I have worked alongside enterprise technology for more than 30 years and watched AI evolve from a lab experiment into the modern boardroom’s core focus. However, the last few years of implementing AI alongside our customers have delivered our most profound reality checks.

The initial hype has faded, leaving CIOs to drive real enterprise value. Based on my experience implementing Google, OpenAI and Anthropic technologies, here are the fundamental, technology-agnostic lessons every leader must anchor their strategy around.

AI as a leadership multiplier

The most common tactical error we see is treating AI as an isolated technology project. What I have observed among our customers is that true success does not come from organizations that define a standalone “AI strategy,” but rather from those leaders that integrate AI into their business strategy.

When our customers isolate AI and define an AI strategy, it inevitably treats it like a “technological toy” to experiment with. This approach yields fragmented, orphaned initiatives that fail to scale because they are fundamentally disconnected from their core corporate objectives. What I learned is that AI is not the ultimate destination; it is a powerful catalyst. We have replaced “What can AI do for our customers?” with a more strategic question, “How does AI accelerate their existing business goals?”

Think of AI like electricity. No modern corporation designs a standalone “electricity strategy.” Instead, all companies route it invisibly across the entire organization to illuminate offices, power production lines and drive communication. AI must be woven into the enterprise fabric in the exact same way, acting as an underlying utility that supercharges your existing operational model.

Integrating AI into the broader business strategy also dictates how we measure success. It forces a shift away from short-term tech vanity metrics and anchors the technology into a long-term roadmap.

When AI remains trapped within the IT department of our customers, we notice that it is relegated to a mere “software experiment.” To become a true competitive advantage, we observed that AI requires intense cross-functional orchestration. This perspective does not diminish the merit of the technical team; their expertise is fundamental for establishing the architecture, data governance and tools your enterprise requires. However, while IT builds the foundational infrastructure, it lacks the organizational authority to decide what should be built on top of it. Only the CEO or the owner of the company can step in to ensure AI leaves the “toy project” phase and integrates into the DNA of the organization.

The requirement for top-down, executive ownership stems from three critical realities observed in the field:

• Silo-smashing and data collaboration: True enterprise AI is data-hungry and that data lives across disparate business lines, finance, operations, marketing and customer service. Only the CEO possesses the cross-functional authority to demand that data silos be dismantled.
• Cultural transformation and fear mitigation: AI triggers widespread anxiety over job displacement across all industries and hierarchies. When relegated to an “IT project,” resistance spikes as teams view it as a threat to their livelihoods. When I saw the CEO lead this cultural shift directly is when I noticed the best results.
• C-Suite education and strategic alignment: The mandate for AI capability cannot just be delegated downward; the transformation must begin at the very top. I have conducted more than 70 presentations for the Board of Directors and C-Level teams. These people need to be actively educated not on technical code, but on specific business use cases, return on investment (ROI) frameworks and how AI resolves core organizational bottlenecks.

PwC’s data found that only 12% of enterprises have achieved both cost and revenue benefits from AI. Those elite 12% succeeded precisely because their CEOs embedded AI extensively across strategic decision-making and cross-functional workflows. AI is simply too disruptive and too critical to be left exclusively in the hands of technical experts. If AI is not on the CEO’s weekly agenda, it is fundamentally missing from the company’s true strategy.

AI as a new operational framework

Traditional IT systems have operated on strict algorithmic certainty: if you input a specific set of data, the system executes an immutable line of code and guarantees the same, predictable output every single time.

AI completely breaks this paradigm. Because modern AI is built on probabilistic models, it does not execute static formulas; instead, it predicts the most likely correct response based on mathematical probabilities. This means that AI solutions carry an inherent, small percentage of uncertainty and variability. A prompt entered today might yield a slightly different, though contextually valid, output tomorrow.

Executive leadership and organizational cultures must be actively educated to accept and navigate this fundamental shift. Traditional quality assurance frameworks for software are designed for a 100% success rate. Applying this rigid standard to AI will paralyze your initiatives, keeping 80% of your projects trapped eternally in the pilot phase. This happened to us in a food and beverage company in Latin America a couple of years ago. After this experience, we started to include conditions in our contracts that tolerate statistical margins of error and still define the project as a success.

In terms of cost calculation, we had to teach CIOs and business managers to forget the monthly subscription model for AI and learn to manage the primary unit of exchange in modern AI: the token.

To understand AI costs, executives must understand how large language models process data. AI models do not read full words; instead, they break text, images or code down into “pieces” called tokens. As a baseline, every 100 words process as approximately 130 to 140 tokens. Because the major AI providers use the token as their currency, your business is billed dynamically based on the exact volume of tokens consumed by every query submitted (input) and every response generated (output).

Many leaders believe AI costs are fixed due to flat-rate enterprise tiers ($25–$30/user). This is a temporary illusion. These venture-capital-subsidized rates mask true operational costs and come with dynamic usage limits. Modeling long-term ROI on them guarantees a severe budget shock when true consumption pricing takes over.

The solution is not to halt AI adoption; doing so means losing your competitive edge. Instead, the cost per token must cease to be treated as a technical footnote relegated to the IT department. It must be elevated to a core business variable.

Risks in the AI adoption model

Since the beginning of the AI boom, I have seen all our customers making a critical tactical error that could cost them heavily in the medium term: they are focusing only on operational efficiency (reducing costs with AI).

I have observed that an alarmingly high percentage of companies remain trapped in pilot phases focused exclusively on short-term cost reduction. Bain & Company’s global Automation and AI Pathfinder Survey found that the largest share of companies measuring their AI initiatives (exactly 40%) realized cost reductions of 10% or less, heavily missing their internal targets. Our customers are putting too many resources and effort into marginal financial gains and in doing so, they are jeopardizing their most valuable assets: service quality, resilience and customer trust.

Utilizing AI solely to slash headcount or cut operational corners is a dangerous trap that introduces severe field liabilities. A financial service organization in Latin America announced that they saved $1 million in customer support by replacing humans with AI chatbots. However, the mid-term reality revealed a different story: a damaged brand reputation due to AI errors and an influx of frustrated clients fleeing because the automated system cannot handle special cases.

Putting a company on an extreme AI diet might make it look leaner on next quarter’s financial statement, but over-indexing on cost-cutting will ultimately leave the business too weak to compete when market dynamics shift. We are now inviting our customers to change the question from “How much money will AI save us?” to “How will we leverage AI to exponentially increase the long-term value of our enterprise?”

Deploying enterprise AI is a marathon, not a sprint, and the terrain changes with every mile. The organizations that thrive in this next era will be those that transition from fascination to discipline, treating AI not as a magic bullet for immediate savings, but as a core capability that demands rigorous governance, architectural foresight and cultural maturity. Navigating this shift requires moving past the theoretical hype and anchoring decisions in raw, field-tested reality.

As we continue to deploy these technologies across industries, the blueprint for success is being rewritten in real time. Let’s keep this conversation going as we map out the future of business intelligence together.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

I have worked alongside enterprise technology for more than 30 years and watched AI evolve from a lab experiment into the modern boardroom’s core focus. However, the last few years of implementing AI alongside our customers have delivered our most profound reality checks.

The initial hype has faded, leaving CIOs to drive real enterprise value. Based on my experience implementing Google, OpenAI and Anthropic technologies, here are the fundamental, technology-agnostic lessons every leader must anchor their strategy around.

AI as a leadership multiplier

The most common tactical error we see is treating AI as an isolated technology project. What I have observed among our customers is that true success does not come from organizations that define a standalone “AI strategy,” but rather from those leaders that integrate AI into their business strategy.

When our customers isolate AI and define an AI strategy, it inevitably treats it like a “technological toy” to experiment with. This approach yields fragmented, orphaned initiatives that fail to scale because they are fundamentally disconnected from their core corporate objectives. What I learned is that AI is not the ultimate destination; it is a powerful catalyst. We have replaced “What can AI do for our customers?” with a more strategic question, “How does AI accelerate their existing business goals?”

Think of AI like electricity. No modern corporation designs a standalone “electricity strategy.” Instead, all companies route it invisibly across the entire organization to illuminate offices, power production lines and drive communication. AI must be woven into the enterprise fabric in the exact same way, acting as an underlying utility that supercharges your existing operational model.

Integrating AI into the broader business strategy also dictates how we measure success. It forces a shift away from short-term tech vanity metrics and anchors the technology into a long-term roadmap.

When AI remains trapped within the IT department of our customers, we notice that it is relegated to a mere “software experiment.” To become a true competitive advantage, we observed that AI requires intense cross-functional orchestration. This perspective does not diminish the merit of the technical team; their expertise is fundamental for establishing the architecture, data governance and tools your enterprise requires. However, while IT builds the foundational infrastructure, it lacks the organizational authority to decide what should be built on top of it. Only the CEO or the owner of the company can step in to ensure AI leaves the “toy project” phase and integrates into the DNA of the organization.

The requirement for top-down, executive ownership stems from three critical realities observed in the field:

• Silo-smashing and data collaboration: True enterprise AI is data-hungry and that data lives across disparate business lines, finance, operations, marketing and customer service. Only the CEO possesses the cross-functional authority to demand that data silos be dismantled.
• Cultural transformation and fear mitigation: AI triggers widespread anxiety over job displacement across all industries and hierarchies. When relegated to an “IT project,” resistance spikes as teams view it as a threat to their livelihoods. When I saw the CEO lead this cultural shift directly is when I noticed the best results.
• C-Suite education and strategic alignment: The mandate for AI capability cannot just be delegated downward; the transformation must begin at the very top. I have conducted more than 70 presentations for the Board of Directors and C-Level teams. These people need to be actively educated not on technical code, but on specific business use cases, return on investment (ROI) frameworks and how AI resolves core organizational bottlenecks.

PwC’s data found that only 12% of enterprises have achieved both cost and revenue benefits from AI. Those elite 12% succeeded precisely because their CEOs embedded AI extensively across strategic decision-making and cross-functional workflows. AI is simply too disruptive and too critical to be left exclusively in the hands of technical experts. If AI is not on the CEO’s weekly agenda, it is fundamentally missing from the company’s true strategy.

AI as a new operational framework

Traditional IT systems have operated on strict algorithmic certainty: if you input a specific set of data, the system executes an immutable line of code and guarantees the same, predictable output every single time.

AI completely breaks this paradigm. Because modern AI is built on probabilistic models, it does not execute static formulas; instead, it predicts the most likely correct response based on mathematical probabilities. This means that AI solutions carry an inherent, small percentage of uncertainty and variability. A prompt entered today might yield a slightly different, though contextually valid, output tomorrow.

Executive leadership and organizational cultures must be actively educated to accept and navigate this fundamental shift. Traditional quality assurance frameworks for software are designed for a 100% success rate. Applying this rigid standard to AI will paralyze your initiatives, keeping 80% of your projects trapped eternally in the pilot phase. This happened to us in a food and beverage company in Latin America a couple of years ago. After this experience, we started to include conditions in our contracts that tolerate statistical margins of error and still define the project as a success.

In terms of cost calculation, we had to teach CIOs and business managers to forget the monthly subscription model for AI and learn to manage the primary unit of exchange in modern AI: the token.

To understand AI costs, executives must understand how large language models process data. AI models do not read full words; instead, they break text, images or code down into “pieces” called tokens. As a baseline, every 100 words process as approximately 130 to 140 tokens. Because the major AI providers use the token as their currency, your business is billed dynamically based on the exact volume of tokens consumed by every query submitted (input) and every response generated (output).

Many leaders believe AI costs are fixed due to flat-rate enterprise tiers ($25–$30/user). This is a temporary illusion. These venture-capital-subsidized rates mask true operational costs and come with dynamic usage limits. Modeling long-term ROI on them guarantees a severe budget shock when true consumption pricing takes over.

The solution is not to halt AI adoption; doing so means losing your competitive edge. Instead, the cost per token must cease to be treated as a technical footnote relegated to the IT department. It must be elevated to a core business variable.

Risks in the AI adoption model

Since the beginning of the AI boom, I have seen all our customers making a critical tactical error that could cost them heavily in the medium term: they are focusing only on operational efficiency (reducing costs with AI).

I have observed that an alarmingly high percentage of companies remain trapped in pilot phases focused exclusively on short-term cost reduction. Bain & Company’s global Automation and AI Pathfinder Survey found that the largest share of companies measuring their AI initiatives (exactly 40%) realized cost reductions of 10% or less, heavily missing their internal targets. Our customers are putting too many resources and effort into marginal financial gains and in doing so, they are jeopardizing their most valuable assets: service quality, resilience and customer trust.

Utilizing AI solely to slash headcount or cut operational corners is a dangerous trap that introduces severe field liabilities. A financial service organization in Latin America announced that they saved $1 million in customer support by replacing humans with AI chatbots. However, the mid-term reality revealed a different story: a damaged brand reputation due to AI errors and an influx of frustrated clients fleeing because the automated system cannot handle special cases.

Putting a company on an extreme AI diet might make it look leaner on next quarter’s financial statement, but over-indexing on cost-cutting will ultimately leave the business too weak to compete when market dynamics shift. We are now inviting our customers to change the question from “How much money will AI save us?” to “How will we leverage AI to exponentially increase the long-term value of our enterprise?”

Deploying enterprise AI is a marathon, not a sprint, and the terrain changes with every mile. The organizations that thrive in this next era will be those that transition from fascination to discipline, treating AI not as a magic bullet for immediate savings, but as a core capability that demands rigorous governance, architectural foresight and cultural maturity. Navigating this shift requires moving past the theoretical hype and anchoring decisions in raw, field-tested reality.

As we continue to deploy these technologies across industries, the blueprint for success is being rewritten in real time. Let’s keep this conversation going as we map out the future of business intelligence together.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Nvidia has introduced its next-generation Spectrum-X Ethernet networking platform, positioning it as a key building block for the next wave of “gigascale” AI factories designed to connect millions of GPUs while reducing power consumption and operational costs.

The networking platform is part of Nvidia’s broader Rubin architecture, which integrates six major components—including the Vera CPU, Rubin GPU, NVLink 6 switches, ConnectX-9 SuperNICs, BlueField-4 DPUs and the new Spectrum-6 Ethernet switches—into a tightly coupled AI infrastructure stack.

The company says this level of integration underscores the growing importance of networking in AI. In its most recent quarter, networking sales were $11 billion, up 263% year-over-year, prompting the ever-subtle CEO Jensen Huang to declare “We’re … now the largest networking company in the world” during Nvidia’s earnings call.

While GPUs have dominated headlines during the AI boom, networking has increasingly become a performance bottleneck as models grow larger and require faster communication between compute nodes.

Spectrum-X is a comprehensive platform consisting of Spectrum Ethernet switches, Spectrum-X SuperNICs, ConnectX NICs, BlueField DPUs, LinkX cabling and transceivers and Spectrum-XGS for networking between multiple AI data centers.

At the heart of the platform is the Spectrum-6 switch, a 102.4-terabit-per-second Ethernet switch system delivering 2x the capacity of previous-generation systems and built as part of the Vera Rubin platform. 

Spectrum-6 is designed to operate an AI factory as one end-to-end computing system. It combines new Ethernet switches, network interface cards, silicon photonics and software designed to improve bandwidth while lowering latency and power usage.

The new Spectrum-X technology intelligently balances traffic across available paths, rapidly bypasses failures and precisely recovers when data traveling across a network fails to reach its destination. Plus, support for open network operating systems and a choice of RDMA transport models gives AI builders flexibility without compromising performance.

Nvidia says its latest silicon photonics technology integrates optical communications directly into networking hardware, reducing power consumption while increasing bandwidth density compared with conventional optical networking approaches.

The announcement reflects a broader shift in AI infrastructure strategy. Early AI clusters were primarily limited by GPU availability, but hyperscale operators are increasingly finding that networking, storage and power delivery determine how efficiently massive GPU deployments perform. By integrating networking more tightly with compute, Nvidia aims to eliminate communication bottlenecks that emerge as AI systems scale beyond a single data center or even multiple campuses.

New to the platform is Nvidia’s previously announced Spectrum-XGS technology, which links geographically distributed data centers into a single AI supercomputer. Together, the technologies are designed to enable organizations to construct AI factories that span multiple facilities while operating as a unified computing environment.

You are one of the six billion people (75% of the world population) online today, and every click you make is routed through the data center. Data centers, whether knowingly or unknowingly, play a very critical role in your daily online activities. With an increasing population, increasing usage of online presence, and now omniscient AI, the demand for data centers has increased manyfold, and the trend seems similar to the year 2000, when telephone towers were built to accommodate increased digital presence.

To win the AI race, Hyperscalers (Google, Meta, Amazon, Microsoft, Alibaba, Oracle, IBM, Tencent) are spending huge amounts of money on data center development. In the USA, the hyperscalers are planning to spend $650 billion in 2026, which is around 70% higher than 2025 spending, according to Yahoo Finance.

As per McKinsey research, by 2030, companies will invest around $7 trillion in Capex on data center infrastructure globally. More than $4 trillion will go towards computing hardware investment. More than 40% of this spending will be invested in the United States.

Demand growth in data centers

McKinsey analysis shows that global demand for data center capacity can more than triple by 2030, with a compound annual growth rate (CAGR) of around 22 per cent. In the USA, data center demand could grow by 20-25 per cent at the same time.  

The data center industry is currently undergoing a violent transition. We are moving away from the era of “bespoke projects” — where every facility was a unique architectural feat — into an era of industrialized infrastructure. With global capital expenditure in the sector projected to hit $3 trillion by 2028, the “bottleneck” has shifted. It is no longer about securing the capital; it is about the physics of the supply chain.

During my tenure at Vantage, managing the intersection of data center construction management (DCCM) and infrastructure management (DCIM), I saw firsthand that the most successful players aren’t those with the deepest pockets, but those with the most integrated data threads. If your construction data in Procore doesn’t talk to your financial reality in Yardi, or your operational capacity in DCIM, you aren’t building a data center — you’re managing a $500 million blind spot.

The death of “sticks and bricks”

Traditionally, data center construction was treated as civil engineering. But for the modern CIO, a data center is a complex product assembly.

The challenges are systemic. We are facing 50-to-80-week lead times for critical “long-pole” items: extra-high-voltage transformers, switchgear, and the liquid cooling manifolds required for the next generation of AI chips. In this environment, the traditional reactive supply chain model is a liability.

To survive the $3 trillion inflow, we must adopt a hybrid-agile SCOR (supply chain operations reference) model. This means applying continuous flow logic to standardized components (like modular power skids) while maintaining agile responsiveness for the volatile IT layer.

The digital bridge: Construction management software  to ERP

The most significant opportunity for CIOs lies in financial-operational integration. In many organizations, there is a data chasm between the construction site and the corporate office. Construction teams live in the construction management software tracking tasks, trades, RFIs and payment submittals. Finance teams operate corporate offices with project management tools (worth remembering that email is a key tool besides spreadsheets and phone calls) tracking capex schedule, commissioning timeline, capital drawdowns and asset lifecycle management.

These systems are siloed; the CIO loses visibility into the total cost to serve. By integrating construction management into the financial system, we create real-time financial visibility of the build. We can see exactly how a three-week delay in a chiller delivery impacts the internal rate of return (IRR) of the entire asset. This isn’t just accounting; it’s strategic telemetry.

From BIM to DCIM: The lifecycle thread

The second bridge is the handoff from construction (BIM) to operations (DCIM). Historically, this handoff was a nightmare of PDFs and Excel sheets. By the time the operations team took the keys, the “as-built” design information was already out of date.

The opportunity today is to maintain a continuous data thread. The sensor data and asset tags established during the “make” phase in our SCOR model should flow directly into the DCIM. This allows us to perform virtual commissioning. Before a single server is racked, we should already have a digital replica of the airflow, power distribution, and cooling capacity.

The scientific inference: AI in the supply chain

As someone who has led data and AI initiatives, I’ve seen the hype. But in the supply chain, the application of AI must be pragmatic, not generative. We don’t need AI to write poems; we need it for predictive procurement. Most organizations manage their procurement in ERP or a mix of a few tools to manage the source-to-settle business flow. Adopting a system workflow improves data collection and the state of the procurement cycle, which in turn provides AI with the context to draw inferences for possible delays and anomalies in original specifications and change orders.

By applying machine learning to global logistics data, we can move from just-in-time to just-in-case modeling. AI can analyze geopolitical risks, shipping lane congestion, and raw material pricing to tell a CIO: “Order your switchgear 14 months early, or your Q3 2027 ‘Power On’ date is at risk.”

Bringing it all together: AI in the supply chain and finance

Why it matters: Approximately 70% of the capex is on this workflow and making timely decisions that directly impact the ready-for-service dates. The current challenge of reactionary adjustment in design to procurement to local fit-out is a significant drain on capex efficiency and cost of capital. Because single-project delivery delays have become so volatile, a massive structural shift is occurring in how digital infrastructure is funded. Single-project debt (special purpose vehicles or SPVs) is facing severe friction. To insulate themselves from RFS shocks, the largest institutional players are moving toward permanent platform capital — aggregating exposure across dozens of global assets simultaneously.

Navigating these complex multi-billion-dollar engineering projects distributed over a large geography is simply unmanageable without rethinking and re-engineering existing tools and processes.

The roadmap for the modern CIO

To lead this transformation, CIOs must move beyond the IT shop mentality and become master orchestrators of the supply chain. Here is the 1500-word reality condensed into three mandates:

1. Standardize the product: Stop designing bespoke facilities. Move toward DFMA (design for manufacturing and assembly). If 70% of your data center can be built in a factory and shipped as modules, you bypass the unpredictability of on-site labor.
2. Integrate the financial stack: If your construction management software and your ERP aren’t sharing a heartbeat, your data is lying to you. Force the integration between Procore and Yardi.
3. Own the long poles: Don’t leave the procurement of transformers and cooling units to general contractors. Use your balance sheet to secure these items years in advance. In 2026, inventory is the new currency.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

At Cisco, VP of engineering Jason Andrews deals with all the same technical issues as every other company deploying AI, including ensuring it’s governed, secure, and integrating multiple data sources, legacy systems, and AI models.

But these issues are relatively straightforward compared to the bigger challenges relating to the fast pace of change, specifically how AI can touch and transform nearly every aspect of business.

“We’re thinking about it every day,” he says. “My belief is we’ll be seeing a massive acceleration of everything.”

In coding, for example, he’s witnessing productivity increases up to 110% with AI assistants. “I can build apps or custom integrations a lot faster,” he adds.

And the real benefit of AI isn’t just in speeding up individual steps in a process, but in making AI the core of a new business process. But building it from scratch puts even more pressure on organizations trying to get employees up to speed on new ways of doing things.

“We want to move fast, train people, and get them onboarded,” he says. “But what I thought AI was going to do for my organization nine months ago is different from three months ago.” So by the time something is rolled out, it’s changed three times.

“I struggle with the change management aspect,” he says. “The legacy model of change management isn’t fast enough. How do you create that constant learning?”

One of the ways Cisco approaches it is to create communities where people can talk about these issues and share best practices and governance, and you have to keep people’s minds open that every day is going to be different than the last, Andrews adds.

Testing the AI waters

Cisco isn’t the only organization struggling with change management in the face of the AI tsunami. In a survey of 2,000 global CEOs IBM released in May, 83% of them said AI success depends more on adoption than on the technology itself, and 77% said talent and technology roles are converging.

“Thanks to Claude Code, our entire development cadence is exponentially greater than a year ago,” says Andrew Johnson, CIO at Brownstein Hyatt Farber Schreck, a Denver-based law firm with about 700 employees and clients around the US. But, as with Cisco, the biggest challenge isn’t technical.

“In our industry, with our circumstances, we’re probably less constrained by technical capability than organizational constraints, culture, aptitude, the need to bind people to technology, and what helps me and the client,” he says. “There’s a tremendous amount of cultural shift that has to happen in our organization, which is far more demanding of my attention and complexity of thought than the technical stuff.”

Companies that bill by the hour, such as law firms, may face additional challenges as attorney productivity increases because billable hours might go down. Alternatively, the total number of cases could go up as litigation becomes less expensive. Either way, firms that adapt will see competitive advantage, and the rest will fall behind, putting more pressure on the need for change management.

“If people can’t embrace technology, we won’t be able to get a lot of value out of it,” says Johnson. “I’m talking to people about adapting their way of work. There are certainly a lot of people intrigued and anxious to dive in. They recognize the connection between the potential of the technology and what we do.”

But helping everyone see that connection and then working with them to change their habits is difficult, and requires solid relationships and good communications. “That’s been far more of a bottleneck for us,” he says.

To address the issue, the firm has developed a network of technology champions who also understand the legal side of the business. “Now we need lawyers who know how to use the technology and can articulate these things to the people we’re trying to reach,” Johnson says.

But change management is only one leadership bottleneck slowing AI adoption. Companies also struggle with figuring out their vision for AI, with slow decision-making, and a tendency to focus on the past instead of the future.

Vision and strategy

In another survey, this time of 950 business leaders released by Grant Thornton in April, 51% said strategy is the biggest driver of ROI when it comes to AI adoption, but 79% of operations leaders said they don’t have a fully developed and implemented AI strategy.

“Having leadership understanding why AI is needed and what objective they’re trying to achieve is very important,” says Shivi Verma, senior manager of engineering at Docusign. “Sometimes leadership doesn’t have a strategy for their organization on how AI should be adopted. Many times it’s bottom-up, which creates a chaotic experience.”

When Docusign started adopting gen AI, different teams and organizational units wanted to go in different directions. “All were coming up with their own strategy and tooling,” he says. So Docusign brought business leaders together to understand the pain points, and decide on the technology.

“Getting requirements and placing a bet on a specific technology was important,” he says, “as well as pivoting to a different technology if needed.”

In order to adapt to changes, the company wanted to have a nimble approach, starting with smaller use cases, with power users, and problem areas.

“We try to plan for four to six months,” he adds. “We set expectations for our leadership that we place a bet with a specific technology, but want to be able to pivot.”

Today, the leadership challenge front lines have moved yet again, to agentic AI. “Folks are creating their own agents and deciding their own permissions,” Verma adds. “We’re still coming up with a governance strategy.”

Slow decision-making

When it comes to AI deployments, Dan Diasio, global AI consulting leader at EY and CTO for its US consulting business, admits he’s a bottleneck.

There’s a great deal of interest in what AI can do, and using a variety of new AI tools. But since the firm deals with sensitive client data, safety is paramount. It’s a slow process, but important to build secure infrastructure, and to have trust in the technology. “That’s a reasonable bottleneck that makes sense,” he says.

Trust in the tools they work with is essential because clients expect it. “Every tool we use has to go through a detailed security and information privacy impact assessment, as well as a whole other set of controls so they can be used appropriately and safely,” he says.

These reviews can take a lot of time, though, and in the age of AI, speed is a highly valued currency. So how do you balance the two, when safety reviews can require input from a lot of different stakeholders and be extremely time intensive?

“We’ve stood up a team to be able to quickly certify and address a variety of platforms,” Diasio says. “Instead of working with different departments in the way we used to, we’ve started identifying representatives from different departments into a cohort. Decisions we used to make in months now take weeks.”

According to a West Monroe survey of more than 1,200 leaders released earlier this year, slow decision-making is already showing up on the bottom line. Nearly three out of four leaders said their organizations lose up to 5% of annual revenue to slow decision-making and delayed execution.

And the top reasons for the delays? According to 40% of the managers surveyed, the problem was the skills gaps of overwhelmed teams, and 35% pointed to layers of management or approvals. Nearly half said they’re spending 10 to 25% of their time on rework, excessive approvals, and unnecessary meetings, and more than half say up to 50% of their projects fail or lose momentum to delays.

Focus on the future, not the past

When it comes to the decision about where to apply AI in an organization, the tendency, Diasio says, is to turn to the experts with the most expertise in the business. But these are the same people most likely to focus on improving on what they’re already doing.

“And that often blinds people to what’s possible in the future,” he says. “That becomes a significant bottleneck.” So the solution is to revamp the decision-making process around the new reality.

“What we see some advanced companies do is give people who don’t understand the process but understand the technology equal footing with people who don’t understand the technology but understand the process,” he says. “A lot of companies are disproportionately focused on just addressing their operating model right now.”

Instead of focusing on what they’re currently doing, AI-native companies will start with a focus on the customer, he says. This shift in focus isn’t likely to show up immediately on the bottom line, or result in the highest possible number of pilots going into production.

“If leaders are in a position where they’re justifying the use of a technology to the board or their CFO, they become a bottleneck when they start demonstrating their value in terms of the number of things they’re doing,” Diasio says.

But 150 or 200 use cases deployed into production may feel like progress, like things are happening in the organization. But all these use cases are a waste of time and money if they’re applied to existing processes that don’t move the needle. “We see that happen in organizations today,” he says. “Maybe we need to reinvent the processes.”

It’s no secret that companies will need to change in order to adapt to AI. Deloitte recently surveyed 660 global technology leaders and 81% said their current operating model can deploy and govern AI enterprise-wide, but 75% also said their organization must change its operating model within the next 12 to 18 months to drive greater value.

AI ROI is real, says China Widener, Deloitte vice chair and US tech, media, and telecom industry leader. But it’s currently weighted toward efficiency gains, with broader business transformation and revenue upside still developing.

Another Deloitte survey showed that the clearest results from AI were in productivity, with 66% of organizations reporting gains, and cost efficiency, with 40% saying AI reduces costs. “However, revenue impact is still emerging,” says Widener. “Only one in five companies says AI is driving top-line growth today.” But optimism prevails, with 74% expecting it to do so in the future.

HireQuotient, an AI-native recruiting platform, today announced its integration with Paylocity (Nasdaq: PCTY), bringing AI-powered candidate sourcing and screening capabilities to Paylocity customers in manufacturing, building services, construction, healthcare and insurance, which are industries where deskless and frontline hiring has historically been underserved by AI recruiting tools.

Employers in these sectors who already use HireQuotient are seeing the impact firsthand.

“By simply putting in vetting criteria, I was able to get a very specific talent pool within a day,” said Niki Simoneaux, COO of Arc Health. “With EasySource, we can reach a huge database or filter for specific licenses and areas.”

“With technology and the ability to work remotely, we’re able to recruit nationwide outside of our footprint. This expands the pool of prospective candidates and gives us access to candidates who might not have ever applied for a position on our website’s career page,” said Jeff McGee, vice president at W3 Insurance.

“HireQuotient’s AI-native product helped my team at Alliance Building Services to cut down time to close position by more than 60%, and their team works very closely with the client to ensure adoption at scale,” said Willow Marcon, senior vice president at Alliance Building Services.

Recruiters in manufacturing, building services, construction, healthcare and insurance often spend more than two-thirds of their time on manual work and using over 10 platforms to just close a hire: sourcing a wide range of profiles, skimming resumes, finding contact information, reaching out and doing hundreds of calls and constant follow-ups. That fragmented process leads to recruiter burnout and leaves gaps in candidate data. Because most HR platforms don’t offer built-in AI native agents that work in tandem to do all it takes to close the hire, employers in these industries have faced hiring delays and platform churn.

The partnership addresses this gap by integrating HireQuotient’s EasySource platform directly into the Paylocity ecosystem. Instead of relying on rigid keyword searches, EasySource identifies strong talent pools, screens for role-specific credentials and licenses and personalizes outreach by phone and email. For mid-market companies with 500 to 1,000 employees, that translates to a 70% faster time-to-hire and an estimated $100,000 in annual savings.

The integration also closes the feedback loop for employers. By feeding post-hire data back into the recruiting system, EasySource learns from successful hires to build smarter talent pools over time, while keeping recruiters engaged longer by freeing them to focus on the human side of hiring.

Gokul Rajaram, board member at Coinbase and former board member of The Trade Desk (Nasdaq: TTD), and also known as the godfather of Google AdSense, said, “Smarthveer is one of those rare founders who picks an unglamorous, deeply underserved market and refuses to leave until it’s fixed. Frontline hiring is exactly that market. Being named to Paylocity’s elite partner network is a testament to his relentlessness and to the team he’s built. Excited for what’s ahead.”

“Paylocity maintains an elite partner network, so being named one of them is a testament to the strength of our product,” said Smarthveer Sidana, founder and CEO of HireQuotient. “By keeping that recruiting activity inside the Paylocity ecosystem, we’re helping them close a critical gap for their employers, capture revenue that previously sat outside their platform, and prevent the client churn that comes with a fragmented hiring process.”

Jim Moffatt, former global CEO of Deloitte Consulting and board partner at Greycroft VC, said, 

“This is a big milestone for Smarthveer and his team. I congratulate them on this big win. Paylocity’s large client base acts as a strong distribution, and HireQuotient’s EasySource acts as a strong product to cater to the needs of Paylocity’s clients. Paylocity is known for its highly selective approach, and I’m glad to see that after months of evaluation and extensive due diligence, they’re going live with HireQuotient’s EasySource. I feel confident in the value this partnership will create for frontline industries. I remember when Smarthveer spoke to me about it in December, and it felt very ambitious. I’m glad to see it turn to reality.”

For employers with a traditionally deskless workforce in industries where AI adoption has lagged, the integration bridges a major capability gap by allowing them to source, screen, onboard and manage payroll all in one place.

For more information, visit www.hirequotient.com.

A media kit with additional partner quotes, executive headshots and logos can be found here.

About HireQuotient

HireQuotient is an AI-native recruiting platform that automates candidate sourcing and screening for employers in manufacturing, building services, construction, healthcare, insurance and other frontline-heavy industries. Its flagship platform, EasySource, is one of a select number of recruiting technologies integrated with Paylocity’s HR and payroll ecosystem. Founded by Smarthveer Sidana, HireQuotient is headquartered in San Francisco. For more information, visit https://www.hirequotient.com/.

Media Contact

Bethany Rhodes

Uproar by Moburst for HireQuotient

bethany@moburst.com

Contact

Bethany Rhodes

bethany@moburst.com

AMD has expanded its AI infrastructure portfolio with the launch of Helios, an open, rackscale AI infrastructure designed for frontier AI and sovereign computing. Helios is built around AMD’s next-generation Instinct GPUs, EPYC Venice processors, Pensando networking and the ROCm software stack.

“Helios is AMD’s first complete AI rack system with GPUs, CPUs, and networking built together, instead of selling separate chips. It is well suited for training large AI models, memory heavy models, long context processing and high volume inference, and AMD’s biggest shot yet at challenging Nvidia’s dominance,” said Pareekh Jain, CEO at EIIRTrend & Pareekh Consulting.

AMD has also secured an early hyperscale deployment for Helios with Microsoft agreeing to deploy it to power its frontier model AI inference, its AI customers, and support Azure AI services.

The architecture behind Helios

The launch of Helios marks AMD’s latest attempt to strengthen its position in a market where Nvidia continues to dominate AI infrastructure. Unlike previous AMD AI offerings centred on individual accelerators, Helios is designed as a complete rack-scale system integrating compute, networking and software.

According to Jain, Helios goes up against Nvidia’s Vera Rubin rack. “Nvidia is faster on raw inference speed and has a faster internal connection between chips whereas AMD wins on memory size and offers better value for the price and power used. It’s standout feature is memory, where each rack packs about 50% more total memory than Nvidia’s competing system, which helps run very large AI models. It also uses open, industry-standard connections instead of Nvidia’s private technology, giving buyers more flexibility,” he said.

The AMD Helios rackscale design includes 72 AMD Instinct MI455X GPUs with AMD EPYC Venice CPUs and AMD Pensando Vulcano networking using UALink, optimized for compute, data movement, and system efficiency. The platform also supports both OCP and MX data types, delivering up to 2.9 EFLOPS of FP4 and 1.4 EFLOPS of FP8 compute for AI training and inference.

It also integrates 31TB of HBM4 memory with 19.6TB/s of memory bandwidth, while a liquid-cooling design uses quick-disconnect connections to efficiently dissipate heat. It is designed on open standards including OCP Open Rack Wide (ORW), Ultra Accelerator Link (UALink), and Ultra Ethernet Consortium (UEC) and can be scaled efficiently across datacenters while optimizing power, cooling, and serviceability for modern AI infrastructure, said the company.

On the security front, Helios incorporates a hardware root of trust and continuous attestation at every layer. It supports hardware-enforced isolation, encrypted memory and interconnects to help protect AI models, data and workloads in multi-tenant environments.

The software challenge

While the launch of Helios might help AMD close the hardware gap with Nvidia’s rack-scale systems, it will be the software compatibility that will be the real driver of enterprise adoption.

For this, AMD is expanding its ROCm AI software platform too, which supports frameworks including PyTorch, TensorFlow, and JAX, for enabling high-throughput inference and efficient distributed training while preserving familiar developer workflows.

Jain stated While hardware parity or superiority in memory bandwidth is achievable, software maturity remains the key differentiator for Nvidia. The Nvidia’s CUDA software has a 15-20 year head start, and almost every AI tool, tutorial, and codebase defaults to it.

He added software has been AMD’s weak spot. AMD has improved  ROCm a lot but it still lags behind on the newest, most specialized optimizations, and setup is more complicated. For everyday AI work, ROCm is usable but for cutting-edge performance, CUDA still leads.

Evaluating the trade-offs

For CIOs evaluating AI infrastructure, Helios launch brings in another option to a market that has largely revolved around Nvidia’s dominance. But when considering Helios, CIOs will have to evaluate factors such as performance, software readiness, deployment models, procurement timelines and total cost of ownership before committing to a platform.

While AMD has not publicly announced a specific price tag for the Helios, Jain believes it to be noticeably cheaper to buy and run with lower chip prices and lower power use per GPU.

“It gives companies a real second option besides Nvidia, easing supply shortages and giving leverage in negotiations. The catch is software, where teams need to check whether their AI tools run well on AMD’s stack, since some advanced tools are still CUDA only,” Jain said.

For CIOs planning to deploy both, Jain warns the two systems can’t be plugged together into one combined machine as they use different, incompatible connection technology. But companies can and do run both side by side in the same data center, just as separate systems handling different jobs.

CIOs remain at the forefront of setting the course for AI adoption in their organizations.

In fact, 82% of CIO respondents to CIO.com’s 2026 State of the CIO survey are responsible for researching and evaluating AI products, with 78% of IT leaders saying their IT departments are driving AI adoption efforts, with business units aligning their strategies accordingly.

As such, CIOs are leading or co-leading AI strategies at the majority of organizations, with many also playing a key role in tackling AI change management. They report encountering numerous factors — from heightened pressure to deliver ROI to challenges with trust in AI outputs — as they formulate and shape those AI strategies.

Here’s a look at seven notable issues impacting AI strategies in 2026.

1. Increasing pressure to show ROI for AI investments

The era of AI experimentation and pilots is over. Boards and CEOs are making it clear they want to see quantifiable returns from their AI investments. Kyndryl’s 2025 Readiness Report, for example, found that 61% of senior business leaders and decision-makers felt more pressure to prove ROI on their AI investments than they had the prior year.

“The era of funding AI is shifting from everything all-in to every project has to have line of sight to some financial value at the end of the day. It’s moving from the experimentation phase to expecting measurable outcomes,” says Jim Piazza, chief AI officer at IT services firm Ensono.

As a result, Piazza says companies, both his own as well as those he advises, are more diligent about building business cases that estimate implementation costs, AI run costs, and expected benefits so they’re primed to pursue AI initiatives that will deliver ROI.

That strategy seems to be paying off. According to the May 2026 AI Momentum Survey from Dun & Bradstreet, 67% of 10,000 businesses surveyed reported seeing early signs or pockets of ROI, 20% reported multiple projects delivering ROI, and 10% reported strong ROI.

That’s a big jump from earlier surveys that found few AI initiatives providing returns. For example, PwC’s 2026 Global CEO Survey, released in January, found that 56% of CEOs saw no significant financial benefit from AI to date, while The GenAI Divide: State of AI in Business 2025 from MIT found that 95% of enterprise generative AI projects failed to show measurable financial returns within six months.

2. The need to harness AI for transformation

The No. 1 concern for CEOs this year, according to PwC’s 2026 Global CEO Survey, is whether they’re transforming fast enough to keep pace with technological change, cited by 42% of respondents as their top concern. And 68% of the 1,120-plus C-suite executives surveyed by KPMG for its May 2026 Adaptability Pulse Survey said they feel pressure to accelerate innovation.

That in turn is influencing AI strategies.

Steve Santana, CIO and head of AI at ETS, the world’s largest private nonprofit educational testing and assessment organization, says his company is “pivoting from working on enterprise efficiencies using AI to figuring out how to deliver assessments,” adding that “AI will enable innovation we couldn’t get to before.”

For ETS, that means reimagining how the company delivers its core products, “finding areas to do something you couldn’t do before because it was too big or too daunting,” such as having more interactive tests and assessments at scale, Santana says.

And while Santana believes organizations can’t move too slowly, he predicts innovation will trump speed. “The winners and losers in the AI race aren’t always going to be the ones that got there the fastest,” he says, observing that those who move too fast “can drive behaviors that are very dangerous.”

He adds, “I’m not advocating for moving slow; I’m advocating moving at pace. It’s better to be measured in your approach.”

3. The black box of AI costs

CIOs are struggling to calculate the full cost to run AI for their use cases, with estimates coming in well under what their actual bills will be. Consider the figures from research firm IDC, which found that global 1,000 companies will underestimate their AI infrastructure costs by 30% through 2027.

That makes identifying which AI use cases will produce quantifiable value much more challenging, which in turn makes determining a winning AI strategy harder to do. CIOs, however, say they can’t let that stop them from advising their C-suite colleagues on which AI use cases are likely to be winners.

“You can’t sit on the sidelines and wait and watch. The general conclusion is you’re going to lose if you do that, so you have to play even though the cost dynamics are not really well understood,” says Mohan Sankararaman, executive vice president and CIO of First Horizon Bank.

Sankararaman says he’s devising his AI strategy with that uncertainty in mind.

“It’s up to me and my team to figure out how to optimize our use for costs, just like we did with cloud,” he says, noting that part of his strategy is to avoid infrastructure choices that could result in AI vendor lock-in and, thus, getting stuck with that vendor’s bills.

“IT has to get the engineering right and not overengineer solutions to make sure the AI strategy we pursue delivers returns,” he adds.

Researchers recommend such approaches. In a blog highlighting the IDC research, Jevin Jensen, research vice president for infrastructure and operations at IDC, wrote that “organizations successfully navigating this challenge are ones that effectively share a common trait: they’ve reimagined FinOps as a strategic team, not an after-the-fact accounting exercise. They treat AI economics as a living ecosystem — measurable, visible, and continuously optimized.”

4. Aligning use cases to business strategy

There are an overwhelming number of potential use cases, so execs must pick and prioritize those that will help them achieve their strategic goals.

That’s easier said than done.

Enterprise Strategy Group’s 2025 report on generative AI’s ROI surveyed 1,900 business and IT leaders across nine countries and found that 71% had more potential use cases that they want to pursue than they can possibly fund; 54% said selecting the right use cases based on objective measures like cost, business impact, and the organization’s ability to execute is hard; and 71% acknowledged that selecting the wrong use cases will hurt their company’s market position. Furthermore, 59% of respondents said advocating for the wrong use cases could cost them their job.

Longtime CIO adviser Larry Wolff says challenges picking and prioritizing use cases stems in part from boards and CEOs commanding their teams “to do AI.” Such directives, he explains, puts the technology first and business goals second — something CIOs have been trying to avoid for years.

“There should not be a technology strategy. There should be a business strategy with a technology component. The same applies to AI,” says Wolff, now CIO of Preferred Travel Group. “We need to talk about business challenges and opportunities first and then talk about how AI can solve for those.”

5. Human readiness to use AI

Even as Sankararaman and his executive colleagues build the bank’s AI strategy, he still sees the need to improve the organization’s understanding of the technology. “Everybody has a basic understanding, but AI fluency isn’t where it should be,” he says, noting that a subpar level of fluency “can hamper creativity.”

“If the strategy is to become top notch in, say, customer experience, we have to determine how to achieve that. And if you start building the road map but you don’t know what the technology can do, then the strategy will be limited,” he adds.

Sankararaman considers running AI boot camps for executives and their direct reports to improve their knowledge of AI and its transformative capabilities. “Not everyone needs to be an AI expert, but we still need to have a level of understanding of, say, what a large language model is and how to apply it and other elementary things like that. The hope is that when we do talk about strategy for business outcomes, everyone will know how to leverage AI,” he explains.

According to Jamaal Justice, principal for people consulting at EY, concern about AI fluency is widespread.

“One of the biggest challenges that impacts the success of an AI strategy is human readiness,” Justice says. He points to EY research showing “that while 88% of employees use AI at work, only 28% of organizations have positioned employees to achieve transformative business impact from AI. This underscores that the challenge is not access, but adoption and readiness.”

Like Sankararaman, Justice acknowledges that it’s OK to have a spectrum of knowledge and use among workers. But success with AI “depends on aligning mindsets, skillsets, and toolsets, by creating the right conditions for both workforce readiness and effective technology use,” he says.

“Organizations that integrate human capability with technology and fundamentally rearchitect work using a human-centered and value-oriented approach will unlock value at scale,” he adds. “Those that don’t risk fragmented adoption and limited returns.”

EY research confirms as much, finding that productivity gains can fall by more than 40% when AI is deployed on weak talent foundations, including poor learning, culture, and incentives.

6. Data readiness for AI use

Data readiness is also lagging at most organizations, further hindering AI ambitions.

According to a 2026 report from Cloudera and Harvard Business Review Analytic Services titled Taming the Complexity of AI Data Readiness, 73% of surveyed business leaders said their organization struggles with AI data preparation. The top obstacles are siloed data and difficulty integrating data sources (56%), lack of a clear data strategy (44%), data quality and bias issues (41%), and regulatory constraints on data use (34%).

To ensure AI success, “a radical reshaping of the data landscape is needed,” says Steve Prewitt, who as chief data and AI officer at IT services firm Genpact advises clients on AI deployments for their own organizations.

That reshaping is more critical today as agentic AI becomes more prevalent, Prewitt observes. Organizations need high-quality well-governed data to enable and trust AI agents to make real-time decisions autonomously. Otherwise, organizations either can’t move forward with deploying agents or, if they do, risk triggering cascading failures.

7. Engendering trust

ETS CIO Santana and his colleagues recognize AI’s potential to deliver faulty outputs, whether from problematic data, drift, or other problems. Everyday users recognize that potential, too.

That’s why the issue of trust has a significant impact on the nonprofit’s AI strategy. Companies such as ETS that provide critical, high-stakes services know they must earn trust by building AI use cases that can consistently and demonstratively deliver accurate outputs, Santana says.

ETS’s strategy is to highlight where AI is making high-stakes decisions and to detail what steps the company must take to ensure that it consistently delivers accurate, trustworthy outputs and that it conforms to established standards and requirements, he says.

“You don’t want someone to feel the results may be wrong if you’re using AI to assess a person and their future depends on it,” he notes. “You want to remove any doubts [in such AI use cases], and the strategy should ensure that. The strategy should include all the work needed to have that trust.”

The industry conversation around AI infrastructure has narrowed to a single dimension: scale. The focus is on GPUs, power, cooling and the massive physical footprint required to train and run AI agents and models. At the same time, organizations are adjusting to the speed and scale with which AI is identifying vulnerabilities — which is much faster than remediation can be started.

However, almost no one is talking about the infrastructure layer that actually determines whether AI workloads remain secure, resilient and compliant. This is the layer that runs the world’s most sensitive, regulated, high‑value workloads. Thankfully, it already has the guardrails needed for an era where vulnerabilities are discovered faster than ever. But are they being set correctly?

With more than one billion AI agents expected by 2029, organizations need a plan for their infrastructure layer to withstand threats from new frontier models, maintain uptime and protect data sovereignty. As they scale AI deployments, enterprises must secure the infrastructure AI depends on.

These five steps outline what organizations can do now to strengthen their infrastructure posture using proven, enterprise‑grade practices for current and future threats.

Step 1: Build on infrastructure engineered for security and resilience

Infrastructure must be secure by design, not secured after deployment. The systems that have historically supported the world’s most critical workloads — from global payments to national‑scale operations — were built with this principle at their core. If you’ve already invested in systems designed for mission-critical workloads, you’ve checked this first box.

Enterprise‑grade systems have been engineered with multilayered security controls, pervasive encryption, confidential computing and hardware‑level protections that make exploitation dramatically harder. A frontier model in the hands of a bad actor can chain weaknesses faster than humans can patch them — unless the underlying infrastructure is built to absorb and deflect that pressure.

When I meet with clients, I often tell them what our own security teams operate under: we assume vulnerabilities will continue to be discovered and we design for that reality. That mindset is what separates infrastructure that survives frontier‑model pressure from infrastructure that collapses under it. These systems continue to evolve with predictive failure analysis and accelerated recovery, allowing systems to continue operating even during investigation and remediation.

Step 2: Treat uptime and resilience as a security requirement

If your infrastructure fails, your workloads will too. These systems depend on uninterrupted access to data and compute, and even seconds of downtime can compound operational and security risk. Enterprise‑grade platforms deliver near‑continuous availability through redundant hardware paths and intelligent system recovery.

The easiest fix? Ample resources and an up-to-date infrastructure foundation. Too often, a security problem is really an availability problem that turned into a security problem. When systems fall behind on maintenance, capacity or recovery readiness, they create the exact openings a frontier model can exploit. A delayed maintenance cycle or a recovery process that takes too long becomes the opening a frontier model can exploit. Resilience is not just about uptime. It is a security control. And this will not be the last time a frontier model tests the limits of that resilience.

Data resilience is equally critical. Cyber‑resilient storage systems with immutable backups and rapid recovery capabilities ensure that critical data remains protected and available even after a cyber incident or disaster.

Step 3: Operate for continuous discovery, not periodic defense

The idea that you can prevent every vulnerability is outdated. The more realistic model is continuous discovery — finding, prioritizing and addressing issues faster than they can be exploited. Organizations must operate as if vulnerabilities will be found faster than ever.  Instead of relying on static defenses, they should emphasize layered controls, rapid triage, continuous delivery of fixes and coordinated disclosure.

Frontier models in the hands of bad actors can amplify security challenges by connecting vulnerabilities. They can chain misconfigurations, outdated components and privilege gaps into a viable attack route in minutes. And the more outdated or inconsistent an environment is, the easier that chaining becomes.

Modern operational‑intelligence tooling helps them surface that risk, prioritize what matters and act before an attacker can exploit the gaps. These platforms help organizations understand where they are exposed, identify which maintenance issues carry the highest operational and security risk, and reduce the blind spots that frontier‑model attackers are increasingly adept at exploiting.

It’s critical to assess how you manage your vulnerabilities. Internal processes should address severe vulnerabilities within hours, regardless of whether they are discovered by humans, traditional tooling or AI‑driven techniques. As AI accelerates vulnerability chaining, this posture maintains operational integrity and reduces exposure.

Step 4: Use AI to defend AI

Leading organizations are integrating AI‑driven threat detection directly into their infrastructure. On operating systems like z/OS, AI‑based analytics can identify anomalous and potentially malicious data access, reducing investigation time and limiting impact.

Beyond detection, autonomous security models are emerging that continuously govern risk, investigate threats and enforce resilience across identities, data, applications, cloud and networks. Across the industry, we’re seeing the rise of autonomous security frameworks that use AI to assess posture, detect threats and harden controls without waiting for human intervention. Combined with modern AI‑accelerated processors, these capabilities allow threats to be analyzed and mitigated directly within the infrastructure itself.

Step 5: Join a broader ecosystem fighting frontier model threats

No organization can face frontier model threats alone. These risks require coordinated industry action. Frontier models give both good and bad actors the ability to analyze codebases, chain vulnerabilities and probe infrastructure at a scale that no single enterprise can counter on its own.

Across the industry, coalitions are emerging to assess and remediate vulnerabilities discovered by frontier-class models and to help enterprises build AI resilience. Initiatives like Project Glasswing, Project QuiltWorks and the Frontier AI Alliance are examples of how providers, consultancies and security firms are beginning to coordinate their response to AI-accelerated threats.

Organizations can also benefit from independent assessments that evaluate readiness for agentic-enabled threats and identify gaps across their infrastructure. These assessments help teams understand where they are exposed, how frontier models might chain those exposures together, and what actions will reduce the likelihood of a high-impact event.

Participating in these programs is one of the most concrete steps enterprises can take today to strengthen their AI infrastructure posture.

Your AI security depends on the infrastructure you choose

AI is accelerating both innovation and risk. The organizations that succeed will be those that build on resilient, secure infrastructure, prioritize uptime as a security control, operate with continuous discovery, use AI to defend AI and participate in the global response to frontier‑model threats. In the end, your ability to scale AI safely comes down to the infrastructure you trust to run it.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

IBM has bolstered its Power server portfolio with a new edge S1112 server and announced IBM Power Autonomous Operations, an AI agent that helps customers monitor Power systems and autonomously resolve issues to keep operations running smoothly. Additional software upgrades are aimed at helping customers deploy and manage AI infrastructure components. 

“Each announcement addresses a different layer of the enterprise technology stack, from how infrastructure is deployed and managed to how applications are developed, modernized, and optimized,” wrote Brandon Pederson, senior IBM i product manager, in a blog post about the new products. “Together, they reinforce a broader direction for IBM Power of helping clients move from manually operated infrastructure toward intelligent, resilient, and AI-assisted systems that are easier to manage, easier to modernize, and ready for new workloads.” 

The new IBM Power S1112 is a one‑socket Power11 server engineered for IBM i, AIX, and Linux. Aimed at distributed and edge locations, it is Big Blue’s new entry-level i server and is AI‑ready by design, integrating on‑chip Matrix Math Acceleration (MMA) for fast inferencing and other AI‑driven use cases, such as support for AI-assisted decisions, automation, and analytics close to where data is generated and consumed, Pederson stated.

The server supports two configurations: a 10-core 3.05 to 4.0 Ghz Power11 Processor in a rack version only, and a 4-core 3.60 to 4.0 Ghz Power11 in rack and tower form factors, IBM stated.

“For IBM i clients, Power S1112 is especially important because it expands what entry IBM i environments can do. IBM i P05 clients can run IBM i partitions within the P05 software tier while also using additional system resources for AIX, Linux, VIOS, AI, or open-source workloads on the same server,” Pederson wrote. “This creates a flexible path to consolidate workloads, improve utilization, and support modernization without forcing clients into a larger platform than they need.”

Announced: IBM Power Autonomous Operations

On the software side, IBM Power Autonomous Operations offers automation capabilities via an embedded AI agent that offers natural language interactions designed to help customers manage, tune, and streamline their environments without relying on deep domain expertise for every task, Pederson stated.

“IBM Power Autonomous Operations is designed to continuously monitor, optimize, protect, and manage Power environments. It combines Power telemetry, AI-powered analytics, automation, and operational workflows into a unified experience that helps IT teams reduce complexity, improve resiliency, and increase productivity,” Pederson wrote. 

“Rather than simply showing operators what is happening, Power Autonomous Operations is designed to help teams decide what to do next. The platform analyzes system telemetry, identifies risks and optimization opportunities, and provides intelligent recommendations or automated actions to improve performance, resiliency, and operational efficiency,” Pederson wrote.

Agentic Engine for IBM i

IBM also issued a preview of the Agentic Engine for IBM i, which is aimed at providing greater AI support for Power systems. 

IBM described the Agentic Engine as a new enablement layer designed to make it easier to adopt native and integrated AI agents into IBM i workloads and business processes. The engine provides the runtime, IBM i Knowledge Pack, observability, extensibility, MCP server, and foundational agents that help teams build trusted agents for IBM i without starting from scratch. Developers can build agents using their preferred coding tools, run them close to Db2 for i data under native IBM i object-level authority, and extend them into broader enterprise workflows through APIs and agent-to-agent integration.

With security, governance, and instrumentation built in, the Agentic Engine for IBM i helps organizations manage agent behavior, monitor activity, and support responsible adoption across mission-critical environments, Pederson stated.

IBM Bob Premium Package for i

Also in the AI agent vein, IBM announced support for its Bob AI application development environment for the i system. The idea here is to help customers quickly modernize applications built on RPG and COBOL.

“These capabilities help developers explain complex RPG and COBOL programs, convert Fixed-Format RPG to modern Free-Format RPG, refactor monolithic applications into modular structures, generate RPG, CL, COBOL and DDS code, create technical documentation, and produce unit tests to support validation,” Pederson wrote. “Rather than relying on generic prompts and inconsistent results, IBM i teams can use expert-built skills that deliver more predictable, repeatable and higher-quality outcomes. Agentic workflows help guide multi-step development tasks from understanding and planning through implementation and validation, allowing developers to modernize incrementally without losing control.”

IBM also added new development features to the core operating system for i with IBM i 7.6 Technology Refresh 2 and i 7.5 Technology Refresh 8 that include a variety of features designed to enhance RPG and COBOL development, security, and hybrid cloud integration.

IBM Power S1112 is expected to be generally available on July 24, IBM Power Autonomous Operations is expected to be generally available on September 23, 2026, and IBM Bob Premium Package for i was made generally available on June 24, 2026.

If you just read the headlines, it would seem as if AI is now writing all of the world’s code and powering every application businesses run on.

That’s far from true. Just 4 of 33 AI pilots reach production, according to IDC Research — leaving legacy applications still fueling the wheels of commerce. This “silent majority” represents trillions of dollars spent each year on building, maintaining, testing, validating and monitoring legacy applications.

These applications won’t be replaced overnight. Companies and organizations depend on their predictability. The 60-plus-year-old COBOL programming language remains the backbone of banking software for good reason: it is extraordinarily efficient at processing massive transaction volumes with precision. Furthermore, do you want your bank revolutionizing how they manage your money? Probably not.

So, while AI investment continues to build inside the software development lifecycle (SDLC), it isn’t instantly rendering older software obsolete. What it will do is steadily enable easier tweaking, updating and testing of legacy applications — and in some cases, full migrations to modern platforms. And really, this isn’t a new phenomenon. Businesses have always looked to wring more efficiency and profit from existing products through intelligent prioritization.

The argument then is that CIOs and CTOs can take a proactive look at their legacy application portfolios to determine which ones, if any, should migrate sooner. Five considerations can help guide that decision.

Before replacing legacy apps with AI, ask these 5 important questions

1. Does the legacy application still work?

Is its utility still there? Customers often appreciate the consistency of legacy applications. They’re reliable, predictable and well understood. Don’t fix what isn’t broken. Another way to think about this is the degree to which the technical approach of your legacy application is still viable. It’s pretty much a guarantee nowadays in software that an application built one way, with some set of technologies, would be built a totally different way just two to three years later. There is no avoiding that, but what you want to avoid is investing further into a technical approach powering a legacy application that has been completely replaced with new software or a technical approach, especially if it is 10x better across the vectors of software development (latency, cost, accuracy).

2. Does it still make financial sense?

Running a system over a long period amortizes costs significantly. Even as growth rates slow or plateau, it can still be less expensive to let legacy applications run than to overhaul them. Another way to think about this is: how viable is my customer base in the near-term and the long-term? If you anticipate modest—or even flat—earnings growth for your product, then that’s an indicator that it’s possibly worth optimizing your development processes with AI. Where it’s probably not worth investing is when you have no confidence in your future earnings, whether that’s due to the customer base shrinking or commoditization or something else.

3. Can you integrate AI into existing workflows?

A significant portion of upcoming software development lifecycle work will focus on refactoring applications to be more AI-native. Some legacy applications may be strong candidates for a full AI rebuild, while others are better positioned for an AI add-on. Gartner research from 2025 found that only 28% of AI use cases in infrastructure and operations fully succeeded.

Among those that did, success was attributed primarily to integrating AI into existing workflows and systems. “As AI becomes part of day‑to‑day operations, it boosts adoption and creates visible impact within the organization,” Gartner states.

It’s important to keep in mind the distinction between using AI to optimize an existing process or workflow within your application, versus powering a workflow or feature with AI. The former approach is more palatable for legacy applications because it generally doesn’t change the cost profile of running that application. In the latter case, if you’re introducing an AI-powered module into the application, you’re generally going to incur inference costs at runtime, and they are an order of magnitude more expensive for today’s frontier models than base compute.

4. Do you have documented processes for maintaining legacy applications?

If so, you’ll more quickly identify where AI can optimize. The more coherent, organized and detailed processes are, the faster AI can find its footing and drive tangible efficiency gains. If documentation is lacking, start there. Keep detailed instructions and workflows for how you do things. Consistency matters. Don’t do things by heart. Don’t approach tasks casually, and don’t do things differently each time. The more uniform your process, the more easily you can insert AI into discrete steps and achieve efficiencies without disrupting the broader software development lifecycle. The organization in the most precarious position is the one managing legacy applications with no documented process for doing so.

5. Can you prioritize?

Making a change to a piece of legacy software might involve 20 or more steps. Only one or two of those steps may be clear candidates for AI-driven optimization. Identifying and prioritizing those opportunities will help you realize early wins and build the case for broader return on investment. Also, not all candidates for optimization make sense in light of broader financial and operational constraints. As always, prioritize ruthlessly in favor of ROI—bang for your buck. If your team has been struggling to operate a particular part of your system due to a lack of expertise or time, you might consider using AI to buttress the maintenance of that component. Having AI own that part of the workflow might unlock big time savings—or it might erode crucial domain knowledge that your team used to possess through repetition. There is no one-size-fits-all; think through the second-order effects.

Adding AI in testing in the SDLC

Beyond coding and application development, AI is opening new possibilities in how we test software. As leaders examine processes and look for places to insert AI, testing is often a natural entry point. There has been substantial innovation here, including new autonomous AI-driven testing solutions, those that have been enhanced with AI, and hybrid approaches that blend both. Each organization will be at a different place in its AI journey. Testing solutions exist to meet everyone where they are. Also, the state of applications will help determine which approach fits best—and when it fits as you evolve applications.

Of course, there is some substance to the AI hype around how much code AI will write and how many applications it is already creating faster than ever. But one school of thought is that AI’s biggest economic impact will be in the creation of massive new markets and industries rather than in the complete displacement of existing industries. Regardless of how far AI takes us through the universe, it’ll take some time and it’ll be bankrolled by the trillions of dollars of existing products and industries that we depend on every day.

That’s all good news for legacy players, but no one can afford to stay still. AI capabilities are advancing rapidly. Make it a habit to revisit legacy applications and workflows regularly. The right moment to introduce AI will keep shifting, and staying ahead of it is a competitive advantage.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

When people hear the term artificial intelligence, they usually think of chatbots or data analysis. But at BMW’s Spartanburg plant in the US, AI is now getting hands, legs, and eyes. Under the term physical AI, the automaker is integrating the new humanoid AI robt Figure 03 into its production logistics.

The move comes as no surprise: For almost a year, BMW had the predecessor (Figure 02) welding body parts for more than 30,000 vehicles. The conclusion of this practical test: The machines can precisely perform monotonous, heavy tasks. Now the technology is leaving the testing phase and moving to where things get highly complex: logistics.

The task: Transform chaos into order

While its predecessor simply lifted sheets of metal, the further enhanced Figure 03 has to solve cognitive and tactile tasks. In logistics, it picks unsorted components from large boxes and sorts them into carts in the exact required order. Automated transport systems then take over, carrying them to the assembly line.

To achieve this, the manufacturer has upgraded Figure AI. The new robot has:

• Cameras and tactile sensors directly in the palms of the hands for greater sensitivity
• Audio functions for true speech-to-speech communication in the factory hall
• Wireless charging for continuous, autonomous operation
• Softer components to increase safety for human colleagues

At first glance, a humanoid robot might seem like a project solely for the production manager. That’s a misconception. This use case is relevant for everyone, and is highly relevant for CIOs. Figure 03 is ultimately nothing other than a highly complex, mobile edge client that has to process large amounts of data (video, audio, sensor data) locally and in real-time.

BMW AG

BMW is demonstrating in Spartanburg that such a robot works, but only in a fully digitized ecosystem like an automotive plant. This means that the IT department is the enabler for the production environment of the future.

1. Virtual twins: Even before the first robot touches a box, BMW simulates Hall 52 and all movement sequences in a 3D “Virtual Factory.” IT provides the planning basis.
2. AI Quality Control (AIQX): Error detection is performed using cameras and microphones along the production line. The algorithms perform visual and audible checks and send the feedback directly to the smart devices of human colleagues.
3. Infrastructure scaling: When robots communicate via voice, charge wirelessly, and interact with autonomous transporters, the WLAN, 5G, and network backbone in the factory must have low latency and be fail-safe.

On the one hand, the humanoid robot relieves BMW factory workers of physically demanding work; on the other hand, it forces the IT department to merge traditional IT infrastructure and factory technology (OT). “Physical AI” has thus arrived in everyday industrial practice.

Fortinet has added AI visibility and control capabilities to its endpoint security package to help enterprises better govern AI usage, reduce data exposure, and simplify security operations.

The vendor’s FortiEndpoint platform integrates antivirus, endpoint detection and response, VPN, zero trust network access, vulnerability management, and data protection. It feeds into Fortinet’s overall Security Fabric system to improve enterprise threat detection and response and simplify endpoint management and security policies, according to the company.

With the new release, FortiEndpoint gains improved AI visibility and controls, integrated data loss prevention, and a natural language-based AI agent to help security teams generate investigation summaries, identify high-risk devices, and troubleshoot issues.

“FortiEndpoint provides centralized visibility into AI applications and agents operating across managed endpoints. Security teams can identify sanctioned and unsanctioned tools, detect shadow AI, monitor adoption trends, and understand user activity through unified dashboards,” wrote Ankit Gupta, product and marketing leader for Fortinet, in a blog post about the enhancements.

“Organizations can’t govern AI instances they can’t see. As employees increasingly rely on a growing number of AI assistants, coding copilots, autonomous AI agents, and browser-based AI services, security teams need visibility into which tools are being used, who is using them, and whether those applications comply with corporate policy,” Gupta wrote.

In addition, FortiEndpoint natively supports data loss prevention (DLP) by automatically inspecting sensitive business data exchanged with AI applications, agents, and web services. Built-in user coaching provides real-time policy guidance to help users understand acceptable AI usage and reduce risky behaviors without impacting productivity, Gupta stated.

This feature helps prevent the leakage of sensitive data such as personally identifiable information, intellectual property, and financial information directly at the endpoint. By integrating DLP into FortiEndpoint, organizations can safely adopt AI while maintaining stronger data security and compliance controls without adding another point product or management layer, according to Fortinet.

Lastly, the vendor has built a FortiAI-Assist agent into FortiEndpoint to simplify administration and accelerate day-to-day operations. The agent can provide contextual insights, policy recommendations, and risk guidance to help customers strengthen governance, prioritize threats, scale threat hunting, and improve efficiency through a unified management experience, according to Fortinet.

These assisted workflows are complemented by adaptive zero-trust capabilities with dynamic risk and compliance scoring.

“By continuously assessing endpoint health, compliance status, and risk posture, FortiEndpoint helps organizations make access decisions based on real-time context, so access to AI applications and protected resources can be adjusted as risk changes,” Fortinet stated. “This helps organizations reduce exposure, enforce more consistent policy, and safely support AI-enabled work.”

“Delivering these capabilities through FortiEndpoint gives customers a practical way to manage AI risk with the same agent and license they already rely on for endpoint security” said Chris DePuy, technology analyst at 650 Group, in a statement.

The FortiEndpoint enhancements are expected in Q3 2026.

Since the advent of generative AI, the use of AI in business has shifted from something we should do to something we must do to survive. Many companies are now working to utilize AI with the aim of improving productivity and creating value.

Here, I would like to pose a question to you all once again: “What is the fundamental factor that determines AI performance?”

Is it the AI model? Is it the AI tool? Or is it the AI agent?

Of course, I believe all of these are important. However, if we look at the long-term perspective, the competition among multiple companies to improve AI model performance will eventually level off, and we will eventually reach a point where every AI model is amazing!

In that context, what I believe is the most important factor influencing AI performance is the data accumulated by companies that connects to their unique strengths.

For example, if asked, “What do plants need to grow?” I would say “good water and light.”

Similarly, if asked, “What do people need to thrive?” I would say, “Kind words.”

Finally, “What does AI need to thrive?” The answer is “good data.”

I believe that the extent to which companies can genuinely understand the importance of this extremely simple principle and implement it with unwavering dedication will determine their ability to establish a competitive advantage and achieve sustainable growth.

AI is a mirror of data

As I’m sure you’re all aware, AI is by no means a magic wand. It is an entity that learns based on the data it is given and makes inferences within that scope. In other words, AI’s output depends heavily on the quality of its input data; one could say that AI is a mirror of data.

• If you feed it inaccurate data, it will return inaccurate results (i.e., garbage in, garbage out)
• If you feed it biased data, it will make biased judgments
• Insufficient data yields only shallow insights and suggestions

In this way, AI is not smart but rather faithful to the data. Based on this premise, it becomes clear that the essence of AI utilization lies not in which tools to use, but in what kind of high-quality data to prepare and how to utilize it.

What is good data?

So, what exactly is good data?

It goes without saying that data is useless if it is merely abundant in quantity, but on the other hand, what specific qualities must good data possess?

Generally speaking, good data possesses at least the following elements.

• Accuracy: Data containing many errors or noise will skew conclusions, no matter how advanced the analysis. It is important to minimize sensor errors, input mistakes and duplicates.
• Completeness: Are any required fields missing, and are there too many missing values? For example, if customer data is missing information such as age, region or gender, it becomes difficult to perform meaningful analysis.
• Consistency: Is data with the same meaning mixed in different formats (e.g., date formats, units, variations in notation)? This is particularly important for system integration and long-term data.
• Timeliness: No matter how accurate it is, data that is too old may not be useful for decision-making. Whether real-time data is required or historical data is sufficient depends on the use case, but it is important that the data has the appropriate freshness for the purpose.
• Relevance: If there is a large amount of data unrelated to the analysis objective, it becomes noise and leads to incorrect judgments. It is necessary to clearly define what the data is used for and ensure the data is appropriate for that purpose.
• Reliability: The data’s source and collection method must be clear, ensuring reliability and reproducibility. Data with an unknown source or that is a black box cannot be verified later.

In summary, good data is data that is accurate, has few gaps, is consistent in meaning and notation, is collected at the appropriate time, is suitable for the purpose and comes from a reliable source.

Only when the quality of this good data is guaranteed can AI produce valuable outputs. Conversely, introducing AI with unorganized data will not yield the expected results. Many complaints, such as “We implemented AI but it’s unusable” or “The AI’s accuracy isn’t improving stem from data issues.”

Data does not organize itself naturally

The key point here is that good data does not arise naturally. On the contrary, if left unattended, data will inevitably deteriorate.

• Rules become inconsistent depending on who entered the data and when
• Multiple instances of data with the same meaning exist
• Outdated data is scattered and left unattended
• Data becomes siloed by department

These conditions are likely common in many companies.

Below is an overview of our company’s data management framework.

Akio Ueda

Broadly speaking, it consists of data governance — covering roles and structures, risk management and evaluation — and data management, which encompasses data utilization cycle management and data utilization support services. Within this framework, data utilization cycle management involves:

• Needs management: We clarify the purpose and needs by asking, “What is the data being used for?” and “For whom, and in what way, does this data create value?”
• Collection: We gather the necessary data based on the defined objectives. We design the process to determine what data is required (internal/external), the level of detail and frequency of collection, and how to ensure data quality.
• Processing: We enhance the quality and prepare the data for use. This includes cleansing (correcting errors and missing values), standardizing formats, deduplicating and integrating data, processing structured and unstructured data separately, and assigning business and operational meaning to the data.
• Storage: We ensure the data is available to the right people at the right time. This involves storing data in databases or data lakes, implementing security and access controls, and managing metadata (ensuring the data is clearly identifiable).
• Utilization: This is the most critical step. The purpose of data is not merely analysis but driving action. We generate value from the data through visualization (dashboards), analysis (statistical processing, BI, AutoML, AI) and integration into business operations (automation and decision support).
• Disposal: We properly dispose of data that is no longer needed. Simply holding data can itself pose risks, such as managing retention periods, complying with laws and governance requirements, and mitigating security risks. That is why the principle of not holding data that is not used is so important.

Data management is not a one-time effort; it is an ongoing initiative that requires continuous maintenance and improvement.

The CIO must embed data management as a system within the organization and continue to implement it until it becomes firmly established.

Data management is not just the IT department’s job

Another important point is that data management is not just the IT department’s job.

Data is fundamentally generated within day-to-day operations on the front lines. Therefore:

• Who determines the meaning and definition of data
• How should input rules be standardized?
• How do we ensure data quality?

are, in essence, operational issues, business issues and management issues.

The latest Digital Skills Standard ver. 2.0, published by the Ministry of Economy, Trade and Industry in April 2026, defines the following three roles within the data management category:

• Data steward: Based on business domain knowledge, this role is responsible for operations aimed at ensuring data quality, reliability and security, as well as for promoting the adoption and establishment of data management within business divisions and frontline organizations, and for fostering data utilization. In short, they are the data quality manager and data utilization promoter.
• Data engineer: This role involves understanding the current state of data and supporting the organization’s continuous data utilization through data preparation and preprocessing in processes such as collection, integration, processing and provision, as well as the design and implementation of data pipelines. In essence, they are the implementers and operators who drive data.
• Data architect: This role involves taking a bird’s-eye view of the data structure, flow and utilization methods across the entire organization and business. By designing and continuously reviewing data architecture that encompasses the entire data lifecycle in alignment with business strategy, they ensure the successful integration of company-wide data utilization and governance—essentially serving as the overall designer of data.

The CIO is not merely responsible for establishing data storage and analysis infrastructure; they are also tasked with appropriately assigning personnel to these three roles within the company and establishing cross-departmental, company-wide tools and rules to connect data with management, business operations and daily tasks.

Ultimately, the success of data utilization depends on organizational culture

On the other hand, no matter how much progress is made in staffing, infrastructure, tools and rulemaking, data will not be utilized unless there is an organizational culture that actively drives management, business and operations based on data.

• The purpose of data entry is not understood
• Data is optimized solely for the department’s own operations
• Decision-making based on data is not valued

In such a situation, no matter how well the systems are set up, they will become mere formalities.

In contrast, in organizations where data utilization is advanced:

• Discussions are based on data
• Formulate hypotheses and verify them with data
• And continuously improve based on data

These actions occur naturally.

In other words, the essence of data management ultimately lies in creating an organizational culture that assumes the effective use of data.

Data management cannot be achieved overnight. That is precisely why it is important to start small and build on your successes.

• Organize data for specific tasks and achieve results through the use of AI
• Rolling out successful practices
• Gradually Expand the Scope

By repeating this cycle, the importance of data will permeate the entire organization.

The role expected of a CIO in the AI era

In the AI era, the role expected of a CIO has changed significantly.

Traditionally:

• Ensuring the stable operation of systems
• And optimizing costs

However, moving forward:

• We will view data as an asset and maximize its value
• Developing the data infrastructure, tools and rules that underpin AI adoption, and advancing personnel allocation and development
• And fostering an organizational culture that embraces data utilization —roles that are more directly linked to business management

In other words, the CIO must evolve into the person responsible for creating value from data.

Data is the source of competitive advantage

In the coming era, the use of AI will be a given. What will set companies apart is not whether they use AI, but what data they possess.

Data is the accumulation of a company’s past strengths and the source of future value creation. And its quality is determined by daily operations and the nature of the organization.

• AI grows by being fed good data
• And companies grow through that AI

Taking this simple principle as our starting point, we must place data management at the core of our business strategy. Isn’t that the shortest route to sustainable growth in the AI era?

CIOs are called upon to lead the way in making this a reality.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

AI-driven hyperscale data centers are creating a new generation of risks and challenges that extend well beyond power shortages and chip supply, according to a new report from Zurich North America.

The unprecedented scale, speed and complexity of AI data center construction are exposing the industry to new threats previously unknown to the older generation of data centers, ranging from severe weather and energy constraints to insurance capacity, labor shortages and geopolitical disruptions, in its report, “Data Center Risks Right Now: Six Critical Questions to Enable a Resilient Buildout.”

The report states that hyperscalers are prepared to spend an estimated $710 billion in capital expenditures during 2026, and global investment in data centers is projected to top $7 trillion by 2030. New capacity added between 2026 and 2030 is expected to total roughly 100 gigawatts, equivalent to the peak electricity demand of about nine New York Cities.

Much of that is because these new data centers are not like any previous generations of  data center development in that modern AI campuses can span up to 20 buildings, consume as much as 2,000 megawatts of electricity and house billions of dollars’ worth of servers and cooling equipment.

In addition, insurance providers are struggling to keep pace with the massive growth in projected value of these data centers.  Zurich says the average value of the data centers it insured has jumped from roughly $150 million five years ago to about $3 billion today, while the largest campuses can be measured in the tens of billions of dollars.

The report cited six areas of concern, the primary of which is growing: severe weather.   Severe weather has surpassed fire as leading construction threat due to changing geography. Zurich states that 64% of U.S. data center capacity currently under construction is located outside traditional markets such as Northern Virginia, in areas are known for bad weather.

They include West Texas, Tennessee, Wisconsin and Ohio, where tornadoes, hailstorms and high winds present new hazards. Zurich says severe weather has become the largest source of losses in its U.S. builders-risk portfolio over the past three years, surpassing fire as the industry’s dominant construction threat. Weather accounts for 32% of losses in Zurich’s data center portfolio, followed by fire and equipment damage.

The second issue is compressed construction schedules. Operators are increasingly beginning operating portions of a campus where construction is complete and while construction continues elsewhere. That means welding and other, heavy equipment plus incomplete fire protection coexist with active server halls containing sensitive computing equipment.

Beyond construction and to absolutely no surprise, Zurich identifies energy infrastructure as one of the defining challenges facing AI expansion. The report notes that U.S. data center electricity demand increased roughly 22% in a single year and is expected to nearly triple to approximately 134 gigawatts by 2030.

Likewise, water availability is becoming equally important as power as AI workloads generate more heat and require increasingly sophisticated cooling systems. The report notes that many operators are deploying closed-loop water recycling systems or shifting toward air cooling where possible in a bid to reduce water consumption.

Downtime has become more expensive because so much expensive equipment is involved, even minor operational failures can become multimillion-dollar events.

The report also warns that replacement equipment often requires months to arrive, citing industry estimates that switchgear may take up to 85 weeks to replace and generators as long as 100 weeks.

Workforce shortages have raised operational concerns as the AI construction boom is straining the labor market, and they don’t mean The IT staff to run the place, they need people to build it. Zurich cited a report from Associated General Contractors of America that 92% of U.S. construction firms are having difficulty finding qualified workers.

The report concludes that geopolitical tensions, regulatory scrutiny and emerging technologies will increasingly influence where and how data centers are built. Among the trends Zurich identifies are growing political concern over electricity prices and water consumption, increased reliance on nuclear energy, interest in integrating future quantum computing systems and even early proposals for orbital data centers supported by solar power.

Generative AI is a kind of artificial intelligence that creates new content, including text, images, audio, and video, based on patterns it has learned from existing data.

Today’s generative models are typically built on foundation-model architectures such as large-language models (LLMs) and multimodal systems, enabling them to carry on conversations, answer questions, write stories, generate code, and produce images or videos from brief prompts.

Generative AI is different from discriminative AI, which draws distinctions between different kinds of input. Where discriminative AI answers questions like “Is this image of a rabbit or a lion?”, generative AI instead responds to prompts such as “Describe to me how a rabbit and lion look different from one another” or “Draw me a picture of a lion and a rabbit sitting next to each other” — and in both cases produces text or imagery that, while grounded in the AI’s training data, isn’t just a copy of something that already existed.

Just a few years ago, generative AI was once a novelty focused on chatbots and artistic image generation. Today, it has become a core enterprise technology, and powers everything from content creation and software development to customer support and analytics workflows. But with that power comes a new set of challenges — from model alignment and hallucination to governance and data-integration hurdles.

In this article, we’ll look at how generative AI works, explore how it has evolved into the foundation-model era, examine how to implement it effectively, and offer best practices for getting value out of it, today and in the future.

How does generative AI work?

For decades, early artificial-intelligence efforts often focused on rule-based systems or narrowly trained models that were built for one task at a time. While these efforts produced useful systems that could reason and solve human tasks, they were generally a far cry from sci-fi visions of thinking machines. Programs that could talk to people never seemed to get very far past the level of ELIZA, a “computer therapist” created at MIT in the mid 1960s; even Siri and Alexa after much fanfare were revealed to be fairly limited.

The big structural shift that gave birth to modern generative AI came with the concept of a transformer, first introduced in “Attention Is All You Need,” a 2017 paper from Google researchers.

Using a transformer architecture as a basis, you can build a system that derives meaning from analyzing long sequences of input tokens (words, sub-words, bytes) to understand how different tokens might be related to one another, then determines how likely any given token is to come next in a sequence, given the others. In AI lingo, we call these systems models. Because a model analyzes very large datasets and parameter counts, it can pick up on statistical patterns and knowledge implicitly embedded in the data.

This is all easier said than done. The process of adjusting a model’s internal parameters so it gets better at predicting the next token in sequences is called training. During training, the model repeatedly guesses the next token in a given sequence, compares its prediction to the actual one, measures the error, and updates its parameters to reduce that error across billions of examples. Over time, that process teaches the model the statistical relationships that will allow it to generate coherent language (or code, or images) later.

What is a foundation model?

You’ll often hear the word large used for transformer-based models of these types, like the LLMs we mentioned earlier. Large in this context refers to the large number of internal numerical values that the model adjusts during training to represent what it has learned, along with breadth and diversity of data used to train the model and the underlying compute resources powering this whole process.

This is in contrast with the narrow models of the earlier era of AI/ML, which werebuilt for one purpose and trained on a limited dataset. For instance, a spam filter may be very good at what it does, but it’s only trained on email data and all it can do is classify emails. Large models, by contrast, serve as what’s known as foundation models. They’re trained broadly on diverse data (text, code, images, or multimodal data) and then adapted or specialized for many downstream tasks.

These foundation models are the basis for most of the popular generative AI tools and services on the market today. They can be specialized in several ways:

• Fine-tuning: Giving a foundation model further training on a smaller, task-specific dataset
• Retrieval-augmented generation (RAG): Giving the model the ability to pull in external knowledge when asked a question
•  Prompt engineering: Tailoring a query so the model gives the sort of answers you’re looking for.

How do AI systems write computer code?

One of the surprising discoveries of the gen AI era was that in recent years was that foundation models trained on natural-language text can also, when fine-tuned with code examples, also write computer code — often better than many purpose-built systems. Still, it makes sense, when you think about it — after all, high-level computer languages are designed by humans and ultimately based on human language.

This 2023 InfoWorld article highlights how models like PaLM, LLaMA and other transformer-based systems fine-tuned on code repositories propelled this shift, but since AI giants like OpenAI have moved into this space. This all matters because code generation (or code-assisted productivity) has become a key enterprise use case of generative AI — perhaps the key use, given the industry’s enthusiastic adoption of it.

What are AI agents?

So far, we’ve been talking about chatbots, writing assistants, image-generation tools. They respond to prompts, output text or images, and then stop. A new category of tool called agentic AI goes further: it plans, executes, and in many cases learns as it works.

Because large models already understand language, code, and even structured data to some extent, they can be repurposed to generate not only descriptive text but operational instructions. For example: an agent might parse the intent “generate a sales-report”, then format internal calls like getData(salesDB, region=NA, period=lastQuarter), and then call an API, all by generating text that’s interpreted as instructions. The MCP framework standardizes the “language” of those instructions and the plug-points into tools and data so that the model doesn’t need bespoke integrations for each new workflow.

These kinds of autonomous agents have several enterprise use cases:

• Software automation: Agents that generate code, call unit tests, deploy builds, monitor logs and even roll back changes autonomously.
• Customer support: Instead of simply drafting responses, agents interact with CRM APIs, update ticket statuses, escalate issues, and trigger follow-up workflows.
• IT operations/AIOps: Agents monitor infrastructure, identify anomalies, open/close tickets, or auto-remediate based on defined rules and context from logs.
• Security: Agents may detect threats, initiate alerts, isolate compromised systems, or even attempt to manage threat containment — though this raises new risks.

How can you implement generative AI in the enterprise?

We’ve now touched on what generative AI can do. But how can you make it work reliably in your business. The difference between a pilot and full-scale deployment often comes down to systems, structure and governance as much as to models themselves. InfoWorld’s Matt Asay offers a deep dive into enterprise gen AI essentials, but here are some important points to keep in mind:

Choosing between API, open-source or custom fine-tuned models. One of the first major decisions for any enterprise project is: do you use a model via an API (e.g., from a vendor like OpenAI or Anthropic), deploy an open-source model internally, or build/fine-tune a custom model yourself? Each has trade-offs.

APIs offer speed and minimal setup, but may expose data, limit customization or accrue high cost — and will leave you at the mercy of your vendor. Open source allows internal control and may ease fine-tuning, but requires infrastructure, expertise, and support. Custom fine-tuning gives you the tightest alignment to your use-case, but lengthens time to value and increases risk.

Governance, data privacy and compliance. Deploying generative AI in an enterprise setting raises new governance, privacy and regulatory issues. For example: Who owns the data that’s ingested? How is proprietary data protected if you call a third-party API? What traceability exists for model outputs—a huge question for regulated industries? One useful framework is covered in “A GRC framework for securing generative AI” Data governance must adapt for the new era,  and new frameworks are evolving to help.

Human-in-the-loop review. Even the best models make mistakes and cannot simply be put on autopilot. You need a human-in-the-loop (HITL) process: real people need to review outputs, validate for bias, approve high-stakes content, and tune prompts or models based on feedback. Incorporating HITL checkpoints helps mitigate risk and improve overall quality.

Integration with existing systems and RAG pipelines. Retrieval-augmented generation, which we touched on earlier, connects foundation models into business workflows, systems, and enterprise data stores. RAG can bind LLMs to your organization’s internal knowledge bases, thereby reducing hallucinations (which we’ll discuss in a moment) and increasing the relevance of gen AI output.

What causes AI hallucinations?

Probably the biggest limitation of generative AI is what those in the industry call hallucinations, which is a perhaps misleading term for output that is, by the standards of humans who use it, false or incorrect.  

Every generative AI system, no matter how advanced, is built around prediction. Remember, a model doesn’t truly know facts—it looks at a series of tokens, then calculates, based on analysis of its underlying training data, what token is most likely to come next. This is what makes the output fluent and human-like, but if its prediction is wrong, that will be perceived as a hallucination.

Foundry

Because the model doesn’t distinguish between something that’s known to be true and something likely to follow on from the input text it’s been given, hallucinations are a direct side effect of the statistical process that powers generative AI. And don’t forget that we’re often pushing AI models to come up with answers to questions that we, who also have access to that data, can’t answer ourselves.

In text models, hallucinations might mean inventing quotes, fabricating references, or misrepresenting a technical process. In code or data analysis, it can produce syntactically correct but logically wrong results. Even RAG pipelines, which provide real data context to models, only reduce hallucination—they don’t eliminate it. Enterprises using generative AI need review layers, validation pipelines, and human oversight to prevent these failures from spreading into production systems.

What are some other problems with generative AI?

Generative AI has proven to be such a disruptive technology that’s stoking near-apocalyptic fears that it will result in a superintelligence that will enslave or destroy humanity. Meanwhile, in the present day, increasingly troubling reports of so-called AI psychosis are emerging, where people have mental health episodes triggered by the uncanny and sometimes sycophantic ways chatbots affirm whatever you talk to them about and try to keep the conversation going.

Compared to such existential questions, the following business-related problems may seem petty. But they’re real issues for enterprises considering investing in AI tools.

• Data leakage and regulatory risk. When a model is fine-tuned or prompted with sensitive information, that data may be memorized and unintentionally reproduced. Using third-party APIs without strict controls can expose proprietary or personally identifiable information (PII). Regulatory frameworks like GDPR and HIPAA require explicit governance around where training data resides and how inference results are stored.
• Prompt injection occurs when an attacker manipulates a model’s instructions—embedding hidden directives or malicious payloads in user input or external content the model reads. This can override safety rules, expose internal data, or execute unintended actions in agentic systems. Guardrails that sanitize inputs, restrict tool-calling permissions, and validate outputs are becoming essential.
• Copyright and content ownership. Many foundation models are trained on data scraped from the public internet, creating disputes over copyright and data provenance. Enterprises using generated output commercially need to confirm usage rights and review indemnity terms from vendors.
• Unrealistic productivity expectations. Finally, organizations sometimes expect generative AI to deliver instant productivity gains. The reality, it turns out, is more mixed. Enterprise adoption requires infrastructure, governance, retraining, and cultural change. The models accelerate work once properly integrated, but they don’t automatically replace human judgment or oversight.

The current generation of enterprise AI systems includes several layers of defense against these risks:

• Guardrails that constrain model behavior and filter unsafe outputs.
• Model validation frameworks that measure factual accuracy and consistency before deployment.
• Policy layers that enforce compliance rules, redact sensitive data, and log model actions.

These safeguards reduce—but don’t remove—the inherent uncertainty that defines generative AI.

GenAI: essential for the enterprise

Generative AI has evolved from a novelty into a core layer of enterprise technology. Foundation models and agentic systems now power automation, analytics, and creative workflows — but they remain fundamentally probabilistic tools. Their strength lies in scale and adaptability, not perfect understanding.

For organizations, success depends less on chasing model breakthroughs than on integrating these systems responsibly: building guardrails, maintaining oversight, and aligning them with real business needs. Used wisely, generative AI can amplify human capability rather than replace it.

A portmanteau of “development” and “operations,” devops emerged as a way of bringing together two previously separate groups responsible for the building and deploying of software.

In the old world, developers (devs) typically wrote code before throwing it over to the system administrators (operations, or ops) to deploy and integrate that code. But as the industry shifted towards agile development and cloud-native computing, many organizations reoriented around modern, cloud-native practices in the pursuit of faster, better releases.

This required a new way to perform these key functions in a more streamlined, efficient, and cohesive way, one where the old frustrations of disconnected dev and ops functions would be eliminated. With two groups working together, developers can rapidly roll out small code enhancements via continuous integration and delivery rather than spending years on “big bang” product releases.

Devops was born at cloud-native companies like Facebook, Netflix, Spotify, and Amazon; but it’s become one of the defining technology industry trends of the past decade, primarily because it bridges so many of the changes that have shaped modern software development.

As agile development and cloud-native computing have become ubiquitous, devops has enabled the entire industry to speed up its software development cycles. Thus, devops has now thoroughly infiltrated the enterprise, especially in organizations that rely on software to run their business, such as banks, airlines, and retailers. And it’s spawned a host of other “ops” practices, some of which we’ll touch on here.[JF1] 

Devops practices

Devops requires a shift in mindset from both sides of the dev and ops divide. Development teams should focus on learning and adopting agile processes, standardizing platforms, and helping drive operational efficiencies. Operations teams must now focus on improving stability and velocity, while also reducing costs by working hand in hand with the developer team.

Broadly speaking, these teams need to all speak a common language and there needs to be a shared goal and understanding of each other’s key skills for devops to thrive.

More specifically, engineers Damon Edwards and John Willis created the CALMS model to bring together what are commonly understood to be the key principles of devops:

• Culture: One that embraces agile methodologies and is open to change, constant improvement, and accountability for the end-to-end quality of software.
• Automation: Automating away toil is a key goal for any devops team.
• Lean: Ensuring the smooth flow of software through key steps as quickly as possible.
• Measurement: You can’t improve what you don’t measure. Devops pushes for a culture of constant measurement and feedback that can be used to improve and pivot as required, on the fly.
• Sharing: Knowledge sharing across an organization is a key tenet of devops.

“Who could go back to the old way of trying to figure out how to get your laptop environment looking the same as the production environment? All these things make it so clear that there’s a better way to work. I think it’s very tough to turn back once you’ve done things like continuous integration, like continuous delivery. Once you’ve experienced it, it’s really tough to go back to the old way of doing things,” Kim told InfoWorld.

What is a devops engineer?

Naturally, the emergence of devops has spawned a whole new set of job titles, most prominent of which is the catch-all devops engineer.

Generally speaking, this role is the natural evolution of the system administrator — but in a world where developers and ops work in close tandem to deliver better software. This person should have a blend of programming and system administrator skills so that he or she can effectively bridge those two sides of the team.

That bridging of the two sides requires strong social skills more than technical. As Kim put it, “one of the most important skills, abilities, traits needed in these pioneering rebellions — using devops to overthrow the ancient powerful order, who are very happy to do things the way they have for 30 to 40 years — are the cross-functional skills to be able to reach across the table to their business counterparts and help solve problems.”

This person, or team of people, will also have to be a born optimizer, tasked with continually improving the speed and quality of software delivery from the team, be that through better practices, removing bottlenecks, or applying automation to smooth out software delivery.

The good news is that these skills are valuable to the enterprise. Salaries for this set of job titles have risen steadily over the years, with 95% of devops practitioners making more than $75,000 a year in salary in 2020 in the United States. In Europe and the UK, where salaries are lower across the board, 71% made more than $50,000 a year in 2020, up from 67% in 2019.

Key devops tools

While devops is at its heart a cultural shift, a set of tools has emerged to help organizations adopt devops practices.

This stack typically includes infrastructure as code, configuration management, collaboration, version control, continuous integration and delivery (CI/CD), deployment automation, testing, and monitoring tools.

Here are some of the tools/categories that are increasingly relevant in 2025, and what is changing:

• CI/CD and delivery automation: Traditional tools like Jenkins remain in many stacks, but newer orchestration tools and CLI-driven or GitOps-centric platforms are growing in importance (e.g. ArgoCD, Flux, Tekton). Also, platforms that integrate more tightly with monitoring, secrets management, drift detection, and policy enforcement are gaining traction.
• Security, compliance, and devsecops tooling: Security tools are increasingly integrated into devops pipelines. Expect to see more use of static analysis (SAST), dynamic testing (DAST), dependency and supply chain scanning (SCA), secret management, and policy as code. The push is toward embedding security earlier and bridging gaps between dev, security, and machine learning teams. (InfoWorld:)
• AI  and automation augmentation: AI-assisted tools are increasingly part of tooling stacks: auto-suggestions in CI/CD, anomaly detection, predictive scaling, intelligent test suite selection, and more. The hope is that these tools will reduce manual interventions and improve reliability. Tools that are “AI ready”—that is, they integrate well with AI or have mature built-in automation or assistance—increasingly stand out from the pack.

Devops challenges

Even as devops becomes more widely adopted, there remain real obstacles that can slow progress or limit impact. One major challenge is the persistent skills gap. The modern devops engineer (or team) is expected to master not just source control, CI/CD, and scripting, but also cloud architecture, infrastructure as code, security best practices, observability, and strong cross-team communication. In many organizations these capabilities are uneven: some teams excel, others lag behind. A 2024 survey showed that while 83% of developers report participating in devops activities, using multiple CI/CD tools was correlated with worse performance — a sign that complexity without deep expertise can backfire.

Toolchain fragmentation and complexity is a related issue. Devops toolchains have sprouted into a sometimes bewildering array of packages and techniques to master: version control, CI build/test, security scanning, artifact management, monitoring, observability, deployment, secret management, and more.

The more tools you have, the more difficult it becomes to integrate them cleanly, manage their versions, ensure compatibility, and avoid duplicated effort. Organizations often get stuck with “tool sprawl” — tools chosen by different teams, legacy systems, or overlapping functionalities — which introduce friction, maintenance burden, and sometimes vulnerabilities.

Finally, although devops has spread far and wide, there is still cultural resistance and alignment. Devops isn’t just about tools and processes; it’s about collaboration, shared responsibility, and continuous feedback. Teams rooted in traditional silos (dev vs ops, or security separate) may resist changes to roles and workflows. Leadership support, communication of shared goals, trust, and allowance for continuous learning are all necessary.

Many CIOs focus too much on tools or implementation first, rather than organizational culture and behaviors; but without addressing culture, even the best tools or processes may not yield the hoped-for velocity, quality, or reliability. Organizations that succeed here tend to have proactive strategies: dedicated training programs, mentorship, internal “guilds,” pairing junior and senior engineers, and making sure leadership supports ongoing learning rather than one-off bootcamps.

Why do devops?

Whoever you ask will tell you that devops is a major culture shift for organizations, so why go through that pain at all?

Devops aims to combine the formerly conflicting aims of developers and system administrators. Under its principles, all software development aims to meet business demands, add functionality, and improve the usability of applications while also ensuring those applications are stable, secure, and reliable. Done right, this improves the velocity and quality of your output, while also improving the lives of those working on these outcomes.

Does devops save money — or add cost?

Devops teams are recognizing that speed and agility are only part of success — unchecked cloud bills and waste undermine long-term sustainability. Waste in devops often comes in the form of “devops debt”— idle cloud capacity, dead code, or false-positive security alerts—which was called a “hidden tax on innovation” in recent Java-environment studies.

 Embedding finops practices can help fight these costs. Teams should shift left on cost: estimating costs when spinning up new environments, resizing instances, and scaling down unused resources before they become runaway expenses.

How to start with devops

There are lots of resources for help getting started with devops, including Kim’s own Devops Handbook, or you can enlist the help of external consultants. But you have to be methodical and focus on your people more than on the tools and technology you will eventually use if you want to ensure lasting buy-in across the business.

A proven route to achieving this is a “land and expand” strategy, where a small group starts by mapping key value streams and identifying a single product team or workload for trialing devops practices. If this team is successful in proving the value of the shift, you will likely start to get interest from other teams and from senior leadership.

If you are at the start of your devops journey, however, make sure you are prepared for the disruption a change like this can have on your organization, and keep your eye on the prize of building better, faster, stronger software.

More on devops:

• Devops debt: The hidden tax on innovation
• 10 big devops mistakes and how to avoid them
• Smarter devops: How to avoid deployment horrors

What is cloud native? Cloud native defined

The term “cloud-native computing” encompasses the modern approach to building and running software applications that exploit the flexibility, scalability, and resilience of cloud computing. The phrase is a catch-all that encompasses not just the specific architecture choices and environments used to build applications for the public cloud, but also the software engineering techniques and philosophies used by cloud developers.

The Cloud Native Computing Foundation (CNCF) is an open source organization that hosts many important cloud-related projects and helps set the tone for the world of cloud development. The CNCF offers its own definition of cloud native:

Cloud native practices empower organizations to develop, build, and deploy workloads in computing environments (public, private, hybrid cloud) to meet their organizational needs at scale in a programmatic and repeatable manner. It is characterized by loosely coupled systems that interoperate in a manner that is secure, resilient, manageable, sustainable, and observable.

Cloud native technologies and architectures typically consist of some combination of containers, service meshes, multi-tenancy, microservices, immutable infrastructure, serverless, and declarative APIs — this list is not exhaustive.

This definition is a good start, but as cloud infrastructure becomes ubiquitous, the cloud native world is beginning to spread behind the core of this definition. We’ll explore that evolution as well, and look into the near future of cloud-native computing.

Cloud native architectural principles

Let’s start by exploring the pillars of cloud-native architecture. Many of these technologies and techniques were considered innovative and even revolutionary when they hit the market over the past few decades, but now have become widely accepted across the software development landscape.

Microservices. One of the huge cultural shifts that made cloud-native computing possible was the move from huge, monolithic applications to microservices: small, loosely coupled, and independently deployable components that work together to form a cloud-native application. These microservices can be scaled across cloud environments, though (as we’ll see in a moment) this makes systems more complex.

Containers and orchestration. In could-native architectures, individual microservices are executed inside containers — lightweight, portable virtual execution environments that can run on a variety of servers and cloud platforms. Containers insulate the developers from having to worry about the underlying machines on which their code will execute. That is, all they have to do is write to the container environment. 

Getting the containers to run properly and communicate with one another is where the complexity of cloud native computing starts to emerge. Initially, containers were created and managed by relatively simple platforms, the most common of which was Docker. But as cloud-native applications got more complex, container orchestration platforms that augmented Docker’s functionality emerged, such as Kubernetes, which allows you to deploy and manage multi-container applications at scale. Kubernetes is critical to cloud native computing as we know it — it’s worth noting that the CNCF was set up as a spinoff of the Linux Foundation on the same day that Kubernetes 1.0 was announced — and adhering to Kubernetes best practices is an important key to cloud native success. 

Open standards and APIs. The fact that containers and cloud platforms are largely defined by open standards and open source technologies is the secret sauce that makes all this modularity and orchestration possible, and standardized and documented APIs offer the means of communication between distributed components of a larger application. In theory, anyway, this standardization means that every component should be able to communicate with other components of an application without knowing about their inner workings, or about the inner workings of the various platform layers on which everything operates.

DevOps, agile methodologies, and infrastructure as code. Because cloud-native applications exist as a series of small, discrete units of functionality, cloud-native teams can build and update them using agile philosophies like DevOps, which promotes rapid, iterative CI/CD development. This enables teams to deliver business value more quickly and more reliably.

The virtualized nature of cloud environments also make them great candidates for infrastructure as code (IaC), a practice in which teams use tools like Terraform, Pulumi, and AWS CloudFormation, to manage infrastructure declaratively and version those declarations just like application code. IaC boosts automation, repeatability, and resilience across environments—all big advantages in the cloud world. IaC also goes hand-in-hand with the concept of immutable infrastructure—the idea that, once deployed, infastructure-level entities like virtual machines, containers, or network appliances don’t change, which makes them easier to manage and secure. IaC stores declarative configuration code in version control, which creates an audit log of any changes.

Foundry

How the cloud-native stack is expanding

As cloud-native development becomes the norm, the cloud-native ecosystem is expanding; the CNCF maintains a graphical representation of what it calls the  cloud native landscape that hammers home to expansive and bewildering variety of products, services, and open source projects that contribute to (and seek to profit from) to cloud-native computing. And there are a number of areas where new and developing tools are complicating the picture sketched out by the pillars we discussed above.   

An expanding Kubernetes ecosystem. Kubernetes is complex, and teams now rely on an entire ecosystem of projects to get the most out of it: Helm for packaging, ArgoCD for GitOps-style deployments, and Kustomize for configuration management. And just as Kubernetes augmented Docker for enterprise-scale deployments. Kubernetes itself has been augmented and expanded by service mesh offerings like Istio and Linkerd, which offer fine-grained traffic control and improved security

Observability needs. The complex and distributed world of cloud-native computing requires in-depth observability to ensure that developers and admins have a handle on what’s happening with their applications. Cloud-native observability uses distributed tracing and aggregated logs to provide deep insight into performance and reliability. Tools like Prometheus, Grafana, Jaeger, and OpenTelemetry support comprehensive, real-time observability across the stack.

Serverless computing.  Serverless computing, particularly in its function-as-a-service guise, offers to strip needed compute resources down to their bare minimum, with functions running on service provider clouds using exactly as much as they need and no more. Because these services can be exposed as endpoints via APIs, they are increasingly integrated into distributed applications, operating side-by-side with functionality provided by containerized microservices. Watch out, though: the big FaaS providers (Amazon, Microsoft, and Google) would love to lock you in to their ecosystems.  

FinOps. Cloud computing was initially billed as a way to cut costs — no need to pay for an in-house data center that you barely use — but in practice it replaces capex with opex, and sometimes you can run up truly shocking cloud service bills if you aren’t careful. Serverless computing is one way to cut down on those costs, but financial operations, or FinOps, is a more systematic discipline that aims to aligns engineering, finance, and product to optimize cloud spending. FinOps best practices make use of those observability tools to best determine what departments and applications are eating up resources.

How cloud-native architecture is adapting to AI workloads

Enterprises deploy larger AI models and make use of more and more real-time inference services. That’s putting demands on cloud-native systems and forcing them to adapt to remain scalable and reliable.

For instance, organizations are re-engineering cloud environments around GPU-accelerated clusters, low-latency networking, and predictable orchestration. These needs align with established cloud-native patterns: containers package AI services consistently, while Kubernetes provides resilient scheduling and horizontal scale for inference workloads that can spike without warning.

Kubernetes itself is changing to better support AI inference, adding hardware-aware scheduling for GPUs, model-specific autoscaling behavior, and deeper observability into inference pipelines. These enhancements make Kubernetes a more natural platform for serving generative AI workloads.

AI’s resource demands are amplifying traditional cloud-native challenges. Observability becomes more complex as inference paths span GPUs, CPUs, vector databases, and distributed storage. FinOps teams contend with cost volatility from training and inference bursts. And security teams must track new risks around model provenance, data access, and supply-chain integrity.

Application frameworks for building distributed cloud-native apps

Microsoft’s Aspire is one of the most visible examples of a shift towards application frameworks to simplify how teams build distributed systems. Opinionated frameworks like Aspire provide structure, observability, and integration out of the box so developer don’t need to stitch together containers, microservices, and orchestration tooling by hand.

Aspire in particular is a prescriptive framework for cloud-native applications, bundling containerized services, environment configuration, health checks, and observability into a unified development model. Aspire provides defaults for service-to-service communication, configuration, and deployment, along with a built-in dashboard for visibility across distributed components.

While Aspire was originally aligned with Microsoft’s .NET platform,Redmond now sees it as having a  polyglot future. This positions Aspire as part of a broader trend: frameworks that help teams build cloud-native, service-oriented systems without being locked into a single language ecosystem. Several other frameworks are gaining traction: Dapr provides a portable runtime that abstracts many of the plumbing tasks in cloud-native distributed applications, and Orleans offers an actor-model-based framework for large-scale systems in the .NET world, and Akka gives JVM teams a mature, reactive toolkit for elastic, resilient services.

Frameworks and tools in the expanding cloud-native ecosystem

While frameworks like Aspire simplify how developers compose and structure distributed applications, most cloud-native systems still depend on a broader ecosystem of platforms and operational tooling. This deeper layer is where much of the complexity—and innovation—of cloud-native computing lives, particularly as Kubernetes continues to serve as the industry’s control plane for modern infrastructure.

Kubernetes provides the core abstractions for deploying and orchestrating containerized workloads at scale. Managed distributions such as Google Kubernetes Engine (GKE), Amazon EKS, Azure AKS, and Red Hat OpenShift build on these primitives with security, lifecycle automation, and enterprise support. Platform vendors are increasingly automating cluster operations—upgrades, scaling, remediation—to reduce the operational burden on engineering teams.

Surrounding Kubernetes is a rapidly expanding ecosystem of complementary frameworks and tools. Service meshes like Istio and Linkerd provide fine-grained traffic management, policy enforcement, and mTLS-based security across microservices. GitOps platforms such as Argo CD and Flux bring declarative, version-controlled deployments to cloud-native environments. Meanwhile, projects like Crossplane turn Kubernetes into a universal control plane for cloud infrastructure, letting teams provision databases, queues, and storage through familiar Kubernetes APIs. These tools illustrate how cloud-native development now spans multiple layers: developer-focused application frameworks like Aspire at the top, and a powerful, evolving Kubernetes ecosystem underneath that keeps modern distributed applications running.

Advantages and challenges for cloud-native development

Cloud native has become so ubiquitous that its advantages are almost taken for granted at this point, but it’s worth reflecting on the beneficial shift the cloud native paradigm represents. Huge, monolithic codebases that saw updates rolled out once every couple of years have been replaced by microservice-based applications that can be improved continuously. Cloud-based deployments, when managed correctly, make better use of compute resources and allow companies to offer their products as SaaS or PaaS services. 

But cloud-native deployments come with a number of challenges, too:

• Complexity and operational overhead: You’ll have noticed by now that many of the cloud-native tools we’ve discussed, like service meshes and observability tools, are needed to deal with the complexity of cloud-native applications and environments. Individual microservices are deceptively simple, but coordinating them all in a distributed environment is a big lift.
• Security: More services executing on more machines, communicating by open APIs, all adds up to a bigger attack surface for hackers. Containers and APIs each have their own special security needs, and a policy engine can be an important tool for imposing a security baseline on a sprawling cloud-native app. DevSecOps, which adds security to DevOps, has become an important cloud-native development practice to try to close these gaps.
• Vendor lock-in: This may come as a surprise, since cloud-native is based on open standards and open source. But there are differences in how the big cloud and serverless providers works, and once you’ve written code with one provider in mind, it can be hard to migrate elsewhere.
• A persistent skills gap: Cloud-native computing and development may have years under its belt at this point, but the number of developers who are truly skilled in this arena is a smaller portion of the workforce than you’d think. Companies face difficult choices in bridging this skills gap, whether that’s bidding up salaries, working to upskill current workers, or allowing remote work so they can cast a wide net. 

Cloud native in the real world

Cloud native computing is often associated with giants like Netflix, Spotify, Uber, and AirBNB, where many of its technologies were pioneered in the early ’10s. But the CNCF’s Case Studies page provides an in-depth look at how cloud native technologies are helping companies. Examples include the following:

• A UK-based payment technology company that can switch between data centers and clouds with zero downtime
• A software company whose product collects and analyzes data from IoT devices — and can scale up as the number of gadgets grows
• A Czech web service company that managed to improve performance while reducing costs by migrating to the cloud

Cloud-native infrastructure’s capability to quickly scale up to large workloads also make it an attractive platform for developing AI/ML applications: another one of those CNCF case studies looks at how IBM uses Kubernetes to train its Watsonx assistant. The big three providers are putting a lot of effort into pitching their platforms as the place for you to develop your own generative AI tools, with offerings like Azure AI Foundry,Google Firebase Studio, and Amazon Bedrock. It seems clear that cloud native technology is ready for what comes next.

Learn more about related cloud-native technologies:

• Platform-as-a-service (PaaS) explained
• What is cloud computing
• Multicloud explained
• Agile methodology explained
• Agile development best practices
• Devops explained
• Devops best practices
• Microservices explained
• Microservices tutorial
• Docker and Linux containers explained
• Kubernetes tutorial
• CI/CD (continuous integration and continuous delivery) explained
• CI/CD best practices

Historically, financial closes required were tedious, manual-intensive processes, which makes them excellent candidates for agentification. AI agents can handle much of the “dirty work” associated with integrating financial data from various sources, reconciling transactions and so on. That said, there are limits on how far AI agents can go in streamlining and accelerating the closing process. It’s unrealistic for businesses to remove humans from the picture entirely.

With this caveat in mind, here’s a look at practical approaches to driving more efficient financial closings with help from AI agents. To ground the conversation, I’ll focus on what the process might look like within environments based on SAP, although many of these lessons apply to any organization and tech stack.

How AI agents can accelerate financial closes

Although ERP systems like SAP house most or all of an organization’s financial data within a central system, closing out the books still tends to be a highly complex process, hampered by challenges like the following:

• Master Data reconciliation
• Working through huge volumes of journaling
• Identifying and resolving transaction reconciliation errors
• Ensuring compliance with governance and regulatory requirements

These are all areas where AI agents can help, even if SAP’s Advanced Financial Closing is used. For example, instead of requiring humans to assess each irregular transaction manually, businesses can employ agents to review the situation and suggest a resolution. Agents also excel at tasks like integrating multiple data sources, then identifying and addressing redundancies or inconsistencies across them.

Similarly, agents can continuously monitor financial workflows throughout the close cycle, flagging anomalies and potential bottlenecks before they delay reporting deadlines. They can automatically collect supporting documentation, validate data against predefined business rules and route exceptions to the appropriate stakeholders for review.

By reducing the amount of repetitive manual work required during closing, AI agents help finance teams focus on higher-value analysis and decision-making. This can lead to faster close times, improved accuracy and greater confidence in the integrity of financial reporting.

The limitations of agents for closing the books

That said, agents can’t handle every aspect of the closing process entirely on their own. Two key limitations apply. The first is that, as with any LLM-powered technology, agents are at risk of making inaccurate decisions or inferences. Businesses can’t blindly trust agents to interpret financial data accurately all of the time. A second factor is that, due to strict regulatory requirements, it’s essential in most cases for humans to sign off on financial accounts. Telling regulators or auditors that you know your books are accurate because an AI agent told you so is not a recipe for compliance success.

Because of these limitations, a healthy perspective on AI agents in financial closing contexts is to think of them as a way to improve visibility, agility and efficiency, not as a replacement for people. Agents can make recommendations, but humans need to be the ones who review, validate and sign off on any actions before they are final.

Integrating AI agents into the closing process in SAP

How can organizations actually take advantage of AI agents to help with closing?

The answer is complicated because every business’s books and closing process are different. This means that, despite the growing inventory of AI agents now available on platforms like SAP, it’s unrealistic to expect to “drag and drop” agents into existing closing workflows and have them do what they need.

Instead, many businesses will find that they need to build custom agentic solutions. Often, they’ll benefit from implementing multiple agents targeted at different tasks, e.g., accounts receivable, accounts payable and foreign currency exchanges, along with an orchestrator agent that oversees them all. Each agent will need to be tailored for the organization’s data sources, governance and compliance obligations, etc.

In addition, organizations must carefully define how agents interact with financial systems and employees. While some activities can be automated end-to-end, others require human review and approval to satisfy internal controls and regulatory requirements. Establishing clear workflows, escalation paths and audit trails is essential to ensure that agent-driven processes remain transparent and trustworthy. Organizations also need to invest in testing and validation to confirm that agents produce accurate results and can handle exceptions without introducing new risks into the close process.

The fact that SAP itself is a complex platform, with native agentic capabilities fully supported only in the latest versions, further complicates the agentification of the closing process. Enterprises need to assess the agentic support level available within the SAP version they use, then determine the extent to which they can leverage SAP’s own agents versus working with third-party agents.

Another key consideration is data quality. AI agents can only perform effectively when they have access to complete, accurate and timely financial information. Organizations may need to improve data governance practices and address integration challenges before agents can deliver meaningful value. The extent to which they can do this easily depends, in large part, on how healthy their underlying SAP data governance practices are.

All of the above means that taking advantage of agents to accelerate closes and other financial workflows within SAP is no mean feat. It requires deep technical expertise in both agentic technology and the complex SAP software portfolio. But the investment is worth it for organizations seeking to reduce the uncertainty and slowness traditionally associated with closing the books. Over time, well-designed agentic workflows can help finance teams spend less time on manual reconciliation and exception handling while enabling faster, more predictable financial close cycles.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Chatting with readers and regular folks in the real world these days, I can’t help but notice a common theme anytime the topic of AI comes up.

It’s an almost amusingly extreme contrast: While the myopic world of tech people (and the type of mostly AI-powered “thought leaders” you see posting in turbo-speed on LinkedIn) are waxing endlessly about AI’s amazing impact on society and all the ways it’s, like, totally revolutionizing workflow, bruh, the average human’s take on AI can best be summed up with a single word:

Exasperation.

With shockingly little exception, almost every non-tech-obsessed organism I interact with reacts with something between an eye-rolling sigh and a fed-up facepalm whenever the prevalence of AI arises. It’s almost like having an on-demand in-person GIF gallery of “frustration” available at your fingertips — just mention AI, and you’ll get a meme-worthy reaction from anyone around you.

It’s such a dramatic divergence from the glowingly excited hype we hear left and right from the tech industry itself and the seemingly small but vocal group of overly enthusiastic evangelists who create an echo chamber around it. And that very contrast and the disparity between what tech companies are giving us and what tech users actually want these days led me to a bit of an epiphany this week:

AI may well be creating a killer feature that people will be willing to pay to possess. It’s just not the one most AI-fixated entities are focused on creating — quite the opposite, in fact.

[Get level-headed knowledge in your inbox with my free Android Intelligence newsletter — practical tech talk by humans, for humans.]

The AI availability irony

I’ve said it before, and I’ll say it again: In many ways, Gemini — Google’s generative AI chatbot and overall AI layer — is the new Google+.

It’s a solution in search of a problem. No one is asking for it and most typical tech users increasingly seem to find its presence actively irksome and invasive — and yet Google continues to insist on shoving it into our faces at every possible opportunity. More and more with every passing week, the company’s adding AI elements into almost every app and service regardless of whether they’re actually helpful in that context. In many cases, in fact, they’re unnecessary, useless, even outright creepy and creating very real problems and liabilities for businesses and individuals alike.

It’s not just Google, of course. The same tale is taking place with practically every tech provider big and small right now. Everyone is cramming AI into every nook and cranny and thinking more about the idea of integrating artificial intelligence — mostly just for the sake of having it there — than creating an optimal experience for the people who actually use said services.

That, in turn, is creating a whole new category of productivity experience that people are actually lining up to pay for — a premium feature of sorts, related to AI and its presence in our lives.

Ready for the most delicious irony of all? The killer AI feature of which we speak is a lack of AI — or at least the ability to disable and avoid it and use it only if and when you want.

It’s not just an anecdotal feeling, either. It’s a measurable trend that may still be in its infancy but is absolutely taking shape around us.

Take, for instance, Kagi — an ad-free, privacy-centric search service that’s been quietly building a viable alternative to Google Search for several years already. The proposition is simple: You pay a monthly fee — five bucks a month for limited use or $10 for unlimited searching — and you get a search engine that’s designed to serve you instead of revolving around the interest of both advertisers and corporate AI initiatives.

The Kagi search experience is clean, simple, and effective — and, most notably for our current conversation, free from all the often accuracy-challenged AI-generated “answers” that are now plastered atop most Google searches. You just get the results you want, without any experience-harming interruptions or distractions — because you’re paying for the service. Those five or 10 smackeroos you send over each month restructure the entire relationship and ultimately change everything about the service’s trajectory.

When I wrote a profile piece about Kagi last February, the service boasted 38,000 paying subscribers. Today, according to Kagi’s public stats page, its subscriber base has nearly doubled — to 72,847 users, as of this writing.

It may still be a drop in the bucket — and it may always be a niche demand, in the grand scheme of the global tech picture — but it represents a rapidly growing demand. And Kagi isn’t the only player seeing both the demand and the resulting opportunity. Practically every time Google pushes AI further into its search setup, the privacy-focused (and AI-optional) search provider DuckDuckGo reports a surge in its adoption as well.

And search isn’t the only arena where this same sentiment is starting to boil over. I hear constantly from folks who are growing ever-more frustrated with all the unavoidable AI integration in other productivity tools, ranging from email to notes and even just plain ol’ document writing. Heck, I created my own custom interface for Google Docs on the desktop (with the help of Gemini, in another delightfully ironically twist) just to escape from all the over-the-top noise Google keeps adding into that environment. It’s a nerdy hack, to be sure — and it’s an opportunity for someone crafty to come in and create an actual solution, in the style of what Kagi has done with search, to more effectively address that same underlying desire.

More and more research is starting to reflect that yearning for practical, useful tech tools that aren’t larded down with AI for the sake of AI. A recent study by Automattic (the behind WordPress) found 60% of people say AI in a brand’s messaging is more of a turnoff than a feature. My own smaller (and much less scientific, though also more specifically focused) poll of folks who read my Android Intelligence newsletter found that only 9% of Android-owning animals said they generally loved the presence of AI results in regular web searches — with 26% outright hating it and 64% saying it depends on the situation but that they at least sometimes find it to be more annoying than useful.

So as company after company crams AI into everything and startup after startup jumps on that same steamy bandwagon, the question in my mind is less about what the next big advancement in AI will bring into our lives and more about what interesting opportunities the lack of AI — or at least the ability to limit its influence on a productivity experience and decide for yourself how and when you actually want to use it — will create.

It’s easy to imagine a scenario in which services like Kagi and DuckDuckGo start to offer AI-free or even just AI-optional alternatives to apps that are being overrun with irritating and countereffective AI integrations — things like Docs, Notion, Slack, and any number of design tools. And it’s equally easy to imagine plenty of people and places being enticed by that lack of AI as a premium feature worth paying to experience.

It may inevitably remain a relatively niche market compared to the more mainstream tech solutions. But for people and organizations woefully underwhelmed with the current direction tech’s taking and willing to shell out cash for quality, it’s an intriguing notion — and an area well worth watching as the AI invasion continues crashing into every last corner of our virtual lives.

Sick of AI for the sake of AI? Check out my free weekly Android Intelligence newsletter for original human thinking and actually-helpful ways to make the most of your devices.

From contracts and invoices to onboarding forms and compliance records, document-heavy processes consume significant time and resources across enterprise organizations.

While AI has introduced new opportunities for automation, many organizations still struggle with one fundamental challenge: A lot of important business information is trapped inside PDFs, forms, and other documents.

Nitro Automate solves this problem.

Designed for enterprise-level document volume, Nitro Automate is an intelligent document automation platform that combines document processing, workflow automation, and AI-powered integrations to help teams eliminate manual document tasks and automate business processes. It’s fast to deploy, built to work anywhere your team handles PDFs, and can start delivering value almost immediately.

Nitro Automate is intelligent document automation for today’s enterprises

Nitro Automate extends Nitro’s document productivity solutions—Nitro PDF, Nitro Sign, Nitro Smart Redact—going beyond document creation, editing, and signing to address the challenge of managing document operations across the AI agents, workflows, and systems your teams rely on.

Instead of depending on employees to move documents between systems, extract data manually, or manage repetitive workflows, Nitro Automate lets you automate tasks throughout the document lifecycle, including:

• Process, convert, reshape, transform, convert, compress, and secure PDFs
• Document generation and assembly
• Data extraction from forms and documents
• Workflow automation and orchestration
• eSignature workflow automation
• Document security and redaction
• Integration with enterprise applications

Key capabilities of Nitro Automate

Nitro Automate works at two levels.

At the team and department level, it combines document automation, AI-powered data extraction, and workflow orchestration to eliminate manual document work entirely for high-volume processes.

At the individual level, it accelerates essential document tasks that still require human judgment, such as reviewing, approving, or routing documents.

Across both levels, enterprise integrations make document data accessible to every stakeholder, whether they’re automating a process or working through it directly.

Here are four ways Nitro Automate transforms document-intensive workflows.

Eliminate many manual PDF tasks

Despite significant investments in digitalization, many core business workflows, like employee onboarding, contract review, and invoice processing, still depend on employees manually performing routine document tasks before work can move forward. These tasks include:

• Converting files to the right format
• Splitting or merging PDFs
• Extracting specific content
• Applying security settings
• Preparing final document packages

Individually, each task takes only a few minutes. But repeated across hundreds or thousands of documents, they add up to hours of low-value manual work embedded inside otherwise automated workflows. Nitro Automate removes these manual document steps from core business workflows entirely, so employees are no longer a required step between one process stage and the next.

These activities may seem insignificant when viewed individually, but when thousands of documents are at play, they can create substantial operational overhead. Nitro Automate helps automate these processes through reusable workflows that can run behind the scenes to support business operations.

That means that your teams can focus on higher-value work while improving process consistency and reducing the risk of errors.

Automate eSignature workflows beyond the signature

In many organizations, obtaining an electronic signature is only one step in a larger workflow.

For example, a contract may require document generation, internal approvals, signature collection, storage, reporting, and follow-up actions. Similar workflows exist across industries, such as HR, procurement, legal, finance, and customer operations.

Nitro Automate helps organizations automate these processes by integrating document preparation, routing, approvals, and Nitro Sign workflows into a single automated experience.

Instead of managing signatures manually across disconnected tools, teams can create workflows that automatically move documents through each stage of the lifecycle, resulting in faster turnaround times, improved visibility, and fewer bottlenecks.

Unlock data trapped in documents

One of Nitro Automate’s most valuable capabilities is how it transforms unstructured document content into actionable business data.

Critical information is often stored inside contracts, invoices, applications, forms, and other documents. Accessing that information traditionally requires manual review and extraction. Nitro Automate uses AI to identify, capture, and structure document data so it can be used by downstream systems and workflows to accelerate processes, such as:

• Invoice and accounts payable automation
• Employee onboarding
• Contract management
• Customer intake
• Compliance reporting
• Claims and case management

Build document workflows that work in the AI era

As enterprises move beyond AI copilots that assist with individual tasks and begin deploying AI agents that can execute multi-step workflows autonomously, document automation is becoming an increasingly important part of AI strategy.

Many AI systems can analyze information and generate recommendations, but they often require specialized tools to execute document-related tasks. Nitro Automate addresses this challenge by providing flexible integration options that support both human- and AI-driven workflows.

For example, business teams can build their own automations using low-code and no-code tools, while developers can easily integrate Nitro Automate into existing applications and workflows using APIs.

Nitro Automate is also compatible with the Model Context Protocol (MCP), an emerging open source standard that allows AI agents to securely access external tools and services. Through MCP, AI agents can use Nitro’s document automation solution to interact with documents inside business workflows, making Nitro Automate a document execution layer for enterprise AI initiatives.

Nitro Automate: A new approach to enterprise document operations

If your organization is investing in automation and AI, it’s important to recognize that document-intensive processes are one of the largest opportunities for operational improvement.

Nitro Automate bridges the gap between documents, workflows, enterprise systems, and AI agents by bringing together document processing, eSignature automation, data extraction, and workflow orchestration.

Ready to discover how Nitro Automate helps create intelligent workflows that can scale alongside the next generation of enterprise AI?

Speak with a Nitro Automation Expert

Choosing the right eSign solution is less about picking the tool with the most bells and whistles and more about confirming that the features support your company’s requirements for security and compliance, workflow automation, cost-effectiveness, and operational efficiency.

The best eSign solutions let teams securely collect legally binding electronic signatures while integrating signing workflows with business systems, compliance controls, and document lifecycle processes — evaluated across four factors: security and compliance, workflow integration, total cost of ownership, and measurable business ROI.

When evaluating eSignature solutions, look beyond signing functionality and consider these four factors:

• Security and compliance
• Workflow integration
• Total cost of ownership
• Measurable business ROI

Security and compliance are the foundation of eSignatures

Yes, you want eSigning to be convenient, but it’s arguably even more important that your eSignature solution provides the security, auditability, and legal validity required to support critical business transactions.

Look for solutions that offer:

• Comprehensive audit trails
• Strong authentication controls
• Encryption in transit and at rest
• Support for established legal frameworks (e.g., the ESIGN Act, UETA, eIDAS)

Independent certifications, including SOC 2 Type II and ISO 27001, provide additional assurance that an eSign vendor follows recognized security and information management practices.

The signature is only one step in the document lifecycle

During the digital signing process, documents typically move through multiple workflows:

During the digital signing process, documents typically move through multiple stages: creation, review, approval, signature collection, storage, reporting, and retention.

Consider a typical sales contract: it might originate in a CRM, require review and approval from finance, get routed for signature, then need to be stored in a repository, reported on for compliance, and retained per policy. If each of these steps happens in a separate, disconnected tool, the signature may be digital, but the workflow is still manual.

When one or more of these steps rely on email attachments, manual routing, or moving files across disconnected applications, delays and inefficiencies quickly snowball.

An eSignature platform that supports document workflow automation can help you avoid this by connecting approval workflows, document routing, signature collection, and archival processes into a low-friction experience.

Evaluating the true cost of ownership of an eSignature solution

When you’re evaluating the cost of eSignature solutions, subscription pricing only tells part of the story. The solution with a lower upfront cost may require additional integrations, administrative effort, training, or support resources that increase long-term expenditure.

When calculating total cost of ownership, be sure to consider:

• Licensing and transaction costs
• Implementation and integration requirements
• Administrative overhead
• User adoption and training
• Compliance and audit support
• Scalability as your business needs evolve

How to measure eSignature ROI

Traditionally, the value proposition for eSignature software was that it reduced paper, printing, and shipping costs. Today, the value is firmly centered on operational outcomes, including:

• Contract turnaround times
• Employee onboarding speed
• Approval cycle duration
• Manual labor reduction
• Error elimination
• Compliance risk mitigation
• Customer and employee experience improvements

For example, reducing contract processing from days to hours can have a greater business impact than eliminating printing costs. Similarly, automated approval workflows can take over repetitive administrative tasks, freeing up employees to work on higher-value initiatives.

What to look for in an eSignature solution

As eSignature technology matures, the evaluation criteria have expanded beyond ease of signing. Today, organizations need solutions that can support compliance requirements, integrate with existing business systems, automate document workflows, and scale alongside broader digital transformation initiatives.

When comparing eSignature solutions, don’t just look at signing capabilities. Assess how well each eSign solution supports the entire document lifecycle through:

• Strong security and compliance controls
• Support for ESIGN, UETA, and eIDAS requirements
• Workflow automation capabilities
• Integration with existing business systems
• API accessibility for future automation initiatives
• Comprehensive audit trails and reporting
• Predictable, scalable pricing

In 2026, the best eSignature solution isn’t the one with the most features. It’s the one that connects signing to the rest of the document lifecycle while keeping security, cost, and ROI measurable. Nitro Sign is built around that principle: it goes beyond electronic signatures to support secure, compliant, connected document workflows that integrate with the systems teams already use, so governance improves, operations accelerate, and the solution scales with long-term business goals.

Discover why Nitro Sign has been recognized by IDC as a global leader in electronic signature software solutions.

Speak with an eSign Expert

You implemented a standalone eSign solution, so why does the rest of your contract workflow still look like this?

• Your CRM generates the contract, but to get it signed, your sales rep has to leave the CRM and open a separate eSignature application.
• Once the signature comes back, someone has to manually update the deal status in Salesforce, upload the signed agreement to SharePoint, and notify Finance that the contract is ready for invoicing.
• Each of these handoffs depends on someone remembering to do it, and on no one doing it twice or missing a step.

The bottleneck isn’t getting the signature. It’s that signing lives in its own disconnected application, separate from the CRM, the document repository, and the finance system, which all need to know the contract is done.

eSignature solutions are supposed to speed up workflows, but if you just add eSign capabilities to manual processes, you’re sacrificing efficiency and ROI. Using an eSign API lets you eliminate the handoffs that are fragmenting workflows and creating bottlenecks by embedding signing capabilities directly into the systems teams are already using.

5 ways an eSign API eliminates bottlenecks in document workflows

An eSign API lets business systems automatically generate, send, track, and store signature requests, without requiring employees to leave the applications where the work already happens. Rather than bolting on a separate signing tool, the API embeds eSign capability directly into the CRMs, ERPs, document management systems, and custom applications teams already rely on.. By integrating signing capabilities at the system level, an eSign API eliminates five common bottlenecks that standalone eSign solutions leave unresolved.

Bottleneck #1: Disconnected systems create manual handoffs

CRMs, ERPs, etc., initiate agreements — but standalone eSign tools create a separate step, involving manually moving documents from one system or application to another via downloads, uploads, and email attachments, which is time-consuming and error-prone.

An eSign API-driven signing solution makes it possible to create signature requests, automate signed document retrieval, and check status inside an application through a REST API.

What this means for your eSigning process:

• Fewer manual steps
• Lower error rates
• Faster cycle times
• Consistent process enforcement across teams

Bottleneck #2: Relying on email notifications and manual status tracking

When teams rely on email notifications and spreadsheets to track signatures, it’s easy for time-sensitive documents to slip through the cracks.

An eSign API lets you programmatically track status, so systems can monitor envelopes, trigger alerts, and update records automatically.

What this means for your eSigning process:

• Real-time workflow visibility
• Automated reminders
• Better SLA tracking
• Fewer support tickets asking, “Where is this document?”

Bottleneck #3: Siloing signed documents in separate applications

When contracts, onboarding forms, procurement approvals, and HR documents live in different applications, teams lose visibility and accessibility, putting data integrity and productivity at risk.

Using an eSign API to embed eSigning directly into CRMs, ERPs, HR platforms, and custom applications, rather than forcing users into a separate signing portal, creates a system of record that keeps the entire organization on the same page.

What this means for your eSigning process:

• Better user experience
• Reduced context switching
• Easier governance and auditing

Bottleneck #4: Manual processes break as document volume grows

Processes that work “well enough” for dozens of signatures often break when teams are processing thousands of documents per month.

An eSign API that supports automated, enterprise-scale signing, paired with predictable, usage-based pricing, lets teams scale to thousands of signature transactions without adding administrative headcount to manage them.

What this means for your eSigning process:

• Automated high-volume processing
• Consistent throughput
• Reduced administrative overhead
• More predictable operating costs

Bottleneck #5: Governance is applied inconsistently across manual workflows

The right eSign API doesn’t just make the signing tool compliant; it makes compliance part of every workflow that touches it.

Because the API is built on infrastructure that complies with eIDAS, UETA, the ESIGN Act, SOC 2, and ISO 27001, every signature request generated through it inherits the same standards, regardless of which application, team, or process initiated it. That consistency is the real compliance benefit: instead of relying on each team to follow the right steps manually, the API enforces the same compliant process every time.

What this means for your eSigning process:

• Legally binding signatures
• Stronger auditability
• Consistent retention workflows
• Reduced compliance risk
• Easier reporting and evidence collection

What to look for in an eSign API

• Clear, comprehensive documentation
• Reliable webhooks for real-time status updates
• Strong security and compliance certifications
• Flexible embedding options across applications
• Scalable, predictable pricing
• Responsive implementation support

How the Nitro eSign API can help

For organizations that have outgrown their standalone signing tools, the Nitro Sign API offers a cost-effective, developer-friendly way to automate high-volume workflows, embed eSigning, ensure compliance at scale, and create measurable visibility across enterprise workflows.

Why choose the Nitro Sign API:

• Embed signing into existing systems: Generate and send signature requests directly from your CRM, ERP, customer portal, or custom application, so signing happens inside the tools your teams already use.
• Automate high-volume workflows: Generate, send, and track thousands of signature requests automatically, without manual follow-up or status checks.
• Scale predictably: Usage-based pricing with no hidden fees or overage penalties keeps costs predictable as transaction volume grows.
• Support governance: Built on infrastructure that meets SOC 2 Type II, HIPAA, ISO 27001, and GDPR standards, with global legal validity under eIDAS, UETA, and the ESIGN Act, so compliance and auditability scale with the workflow.

Discover the benefits of using the Nitro eSign API to embed Nitro Sign functionality directly into your business applications, internal systems, and custom workflows.Learn how the Nitro Sign API can help your team eliminate manual document work and scale signing across every workflow.

AI is getting most of the attention in enterprise technology. Governance, ownership, and data quality do most of the heavy lifting behind the scenes. And yet, as organizations move from AI experiments to production deployments, trusted context is becoming a key factor in determining whether agents create business value — or operational risk.

That shift is reshaping how Salesforce, Microsoft, Snowflake, Databricks, SAP, Oracle, and others are positioning their data, governance, metadata, and integration services. The conversation is no longer just about models. It’s about whether AI systems can operate against trusted, governed, and business-relevant information.

Trusted context has become the new currency, and Salesforce has made a strategic commitment to it.

Agentic AI is exposing the problems master data management was designed to solve

Master data management (MDM) spent much of the last decade as an important but often overlooked infrastructure. AI is changing that. Agentic systems can identify duplicate records, inconsistent definitions, fragmented ownership, and poor governance the moment AI begins interacting with enterprise data and processes.

I recently wrote about Salesforce’s State of Data and Analytics research, which found that 84% of data leaders believe their organizations need significant changes to their data strategies before AI can succeed at scale. That finding shows what many enterprises are now experiencing. AI often exposes data and governance issues that have existed for years.

Manouj Tahiliani, senior vice president for MDM at Informatica, now part of Salesforce, said, “Trusted context is becoming the new currency in enterprise AI.” His argument is that trusted context is the connected, governed view of customers, products, and suppliers that lets an agent act like a tenured employee. Models and agents will commoditize. Differentiation comes from how well an agent understands the enterprise, which depends on the data underneath. AI is not a model problem. It is a data foundation problem with an agent interface bolted on top.

Salesforce is expanding its definition of the data layer

Salesforce completed its acquisition of Informatica in November 2025. The acquisition strengthens Salesforce’s position around data quality, governance, metadata, lineage, and MDM. It also reflects the market reality. Every major enterprise platform provider is trying to create a trusted layer that connects operational systems, business context, and AI.

Marc Benioff, CEO of Salesforce, summarized the rationale when the deal closed. Organizations need trusted, connected, and governed data before they can expect meaningful outcomes from AI. While that statement may sound obvious, it reflects one of the biggest challenges organizations continue to face as AI moves into production.

The combined strategy brings together Tableau for analytics, MuleSoft for integration and Agent Fabric, Data 360 (formerly Data Cloud) for data unification, and Informatica for governance, quality, stewardship, and MDM. The goal is not simply data consolidation. The goal is creating a consistent layer of business context that can be used across applications, workflows, and AI systems.

Salesforce is not alone. Microsoft, for example, is building around Fabric, OneLake, Purview, and Fabric IQ. Snowflake continues expanding governance, semantic, and catalog capabilities. Databricks is advancing Unity Catalog and its broader Data Intelligence Platform strategy. SAP and Oracle are pursuing similar objectives through business applications and industry-specific data models. The competitive landscape is increasingly shifting from data storage and analytics toward trusted context, governance, and operational execution.

Early adoption metrics suggest the strategy is gaining traction, although long-term success will be measured by customer outcomes, implementation timelines, and operational value. Data 360 has grown within Salesforce, Agentforce adoption continues to expand, and deeper integration between Informatica, Data 360, and Agent Fabric is expected throughout 2026.

Informatica extends governance into the agent era

The Intelligent Data Management Cloud (IDMC) remains the foundation underneath Informatica’s data management strategy. It provides metadata-aware connectivity, governance, stewardship, matching, merging, and master data capabilities across applications, databases, files, and streaming sources.

For most enterprises, the number of connectors is less important than whether governance, ownership, quality, and lineage remain consistent across systems. Connectivity alone rarely solves data problems. Operational discipline does.

What is changing is how those capabilities are being exposed to AI systems. Salesforce and Informatica are positioning governance and data management services as capabilities that agents can access directly through Model Context Protocol and related interfaces. The value is not the protocol itself. The value is allowing AI systems to interact with governed enterprise information while maintaining lineage, governance, ownership, and security controls.

Headless data management is also becoming more important. Organizations want agents, applications, and workflows to access trusted services without custom integrations for every use case. If executed effectively, that approach could simplify how AI systems consume enterprise data while preserving governance standards.

Why many data programs continue to struggle

Industry research has consistently shown that many MDM initiatives struggle to achieve their original business objectives. Governance arrives too late. Executive sponsorship is weak. Ownership remains unclear. Business units maintain competing definitions. Technology is expected to solve organizational problems.

One of the recurring issues I see across enterprises is that technology decisions often move faster than governance models. Organizations frequently deploy tools before establishing ownership, stewardship, and accountability. AI tends to expose those gaps very quickly.

The challenge becomes more complicated as enterprises deploy agents across ERP, CRM, finance, supply chain, and operational systems simultaneously. Visibility, accountability, and governance become increasingly important as AI systems move beyond recommendations and begin to influence business processes.

This is where Informatica’s Agent Fabric Context Catalog becomes relevant. The concept is less about cataloging technology and more about providing visibility into how agents are deployed, governed, monitored, and controlled.

Tahiliani offered advice that aligns with what I often tell clients. Start with business priorities. Translate those priorities into a data strategy. Then select the architecture and technology required to support it. Many organizations still approach the process in reverse, struggling to generate business value.

The competitive landscape extends beyond traditional MDM

MDM is not a single-vendor market. Gartner’s 2026 Magic Quadrant leaders include Salesforce (Informatica), Profisee, Reltio, Semarchy, and Stibo Systems. Each vendor approaches the market differently. Profisee remains closely aligned with Microsoft environments. Reltio, which SAP acquired in May 2026, continues to differentiate through graph-oriented architecture and API-first design. Semarchy brings strengths where integration and MDM converge. Stibo maintains a strong position in product information management and retail-focused environments.

Informatica’s key strengths continue to be its broad capabilities, mature governance, and growing alignment with Salesforce. The larger question is execution. Enterprises will want evidence that implementation timelines, governance complexity, and time-to-value improve as the roadmap evolves.

Historically, Informatica implementations have required significant investment, governance discipline, and organizational commitment. Salesforce will need to demonstrate that the combined strategy can simplify adoption while maintaining the governance rigor many customers expect.

Yum Brands and TELUS show what trusted context looks like in practice

Yum Brands, the parent company of KFC, Pizza Hut, Taco Bell, and Habit Burger Grill, operates more than 63,000 restaurant locations globally. According to company leadership, significant effort was being spent consolidating and cleansing location data before it could be used effectively across the business. Informatica MDM became a central component of the company’s modernization effort.

TELUS represents a different use case. The Canadian telecommunications and health services provider uses Informatica MDM Cloud Edition and Customer 360 to improve customer visibility across the organization. Integrating acquisition data into a unified customer view enabled more effective measurement of marketing performance and improved opportunities for targeted cross-sell initiatives.

Neither example proves the broader strategy on its own. Both illustrate a pattern that continues to emerge across enterprise AI initiatives. Data management investments create value when they improve operational execution, decision-making, and business outcomes rather than simply improving data quality metrics.

The common theme is that trusted information is becoming a foundational requirement for organizations attempting to scale AI, analytics, and operational decision-making.

What Salesforce and enterprise buyers still need to prove

The questions that separate successful data programs from costly tech projects are straightforward. Is there clear ownership for each data domain? Is governance embedded from the beginning rather than added later? Can governance and data management services be consumed directly by AI systems? Can compliance, security, and operational controls scale alongside AI adoption?

These questions matter more than any individual AI feature announcement. For Salesforce, the next phase requires measurable proof points. Customer references are encouraging, but enterprises will want audited outcomes, implementation metrics, and long-term operational results. I believe that success in enterprise AI won’t come from having the best model. Instead, it will come from the team with the clearest, best-governed data to support their efforts. This reflects how ERP systems are evolving, not being replaced, with an emphasis on enhancing the core data rather than just updating the technology.

Salesforce has made a decisive commitment to making trusted context essential to enterprise AI, setting a high standard that all other vendors must meet. The proof will not be in the keynotes. It will be in the stores Yum can finally report on, the households TELUS can finally sell into, and the next 10 customer stories about successful AI integration.

—

Disclosure: KramerERP offers paid services to technology companies, similar to those provided by other technology research and analyst firms. These services include research, analysis, advisory services, consulting, benchmarking, acquisition matchmaking, video sponsorships, speaking sponsorships and other related activities. KramerERP has worked with, or is currently working with, companies mentioned in this article.

The cloud security landscape has changed dramatically in recent years, and 2026 presents a completely different scenario. The integration of advanced AI, autonomous agent systems, and the looming threat of quantum computing all require a new security approach, unlike the strategies that have worked for the past decade. While threats have obviously evolved, you might be surprised by how much defensive technologies and architectural strategies have advanced, too.

I have been tracking security across the cloud industry throughout 2026, and three trends have emerged as the most consequential developments that every technology leader needs to understand. These are not minor adjustments to existing security postures. They are fundamental shifts in how we protect cloud infrastructure, with implications that extend well beyond the security team into broader architectural issues.

Zero-trust architecture

The most notable trend is the rapid adoption of zero-trust architecture among enterprises in cloud environments. Gartner predicts that by 2026, 10% of large companies will have a fully developed zero-trust program, compared with less than 1% today. This is not merely a forecast but reflects current industry shifts as organizations recognize that traditional perimeter-based security is ineffective in a landscape where workloads span multiple clouds, remote workers connect from home networks, and applications run in hybrid architectures.

Zero-trust is based on a fundamentally different approach compared to earlier security models. Instead of trusting internal network traffic by default, it treats every access request as potentially malicious, regardless of the source. This approach involves constant identity verification, strict adherence to least-privilege principles, and micro-segmentation of network resources to reduce the impact of potential breaches.

The shift from focusing solely on network security to emphasizing identity-based security is especially important in cloud settings. Solutions like Microsoft Entra ID and Okta have become the foundation for zero-trust architectures, supporting both cloud-native and on-premises systems. According to the Cloud Security Alliance, many zero-trust efforts fail at the network level because organizations still depend on firewalls and VPNs that base trust on traffic origin rather than who is requesting access or what they are trying to reach. Successful zero-trust implementations have moved past this limitation by viewing identity as the actual perimeter.

For enterprise readers, the message is clear. If your organization has not yet launched a serious zero-trust initiative, you are falling behind. This is no longer a forward-thinking security enhancement. It is the baseline expectation for any organization running significant workloads in the cloud.

Quantum-safe cryptography

A second major trend in 2026 is the rising focus on quantum-safe encryption in cloud environments. Quantum computing was long seen as a distant threat to be addressed “someday” as the technology matured. That complacency is no longer justified. IBM recently marked a decade of quantum cloud access, and quantum capabilities are advancing so fast that our current cryptographic security foundations are becoming vulnerable.

The concern is straightforward. Current encryption, especially public key cryptography, relies on hard mathematical problems that classical computers can’t solve easily. Quantum computers will eventually solve many of these problems, making current encryption standards obsolete. A major worry is the “harvest now, decrypt later” strategy, in which adversaries capture encrypted data now and plan to decrypt it later when quantum computers become available.

IBM Quantum Safe is one of the most comprehensive responses to this challenge in the cloud industry. The platform provides tools and services to help organizations migrate to post-quantum cryptographic standards, ensuring that sensitive data protected today will remain secure in a future where quantum attacks are possible. Microsoft has made similar advances in post-quantum cryptography, collaborating with global standards bodies to develop algorithms that can withstand both classical and quantum attacks.

If your organization handles long-lived sensitive data, operates in regulated industries, or maintains classified information, you need to be thinking about quantum-safe cryptography now. The migration to new cryptographic standards cannot be accomplished overnight, and organizations that wait until quantum computers pose an immediate threat will find themselves in a difficult position.

AI is both threat and defense

The third trend transforming cloud security in 2026 is AI’s dual role as both an attacker force multiplier and a vital component of defense. This complexity is one of the most challenging aspects for security leaders, as AI investments may both enhance and undermine security, depending on their implementation and governance.

The threat landscape has become more prominent over the past year. According to CrowdStrike’s 2026 Global Threat Report, AI is facilitating more advanced attacks, with more than 90 organizations reporting breaches involving legitimate AI tools used as attack channels. Adversarial techniques such as data poisoning and model inversion pose practical risks that organizations need to consider when deploying AI systems in operational settings. Furthermore, the proliferation of deepfakes and AI-generated synthetic media complicates identity verification and social engineering defense strategies.

However, the defensive side of the AI equation is equally powerful and rapidly maturing. AI-powered security tools enable early detection of anomalies, dramatically reduce incident response times, and eliminate the false-positive fatigue that has plagued security operations teams for years. SentinelOne and other endpoint security platforms have used AI to detect threats that would be invisible to traditional signature-based systems.

Perhaps most importantly, the rise of agentic AI systems in enterprises introduces a new security challenge: managing non-human identities. As autonomous AI agents run nonstop across cloud environments, each one becomes an identity requiring protection, oversight, and regulation. The Cloud Security Alliance has identified non-human identity governance as the key security gap in the age of agentic AI, emphasizing the need for a complete framework to handle AI agent identities, just as organizations do with human user identities.

The speed of change

These three trends are interconnected, creating a more complex and significant security landscape than ever before. Zero-trust relies on identity verification, which AI systems must support. Quantum-safe cryptography must be implemented carefully to prevent vulnerabilities that AI-driven attacks could exploit. Additionally, as AI agents become an increasingly important part of your digital workforce, integrating non-human identity management into your overall security framework is essential.

To successfully manage this complexity, identify these trends early and begin adjusting your security architecture now. This requires investing in zero-trust foundations, moving toward quantum-safe encryption, and creating governance frameworks for AI systems that address both functionality and security needs. The cloud security landscape is evolving faster than most organizations realize. The question now is whether you are paying attention and, more importantly, whether your security architecture will be prepared for what is coming.

Initially launched in November 2023, Microsoft 365 Copilot brings a range of generative AI (genAI) features to Microsoft Office productivity apps, such as Word, Outlook, Teams, and Excel. With capabilities ranging from quick meeting summaries to in-depth data analysis, it’s available via a paid add-on license for Microsoft 365 enterprise and small-business customers.

Initially hampered by underwhelming capabilities and a hefty price tag for businesses of all sizes, M365 Copilot has slowly gained traction in business as its abilities have increased and the integrations between Copilot and various M365 apps and services have improved. With numerous feature rollouts over the past three years, Microsoft has gradually repositioned M365 Copilot from a simple chatbot to a collection of autonomous agents that can carry out tasks across the M365 ecosystem.

The company has also goosed adoption by introducing a more affordable pricing tier for small businesses and (temporarily, as it turns out) allowing commercial users with a standard M365 license to use Copilot in the Office apps, even without the add-on M365 Copilot license.

Microsoft 365 Copilot pricing: 2026 tiers

Microsoft 365 Copilot today

In this way, Microsoft 365 Copilot has moved from genAI curiosity to a key part of many enterprises’ workflows. In January 2026, Microsoft said it had 15 million paid M365 Copilot seats, a figure the company raised to 20 million in April.

However, its momentum now faces a challenge as Microsoft limits access to Copilot Chat, a freemium version of the paid M365 Copilot, for its largest enterprise customers.

Specifically, for commercial customers with more than 2,000 seats, Microsoft has removed in-app Copilot Chat access from Word, Excel, and PowerPoint for users without a Microsoft 365 Copilot license. To maintain that integration, large organizations must now pay for the full $30/user/month M365 Copilot license. The M365 Copilot license includes what Microsoft calls priority access to Copilot capabilities, which provides “faster response times and more consistent availability compared to standard access,” according the the company.

Smaller firms (less than 2,000 seats) that have a Microsoft 365 license but not the add-on M365 Copilot license will maintain standard access to Copilot from within the Office apps. Microsoft warns that standard users may experience longer response times and temporary feature limitations as the service shifts resources to its higher-tier customers during peak hours.

When signed in to the Copilot Chat hub, users can see which version of Copilot they have by looking for one of the following labels at the bottom of the left sidebar:

• Copilot Chat (Basic) means the user doesn’t have an M365 Copilot license and can’t use Copilot in the Office apps. They can use the standalone Copilot Chat app with standard access.
• M365 Copilot (Basic) means the user doesn’t have an M365 Copilot license but does have standard access to Copilot in the Office apps.
• M365 Copilot (Premium) means the user has an M365 Copilot license and has priority access to Copilot in the Office apps.

Users with paid M365 Copilot licenses also get advanced features including the ability to pull in data from across the M365 environment (documents, meetings, emails, chats, etc.), extensive use of agents including “advanced” agents like Researcher and Analyst, and the ability to create custom agents. See Microsoft’s “How Copilot Chat works with and without a Microsoft 365 Copilot license” page for details.

What other Copilots does Microsoft offer?

It’s worth noting that Microsoft uses the term “Copilot” for a wide variety of genAI tools and functions. Individual users with M365 Personal, Family, and Premium subscriptions can use Copilot in Office apps, but with fewer features and privileges than business users get with a Microsoft 365 Copilot license. There’s also a free consumer version of Copilot with very limited functionality.

Adding to the confusion, the company offers several specialized enterprise versions of Copilot for specific purposes, including Microsoft Copilot Studio, Microsoft Security Copilot, Azure Copilot, and GitHub Copilot, as well as additional Copilot “experiences” for Microsoft products such as Dynamics 365, Power Platform, and Microsoft Fabric.

Also available: agents in M365 Copilot built for specific industries, including finance, sales, and service.

From chatbot to multi-model researcher to agentic powerhouse

Microsoft has moved away from a single-model approach for its AI assistant. Copilot Chat has evolved into a Frontier interface, allowing users to select among different LLMs (large language models) such as GPT-5.4 and Anthropic Claude 4 for specialized tasks.

A persistent AI risk for enterprises is overly permissive data access. Because Copilot inherits the permissions of the user, any file that is improperly shared within an organization can be surfaced by the AI. To combat the issue of business-critical files that are at risk due to inappropriate classification, Microsoft has integrated Purview Data Security Posture Management (DSPM) more deeply into Copilot, alerting users when they are generating content from unclassified or sensitive sources.

Other recently introduced M365 Copilot features include:

• Copilot Researcher: This feature allows the assistant to pull from multi-model intelligence, comparing perspectives from different AI models side-by-side to reduce hallucinations.
• Copilot Notebooks: Notebooks allow you to ground the AI in specific project context. These can now be exported directly into structured Excel spreadsheets or PowerPoint decks, bypassing the need for manual copy and pasting.
• Teams Interpreter: Integrated directly into Teams Phone, Interpreter is designed to provide real-time, AI-powered language interpretation during live calls, a boon for global enterprise operations.
• App Builder: A no-code tool that lets business users create apps, workflows, and agents using natural language prompts. It’s essentially a “lite” version of Microsoft’s high-end Copilot Studio environment for developers.
• Agents for Word, Excel, and PowerPoint: Advanced modes that allow Copilot to take direct action on documents and files rather than simply suggest changes.

Even more notable was the June launch of Copilot Cowork, which Microsoft pitches as an AI agent for M365 Copilot that can independently perform long-running, multi-step tasks, even when a user’s computer is turned off. Unlike Anthropic’s Claude Cowork, which can interact directly with files and applications on a user’s computer, Copilot Cowork runs in Microsoft’s cloud environment and acts on documents held in a customer’s Microsoft 365 tenant. Copilot Cowork requires a Microsoft 365 Copilot license and is billed based on usage.

Another announcement that caused a stir was Microsoft’s unveiling of Scout, its first autonomous agent built on the open-source OpenClaw platform. By integrating OpenClaw-style agentic capabilities, Microsoft hopes to transform Copilot into an always-on system that can, for instance, scan Outlook email inboxes and calendars to suggest daily priorities. Microsoft’s implementation addresses security concerns around self-hosted agents by isolating professional-grade “autopilots” within specific roles and applying managed permission guardrails. Scout is available as an “experimental release” to customers of Microsoft’s Frontier program.

Industry analysts note that these tools are new and unproven, and IT leaders should use caution when testing them and evaluating costs.

Managing AI agent sprawl: Enter Agent 365

As organizations move beyond simple chat to building custom declarative agents in Copilot Studio, the risk of shadow AI has become a concern. Gartner reports that 86% of IT leaders require additional governance to manage these agents.

Available as an add-on subscription for Microsoft 365 or bundled in the top-end M365 E7 package, Agent 365 acts as a control plane for the AI ecosystem. Unlike the user-facing Copilot, Agent 365 is a back-end dashboard that allows IT admins to manage agents in various ways:

1. Registry and lifecycle management: View every agent — Microsoft, third-party, or internally developed — in a “single-pane-of-glass” dashboard.
2. Policy-based guardrails: Admins can set global rules to prevent agents from accessing high-sensitivity data (like payroll), even if the human user has permission.
3. Unified ROI analytics: Leaders can track which agents are actually driving value, allowing for precise seat-count adjustments during renewal cycles.
   
   

Microsoft Agent 365 quick facts

Gartner says that Agent 365 is still a work in progress and has yet to prove it can actually reduce costs in IT operations. The analyst firm advises customers to assess Agent 365 but not necessarily move to it or the E7 bundle right away.

Copilot vs. AI in other productivity apps

Most vendors in the productivity and collaboration software market have added genAI and agentic tools to their offerings at this point.

The rivalry between Microsoft and Google has heightened in 2026. While Google has faced criticism for a messy transition from the Google Assistant to Gemini, it remains a price leader by embedding Gemini features directly into most tiers of its office suite, Google Workspace.

In contrast, Microsoft seems to be threading a needle, tightening Copilot Premium licensing for large enterprises while making basic Copilot features available to smaller customers without an add-on license. The goal may be to standardize AI as a commodity while reserving the high-value agentic features for the highest-paying enterprise customers.

While Microsoft focuses on the productivity suite, Salesforce is positioning Slack as the “agentic operating system” for the enterprise. As of April 2026, Slack AI has moved beyond summarizing to orchestrating agentic workflows. This is designed let you trigger complex, multi-step actions across non-Microsoft systems directly from a Slack thread.

Salesforce’s Agentforce platform uses the Atlas Reasoning Engine, which is designed to offer autonomous front-office automation (sales, service, and marketing). For organizations where CRM data is more critical than Word documents, Agentforce is emerging as a formidable, high-ROI alternative to Copilot.

In March 2026, Apple launched Apple Business, a platform designed to integrate Apple Intelligence directly into macOS and iOS. Apple claims its competitive edge is its on-screen awareness. Unlike cloud-heavy competitors, Apple Intelligence is built to act across apps locally, appealing to regulated industries concerned about data leakage.

Apple Business now supports automated Managed Apple Accounts via integration with Microsoft Entra ID, a feature designed to let IT teams manage Apple’s AI features using their Microsoft identity stack.

As Microsoft tightens the reins on free access, the question for enterprise IT leaders is no longer whether Copilot can summarize a meeting, but whether the $30-per-month leap delivers enough agentic automation to justify the cost. For many, the answer will lie in the effectiveness of Agent 365 in bringing order to the burgeoning fleet of AI workers.

This article was originally published in February 2025 and most recently updated in July 2026.

More on Microsoft 365 Copilot:

• How IT leaders unlock productivity with Microsoft 365 Copilot
• Building end-to-end workflows with Microsoft 365 Copilot
• Microsoft Copilot can boost your writing in Word, Outlook, and OneNote — here’s how
• 11 cool things Copilot can do in Excel
• 9 ways Copilot can turbocharge OneNote
• How to curb hallucinations in Copilot (and other genAI tools)

Operational autonomy is quickly becoming one of the defining capabilities of a modern enterprise. As digital estates become more distributed, cloud environments more dynamic and AI consumption more expensive and less predictable, traditional operating models begin to show their limits. Teams can no longer rely only on manual oversight, disconnected monitoring tools or periodic financial reviews to keep enterprise technology healthy and cost efficient. What is needed instead is a coordinated operating framework that brings together CloudOps, FinOps and AIOps, while also addressing the emerging discipline of AI token and model consumption governance. When these disciplines are designed as one connected system rather than as isolated workstreams, organizations move closer to operational excellence: faster decisions, better resilience, improved financial control, stronger compliance and a more measurable connection between technology investments and business outcomes.

What operational autonomy means in enterprise IT

Operational autonomy does not mean removing people from operations. In practice, it means designing enterprise IT so that routine sensing, decision support, remediation, optimization and policy enforcement happen with minimal friction and with the right human oversight at the right moments. A mature autonomous operating model continuously observes infrastructure, applications, data flows, AI services and financial consumption patterns; detects risk or inefficiency early; and triggers guided or automated action based on policy, confidence and business criticality. This approach depends on four connected pillars: CloudOps to maintain reliable and scalable digital infrastructure, FinOps to govern cost and value, AIOps to detect patterns and automate response, and AI consumption governance to manage token usage, model selection, inference workloads and unit economics.

Gartner’s 2024 research on FinOps for data and analytics emphasizes that cloud operations and financial governance are no longer separate concerns, especially as AI workloads reshape cost structures and accountability expectations. Forrester’s 2024 analysis of AIOps and observability similarly notes that modern enterprises need deeper operational visibility and broader insight-driven coordination to handle hybrid complexity. IDC’s 2024 perspective on future operations adds another useful lens by framing data-driven operations around agility, resilience and predictability. Taken together, these viewpoints reinforce the same idea: autonomy is not a tool purchase; it is a management framework.

Design principles for an enterprise operational autonomy framework

A practical framework begins with a few disciplined principles. First, the enterprise must build around a shared operational data layer. Telemetry from cloud infrastructure, applications, service management systems, security controls, business transactions and AI services should be normalized so that operations, finance and governance teams work from the same facts. Second, every automated action should be policy-aware. Cost optimization, scaling, failover, remediation, model routing, data retention and access control should all reflect business guardrails rather than isolated technical rules.

Third, the framework should be value-led rather than purely cost-led. FinOps has matured beyond simply lowering spend; the stronger objective is to align spend with business priorities, performance requirements and acceptable risk. Fourth, autonomy should progress in stages. Enterprises usually start with visibility, then introduce recommendations, then guided automation and finally closed-loop autonomy for low-risk scenarios. Fifth, executive accountability must be explicit. Operational autonomy touches architecture, finance, privacy, security, data stewardship and business strategy. Without a cross-functional ownership model, autonomy becomes fragmented and difficult to govern. Everest Group’s 2024 FinOps Cloud Cost Management assessment highlights the growing demand for role-based access, cost intelligence, governance and automation as core requirements for enterprise cloud cost management products. That is a useful signal that the framework must be built for collaboration, not just analytics.

Integrating CloudOps, FinOps and AIOps into one operating model

CloudOps, FinOps and AIOps are often discussed separately because each emerged from a different operational problem. CloudOps grew out of the need to run cloud estates reliably and at scale. FinOps developed in response to unpredictable consumption-based billing. AIOps emerged because traditional monitoring could not keep pace with the volume and complexity of telemetry generated across modern digital systems. Yet in a mature enterprise, these disciplines converge naturally.

A performance incident in a cloud platform is rarely only an availability problem; it may also drive higher infrastructure consumption, trigger excess logging charges, degrade customer experience or increase token usage in AI-enabled workflows. Similarly, a cost spike may not be a finance issue alone; it may reveal inefficient architecture, poor scheduling, unnecessary data movement or an AI agent behaving outside policy.

An integrated operating model therefore links observability signals, service context, business KPIs, financial metrics and automation rules into one decision fabric. CloudOps provides the runtime discipline, FinOps introduces value and accountability, and AIOps adds pattern recognition and intelligent response. When connected well, the enterprise can answer not only what is happening, but why it is happening, what it is costing, what risk it creates and what the best next action should be.

AI token optimization and AI cost spend governance

AI introduces a new cost curve into enterprise operations. Unlike traditional software costs, token spend can vary sharply based on prompt design, model choice, context length, retrieval patterns, orchestration logic, concurrency, caching strategy and user behavior. This makes AI cost governance an essential part of operational autonomy. A strong framework begins by defining the unit economics of AI consumption: cost per request, cost per conversation, cost per business workflow, cost per user segment and cost per outcome.

Once these baselines are visible, the enterprise can introduce optimization controls such as prompt compression, response-length policies, semantic caching, model tiering, workload routing to lower-cost models where quality tolerance allows, context-window discipline, batch processing for non-real-time use cases and approval thresholds for premium model usage. AI gateways and model brokers can enforce these policies consistently across teams.

Chargeback or showback mechanisms should also extend to AI services so that business units see both value and consumption behavior. Recent analysis in Forbes has drawn attention to the financial risks of unmanaged token growth and argues for governance layers that connect finance and engineering before AI expenditure becomes opaque. FinOps Foundation guidance on FinOps for AI reinforces the same message, noting that token-level metrics, quotas, tagging, GPU allocation practices and real-time monitoring are necessary to keep AI costs aligned to business value. In enterprise settings, the lesson is straightforward: if cloud cost needed FinOps, AI cost needs an even tighter form of FinOps because usage can scale much faster and become far less transparent as mentioned in IDC report.

FinOps for cloud infrastructure cost management

Cloud infrastructure cost management remains one of the foundational layers of operational autonomy because every autonomous workflow eventually rests on compute, storage, networking, platform services and data transfer. An effective FinOps capability does more than flag overspend after the month has ended. It creates near-real-time visibility into consumption, ownership, unit economics, forecast variance, commitments and waste patterns.

The enterprise should define standard practices for tagging, cost allocation, commitment management, rightsizing, idle resource detection, storage tiering, Kubernetes cost visibility, environment lifecycle controls and architecture reviews for high-cost services. More importantly, these practices should be tied to business context. For example, a workload serving a mission-critical customer channel may justify higher spend if it supports revenue protection, whereas a non-production environment should have stricter shutdown and spend caps.

Gartner’s 2024 research on FinOps for data and analytics underscores that AI and data workloads are changing the financial profile of cloud operations and increasing the need for more sophisticated tooling and governance. IDC’s market perspective on intelligent cloud and edge operations with FinOps software also points to the rapid growth of platforms that combine operations intelligence with financial control, suggesting that enterprises increasingly view operational management and cost management as linked disciplines rather than separate layers.

Autonomous operations through AIOps

AIOps gives the framework its intelligence and response speed. In most enterprises, operations data is noisy, fragmented and too voluminous for humans to interpret quickly during incidents or performance degradation. AIOps platforms reduce that burden by correlating events, identifying anomalies, clustering symptoms, surfacing probable root causes and recommending or initiating remediation actions. The best outcomes appear when AIOps is connected not only to infrastructure monitoring but also to service maps, change records, configuration data, incident workflows and business priorities.

That connection allows the enterprise to distinguish between a harmless signal fluctuation and an issue that threatens a critical business service. Forrester’s 2024 research on AIOps and observability explains this well by describing the complementary value of breadth and depth: observability provides richer technical insight, while AIOps helps transform those signals into operational action. In practice, autonomy grows when low-risk responses such as service restarts, resource adjustments, ticket enrichment, dependency checks or rollback decisions are automated under policy. High-risk actions should remain human-approved until confidence improves. Over time, the enterprise can move from reactive incident management to predictive operations, where emerging capacity risk, recurring error patterns or unusual AI workload behavior are addressed before service impact is visible to users.

How the framework leads to operational excellence

Operational excellence is the cumulative result of better decisions made earlier, faster and with clearer accountability. A well-designed autonomy framework improves service reliability because systems are observed continuously and remediation can be triggered before failures spread. It improves cost discipline because consumption anomalies are identified at the same time as performance or usage anomalies, not weeks later in a billing report.

It improves strategic focus because technology leaders can evaluate trade-offs in terms of business value rather than technical activity alone. It also improves employee productivity by removing repetitive operational effort and shifting skilled staff toward engineering improvements, policy tuning and service innovation. The most important outcome, however, is predictability. Enterprises become more confident in how they scale AI services, how they control cloud spend, how they handle operational events and how they meet compliance obligations. That confidence is what separates routine automation from genuine operational autonomy.

Security, governance, process implementation and people upskilling

No autonomy framework survives without strong security and governance. Automated operations amplify both efficiency and risk, which means identity controls, segmentation, least-privilege access, secrets management, encryption and auditability have to be embedded from the start. AI services add further concerns: prompt leakage, data residency, model misuse, training-data exposure, shadow AI adoption and uncontrolled access to external models.

Governance therefore needs to extend across cloud resources, operational workflows, AI services and data assets. Enterprises should establish clear policy domains covering infrastructure provisioning, AI model approval, token limits, vendor usage, observability data handling, retention rules, access reviews and exception management. Process implementation is equally important. The framework should define standard operating patterns for incident triage, automated remediation approval, cost anomaly review, model lifecycle management and post-incident learning. None of this works unless people are prepared for the shift.

Operations teams need skills in cloud economics, observability, automation engineering and policy-driven operations. Finance teams need to understand cloud and AI consumption models. Security and privacy teams need fluency in AI risk scenarios and control design. Business leaders need a clearer grasp of unit economics and value realization. IDC’s 2024 briefing on enterprise AI strategy highlights the tension between rapid AI investment, ROI pressure, staffing constraints, security and compliance. That is exactly why upskilling must be treated as part of the framework itself, not as an optional change-management activity as per FinOps Foundation documentation.

The role of regulatory compliance

Regulatory compliance is not a side topic in operational autonomy; it is one of the main reasons the framework must be formalized. Cloud environments frequently span jurisdictions, AI systems process sensitive information, observability platforms collect detailed operational data and automated decisions may influence customer experience or internal controls. Regulations such as GDPR, DPDP, sector-specific cybersecurity directives, financial reporting obligations, contractual data-handling requirements and internal audit standards all shape what autonomy can and cannot do.

Compliance requirements should therefore be translated into operational policy. Examples include residency-aware workload placement, data minimization in logs and prompts, access segregation for financial and regulated data, explainable automated actions, evidence retention, periodic control attestations and approval workflows for AI usage involving personal or confidential information. Chief privacy and data leaders play a central role here because the compliance question is no longer just where data is stored, but also how data is observed, transformed and consumed by AI-driven services. A mature framework reduces compliance risk by making control enforcement systematic rather than dependent on manual effort.

How to implement the framework in practice

Implementation is usually most successful when handled in phases. The first phase is baseline visibility: consolidate telemetry, cloud billing data, service inventory, AI usage data and business ownership into one operational picture. The second phase is governance design: define policies for tagging, spend thresholds, automation boundaries, access controls, model usage and compliance checkpoints.

The third phase is prioritization: choose a small number of use cases where autonomy can produce measurable value, such as cloud rightsizing, incident correlation, cost anomaly detection, AI token governance or automated remediation for recurring low-risk faults. The fourth phase is automation with guardrails: deploy workflows, approval rules and rollback paths. The fifth phase is optimization and learning: review outcomes, refine policies, update unit economics, expand autonomy coverage and measure business impact.

This staged approach matters because full autonomy is not achieved by switching on one platform. It is built progressively through trusted control, good data and disciplined execution.

Useful tools for building the framework

The tool landscape should be chosen based on architecture, governance maturity and operating model rather than vendor popularity alone. Cloud-native cost and operations tools from hyperscalers provide baseline visibility, but many enterprises supplement them with specialized FinOps platforms for allocation, forecasting, commitment analysis and chargeback. Observability platforms help unify metrics, logs, traces and service maps, while AIOps platforms add anomaly detection, event correlation and automation orchestration.

Service management platforms remain important for change control, incident workflows and audit evidence. AI gateways and model management layers are increasingly useful for token monitoring, policy enforcement, prompt controls, model routing and usage analytics. Security posture management, DSPM, identity governance and compliance automation tools also become part of the architecture because autonomy without trust quickly becomes fragile. The most effective toolchains are the ones that integrate technical telemetry, financial signals, governance policy and workflow automation into a coherent operating system for the enterprise.

Executive roles in developing and managing the framework

Here is a table that summarizes various Executive Roles and their responsibilities in Operational Autonomy governance.

Conclusion

Developing operational autonomy for an enterprise is not about chasing a futuristic ideal. It is about building a disciplined and connected operating model that helps the organization run technology with greater confidence, speed and accountability. CloudOps keeps the estate reliable, FinOps ensures that spending reflects value, AIOps makes complexity manageable and AI cost governance brings much-needed control to token-driven consumption. Security, privacy, compliance, process rigor and people capability are what make the framework sustainable. When all of these parts work together, the enterprise does not just automate tasks; it strengthens resilience, improves financial stewardship and creates a more adaptive path to operational excellence.

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Detection engineering, which was once a niche practice among mostly large companies, appears to have evolved into a capability that organizations across industries now consider essential to their security operations.

What is detection engineering?

Detection engineering is about creating and implementing systems to identify potential security threats within an organization’s specific technology environment without drowning in false alarms. It’s about writing smart rules that can tell when something potentially suspicious or malicious is happening in an organization’s networks or systems and making sure those alerts are useful. The process typically involves threat modeling, understanding attacker TTPs, writing, testing and validating detection rules, and adapting detections based on new threats and attack techniques.

A small survey of 264 cybersecurity professionals by the SANS Institute and Anvilogic found that 80% of organizations — and 85% of large enterprises — are actively investing in detection engineering, with 60% now having dedicated teams. More than two-thirds (67%) reported strong leadership support for the practice within their organization.

The survey’s data suggested that many companies have not just merely adopted detection engineering practices but have made it a strategic focus of their cyber risk mitigation effort.  “Just a decade ago, detection engineering was a relatively unknown role in cybersecurity,” the report stated. “Now, it is emerging as one of the most critical roles in security operations.”

More than the usual threat detection practices

Proponents argue that detection engineering differs from traditional threat detection practices in approach, methodology, and integration with the development lifecycle. Threat detection processes are typically more reactive and rely on pre-built rules and signatures from vendors that offer limited customization for the organizations using them. In contrast, detection engineering applies software development principles to create and maintain custom detection logic for an organization’s specific environment and threat landscape. Rather than relying on static, generic rules and known IOCs, the goal with detection engineering is to develop tailored mechanisms for detecting threats as they would actually manifest in an organization’s specific environment.

Often this involves a stronger emphasis on behavior-based detections, the integration of threat intelligence to create detections aligned with real-world adversary tactics and the use of threat modeling to anticipate potential attack paths, says Heath Renfrow, CISO and co-founder of Fenix24 a cyber disaster recovery firm. “Unlike conventional threat detection, which often relies on static signatures and pre-built rules, detection engineering is behavior-driven, context-aware, and tailored to an organization’s unique threat landscape,” Renfrow says. “It involves a blend of security operations, threat intelligence, and data science to build more adaptive and resilient detection capabilities.”

The SANS-Anvilogic report describes detection engineering practices as evolving over the years from being over-reliant on vendor-specific consoles and proprietary languages to incorporate software development life cycle (SDLC) and continuous integration/continuous deployment (CI/CD) principles. This is enabling teams to test, deploy, and refine detections more efficiently while maintaining auditable trails of changes.

Drivers of detection engineering’s adoption

There are a couple of factors driving adoption of detection engineering practices. The biggest is the fact that out-of-the-box detections aren’t good enough. They don’t baseline the environment, they don’t drive down false positives and, troublingly, they don’t always alert on the things that matter, says Johnathon Miller, vice president of security operations at Lumifi Cyber.

Generic alerts that don’t account for organizational context have become a major problem and a contributor to false positive fatigue within many security teams. Sixty-four percent of organizations in Anvilogic’s survey for instance, reported high false positive rates; 61% struggled with detections that lacked environmental accuracy; and 34% said they had encountered delays in updates and improvements.

“Traditional threat detection methods historically have been static; if a=a, create an alert,” says Kevin Gonzalez, VP of security, operations and data, Anvilogic. “They are often rigid, black-box mechanisms that lack flexibility in customization. Though useful to some extent, these approaches become unmanageable at scale especially in organizations with hybrid environments,” he says.

Growing threat volumes and sophistication are another issue. Attackers are using more advanced and evasive techniques — including fileless malware, living off the land approaches, zero-day exploits and attacks via the software supply chain — rendering signature-based detection largely insufficient. Rising cloud adoption has introduced new vulnerabilities as well and created blind spots that legacy detection methods often struggle to cover. 

The rise in advanced persistent threats (APTs), supply chain attacks, and ransomware operations has made traditional reactive approaches insufficient, Renfrow says. “Organizations now realize that proactive detection engineering reduces dwell time, improves response capabilities, and enhances overall cyber resilience. Additionally, compliance frameworks and cyber insurance providers are increasingly emphasizing strong detection strategies.”

Industries adopting detection engineering

Organizations in the banking and finance sector, the technology industry, cybersecurity companies and, to a lesser extent, healthcare companies are among the leading adopters of detection engineering practices. Many are in sectors that must deal with regulatory scrutiny or are frequent targets of sophisticated threat actors. But the reality is that most organizations, especially larger ones, can benefit from implementing a systematic approach to developing detection mechanisms for their specific threat profile.

Any large enterprise with a complex IT infrastructure can benefit from detection engineering. Security operations centers (SOCs) need to continuously improve and maximize their detection posture. “Along with the evolving threat landscape, their own internal IT infrastructures are constantly changing, which can result in detection ‘drift,’ where detection rules are broken and will no longer fire or alert,” CardinalOps CEO Michael Mumcuoglu says.

Security experts point out some key requirements for setting up a detection engineering capability. The biggest among them is data. To succeed, detection engineering teams need access to logs and security event data from endpoints, networks, cloud environments, and security tools and a centralized SIEM or log management platform to aggregate and normalize the security data. An effective detection engineering capability also means having skilled personnel including detection engineers, analysts, and threat researchers, to develop and refine detection rules. Also important are formal processes for threat modeling, testing and integrating threat intelligence with incident response.

The goal should be to move beyond static signatures and focus on how attackers operate, by prioritizing behavior-based threat detection. Use frameworks like MITRE ATT&CK to map detection coverage against known adversary techniques and utilize adversary emulation tools like Atomic Red Team to validate effectiveness, Renfrow says. “Detection engineering works best when security operations, threat intelligence, and IT teams work together,” Renfrow notes.

How AI and automation can help

AI/ML can play a key role in rule tuning and automation as well. Some 45% of the survey respondents described their organizations as using AI in their detection engineering programs for purposes like anomaly detection, rule generation and alert triage. Nearly nine in 10 (88%) believed AI would have a big impact on their detection engineering programs in the next three years. “One of [AI’s] strongest use cases is analyzing vast amounts of data to identify anomalies, particularly when utilizing a custom-trained language model,” says Glenn Thorpe, senior director of security research and detection engineering at GreyNoise Intelligence. “Depending on an organization’s threat model and risk tolerance, employing AI with a well-trained LLM can significantly enhance the effectiveness and efficiency of defenders within the organization.”

AI is not the only change. More organizations are also adopting automated processes for detection engineering. The areas that organizations are automating include mapping detection coverage to the MITRE ATT&CK framework, identifying broken or misconfigured detections, and being able to operationalize threat intelligence and convert it into actionable detection rules, Mumcuoglu says. Ninety-three percent of Anvilogic’s survey respondents reported they are currently using or plan to use automation in their detection engineering workflow for rules development, tuning existing detections and threat hunting.

Thorpe cautions against organizations looking for some kind of one-size-fits-all approach to standing up a detection engineering capability. “Instead, a creative mindset, diversity of thoughts and experiences, and curiosity are vital for building an effective team.”

A good place to start is by identifying your organization’s core data and finding individuals who can analyze that data from multiple perspectives. Develop a realistic understanding of what you don’t know and begin to address those information gaps. “You might discover that small changes can significantly improve your visibility and understanding of network traffic,” Thorpe notes.

Foto: Geka – shutterstock.com

Um Software abzusichern, muss man wissen, was in ihrem Code steckt. Aus diesem Grund ist eine Software Bill of Material, SBOM oder Software-Stückliste heute unerlässlich. Der SolarWinds-Angriff sowie die Log4j-Schwachstelle haben verdeutlicht, wie wichtig es ist, die Sicherheit von Softwarelieferketten in den Fokus zu nehmen – insbesondere, wenn es um Open Source Software geht. Einer Umfrage (PDF) des Open-Source-Unternehmens Tidelift zufolge enthalten heute 92 Prozent aller Anwendungen Open-Source-Komponenten. Eine durchschnittliche, moderne Applikation besteht demnach sogar zu 70 Prozent aus quelloffener Software.

Die Antwort auf die potenziellen Risiken sind – wenn es nach der Linux Foundation, der Open Source Security Foundation und OpenChain geht – SBOMs: Formale und maschinenlesbare Metadaten, die ein Softwarepaket und seinen Inhalt eindeutig identifizieren. Die Software-Stücklisten können auch andere Informationen enthalten, etwa Copyright- oder Lizenzdaten. Dabei ist eine Software Bill of Material so konzipiert, dass sie organisationsübergreifend ausgetauscht werden kann. Besonders hilfreich ist eine SBOM, um die Transparenz über die von den Teilnehmern einer Softwarelieferkette gelieferten Komponenten zu gewährleisten.

SBOM – Best Practices

Eine SBOM sollte beinhalten:

• die Open-Source-Bibliotheken der Anwendung;

• Plugins, Erweiterungen und andere Zusatzmodule;

• von In-House-Entwicklern selbst geschriebenen Quellcode;

• Informationen über die Versionen dieser Komponenten, ihren Lizenzierungs- und Patch-Status;

• automatische kryptografische Signatur und Überprüfung von Komponenten;

• automatische Scans, um SBOMs als Teil der CI/CD-Pipeline zu erstellen.

Dabei sollte eine Software Bill of Material ein einheitliches Format verwenden. Zu den gängigen SBOM-Formaten gehören:

• Software Package Data Exchange (SPDX),

• Software Identification (SWID) Tagging und

• OWASP CycloneDX.

Bislang hat sich keiner der drei Standards von den anderen abgesetzt und einen De-facto-Industriestandard geschaffen. Um SBOMs praktikabel zu machen, sollte die SBOM-Erstellung nicht nur automatisiert, sondern in die CI/CD-Pipeline integriert werden. Oder wie die National Telecommunications and Information Administration (NTIA) es ausdrückt (PDF): “Das ultimative Ziel ist es, SBOMs in Maschinengeschwindigkeit zu generieren.”

Software Bill of Materials – Use Cases

Auch bei SBOMs gibt es drei verschiedene Anwendungsfälle. Im Allgemeinen sind das:

1. Softwarehersteller verwenden SBOMs, um Erstellung und Wartung der von ihnen gelieferten Software zu unterstützen.

2. Softwareeinkäufer nutzen SBOMs, um sich vor dem Kauf abzusichern, Rabatte auszuhandeln und Implementierungsstrategien aufzusetzen.

3. Softwarebetreiber nutzen SBOMs für das Vulnerability- und Asset-Management, um Lizenzen und Compliance zu managen und Abhängigkeiten und Risiken in Sachen Software und Komponenten schnell zu identifizieren.

Empfehlenswerte SBOM-Tools

Bei drei verschiedenen SBOM-Formaten und einer Vielzahl von Metadaten, die innerhalb einer Software Bill of Material verfolgt werden können, ist es nicht verwunderlich, dass es kein SBOM-Tool gibt, das sämtliche Bedürfnisse erfüllt. Gartner empfiehlt, Tools zu verwenden, die folgende Funktionen mitbringen:

• SBOMs während des Build-Prozesses erstellen;

• Quellcode und Binärdateien (wie Container-Images) analysieren;

• SBOMs bearbeiten;

• SBOMs in lesbaren Formaten anzeigen, vergleichen, importieren und validieren;

• SBOM-Inhalte von einem Format oder Dateityp in andere übersetzen, beziehungsweise die Informationen zusammenführen;

• Einbindung anderer Tools über APIs und Bibliotheken;

Keines der folgenden acht Tools erfüllt (bislang) all diese Empfehlungen. Wir empfehlen Ihnen, die Tools auszuprobieren und anschließend zu ermitteln, welches für Ihre Zwecke am besten geeignet ist. Diese acht SBOM-Tools verdienen Ihre Aufmerksamkeit:

Anchore

Das Unternehmen ist bereits seit sechs Jahren im SBOM-Business tätig. Die Grundlage des Unternehmens bilden zwei Open-Source-Projekte:

• Syft ist ein Tool mit Kommