approach container challenges. Rather than being paralyzed by complexity, they’re systematically working through the four obstacles that trip up most enterprise container initiatives. What makes their approach different isn’t the absence of problems: it’s how they frame and solve them.

Infrastructure modernization: The 76% reality check

When 76% of public sector organizations say their current IT infrastructure requires improvement to fully support cloud-native applications, they’re not admitting failure. They’re demonstrating strategic honesty that I rarely see in private sector assessments.

In my experience building hybrid solutions at VMware, private sector organizations often overestimate their infrastructure readiness. They want to believe their existing systems can handle containers without major changes. Government organizations skip this wishful thinking. Their assessment processes force a realistic evaluation of what it actually takes to run containers at scale.

This honest assessment drives better outcomes. Instead of bolting containers onto unprepared infrastructure and dealing with performance issues later, government organizations invest in foundational improvements first. They understand that container success depends more on operational readiness than on technology deployment.

Container-native development: The 60% skills challenge

The 60% of public sector organizations finding cloud-native application development challenging points to something the private sector often misses: containers aren’t just an operations problem. They’re a development methodology shift.

Government organizations are approaching this systematically. Rather than expecting developers to figure out containerization on their own, they’re building formal training programs and establishing centers of excellence. The same governance structures that slow initial decisions accelerate organization-wide capability building once decisions are made.

What I’ve observed at F5 is that enterprises often implement containers in silos — individual teams or projects adopt them independently. The government’s approach is more coordinated. When they commit to container-native development, they commit organizationally. This creates consistency that private sector implementations often lack.

Data silos: The 67% integration problem

The 67% struggling with isolated data storage systems reveals the government’s biggest architectural challenge — and its biggest opportunity. Government agencies have been dealing with data integration problems long before containers existed. They’ve developed approaches to breaking down silos that private sector organizations are just beginning to understand.

The key difference is perspective. Private sector organizations often view data silos as technical problems to solve with better APIs or integration platforms. Government organizations treat them as governance problems that require policy solutions backed by technology. This policy-first approach creates more sustainable integration architectures.

Application portability: The 59% hybrid reality

When 59% of public sector organizations find portability between clouds and on-premises challenging, they’re grappling with the same hybrid complexity that the private sector faces. But their response is different.

Rather than pursuing perfect portability — which often leads to lowest-common-denominator architectures — government organizations are building standards-based approaches that provide controlled portability. They’re not trying to make every application run everywhere. They’re creating consistent deployment patterns that work across their specific environment mix.

VMware’s Private Cloud Outlook 2025 report confirms this workload-first mindset is spreading across the private sector, with organizations now choosing cloud environments based on workload attributes rather than following blanket cloud-first strategies.

The multi-environment complexity trap

The statistic that stopped me cold was this: 83% of public sector organizations deploy multiple Kubernetes environments. In my work architecting F5’s BIG-IP management plane, I see firsthand what managing multiple container environments actually means — exponential complexity that can paralyze even experienced IT teams.

Each additional Kubernetes environment doesn’t just add one more platform to manage. It multiplies integration points, security policies and operational procedures. When I worked on VMware’s hybrid cloud solutions, we discovered that the operational burden grows geometrically, not linearly. Three environments aren’t three times as complex as one — they’re often nine times as complex.

Yet government organizations are not just surviving this complexity; they’re thriving with it. The question is how.

Standardization as a survival strategy

What I’ve observed in government implementations is fundamentally different from private sector approaches. While enterprises often let each team choose its own container tools and configurations, government organizations enforce standardization from day one. This isn’t bureaucratic inflexibility — it’s operational necessity.

When you’re managing multiple environments across agencies with different security requirements, regulatory constraints and budget cycles, consistency becomes critical. Government organizations understand that flexibility at the environment level requires rigidity at the standard level. They standardize everything they can so they can customize only what they must.

The governance advantage

Government’s built-in governance structures, often criticized as bureaucratic overhead, become competitive advantages in multi-environment container management. The same compliance frameworks that slow initial adoption create operational discipline that private sector organizations struggle to achieve.

When every configuration change requires approval through established channels, you get consistency. When every security policy must align with federal standards, you get uniformity. When every vendor relationship goes through procurement processes, you get strategic vendor management instead of tool proliferation.

Lessons the private sector can learn

After watching government organizations succeed where many enterprises struggle, three critical lessons emerge that private sector CIOs can implement without adopting government bureaucracy.

Governance before technology

The biggest mistake I see in enterprise container implementations is technology-first thinking. Organizations choose their Kubernetes distribution, pick their container registry and select their monitoring tools before establishing governance frameworks. The government reverses this sequence.

Public sector organizations start with policy: who can deploy containers, what security standards apply, how environments get provisioned, what data can move where. Only after establishing these frameworks do they select technology that supports their governance requirements.

This approach feels slower initially but accelerates implementation dramatically. When everyone understands the rules, they can move confidently within them. When technology choices align with policy requirements, you avoid the costly retrofitting that plagues many enterprise implementations.

The practical application for CIOs is simple: establish container governance councils before expanding container adoption. Define your standards, security policies and operational procedures while your container footprint is still manageable.

Security as foundation, not afterthought

Government organizations approach container security differently because they have no choice — their threat models assume compromise. This defensive posture creates more resilient architectures than the “secure it later” approach common in the private sector.

From my experience at F5, I’ve learned that enterprises often implement containers for speed and efficiency, then struggle to retrofit security controls. Government organizations build security assumptions into their container architecture from the beginning. Zero-trust principles, network segmentation and identity-based access controls are architectural requirements, not operational add-ons.

Strategic vendor relationships over tool proliferation

Government procurement processes, despite their reputation for inefficiency, create something valuable: strategic vendor relationships. When you can’t easily add new vendors, you invest more deeply in the ones you have.

This forced discipline prevents the vendor sprawl that complicates many enterprise container implementations. Rather than adopting best-of-breed tools for every function, government organizations build comprehensive relationships with fewer vendors. This reduces integration complexity and improves support quality.

The road ahead — GenAI and containers

The most telling statistic in the Nutanix research isn’t the 96% containerization rate — it’s that 68% of public sector organizations are already using containers for GenAI applications. While private sector CIOs debate AI strategies, government agencies are running AI workloads in production.

This early GenAI adoption reveals something profound about the government’s container maturity. Running AI models in containers isn’t just about having the right technology — it requires operational sophistication that many organizations lack. AI workloads demand dynamic resource allocation, sophisticated networking and security controls that standard applications don’t require.

Government organizations can handle these demands because they’ve built container platforms with the operational discipline to support complex workloads. Their standardized approaches, governance frameworks and multi-environment experience create the foundation that AI applications need.

The government approach suggests a clear path for private sector AI container strategies. Start with operational excellence in traditional container workloads before moving to AI applications. Build the governance frameworks, standardization practices and multi-environment management capabilities that AI workloads will eventually require.

Beyond the hype

The data tells a story that challenges everything we thought we knew about government technology adoption. While private sector organizations chase the latest container trends, government agencies have quietly built the operational foundation that actually makes containers work at scale.

Their success isn’t accidental. It’s the result of treating container adoption as organizational transformation rather than technology deployment. Government’s emphasis on governance, standardization and systematic problem-solving — characteristics often dismissed as bureaucratic overhead — are precisely what container implementations need to succeed.

The lesson for private sector CIOs isn’t to adopt the government’s bureaucracy, but to embrace their discipline. In my 11 years building enterprise systems, from VMware’s hybrid cloud solutions to F5’s BIG-IP management plane, I’ve learned that the organizations that succeed with complex technologies are those that solve their operational challenges before they solve their technical ones.

Government organizations understand this instinctively. Their 96% containerization rate and 68% GenAI adoption aren’t just statistics — they’re proof that methodical approaches beat rapid deployment when it comes to sustainable technology adoption.

Container strategy is infrastructure strategy. The organizations that get the foundation right first will be the ones that successfully harness AI’s potential. The government has shown the way — now it’s time for the private sector to follow.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

As procurement practices become more integrated into larger business strategies around social responsibility, companies are paying closer attention to their supplier base and actively seeking diversity—supporting minority- or women-owned businesses or suppliers that can help meet environmental, social, and governance and corporate social responsibility targets.

To that end, there is a growing push to identify local suppliers from within the communities in which organisations reside. Frequently, these initiatives are driven by regulatory guidelines (most often in the case of public sector entities), but there is a rising appreciation for the value of local buying beyond questions of compliance. For starters, it helps deepen the connection between a business and the community. But the benefits run deeper. “Local buying is good for small businesses and our third-party sellers, but it’s also good for our local communities,” says Antwuan Griffin, general manager, socially responsible purchasing, Amazon Business. “One of the things the pandemic taught us is the intrinsic value in strengthening our local supply chains and making sure our small-business communities are thriving, so they have sufficient capacity. It’s all part of a smarter approach to business buying.”

Happily, local buying is a space in which the value to the business and the values of a business can successfully align, says Lynn Meadors, senior customer advisor at Amazon Business. Investments in the local community can be deeply meaningful to those making them. “These are not random people who happen to be in the area. These are the communities in which buyers live, where their children go to school, where their parents live, and where they grew up,” she says.

Technology as an enabler

Historically, the biggest roadblock to robust local purchasing hasn’t been want or willingness; it was all about logistical capacity—endless hours searching to identify potential suppliers, place and pick up orders, and beyond. “It would cause operational headaches and bottlenecks,” Meadors says. “It was so inefficient.”

Griffin agrees. “The biggest challenge is getting actionable intelligence,” he says. People are willing, even eager, to make procurement decisions that prioritise local businesses, provided they’re given the means to do it. Leveraging technology is key to that effort. Companies can use the feature set of Amazon Business, for example, to identify, highlight, and prioritise local sellers, setting parameters around pricing thresholds, product offerings, and delivery requirements.

“We see smart business buying really being leveraged by customers of all sizes and stripes. For small and medium-sized businesses, this may be the first time they’ve had an ability to drive purchasing toward other local businesses.” — Antwuan Griffin, General Manager, Socially Responsible Purchasing, Amazon Business

“It makes it easy for the administrator to set up a preferred buying policy, and buying local is just one of the many smart business buying policies we use,” Griffin says. “Products that fall into relevant categories that have been established as a priority show up first, so it’s incredibly simple for users of Amazon Business to find something that aligns with what it is they’re supposed to be buying.”

These tools also allow procurement teams to integrate local buying into other strategic considerations around purchasing, while robust real-time reporting and analytics provide the visibility required to properly measure success. “The capabilities of Amazon Business help leaders track progress with an eye toward goals, from the user or buyer level up through spending groups and to the organization as a whole,” he says.

The ability to identify, onboard, and highlight through Amazon Business also allows organisations with smaller procurement operations lacking technical capacity or human bandwidth to take more proactive steps around local purchasing. This, Griffin says, can be a game-changer. “We see smart business buying really being leveraged by customers of all sizes and stripes,” he says. “For small and medium-sized businesses, this may be the first time they’ve had an ability to drive purchasing toward other local businesses. Historically, you’ve needed to set up an entire division within your procurement or finance shop to drive these types of outcomes. Now organizations of all sizes can think big, and dream of what’s possible through procurement.”

The power of local buying in action

For Meadors, the potential of local buying isn’t something that’s just for customers of Amazon Business. At the National Institute of Governmental Purchasing’s 2023 convention in Louisville, Kentucky, she hoped to use the presence of Amazon Business at the event to do some tangible good. Having previously lived in the Louisville area, Meadors was familiar with the landscape of nonprofit organizations there, and identified one dedicated to youth in foster care that was in need of donations.

The idea was to create toiletry kits that could be distributed to the young people served by the nonprofit. Rather than simply order what was needed, Meadors utilized the tools of Amazon Business to refine her search. “I used our Guided Buying and local buying features, setting up preferences for Kentucky suppliers so each of the products we were searching for came from a seller in that region,” she says. “Then I placed the order.”

It was a simple process, Meadors notes, but identical to what any other Amazon Business customer could utilise in an effort to drive local purchasing and generate the force multiplier it can represent. More than 300 kits were created and distributed—well beyond what they’d hoped to generate—but Meadors particularly appreciated how they were able to expand the project’s reach.

“We found a local seller, so they got the business benefit. Local facilities processed it, so we have that layer, and we were giving to a local organisation,” she says. “It’s the idea of making multiple impacts, layered on top of each other.”

Originally published on the Wall Street Journal.

Back in April, Infosys helped to start the Essedum open-source networking project for AI at the Linux Foundation’s LF Networking (LFN) division.

This week the project hit a major milestone with its 1.0 launch. Essedum Release 1.0 is an open-source platform designed specifically to accelerate AI integration in networking environments. Essedum provides a framework spanning data ingestion, pipeline orchestration and model deployment across on-premises and cloud environments. In addition to code contributed by Infosys, Essedum also integrates components from the LFN AI Task Force’s Data Sharing Platform. 

The initial release delivers seven core technical capabilities:

• Connections: Establish secure communication links between software systems to enable data exchange and integration across environments.
• Datasets: Ingest and manage data from multiple sources including storage buckets, MySQL databases and REST APIs.
• Pipelines: Build and manage both training and inferencing workflows for AI/ML workloads, including model fine-tuning and deployment.
• Models: Access and manage AI models from configured connections across platforms including AWS SageMaker, Azure ML and GCP Vertex AI.
• Endpoints: View and manage all connected endpoints, including REST APIs and model services, from a centralized interface.
• Adapters: Simplify integration with external services without needing to configure host details.
• Remote executor: Run pipelines or programs on remote servers or virtual machines to optimize compute-intensive processing.

“The goal is to have a thriving community of developers and a rich set of reusable components that make building AI-powered network solutions a standard, accessible practice, rather than a bespoke engineering effort,” Ranny Haiby, CTO, networking, access, edge at the Linux Foundation, told Network World.

Why Essedum is a game changer for AI networking applications

Building AI-powered networking applications is typically a complex, time-intensive process requiring teams to stitch together disparate tools. While general-purpose machine learning platforms like MLflow and Kubeflow provide machine learning lifecycle management, they lack the domain-specific components needed for telecommunications and network management use cases.

Essedum is positioned as a specialized integration framework that orchestrates existing tools rather than replacing them. It’s an approach that allows organizations to leverage their current AI/ML platform investments while gaining networking-specific capabilities that general-purpose platforms cannot provide effectively.

“Essedum is not a replacement for existing AI/ML platforms like MLflow, Kubeflow, or vendor-specific solutions,” Haiby explained. “Instead, it acts as a specialized integrating framework for the networking domain.”

Essedum simplifies this entire workflow by providing a unified and comprehensive framework that contains all the necessary components in one place. Specifically, he noted that it offers networking teams:

• Easy access to AI building blocks: Essedum makes it simple to access and integrate the different layers required to build AI applications for networking. This includes tools for data sharing and preprocessing, domain-specific AI models, and a framework for building the applications themselves. This structured approach eliminates the need for teams to source, validate, and integrate these components individually.
• Reduced development time: By providing a ready-made platform with pre-built tools and libraries, Essedum significantly shortens the time to develop AI-powered solutions. Teams can focus on the specific networking problem they want to solve rather than on the foundational engineering work. This accelerates innovation and allows teams to deliver value more quickly.

“With Essedum, networking teams can now build and deploy AI applications for networking much faster and more easily than before,” Haiby said.

Production-ready sandbox environment demonstrates deployment viability

Beyond the code release itself, LF Networking has deployed Essedum in a fully operational developer sandbox environment through partnership with the University of New Hampshire Interoperability lab. 

“Building on the initial code drop, our next priority was to ensure the code is not just available, but also functional in a real-world setting,” Haiby said. “I’m pleased to report that the code was successfully deployed and is now fully operational in a developer sandbox environment.”

The sandbox provides developers with hands-on access to test the platform’s capabilities in realistic scenarios while demonstrating the platform’s production readiness and deployment reliability across different infrastructure configurations.

The operational sandbox also serves as a validation environment for the platform’s multi-cloud deployment capabilities. The deployment demonstrates that Essedum can function effectively across different infrastructure environments while maintaining consistent performance and functionality characteristics that networking teams require for production deployment scenarios.

Community-driven development roadmap targets operational transformation

LF Networking’s development strategy for Essedum emphasizes community-driven enhancement. 

“Our 18-month roadmap is focused on moving Essedum from a foundational release to a tool that transforms how network operations teams work day-to-day,” Haiby said. “The key to this transformation is developer onboarding and community enrichment.”

The strategy reflects the open-source principle that widespread adoption and diverse contributions create better, more robust software than centralized development. This approach becomes particularly important for domain-specific platforms where user requirements, operational contexts and use cases may vary significantly across different networking environments, organizational structures and technical constraints.

“As developers build applications, we expect to see a virtuous cycle of contribution,” he said. “The core team will work closely with the community to identify common functions and components, such as specific data preprocessing pipelines, AI models for anomaly detection, or network-specific agents and bring them back into the main project.

The technical roadmap includes several key enhancements planned for the coming months. Docker and Helm-based deployment automation will streamline cloud-native deployments and container orchestration. Ingestion support for PDF and Excel files will accommodate common networking documentation and data formats used in network planning and operations. Secrets management capabilities will address secure credential handling requirements in enterprise environments. Enhanced role-based access control will support multi-team deployment scenarios. Expanded public cloud platform support will ensure broad infrastructure compatibility across different organizational technology stacks.

“As more real-world applications are built with Essedum, we will gather critical feedback to refine the project to learn what works, what needs improvement, and what new features are required to truly transform network operations,” Haiby said. “This feedback loop will guide the project’s evolution, ensuring it remains relevant and impactful.”

As the world accelerates towards the AI era, business leaders across the Middle East, Turkey, and Africa (META) are rethinking their transformation strategies. Increasingly, businesses are shifting to intelligent business regeneration, where digital is no longer an enabler but the foundation of the enterprise. This shift is reshaping industries, with companies deploying technology at scale, building platform-based models, and generating substantial revenue from digital streams.

According to IDC research, 68% of organisations in META already identify as digital businesses, with 28% of their revenue coming from digital business models. That figure is projected to rise to 44% in the coming years, signaling a decisive shift from product-based to platform-enabled business models.¹ From direct-to-consumer offerings and dynamic pricing to API monetisation and industry ecosystems, businesses are rewriting the rules of value creation.

The challenge: Regenerating amid disruption

Transformation at this scale brings complexity. Despite their ambitions, organisations face several roadblocks on the path to tech-driven business regeneration. These challenges typically fall into four broad categories: strategy, skills, systems, and data.

The most pressing issue is the absence of a unified, enterprise-wide digital strategy. Many businesses struggle with limited executive ownership, fragmented planning, and resistance to change. IDC research shows that 64% of organisations in META have disconnected or poorly aligned digital strategies, undermining the impact of their transformation efforts.¹

A second major hurdle is the shortage of digital and technical skills. The talent gap is fueled by brain drain and outdated training programs that fail to keep up with the pace of innovation.

Legacy IT systems present another significant barrier. Many enterprises continue to rely on ageing infrastructure due to conservative mindsets, continuity concerns, and employee reluctance to adopt new tools.

Finally, a lack of high-quality, accessible data hampers innovation. Siloed departments, fragmented IT systems, and weak data governance contribute to poor data quality and low organisational data literacy.

Best practices: Building a future-ready business

Organisations must adopt a proactive, tech-driven approach to overcome these challenges and thrive in a digital-first world. Here are three best practices to guide the way:

1. Embrace intelligent business regeneration: Digital experiences are no longer optional; they’re expected by customers, employees, partners, and suppliers alike. To remain competitive, businesses must go beyond surface-level digitisation. They must build new digital revenue streams while optimising internal operations to reduce costs, boost efficiency, and increase resilience.
2. Anchor regeneration in a unified digital strategy: Develop a comprehensive digital roadmap that aligns with corporate strategy. Clearly define roles, responsibilities, and governance structures, especially across the C-suite. Regularly measure progress using digital KPIs and keep the strategy agile, ready to evolve with market conditions.
3. Lay the foundation with a platform-based technology architecture: Leading digital businesses are moving towards a digital business platform approach. This model emphasises experience-centric technologies, intelligent platforms, modular architectures, agile development, cloud-native design, and secure environments. Such an integrated architecture enables organisations to automate workflows, scale AI-driven capabilities, and make faster, smarter decisions using real-time data.

Transformation is no longer a one-time initiative but a continuous journey of regeneration that touches every part of the business. In the AI era, success will belong to those who can combine strategic vision with agile execution, underpinned by modern architecture, empowered talent, and intelligent use of data. By addressing the foundational challenges and embracing a holistic, tech-driven approach, organisations can future-proof themselves and unlock new sources of growth, innovation, and value in an increasingly digital world.

Explore how leading organisations are aligning platforms, people, and priorities to scale with confidence by downloading the “Intelligent Regeneration: A Guide to Thriving in the AI Era” eBook. 

---

¹ Source: IDC Digital Executive Sentiment Survey 2024 (META, N=498). 250+ employees only.

The way consumers discover, evaluate and purchase products is fundamentally shifting. Traditional commerce experiences — even those considered modern — are built around customers doing the work: searching, filtering, comparing, clicking. But what if the commerce experience could do the work for the customer? That’s the promise of agentic commerce.

As a practitioner leading digital and e-commerce transformation at a leading lifestyle brand, I have seen firsthand how rapidly customer expectations are evolving. They want relevance, speed, simplicity — and they increasingly expect technology to anticipate their needs. Agentic commerce offers a vision of the future where intelligent systems do more than personalize; they participate.

While most customers still rely on filters and categories today, there is a clear shift underway — toward discovery driven by questions, needs and intent-based prompts. Agentic commerce meets them at that moment.

What is agentic commerce?

Agentic commerce refers to a shopping experience powered by intelligent, autonomous and customer-aligned agents. These agents can learn preferences, make suggestions, automate purchases and even negotiate or personalize offers in real time (see Digital Commerce 360’s overview of agentic commerce for online retail).

It moves beyond rules-based personalization or basic chatbots. Think: a proactive shopping assistant that knows your style, budget, calendar and values and helps you make better choices faster.

This isn’t science fiction. From AI-driven recommendations to dynamic bundles and replenishment nudges, we’re already seeing the building blocks of agentic commerce emerge across categories. In my current role, we’re exploring different options in this space, including allowing our product content to be indexed by LLMs like ChatGPT and Perplexity. The goal? Let customers discover and shop directly through intelligent agents, without ever landing on our website.

By making product content discoverable by AI agents, we’re not just enabling new purchase paths — we’re building a new kind of search experience, where the customer starts outside the site and still finds the perfect product.

From personalization to participation: The agentic maturity curve

Retailers have long relied on reactive personalization — “you bought this, so you might like that.” But agentic commerce introduces a more proactive model: systems that anticipate intent and act on behalf of the customer.

Forward-thinking brands are embedding AI into key customer moments — from discovery and bundling to adaptive checkout — building the infrastructure and behavioral trust required for agent-led transactions. These near-term investments are training grounds for a broader transformation.

As agentic commerce evolves, a maturity model is beginning to take shape across the industry:

• Level 1: Personalized nudges. Systems react to prior behavior with basic recommendations. 
• Level 2: Predictive guidance. AI anticipates intent and proactively suggests bundles or next-best actions. 
• Level 3: Delegated action. Intelligent agents complete purchases, manage fulfillment or negotiate offers on the customer’s behalf. 

Most retailers today operate between Level 1 and 2. Advancing to Level 3 will require not only technical enablement but also executive readiness to delegate decision-making and design for trust.

Customers increasingly expect more than suggestions. This shift challenges the dominance of traditional search engines and even on-site search bars. Instead of users typing in what they want, they increasingly expect the system to surface the right product through a dialogue — or simply deliver it.

Checkout innovation: Toward zero-click commerce

One of the clearest near-term use cases for agentic commerce lies at the point of conversion: checkout. Traditional checkout flows are designed around static steps. But intelligent agents can collapse those steps entirely.

Imagine a system where the moment a customer expresses interest through an agent, the purchase is already 90% complete — size selected, payment method confirmed, shipping pre-filled. This is no longer speculative. We’re seeing early momentum through single-click checkout, stored wallet integrations and adaptive checkout pods that preempt customer needs — and the future is clearly pointing toward zero-click checkout, where agents can complete transactions entirely on the customer’s behalf.

In our own work, we’ve focused on streamlining mobile checkout as a foundation for this shift. From single-page flows to one-click experiences, each improvement reduces friction and sets the stage for agents to handle future transactions autonomously.

Just as agentic systems reinvent how customers find products, they also have the power to redefine how purchases are completed — quietly removing friction in the background while trust and relevance take center stage (read Forrester’s take on thriving in a zero-click world).

The technology enablers: A layered stack for agentic commerce

While agentic commerce is still emerging, this layered model reflects my perspective on how it can scale successfully. Powering agentic commerce at scale requires multiple interconnected layers working in harmony — each critical to enabling intelligent, adaptive and autonomous customer journeys. In this model, the website evolves into both an emotional interface for humans and an intelligence surface for machines. These capabilities align across three layers:

Foundation

• Data orchestration: Unifies data from across channels-transactional, behavioral, contextual and third party-into real-time customer profiles that agents can act on instantly. 
• Product catalog enrichment: Transforms product data into AI-friendly content using structured attributes, rich metadata and natural language. This ensures agents can match products with intent, power dynamic discovery and drive conversion in conversational or zero-UI environments.

Core logic 

• Decisioning engines: Drive journey orchestration by using real-time context to select the next best action, message or recommendation for each customer moment (see MIT Sloan on how ICAs rewrite decision rights).

Experience layer 

• Generative AI: Powers natural conversations, dynamic product storytelling and image generation-creating rich, human-like engagement across platforms (read McKinsey’s research on scaling generative AI in retail). 
• Composable architecture: Enables rapid innovation through modular, API-first systems-allowing seamless integration of agents into the digital experience. 

Not every enabler must be present on day one, but the combination of data readiness, modular systems and enriched content sets the foundation for success. Retailers who invest early in these areas will be better positioned to grow with the pace of agent ecosystem adoption. 

From signals to stakes: The case for agentic commerce now

Agentic commerce is no longer hypothetical — leading companies are already making bold moves to operationalize it. Walmart recently announced four internal “super agents” and two EVP-level hires focused on enterprise AI adoption. OpenAI is testing hosted checkout inside ChatGPT, hinting at a future where conversational agents complete purchases directly. And PayPal’s CEO has forecast that 25% of e-commerce spend could be agent-driven by 2030. 

The stakes are equally significant. According to Bernstein, agent-driven experiences could lift global e-commerce conversion by 1.5–2.5% annually, unlocking over $240 billion in incremental retail revenue.

What this means for retail leaders

Agentic commerce isn’t just a technology shift — it’s a structural, economic and competitive one. And early movers stand to lead it. It changes how teams think about product pages, search, merchandising and loyalty

Instead of optimizing funnels, brands must design systems that think with the customer. This means:

• Less focus on traditional segmentation, more on moment-based intent. 
• Less rigid site structure, more adaptive journeys. 
• Less push messaging, more collaborative dialogue. 

For CEOs and the C-suite, agentic commerce presents both a competitive advantage and a wake-up call. If intelligent agents become the first point of discovery, brands that are not indexed, accessible and API ready — risk becoming invisible. The shift demands executive alignment across marketing, product, technology and legal, building trust-based agent ecosystems that meet customers where they are going, not where they’ve been.

Leaders must also ask tough questions:

• What decisions are we willing to delegate to AI? 
• How do we build trust in autonomous systems? 
• Where does the brand voice end and the agents begin? 

Looking ahead

Agentic commerce isn’t a replacement for human connection. It’s a tool to enhance it. By reducing friction, surfacing better choices and respecting individual preferences, agentic systems can help retailers become more personal at scale (see BCG’s insight on how AI agents herald a “golden era” of customer experience). 

We’re just at the beginning. But in a world where traditional search is declining and intelligent agents are becoming the new discovery layer, agentic commerce isn’t just a future play: it may be how your next customer finds you.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

CIOs are in a tough spot. They’re being told to spend less on IT, but at the same time, still expected to drive innovation and keep the business thriving. With the economy on shaky ground and new technologies popping up all the time, it’s getting harder to do both.

But the good news is saving money doesn’t have to mean falling behind. Many CIOs are finding inventive ways to cut costs and still invest in what matters. They’re getting rid of old systems that no longer work, teaming up with CFOs to make better spending decisions, and using AI and automation to get more done with fewer resources. It’s all about working smarter, not just cheaper.

“Reducing IT costs and accelerating innovation are not mutually exclusive,” says Arvind Joshi, COO and CFO for global technology at JPMorganChase. “When done right, cost discipline should enable innovation. We take an approach that blends development, financial management, and operational discipline to extract as much value from our $18 billion technology investment as possible.”

That kind of approach is catching on beyond the big banks. Across industries, CIOs are realizing they can stretch their tech budgets without sacrificing innovation, as long as they stay strategic.

“As a tech lead managing infrastructure and platform teams, I’ve seen how CIOs can reduce IT costs without stifling innovation,” says Chandrakanth Puligundla, software development engineer and data analyst at Albertsons Companies. “It just takes discipline, strategy, and the right tools.”

To help get the best of both worlds of reducing costs without hurting innovation, here are five smart tactics to help CIOs exceed expectations.

Cut unit costs, free up resources

For Joshi, the key is ensuring all teams follow the same rules to manage costs, and update cloud systems and other tech in order to make them more efficient. It also means simplifying how software gets built, and making sure engineers take responsibility for how they spend on cloud tools and services.

“These focus areas provide significant dry powder for investments in innovation, growing infrastructure and engineering demand because of continuous digitization of existing and new revenue streams,” he says.

And instead of just trying to cut total costs, focus on getting more value out of each unit so the business can do more without unnecessary additional spend.

“Absolute technology costs will continue to grow with organic business volume growth, new products, features, and platforms as revenue streams become more digitized, hence measuring absolute cost reduction is less relevant,” Joshi adds. “Instead, it’s more important to hold the organization accountable for reducing unit costs for compute, storage, and other technology products. This is a better measure of efficiency and cost reduction.”

Michael Corrigan, CIO at World Insurance Associates, is on the same page. He advocates implementing financial management for IT to keep costs in check by regularly adjusting resources and making smarter spending choices.

“By making IT costs visible per project, teams are encouraged to innovate efficiently and stay within budget constraints,” he says.

Strategically automate with AI

Lucas Tanner, CFO at Carta Healthcare, says CIOs should focus their automation strategies on complex, high-volume tasks where AI can make the biggest impact.

“Our automation of data abstraction from clinical records illustrates a key principle: AI should not merely automate but elevate human effort,” he says. “Internally, AI copilots are deployed across engineering, revenue ops, and go-to-market teams to accelerate output without adding headcount. By measuring AI’s impact through KPIs, CIOs can confidently redirect human capital toward innovation, while proving ROI on AI spend.”

While Tanner emphasizes the power of AI to augment large-scale business processes, Tristan Shortland, CTO at Infinity Group, highlights similar benefits in everyday IT operations.

“By finding areas of repetitive, manual labor within your IT operations and streamlining them with automation, you can reclaim time, drive accuracy, and move from reactive to proactive IT,” he says. “This not only makes your IT more cost-efficient, but frees up staff to focus on innovation, upskilling, and strategic work that will drive business growth.”

Shortland adds that AI can make automation even more powerful by handling a variety of tasks, such as answering questions or completing IT jobs. This helps to further cut costs and lets teams spend more time on more important work.

“The cost savings from efficiency gains can then be reinvested into innovation initiatives, creating a virtuous cycle of efficiency and progress,” he adds.

Bill Hineline, field CTO at software developer Chronosphere, agrees that the cycle of innovation only accelerates when AI is applied to the right kinds of work.

“Automate what’s known, repeatable, and boring so teams can spend their energy on innovation,” he says. “One of the most effective AI applications I’ve seen is using LLMs to automate test script and test data creation. These are tedious, time-consuming tasks perfectly suited for AI. And as a bonus, they directly speed up delivery cycles.”

Collaborate with finance

Cutting IT costs the right way means teaming up with finance from the start. When CIOs and CFOs work closely together, it’s easier to ensure technology investments support the bigger picture. At JPMorganChase, that kind of partnership is built into how the teams operate.

“It’s beneficial that our organization is set up for CIOs and CFOs to operate as co-strategists, jointly developing and owning an organization’s technology roadmap from end to end including technical, commercial, and security outcomes,” says Joshi. “Successful IT-finance collaboration starts with shared language and goals, translating tech metrics into tangible business results.”

That kind of alignment doesn’t just happen at big banks. It’s a smart move for organizations of all sizes.

When CIOs and CFOs collaborate early and often, it helps streamline everything from budgeting, to vendor negotiations, to risk management, says Kimberly DeCarrera, fractional general counsel and fractional CFO at Springboard Legal.

“We can prepare budgets together that achieve goals,” she says. “Also, in many cases, the CFO can be the bad cop in the negotiations, letting the CIO preserve relationships with the new or existing vendor. Working together provides trust and transparency to build better outcomes for the organization.”

The CFO also plays a key role in managing risk, DeCarrera adds. Whether it’s handling insurance or preventing fraud, the CFO aligns with the CIO to help keep the company safe.

“Things like deciding on levels and cost of insurance, the processes and solutions implemented for cybersecurity, and employee training all will involve both the CIO and CFO,” she says.

Clean up and simplify systems and data

One of the biggest opportunities to cut costs and boost performance is cleaning up outdated systems, unused applications, and unnecessary data.

“Migrate legacy systems to cost-efficient cloud services and virtualized platforms, thereby reducing maintenance expenses while gaining access to modern capabilities,” World Insurance’s Corrigan says. “This frees budget that can be reinvested in using cloud analytics or AI services.”

Additionally, he says CIOs need to audit software and tools to remove duplicate or underutilized applications.

“Standardizing on fewer platforms lowers licensing and support costs without impacting functionality, as teams consolidate on common innovative tools,” he adds.

That same idea — getting more out of fewer, smarter tools — is helping a lot of CIOs uncover value they didn’t know they had.

“Smart tactics start with rationalizing tool sprawl,” says Albertsons’ Puligundla. “We often find teams using three or four different platforms that do nearly the same thing. Consolidating these into fewer, more strategic tools reduces licensing costs and simplifies workflows, freeing up time and budget.”

But cleaning up old systems is only part of the equation. Data needs the same attention.

“One of the most effective tactics is addressing data debt, the habit of storing and processing all enterprise data as if it’s equally valuable,” says Rich Prillinger, senior director of platform engineering at tech firm Mezmo.

By profiling data across systems and understanding what’s actually used, CIOs can make smarter decisions about what belongs in costly tools, what can be archived, and what’s simply redundant. “This significantly reduces costs while preserving the capacity for innovation and speed where it matters most,” he says.

Get smarter about vendors and contracts

When money’s tight, managing vendors wisely can lead to big savings and free up budget that can be used to fund innovation. That means knowing exactly what you’re paying for, pushing for better deals, and avoiding waste tied to unused licenses or redundant contracts.

Rebecca Wettemann, CEO of tech analyst firm Valoir, says CIOs can save significantly by tightening their approaches to procurement.

“Work with procurement and finance to understand exactly what’s being spent,” she says. “This is particularly important in environments where departments or teams may be empowered to make some cloud technology investments themselves. That means there may be multiple contracts for similar technologies or even with the same vendor, which are opportunities for consolidation and better volume-based negotiation.”

CIOs should also buy for current needs, not volume discounts, and that undeployed licenses are just like burning money “Even a discount for licenses you’re not using is still a net negative,” says Wettemann, adding that CIOs should demand value-based pricing from vendors. “Look to vendors that are willing to share telemetry and other data that shows you usage and impact, and those that have an ongoing optimization practice driven by real data, not just quarterly business review lip service,” she says.

Re-evaluating every license maintenance contract is also critical for saving money to invest in more strategic initiatives.

“Paying license maintenance when you don’t need it is an expensive habit that needs to be broken,” Wettemann adds. “Look to third-party support vendors to cut your ongoing application and database support costs while maintaining application security and performance, often at higher levels than vendor-provided maintenance.”

Nic Adams, CEO at security startup 0rcus, puts it more bluntly.

“CIOs must approach vendors as adversaries: threaten alternative providers, demand quantified concession points, and refuse standard terms,” he says. “Legacy support contracts for end-of-life platforms still bill annually. Scrub every contract, cancel anything unsupported, and reallocate that capital to new initiatives.”

As AI infrastructure scales at an unprecedented rate, a number of outdated assumptions keep resurfacing – especially when it comes to the role of networking in large-scale training and inference systems. Many of these myths are rooted in technologies that worked well for small clusters. But today’s systems are scaling to hundreds of thousands – and soon, millions – of GPUs. Those older models no longer apply. Let’s walk through some of the most common myths – and why Ethernet has clearly emerged as the foundation for modern AI networking.

Myth 1: You cannot use Ethernet for high performance AI networks

This myth has already been busted. Ethernet is now the de facto networking technology for AI at scale. Most, if not all, of the largest GPU clusters deployed in the past year have used Ethernet for scale-out networking.

Ethernet delivers performance that matches or exceeds what alternatives like InfiniBand offer – while providing a stronger ecosystem, broader vendor support, and faster innovation cycles. InfiniBand, for example, wasn’t designed for today’s scale. It’s a legacy fabric being pushed beyond its original purpose.

Meanwhile, Ethernet is thriving: multiple vendors are shipping 51.2T switches, and Broadcom recently introduced Tomahawk 6, the industry’s first 102.4T switch. Ecosystems for optical and electrical interconnect are also mature, and clusters of 100K GPUs and beyond are now routinely built on Ethernet.

Myth 2: You need separate networks for scale-up and scale-out

This was acceptable when GPU nodes were small. Legacy scale-up links originated in an era when connecting two or four GPUs was enough. Today, scale-up domains are expanding rapidly. You’re no longer connecting four GPUs – you’re designing systems with 64, 128, or more in a single scale-up cluster. And that’s where Ethernet, with its proven scalability, becomes the obvious choice.

Using separate technologies for local and cluster-wide interconnect only adds cost, complexity, and risk. What you want is the opposite: a single, unified network that supports both. That’s exactly what Ethernet delivers – along with interface fungibility, simplified operations, and an open ecosystem.

To accelerate this interface convergence, we’ve contributed the Scale-Up Ethernet (SUE) framework to the Open Compute Project, helping the industry standardize around a single AI networking fabric.

Myth 3: You need proprietary interconnects and exotic optics

This is another holdover from a different era. Proprietary interconnects and tightly coupled optics may have worked for small, fixed systems – but today’s AI networks demand flexibility and openness.

Ethernet gives you options: third-generation co-packaged optics (CPO), module-based retimed optics, linear drive optics, and the longest-reach passive copper. You’re not locked into one solution. You can tailor your interconnect to your power, performance, and economic goals – with full ecosystem support.

Myth 4: You need proprietary NIC features for AI workloads

Some AI networks rely on programmable, high-power NICs to support features like congestion control or traffic spraying. But in many cases, that’s just masking limitations in the switching fabric.

Modern Ethernet switches – like Tomahawk 5 & 6 – integrate load balancing, rich telemetry, and failure resiliency directly into the switch. That reduces cost, lowers power, and frees up power for what matters most: your GPUs/ XPUs.

Looking ahead, the trend is clear: NIC functions will increasingly be embedded into XPUs. The smarter strategy is to simplify, not over-engineer.

Myth 5: You have to match your network to your GPU vendor

There’s no good reason for this. The most advanced GPU clusters in the world – deployed at the largest hyperscalers – run on Ethernet.

Why? Because it enables flatter, more efficient network topologies. It’s vendor-neutral. And it supports innovation – from AI-optimized collective libraries to workload-specific tuning at both the scale-up and scale-out levels.

Ethernet is a standards-based, well understood technology with a very vibrant ecosystem of partners. This allows AI clusters to scale more easily, and completely decoupled from the choice of GPU/XPU, delivering an open, scalable and power efficient system

The bottom line

Networking used to be an afterthought. Now it’s a strategic enabler of AI performance, efficiency, and scalability.

If your architecture is still built around assumptions from five years ago, it’s time to rethink them. The future of AI is being built on Ethernet – and that future is already here.

Click here to explore more about Ethernet technology and here to learn more about Merchant Silicon.

About Ram Velaga

Ram Velaga is Senior Vice President and General Manager of the Core Switching Group at Broadcom, responsible for the company’s extensive Ethernet switch portfolio serving broad markets including the service provider, data center and enterprise segments. Prior to joining Broadcom in 2012, he served in a variety of product management roles at Cisco Systems, including Vice President of Product Management for the Data Center Technology Group. Mr. Velaga earned an M.S. in Industrial Engineering from Penn State University and an M.B.A. from Cornell University. Mr. Velaga holds patents in communications and virtual infrastructure.

I’m sure you’ve heard about the MoSCoW method from strategy gatherings — Must-have, Should-have, Could-have and Won’t-have. It’s a simple but powerful way to prioritize what really matters, particularly when resources are tight and the stakes are high. In 2025, I firmly believe customer data platforms (CDPs) have moved squarely into the “Must-have” category for any organization that wants to unlock the full potential of AI/ML and GenAI. Let me explain why. 

Customer data chaos is the elephant in the room

Let’s be honest & concede, customer data is the elephant in the room for most organizations. It’s scattered everywhere, from CRM and ERP to marketing automation, ecommerce, and other martech tools. I’ve lost count of how many times I’ve tried to get a 360-degree view of a customer, only to feel like I was flying blind. If you’ve ever felt the same, you’re not alone. Customers expect us to know them, to treat them as more than just a number and to anticipate their needs. The reality is, most of us are still struggling to connect the dots.

So, what’s the North Star for companies trying to navigate this new world? For me, it’s the genAI-powered CDP. Over the last six months, I’ve seen a 20% uptick in queries, proof-of-concept projects and MVP solutions focused on genAI-centric customer 360-degree views. The message is clear that CDPs are no longer a “nice-to-have but they’re a must-have. 

Why CDPs matter: Unification, activation and intelligence 

Let’s dig into what makes a CDP so powerful. First and foremost, it unifies all your customer data from online, offline systems and everything in between into a single, persistent profile. No more data silos, no more guessing games. You get a cradle-to-grave view of every customer’s journey. I’ve seen firsthand how this kind of unification can transform not just marketing, but sales, service and even product development. 

But unification is just the beginning. The real magic happens when you start activating that data. With a CDP, you can segment audiences, personalize messages and orchestrate journeys across every channel. I recall working with a retail client that utilized their CDP to deliver personalized offers in real-time, both online and in-store. The result? A 30% increase in NPS score and a noticeable boost in customer satisfaction. 

And then there’s intelligence. With AI/ML and genAI baked in, your CDP becomes more than just a data platform. Predictive analytics, dynamic segmentation and even automated content generation can leverage GenAI to write custom emails or product descriptions, just imagine the art of the possible. According to a recent McKinsey Quarterly report, companies that leverage advanced analytics and AI see up to 25% faster revenue growth than their peers. 

The AI/ML and genAI revolution in CDPs 

Here’s where things get really interesting: The convergence of CDPs with AI/ML and genAI is changing the game for customer engagement. If you’re not experimenting, you’re missing out. I’ve learned the hard way that sometimes you are better off to fail fast, motivating you to test, learn and pivot quickly to find what works. 

• AI/ML for enhanced personalization. Machine learning can spot patterns and predict what your customers will do next. That means tailored recommendations, targeted offers and content that resonates. I’ve seen companies use AI-driven insights to optimize everything from email subject lines to product recommendations, resulting in double-digit lifts in engagement. The optics of real-time personalization are powerful, as customers notice when you’re truly in sync. 
• GenAI for automated content creation. Imagine a CDP that not only finds your audience but also crafts the perfect message for each person. That’s GenAI in action. I am currently working with teams who use GenAI to generate hundreds of personalized product descriptions and custom emails in minutes, freeing up creative teams to focus on strategy and innovation. As MIT Sloan Management Review points out, the key is to blend human creativity with machine efficiency. 

2025 imperative: Why CDPs aren’t optional 

Let’s talk about the carrot and the stick. Customers expect personalized experiences everywhere. If you don’t deliver, they’ll find someone who will. Meanwhile, the slow death of the third-party cookie means you can’t rely on old tracking tricks. First-party data is your lifeline and a CDP is how you chart the course for the future. 

Add in the known-knowns, such as rising privacy regulation, and the known unknowns (what new rules or tech will pop up next?), and it’s clear that without a CDP, you’re at a disadvantage. GDPR, CCPA and whatever comes next are all easier to manage with a CDP’s built-in consent and privacy tools. If you’re still hesitating, it’s time to nip it in the bud. The longer you wait, the harder it gets to catch up. CDO Magazine has highlighted how leading organizations are using CDPs to stay ahead of compliance and customer expectations. 

How to start: A practical glide path 

So, how do you get started? Here’s a glide path I’ve seen work in the real world: 

1. Define clear business objectives. What’s your North Star? Is it more retention, higher conversion or better lifetime value? Please be crisp & specific with your OKRs! I once worked with a financial services firm that set a clear goal to reduce customer churn by 15% in 12 months. That focus made all the difference. 
2. Assess your data landscape. Know what data you have, where it lives and what shape it is in. Be ready for surprises such as data quality issues, integration headaches and more. I’ve found that a thorough data audit upfront saves a lot of pain down the road. 
3. Choose the right CDP vendor and implementation partner. There are plenty of options out there, so look for a partner that fits your needs, tech stack and budget. Don’t be afraid to pivot if your first choice doesn’t deliver. I’ve seen organizations switch vendors & partners midstream, while coming out stronger for it. 
4. Prioritize data privacy and security. This is a professional hazard for every CIO and CISO. Make sure your CDP helps you stay compliant and secure. The International Association of Privacy Professionals offers some great resources on what to look for. 
5. Embrace iterative implementation. Start small, learn and expand. Remember that progress, not perfection, is the key. A pilot project is better than endless planning. I’ve seen teams launch a simple use case, like personalized email campaigns and then build on that success. 
6. Invest in training and expertise. Get your team involved early. When everyone has skin in the game, adoption and success follow. I’ve found that cross-functional teams across finance, sales/marketing, IT, legal/compliance and infosec drive the best results. 

The business impact: CDP by the numbers

Let’s talk ROI. Companies using CDPs have seen up to 25% better customer retention, 15–30% higher conversion rates and 40% faster campaign setup. Revenue growth? I’ve seen 10–15% lifts from smarter targeting. These aren’t just vanity metrics but proof that the art of the possible is real. At least 15% of our new engagements and initiatives are around genAI-enabled customer 360 view and data platforms. 

For instance, consider Accor, one of the world’s largest hospitality brands, operating thousands of hotels and resorts globally. Accor faced the daunting challenge of unifying guest data scattered across loyalty programs, booking systems and digital marketing channels. Instead of sticking with a traditional, one-size-fits-all CDP, Accor took a composable approach, integrating best-in-class tools for data ingestion, identity resolution and activation. This allowed them to create a single, unified view of more than 250 million customer profiles.

The impact was immediate as Accor’s marketing teams could personalize offers and communications at scale, leading to higher guest engagement and a boost in direct bookings. Their experience shows how a thoughtful, composable CDP strategy can empower even the most complex organizations to deliver real business value. For more details, see Why Accor abandoned the conventional CDP and what they built instead.

The time to act is now!

The bottom line is that genAI-powered CDP is no longer a futuristic concept. It’s the foundation for thriving in a customer-centric, AI-powered world. If you want to avoid being left behind, now’s the time to act. Don’t let the elephant in the room, the fragmented customer data, hold you back. Chart your glidepath, keep your North Star in sight and remember that there are always multiple ways to skin the cat. Choose the path that works for your business and you’ll unlock the true power of AI/ML and genAI.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

When meeting with business leaders, there is excitement around the potential of what agentic AI can do for an organization. There is also a clear need to answer the question of how business leaders can effectively and efficiently deploy agentic AI.

New research from the IBM Institute for Business Value shows the buy-in and excitement from business leaders: 86% of those surveyed expect process automation and workflow reinvention to be more effective with AI agents by 2027. Traditional AI or automation tools are offering useful, yet still marginal, productivity gains but aren’t transforming the underlying process. With agentic AI, we can really start driving bigger and more strategic business outcomes that can create greater productivity and efficiency in an organization.

It’s not just about AI telling us what to do—it’s about AI starting to do it. We need to move beyond AI assistants and expand what’s possible with AI agents that can execute and adapt processes under human supervision. This shift requires real reengineering of how work gets done, unlocking the kind of value business leaders genuinely want to achieve.

Already 76% of executives surveyed say they are operating and delivering proof-of-concepts that enable autonomous automation of intelligent workflows through AI agents, according to the IBM Institute for Business Value.

Every client I’ve worked with wants us to have a deep understanding of agentic AI, a credible point of view, and experience scaling agentic AI. And for good reasons. Agentic AI comes with a lot of promise and immense potential to transform your business, but with it also comes technical demands and the need for a cultural shift within an organization.

From my own experience, I’ve learned the ‘how to’ has become a prominent focus for clients and organizations. They are keen on seeing incredible results in cost saving, efficiency, and productivity. Below are my insights on how to integrate this technology and scale it to great outcomes.

AI agents built for business

Specific areas that we’ve seen agentic AI work include customer service, procurement, finance, and the whole IT process, but what we’re seeing in customer service specifically is a significant opportunity.

In fact, we have transformed contact centers that used traditional chatbots and automation tools, by pivoting to an agentic approach. Our agentic conversational experience approach introduces a coordinated team of AI agents capable of handling a much broader and more complex range of customer queries, instead of a single scripted assistant, like a chatbot, to realize significant efficiencies. All while operating with a foundation of defined guardrails to drive compliance and consistency.

What makes agentic AI more effective than traditional chatbots is its ability to operate holistically—not just following scripts, but dynamically coordinating actions, adapting to exceptions, and continuously learning. Agents don’t work in a fixed sequence; they collaborate with each other and with humans to determine the most efficient way to resolve complex tasks in real time.

4 steps to prepare for agentic AI integration

There are preemptive measures and preparations that must be taken to implement agentic AI effectively and efficiently before an organization can scale solutions and see improved outcomes.

Step 1: Find the opportunity

The first thing is identifying an opportunity within your business. For example, let’s say I want my procurement function to be more efficient, and I want to get an agentic solution implemented. IBM has a methodology developed for clients to formally assess whether an agentic solution will provide added value and enhance the process or workflow.  

Our agentic AI readiness assessment approach is:

1. A structured assessment executed using a blend of Process Mining and LLM powered process analysis
2. Designed to identify business processes best suited for agentic AI and autonomous transformation
3. Includes five pillars to evaluate how well a process can be re-engineered using AI

Step 2: Understand your architecture

The second part of the ‘how’ considers underlying enterprise architecture capabilities and identifies how architectures may need to evolve. This might mean going beyond traditional integration layers and establishing a modern architecture designed for autonomous, AI-driven workflows. Some of the necessary capabilities include:

1. Multiagent orchestration and event-driven integration
2. Centralized agent catalog and lifecycle management
3. Agent memory and long-term context stores
4. Modular, AI-ready data products
5. Governance, observability, and security layers tailored to AI agents

Step 3: Address your data strategy for AI

Data remains core to the successful deployment of AI and is a critical part of the conversation at the start. Our point of view at IBM is that this agentic AI application can only deliver value if you combine experience, process, and data.

Managing structured and unstructured data, ensuring data quality, and protecting data privacy are ongoing challenges. Yet, with the right strategies in place, businesses can harness the power of AI to drive transformation and future growth.

There are three core challenges to consider when preparing a business for AI transformation.

1. Access to data. It is estimated that in 2022, 90% of data generated by enterprises was unstructured. Organizations need to access that data wherever it resides and unify it for their use case.
2. Quality and intelligent data for real-time analytics and AI. Your AI is only as good as the data youinput. Can you trust that data for your AI models? Is it of sufficient quality, and how do you objectively evaluate the quality of your data? Answer these questions before deploying AI.
3. Data security. Whether on-prem or multi-cloud, data security needs to extend to the entire landscape. Consider all data no matter where it is in motion and whether it’s structured data or unstructured data.

Step 4: Manage the necessary cultural shift

Another key factor clients must consider is strong change management. Specifically, clients must take into consideration the people who will need to adopt AI as part of their daily work.

A tangible example is from the HR transformation perspective, a use case where we really need to rethink the roles of people and where AI might be most valuable. Many of our clients in the HR function think about upskilling and reskilling employees whose roles are being reimagined. And that’s right.

Change management should be an integral part of any AI transformation. It isn’t just a technical implementation being done; it’s a holistic process that requires the client to consider the entire ecosystem that makes the business run smoothly, including technology, processes, and people.

This shift with agentic AI isn’t just a change for employees and a reconfiguration of job functions. For example, at IBM, reimagining processes to create workflows where AI can be integrated to create a seamless optimization is what makes a transformation possible and helped enable IBM to drive USD 3.5B in productivity gains. We have the tools and expertise in place to advise our clients on the right strategy and method to bring agentic AI into their business.

8 steps to integrate agentic AI

Once the ‘how’ has been established and a client understands what is necessary to scale agentic AI successfully, the next part of the process is to integrate agentic AI into the business.

1. Re-engineer for agentic: Agentic AI requires a shift in how work is designed and executed.
   Pro tip: Rethink workflows with agents—delegate routine tasks to AI while elevating human roles for supervision, escalation, and value-added judgment.
2. Ensure scalability: Scaling agents across systems and functions requires robust orchestration.
   Pro tip: Implement a strong agent orchestration layer that enables agents to work across platforms safely, coordinate tasks, and respect process boundaries and control layers.
3. Prepare your data: Agents need access to focused, high-quality data that’s actionable.
   Pro tip: Build use case-specific data products—curated, governed, and API-accessible—to ensure agents have the structured inputs they need to act in real time and in context.
4. Optimize for performance: Balancing speed, reliability, and cost is critical at scale.
   Pro tip: Equip your platform to route agent tasks to the right LLMs and tools based on complexity and cost. Use caching, smart fallback models, and usage controls to maximize ROI.
5. Test for reliability: Before deployment, agents should be monitored for fairness and explainability.
   Pro tip: Integrate agent evaluation into your AgentOps lifecycle. Automate testing for accuracy, bias, robustness, and ethical compliance—both pre-deployment and continuously in production.
6. Establish governance: Operational control and visibility are essential for trusted AI execution.
   Pro tip: Create a governance framework that includes observability, human-in-the-loop controls, KPI tracking, and audit trails to monitor agent behavior and business impact.
7. Drive rapid deployment: Get to value quickly and build momentum.
   Pro tip: Start with high-value, narrow use cases that demonstrate impact fast. Use reusable agent templates and modular architectures to expand horizontally across functions.
8. Track business value: Impact must be tangible and measurable.
   Pro tip: Define KPIs such as workflow convergence, human handoff rates, and business outcome improvements. Use them to guide iteration, adoption, and executive buy-in.

Recommendations when scaling agentic AI

When integrating agentic AI into your business, I have three recommendations:

1. Reimagine processes: Don’t just fix broken processes; rethink them entirely using an augmented approach.
2. Think beyond agents: Consider the entire end-to-end business process, including user experience, process orchestration, and necessary data products. Think about the overall experience you’re trying to deliver and think holistically.
3. Plan for scalability: Design your AI architecture to scale quickly, starting with robust governance from the outset and quality data to work with right now and in the future.

Looking to the future of agentic AI

Agentic AI is already at the center of enterprise innovation. Traditional SaaS platforms are evolving into agent marketplaces, where agentic apps can source, invoke, and orchestrate AI agents across multiple systems to execute complete workflows. Instead of relying on monolithic applications to perform rigid tasks, enterprises will begin deploying multi-agent systems that dynamically coordinate work, adapt to context, and reduce the need for manual intervention. This transformation marks the beginning of a new architecture for digital operations—one built for autonomy, speed, and continuous optimization.

To learn more about how IBM can help you integrate and manage AI agents across your business, visit IBM watsonx Orchestrate.

Successful AI implementation hinges on making the right infrastructure choices early. You can accelerate your AI revolution by critically evaluating infrastructure readiness before investing, ensuring genuine business transformation rather than disappointment.

Despite CSIRO research showing 68% of Australian businesses have already implemented AI technologies, adequate infrastructure remains a critical barrier to realising its full potential. Overdriving underpowered infrastructure can create unsustainable operational risks that dramatically increase energy consumption.

The five critical questions you should be asking

To accelerate your organisation’s AI revolution, ask these five essential questions when evaluating infrastructure investments:

1. Is your infrastructure agile enough to support evolving AI workloads?

The most transformative AI implementations leverage edge computing to process data closer to its source. This approach delivers the agility required to scale your AI revolution by strategically blending cloud and edge resources.

Your organisation likely faces significant latency challenges due to geographic distance from major cloud regions. Micro Data Centres at strategic edge locations enable local processing for time-sensitive AI applications. By distributing workloads between centralised data centres, cloud resources and edge locations, you can accelerate your unique AI transformation.

Your team’s ability to implement and manage these technologies is also just as important as the technology itself. Creating a culture that supports continuous learning, and adaptation will be essential as AI workloads evolve and your infrastructure needs change.

2. Does your power infrastructure support AI’s intensive energy demands?

Your technology team faces unique challenges with AI’s power requirements. Current systems likely lack the computational capacity and sustainability features needed for AI workloads, which demand 5-10 times more energy than traditional computing.

Schneider Electric’s energy procurement services help you source and manage the increased power requirements for AI. At the same time, its liquid cooling systems improve efficiency in heat-intensive AI environments, with Power Usage Effectiveness (PUE) measurements as low as 1.03 in optimal conditions compared to traditional cooling methods.

With the belief that implementing AI shouldn’t require trade-offs between performance and sustainability, Schneider Electric’s energy procurement strategy is designed to empower you to cast off caution and to AI with intent across your hybrid infrastructure. At the same time, energy-efficient solutions like Smart-UPS Ultra with lithium-ion batteries offer a 50% lower carbon footprint than lead-acid alternatives.

Remember that your AI revolution depends on the human as much as the artificial if it is to deliver on its promise. Your energy strategy must account for both technological needs and your organisation’s sustainability goals.

3. Can your security framework protect AI data while meeting ANZ compliance requirements?

Your organisation faces distinctive regulatory requirements that impact AI implementation. Data sovereignty laws and the Privacy Act create challenges that require security solutions tailored to regional needs.

Schneider Electric’s NetBotz provides environmental monitoring and physical access control, while EcoStruxure IT Expert delivers real-time threat detection. Together, they address both physical and cyber vulnerabilities specific to ANZ compliance requirements.

Effective security also requires skilled personnel who understand both the technological and human elements. Your security framework should account for your team’s expertise and training needs to ensure they can effectively manage AI security risks.

4. Will your infrastructure scale efficiently without compromising sustainability goals?

Energy considerations represent a critical challenge for your AI implementation. Research shows 48% of businesses report positive Return on Investment (ROI) within the first year of implementing AI solutions. However, energy costs significantly impact these gains.

Successful AI implementation requires infrastructure designed for your unique requirements while supporting sustainability. This foundation must balance performance needs with environmental responsibility, and it must tread a fine line to succeed.

With each organisation’s AI revolution following a unique path, you must evaluate whether infrastructure solutions genuinely support your specific use cases and regional requirements while aligning with sustainability commitments.

As such, your leadership approach to creating sustainable AI infrastructure will set the tone for your entire organisation. By demonstrating commitment to both performance and sustainability, you can inspire your team to find innovative solutions that balance these priorities.

5. Does your proposed solution provide end-to-end integration from edge to cloud?

The marketplace has become saturated with “AI-ready” solutions that fail to deliver genuine capabilities. This “AI-washing” marketing creates significant barriers for your AI revolution.

Fragmented approaches create operational complexity and limit the effectiveness of your AI initiatives. End-to-end integration between edge computing resources, data centre infrastructure and cloud services is essential for seamless AI operations.

According to research, while 68% of Australian businesses have implemented AI, many struggle to realise its full potential. Organisations that successfully accelerate their AI revolution will create optimal conditions through strategically designed hybrid IT environments.

Your team’s ability to work across traditionally siloed departments is essential for successful end-to-end integration. Creating cross-functional teams with clear communication channels can help ensure your AI implementation is truly integrated across all components.

From vision to reality: thriving in your AI era

Your AI revolution is a human-led transformation that requires a careful balance of technological capability and human expertise. By implementing modular hybrid IT solutions specifically designed for AI workloads, you can create an environment where both your technology and your people can thrive. To learn more about powering your AI revolution with confidence, download our interactive guide to AI-ready hybrid IT infrastructure solutions.

India will deploy its largest quantum computer, an IBM Quantum System Two with a 156-qubit Heron processor, in the upcoming Quantum Valley Tech Park in Amaravati, Andhra Pradesh, through a collaboration between IBM, Tata Consultancy Services (TCS), and the Government of Andhra Pradesh.

Set to open in January 2026, the tech park aims to establish India as a global quantum technology leader by fostering innovation in quantum computing and AI.

Highlighted its national significance, Andhra Pradesh Chief Minister N Chandrababu Naidu said, “Our National Quantum Mission is to make India a global hub in the quantum industry; a true center of innovation and job creation.”

IBM will provide hardware and expertise through its global IBM Quantum Network, while TCS will drive enterprise use cases and consulting services to embed quantum solutions across industries such as healthcare, finance, logistics, and manufacturing.

“Combining this with India’s National Quantum Mission, we could see an acceleration of the next critical milestone – a successful demonstration of quantum advantage,” Jay Gambetta, Vice President, IBM Quantum said in a press note.

India’s Nation Quantum Mission, announced in 2023, is aimed at developing intermediate-scale quantum computers with 50-1000 physical qubits in various platforms like superconducting and photonic technology by 2031.

The broader vision is to create high-end jobs, attract global investment, and enable enterprises to solve previously intractable problems — such as drug discovery and real-time logistics optimization — through quantum-powered solutions.

The new tech park at Amaravati will host research labs, startup incubators, and training programs to build a quantum-ready workforce, fostering collaboration across academia, industry, and startups.

“This collaboration with TCS will help attract India’s thriving ecosystem of developers, scientists, and industry experts,” IBM said in a statement.

India’s quantum computing future

India’s quantum push comes as the global market for quantum computing accelerates — from $1.79 billion in 2025 to $7.08 billion by 2030, growing at a CAGR of 31.64%, according to ResearchAndMarkets. India’s domestic market is projected to grow at a 22.9% CAGR during the same period.

“Over the next few years, India will carve out a unique role in the global quantum ecosystem, contributing novel quantum algorithms and niche enterprise applications in sectors like pharmaceuticals and supply chain management,” Narayan Gokhale, principal analyst at QKS Group. “However, the real test will be talent,” he added. “India must address the talent gap and invest in indigenous technology to truly compete.”

India’s quantum ecosystem is expanding, with Bengaluru-based startup QpiAI, one of eight selected under the National Quantum Mission, launching 25-qubit quantum computers and planning to scale to 1,000 qubits by 2028.

The big picture

Globally, quantum computing remains in its infancy, with practical applications still confined to a few domains. Experts estimate that there is a significant global shortage of professionals with expertise in areas like quantum algorithms, error correction, and quantum control.

The UK’s National Quantum Strategy flags the talent shortfall as a key risk. In the US, Microsoft recently called for urgent investment to shore up its quantum computing workforce, warning that even global leaders are vulnerable without a strong talent pipeline.

This demand spans the entire stack — from quantum hardware and software to the advanced mathematics and data science skills required to exploit machines capable of computations far beyond classical systems.

Infrastructure presents an equally steep climb as quantum systems require ultra-low temperatures, highly stable power, high-performance computing environments, and reliable, high-speed connectivity.  To emerge as a quantum powerhouse, India’s proposed initiatives must not only match global standards but also foster a sustainable ecosystem grounded in talent, robust infrastructure, and long-term policy support.

CIOs have long been adept at the art of the pivot — a skill that will serve them well as they cope with the fallout of global tariffs that have sent organizations into a tailspin over the past few weeks.

Already, IT is feeling the impact on infrastructure and supply chains, and CIOs are decreasing capital expenditures and scaling back projects or delaying them altogether.

The new tariffs will not only drive up tech prices but also disrupt supply chains and weaken global IT spending this year, IDC warned in a blog post.

“The situation remains highly fluid and dynamic,” IDC wrote. “A weakening economy will lead to IT spending cuts and delays in the next six months.” The research firm is projecting “a move closer to the previous downside of 5% growth, which reflects a rapid, negative impact on hardware and IT services spending.”

Even though some equipment vendors may try to mitigate the impact, US customers will quickly feel the effect of higher prices, IDC noted. “Lean inventories and rapid manufacturing cycles mean that price hikes will materialize quickly. The broad, unfocused nature of these new tariffs leaves manufacturers little room to adjust.”  

Rising IT infrastructure prices “could balloon budgets and force CIOs to delay or prioritize the most important projects,” says Mark Moccia, a vice president and research director at Forrester. As a result, CIOs and other tech leaders need to “proactively analyze costs, diversify sourcing, optimize inventory, and prioritize the projects that don’t sacrifice critical AI ambitions.”

Accelerating some projects, procuring quickly

Jay Leal was getting ready to embark on an almost $2 million hardware and network refresh as the tariffs were being announced in early April. Leal, senior vice president and CIO of Vantage Bank in San Antonio, Texas, said IT will replace network switches, access points, and firewalls, and the plan was to divide the project into smaller phases.

“But after talking to our distributors, we thought there was some volatility and supply chain concerns, so we scaled down a little and purchased everything at one,” Leal says. The project will still be spread out through 2025, “but we’re doing the capital outlay all at once. We really do have a fear these tariffs are … going to bring prices higher for things like technology devices.”

The bank anticipates that because “there may be less demand for lending … our capacity to take on new projects and initiatives is really going to tighten up,” he says.

Leal is looking at every project planned for this year and evaluating whether it makes sense to still move forward, or what can be deferred, given the feeling that there will be a contraction in the market and economy. This includes curbing what the bank had dubbed “the year of cloud,” a strategic initiative that involved several planned platform migrations to the cloud.

“We’re taking a hard look and determining if we need to make those expenditures,” Leal says. “It’s going to be a tough year for banks to meet our budget and [be] where we want to be as an organization” due to the uncertainly around tariffs.

In terms of his supply chain, Leal says IT is trying to procure things as quickly as possible due to anticipated rising costs. “Our strategy is we’re looking at where suppliers are sourcing equipment from and anticipating that in lead times and cost.”

His IT budget is set for the year, so if prices go up and it starts to impact expenses, Leal will have to take a hard look at ways to cut spending, which could ultimately lead to staff layoffs as a last resort, he says.

If IT has “a healthy mix of employee to contractor,” that will allow CIOs the option to reduce contract staff in response to sharp cost increases, says Forrester’s Moccia, adding that other methods of spend optimization should be looked at first. For example, there is hidden waste within cloud bills, according to a March Forrester report on thriving through volatility. Many organizations can realize immediate savings leveraging native cloud cost management tools or a third-party cloud cost management platform, the report said.

Minimizing layoffs will allow IT staff to buy down more technical debt and improve data management capabilities to set up AI projects for success, Moccia says.

Projects put on hold

Freddie Tubbs, CIO at essay writing service Academized.com, says the company had a big CRM system upgrade planned, but that will be pushed to 2026. “We also wanted to invest in a new data analytics platform, and now we [will] scale back and look for a more affordable option,” he says.

IT had also planned to do some hardware upgrades, which have been put on hold, and Tubbs says he is looking to cloud and SaaS platforms instead, “because it’s easier to scale and [involves] less upfront costs.”

IT is using more analytics to understand how supply chain changes could impact the company. “Our team built dashboards to track market shifts and vendor risks,” Tubbs says. “It helps us make faster and smarter decisions. We work closely with ops and finance to stay aligned. The goal is to stay flexible, spend smart, and be ready to pivot if things change quickly.”

Academized.com uses cloud services, learning management systems, and content delivery platforms, and Tubbs knows prices will likely spike on all of them.

“We’re also concerned about our educational merchandise, like books and branded items. Tariffs could push up production and shipping costs,” he says, adding that there could also be delays with overseas suppliers. “To cover these rising costs and adjust for potential supply chain issues, we might need to increase our budget by around 10% to 15%,” he says.

An unhealthy time

Navigating healthcare IT has always been a balancing act of driving innovation while keeping operations running smoothly, and the global tariffs are making that balance tougher, says Michael Mainiero, CDIO and senior vice president at Catholic Health.

“These tariffs have added friction to our technology supply chain, especially around core infrastructure like servers, storage, and networking gear that often come from overseas,” Mainiero says. “It’s a reminder that while we can’t control these external pressures, we can use them to test and strengthen our resilience.”

In healthcare, when costs go up or timelines stretch due to supply chain issues, “it’s not just an IT problem — it’s a care delivery challenge,” he adds. To compensate, IT’s mission is to design agile and scalable systems to pivot when needed so that its value isn’t compromised even when external factors shift, Mainiero says.

He is constantly re-evaluating the value of the hospital’s vendor relationships through application and tech stack rationalization. Mainiero says he also watches for waste in unused licenses, overlapping tools, and aging equipment “and having real conversations with vendors about partnership, not just procurement.”

But he says it’s not productive to spend time worrying about what is out of your control.

“We can keep our strategy strong, our frameworks solid, and our teams ready to pivot when the moment calls for it. If the last few years have shown us anything, agility isn’t a buzzword — it’s survival. And in healthcare IT, that makes all the difference,” he says.

Lessons from the pandemic

AtlantiCare’s leadership and IT team are focused on being proactive in preparing for supply chain events, including bulk buying and working closely with suppliers to ensure availability of necessary equipment, says CIO Jordan Ruch.

“We have been making early purchase decisions to avoid impacting planned programs, such as purchasing networking equipment for our Oracle transformation in advance,” he says. “Supplier collaboration is also key and AtlantiCare has been working closely with suppliers to identify domestically available equipment and maintain reserves. This collaboration ensures we have necessary equipment on hand, depending on how supply chain events play out.”

Both Ruch and Vantage Bank’s Leal say the pandemic prepared IT to be proactive in sourcing and to be adaptable.

“Our digital transformation began during the pandemic, when the need for modernization became apparent,” Ruch says. That “clarified that the future of IT systems demanded a technology infrastructure capable of supporting rapid change. We moved quickly to strengthen our systems, expand cloud capabilities, streamline workflows, and unlock real-time insights.”

Those actions laid the foundation for a more adaptive, responsive enterprise, he says.

Regardless of politics, Leal says the tariffs are an opportunity for tech leaders to understand the country of origin for equipment, suppliers, and materials used to put together the products and services an organization consumes.

“We saw this during pandemic,” Leal says. “The supply chain was impacted and it took a long time for the economy to recover. You can see similar impacts here. Those who will be proactive in knowing where they can source materials will be better off.”

Traditional security approaches have become unsustainable for technology leaders navigating today’s complex threat landscape. Information risk management is no longer a checkpoint at the end of development but must be woven throughout the entire software delivery lifecycle. As regulators demand more tangible evidence of security controls and compliance, organizations must fundamentally transform how they approach risk — shifting from reactive gatekeeping to proactive enablement. 

“Regulators today are no longer satisfied with frameworks, documentation, and audit validation alone; they want tangible evidence, including end-to-end testing, as well as compliance program management that is baked into day-to-day operating processes.” — 2025 Banking Regulatory Outlook, Deloitte 

The stakes are clear. In today’s digital economy, business objectives like “becoming a trusted financial partner” or “protecting customer data while driving innovation” require more than technical controls and documentation. They demand a reimagining of how we integrate security and compliance into every stage of software delivery. 

Key takeaways: 

• Traditional security approaches focused on late-stage gatekeeping are failing to meet modern business and regulatory needs
• Successful transformation requires a shift from “security guard” to “trusted advisor” mindset
• Four critical foundations drive success: collaboration, automation, visibility, and prevention
• Measuring security posture through clear metrics enables data-driven risk management
• Cultural transformation and capability development are as crucial as technical controls

Expected benefits: 

• Reduced security-related delays in software delivery
• Decrease in post-release vulnerabilities and incidents
• Lower remediation costs through early detection
• Improved regulatory compliance and audit readiness
• Enhanced collaboration between security and development teams
• Stronger security posture with minimal delivery friction

I. The modern security challenge: Risk in Wonderland 

In Lewis Carroll’s “Alice in Wonderland,” the Queen of Hearts famously declares, “Sentence first — verdict afterward.” This absurd approach to justice parallels how many organizations handle security today — enforcing controls after development is complete, when changes are most expensive and disruptive. This approach creates an adversarial relationship where security is perceived as the villain rather than a vital partner in delivering safe, reliable software. 

The traditional approach is failing 

Imagine a city where building inspections only occur after construction is complete. Developers would face devastating costs when structural issues are discovered too late, leading to expensive remediation or even complete rebuilds. Unfortunately, many organizations still approach information security this way — waiting until development is nearly complete before conducting security reviews, penetration tests, and compliance checks. 

The cost of late-stage security 

Organizations clinging to traditional security approaches face: 

• Costly rework and delayed releases 
• Adversarial relationships between security and development 
• Mounting security debt 
• Increased exposure to threats 
• Rising operational risks 
• Compliance challenges and regulatory scrutiny 

II. The evolution of risk management 

Modern information security requires thinking like a trusted advisor rather than a checkpoint guardian. This means creating environments that enable secure development while ensuring system integrity and regulatory compliance. 

From security guard to city planner

Traditional approach	Modern approach
End-stage security reviews	Security in requirements
Manual compliance checks	Automated policy enforcement
Security as blocker	Security as enabler
Project-based security	Product security mindset
Perimeter defense	Zero-trust principles

Now imagine a new world where developers have access to pre-approved security patterns, automated compliance verification, and clear security guidelines that enable rapid, reliable construction while ensuring protection. This is the promise of modern security integration — providing higher-level security building blocks that enable innovation and rapid business reconfiguration while maintaining system integrity. Rather than forcing every team to become security experts, we create platforms and patterns that abstract away complexity while ensuring quality and consistency. 

III. The ‘what’: Strategic security alignment 

In an environment where you need to balance business agility with regulatory compliance and security requirements, evolving your security approach is key. Security capabilities need to support rapid delivery of business value while ensuring appropriate protection against threats. 

The shift for security teams to focus on business enablement rather than just protection is essential. This means proactively understanding both the business objectives and planned delivery paths, then integrating security seamlessly into those journeys. 

Moving to “Shift-Left” security is a significant cultural change. Security is no longer expressed as a gate at the end of development but as an integral part of the entire delivery process. Translating security requirements into actionable guidance and controls allows delivery teams to build secure systems from the start. 

Key areas to address: 

• Alignment between security capabilities and business risk appetite 
• Evolution from security checkpoints to security enablement 
• Frameworks for measuring security effectiveness 
• Cultural transformation requirements 
• Models for effective cross-team collaboration 
• Approaches to security investment prioritization 
• Automated compliance monitoring 
• Secure innovation enablement strategies 

Just as a city’s safety depends on building codes being applied from the initial planning stages, our security strategy must be integrated throughout the development lifecycle. This integration ensures that improvements in security posture translate into tangible business value—reduced incidents, better compliance readiness, and stronger customer trust. 

IV. The ‘how’: Building secure digital products 

1. Security in requirements review 

Conversation starter: “How do we ensure security is considered from the very beginning?” 

Just as building codes are consulted before architectural plans are drawn, security requirements must be established early in the development process. 

Focus area	Key activities	Business impact
Risk assessment	– Thorough assessment of controls  – Authentication & authorization review  – Data protection planning  – Input validation requirements	– Reduced remediation costs  – Improved compliance  – Enhanced customer trust
Architecture review	– Network segmentation planning  – Data flow security analysis  – Application security architecture  – Zero-trust implementation	– System resilience  – Defense in depth  – Reduced attack surface  – Compliance by design
Data classification	– Information classification standards  – Appropriate control selection  – Privacy requirements mapping  – Regulatory alignment	– Regulatory compliance  – Data breach prevention  – Appropriate protection levels  – Resource optimization

2. Security in design review 

Conversation starter: “How do we identify and address security risks in our architecture?” 

Like urban planners considering crime prevention through environmental design, security in design focuses on identifying and mitigating threats early. 

Focus area	Key activities	Business impact
Threat modeling	– Systematic risk identification  – Attack vector analysis  – Potential attacker profiles  – Business impact assessment	– Proactive risk mitigation  – Targeted security controls  – Informed investment decisions  – Reduced vulnerabilities
Secure patterns	– Pre-approved security patterns  – Security reference architectures  – Implementation guidelines  – Best practice examples	– Faster development  – Consistent security  – Reduced design flaws  – Knowledge reuse
Design reviews	– Security architecture evaluation  – Control effectiveness assessment  – Design pattern validation  – Expert guidance	– Enhanced design quality  – Early flaw detection  – Optimized controls  – Reduced technical debt

3. Security in build and test 

Conversation starter: “How do we ensure code is secure before it reaches production?” 

Similar to building inspections occurring throughout construction, security testing must be integrated into the development process.

Focus area	Key activities	Business impact
Secure coding	– Coding standards implementation  – Developer security training  – Peer code reviews  – Security frameworks	– Fewer vulnerabilities  – Developer capability  – Consistent quality  – Reduced incidents
Automated testing	– Static application security testing  – Software composition analysis  – Secret scanning  – Container security scanning	– Continuous validation  – Early detection  – Reduced manual effort  – Consistent quality
Pre-production testing	– Dynamic application security testing  – Penetration testing  – Compliance validation  – Security regression testing	– Validation of controls  – Comprehensive assessment  – Regulatory readiness  – Risk reduction

4. Security in production 

Conversation starter: “How do we maintain security posture once systems are live?” 

Like ongoing city safety monitoring and emergency services, production security ensures systems remain protected against evolving threats. 

Focus area	Key activities	Business impact
Continuous monitoring	– Security event monitoring  – Threat intelligence integration  – Anomaly detection  – Vulnerability management	– Rapid threat detection  – Proactive protection  – Breach prevention  – Risk management
Incident response	– Response process automation  – Playbook development  – Cross-team coordination  – Recovery procedures	– Minimized impact  – Business continuity  – Regulatory compliance  – Customer trust
Continuous improvement	– Root cause analysis  – Control effectiveness review  – Process refinement  – Knowledge sharing	– Evolving protection  – Process maturity  – Reduced recurrence  – Organizational learning

V. Measuring success: The security metrics dashboard 

To effectively manage what you measure, a comprehensive security metrics dashboard should track key indicators across the software delivery lifecycle: 

Leading indicators (preventative) 

• % of projects with completed threat models before development 
• % of developers completing security training 
• Code scanning coverage and findings per 1000 lines of code 
• Security requirements coverage in user stories 
• Security architecture review completion rate 
• Third-party component risk assessment completion 

Operational indicators (in-process) 

• Mean time to remediate security findings 
• Security debt reduction rate 
• Automated security test pass rate 
• Vulnerability scan coverage 
• Security gate pass/fail metrics 
• Secure coding standard compliance 

Lagging indicators (results) 

• Production security incidents by severity 
• Security findings discovered post-release 
• Audit compliance status 
• Percentage of applications with current penetration tests 
• Average vulnerability age by severity 
• Security-related release delays 

VI. Practical implementation guide: Down the rabbit hole 

Phase 1: Foundation building (1-3 months) 

Just as Alice had to understand the rules of Wonderland, start by establishing your security baseline: 

• Security maturity assessment across development teams 
• Current state risk mapping and gap analysis 
• Security governance model definition 
• Initial metrics framework establishment 
• Pilot team identification and prioritization 
• Quick win implementation 

Phase 2: Transformation launch (3-6 months) 

Like Alice’s journey through Wonderland, begin your transformation expedition: 

• Developer security awareness program implementation 
• Automated security tooling integration in CI/CD 
• Security champions program establishment 
• Secure coding guidelines development 
• Threat modeling process implementation 
• Initial metrics collection and baseline setting 

Phase 3: Scale and optimize (6-12 months) 

As your journey progresses, expand successful practices: 

• Expansion to additional development teams 
• Metrics-driven improvement initiatives 
• Security automation enhancement 
• Advanced threat modeling capabilities 
• Developer certification program 
• Continuous feedback and optimization loop 

VII. The new security mindset: From Queen of Hearts to Cheshire Cat 

A security team’s mindset should evolve from the authoritarian Queen of Hearts, who demands obedience through fear and threatens to remove heads (or projects) that fail to comply, to one that mirrors the Cheshire Cat — providing guidance, appearing when needed, and helping teams navigate their way through the complex security landscape while respecting their autonomy. 

The transformation of security leadership 

Aspect	Traditional mindset (“Queen of Hearts”)	Modern mindset (“Cheshire Cat”)	Business impact
Leadership style	– Command and control  – Fear-based compliance  – Binary pass/fail  – Centralized authority	– Guide and advise  – Risk-based decisions  – Contextual guidance  – Distributed responsibility	– Faster delivery  – Improved collaboration  – Better security outcomes  – Reduced friction
Decision making	– Rigid standards  – Manual approvals  – Gate-driven process  – Risk avoidance	– Flexible guidelines  – Automated validations  – Continuous assessment  – Risk management	– Accelerated delivery  – Appropriate controls  – Consistent protection  – Business enablement
Team interaction	– Security dictates requirements  – After-the-fact reviews  – Distant relationship  – Approval-based	– Collaborative design  – Embedded security expertise  – Partnership model  – Enablement-focused	– Shared responsibility  – Earlier detection  – Reduced rework  – Team empowerment

Key mindset shifts in practice 

1. From enforcer to enabler 

Traditional practice	Modern practice	Value created
Security gates	Security guardrails	Reduced delivery friction
Manual security reviews	Self-service security tools	Faster development cycles
Audit-driven compliance	Risk-based protection	Appropriate security investment
Security sign-offs	Automated validations	Continuous compliance

2. From documentation to automation 

Traditional practice	Modern practice	Value created
Manual compliance evidence	Automated evidence collection	Reduced audit overhead
Static security requirements	Security as code	Consistent implementation
Periodic security testing	Continuous security validation	Earlier vulnerability detection
Human-dependent controls	Machine-enforced controls	Scalable security

3. From project to product security 

Traditional practice	Modern practice	Value created
Point-in-time assessments	Continuous security monitoring	Sustainable security posture
Handover to operations	Shared security responsibility	Improved operational security
Final penetration tests	Frequent security testing	Earlier vulnerability detection
Security debt accumulation	Continuous security improvement	Reduced security incidents

VIII. Shifting left in practice: The golden pathway 

Building on the concept of a “golden path” for software development, we can establish a “secure golden pathway” that integrates security at every stage of the software delivery lifecycle. 

Before development 

Activities: 

• Information classification validation 
• Third-party risk assessment 
• Security architecture review 
• Authentication/authorization design 
• Threat modeling 

Who: Information risk management, architecture, product Teams 
How: Local governance with security expertise 
Goal: Build security requirements into development backlogs 

During development 

Activities: 

• Secure coding practices 
• Pre-commit security checks 
• Static application security testing 
• Software composition analysis 
• Secret scanning 
• Security-focused code reviews 

Who: Developers, security champions, appsec engineers 
How: Automated tooling in CI/CD pipeline 
Goal: Detect and fix vulnerabilities early in development 

Before release 

Activities: 

• Dynamic application security testing 
• Penetration testing 
• Infrastructure security validation 
• Compliance verification 
• Final security review 

Who: Application security, quality assurance, devops 
How: Automated security gates with clear remediation paths 
Goal: Validate security controls before production deployment 

In production 

Activities: 

• Security monitoring and alerting 
• Vulnerability management 
• Incident response readiness 
• Security metrics tracking 
• Continuous improvement 

Who: Operations, security operations, product teams 
How: Shared responsibility model with clear accountabilities 
Goal: Maintain security posture throughout product lifecycle 

IX. The integrated future: DevSecOps maturity 

As your organization matures, security becomes truly embedded in the development process, leading to a fully integrated DevSecOps approach. 

Characteristics of DevSecOps maturity 

Dimension	Initial level	Intermediate level	Advanced level
Culture	– Security as separate function  – Compliance-driven  – Reactive approach	– Security champions program  – Cross-team collaboration  – Proactive mindset	– Shared responsibility  – Security enablement  – Innovation-friendly
Automation	– Basic scanning tools  – Manual approval gates  – Limited integration	– Integrated security tooling  – Automated security gates  – Self-service options	– Comprehensive automation  – Policy as code  – Preventative controls
Measurement	– Vulnerability counts  – Audit findings  – Manual reporting	– Security debt tracking  – Process metrics  – Automated dashboards	– Risk-based metrics  – Business impact measures  – Predictive analytics
Governance	– Traditional security policies  – Manual compliance checking  – Centralized control	– Modern security standards  – Automated compliance  – Federated governance	– Adaptive policies  – Continuous compliance  – Distributed ownership

Advanced security integration techniques 

As you advance in maturity, explore these advanced security integration techniques:

1. Infrastructure as Code (IaC) security 

class="wp-block-list">

Security policies encoded as infrastructure definitions 

class="wp-block-list">

Automated compliance validation for cloud resources 

class="wp-block-list">

Pre-deployment security verification 

2. Security as code 

class="wp-block-list">

Security requirements defined in machine-readable formats 

class="wp-block-list">

Automated testing of security controls 

class="wp-block-list">

Version-controlled security configuration 

3. Continuous compliance monitoring 

class="wp-block-list">

Real-time compliance dashboard 

class="wp-block-list">

Automated evidence collection 

class="wp-block-list">

Continuous control validation 

4. Self-service security 

class="wp-block-list">

Developer-facing security portals 

class="wp-block-list">

On-demand security testing tools 

class="wp-block-list">

Automated security guidance 

X. Conclusion: Navigating the risk landscape 

The transformation from reactive security to “Shift-Left” risk management represents more than a change in methodology — it’s a fundamental reimagining of how we create and sustain secure business value through technology. Just as thriving cities integrate safety considerations from urban planning through construction and ongoing operations, our development approach must transform from late-stage security testing to integrated risk management that enables continuous secure innovation. 

Vision of the transformed enterprise 

• Security that accelerates rather than constrains innovation 
• Automated controls that ensure compliance without manual intervention 
• Transparent security metrics guiding risk-based decisions 
• Engaged teams sharing security responsibility 
• Architecture designed for protection without compromising agility 
• Strong security foundations that enable continuous compliance 

In the process, security teams step out from the enforcement role — like the Queen of Hearts — and into a role more akin to the helpful but unobtrusive Cheshire Cat. By fostering collaboration, contextual guidance, and continuous improvement, you’ll build not just secure technology solutions, but a resilient digital ecosystem that can adapt to tomorrow’s threats. 

Key takeaways for technology leaders 

• Start with business risk appetite, not just technical controls 
• Align security metrics with business outcomes for meaningful insights 
• Provide security platforms and patterns that make secure development easy 
• Measure what matters — tie security metrics to business impact 
• Invest in security capabilities and culture across the organization 
• Design for secure evolution using automated compliance and verification 
• Continuously share insights and scale successful security patterns 

Remember, just as great cities aren’t built in a day, this transformation is a journey rather than a destination. The key is to start now, move purposefully, and keep the focus on enabling business outcomes while ensuring appropriate protection. In doing so, you’ll build not just a secure technology landscape, but a thriving ecosystem that powers your organization’s future success — safely and confidently. 

Call to action: Starting your transformation 

1. Assess your current security integration maturity 

2. Identify your most pressing security improvement opportunities 

3. Build a coalition of business, technology, and security leaders 

4. Choose a high-impact pilot area for initial focus 

5. Establish clear metrics for measuring security improvement 

6. Share successes and learnings broadly 

7. Scale proven patterns across the organization 

8. Maintain focus on continuous security improvement 

Organizations that successfully navigate this transformation will build competitive advantages through faster, more secure software delivery, more efficient use of security investments, improved ability to meet regulatory requirements, enhanced capacity for secure innovation, and greater business-security alignment. 

The time to start is now. Your organization’s future security posture depends on the foundations you build today. 

Shawn McCarthy is vice president and chief architect, Global Architecture, Risk & Governance, at Manulife. 

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects.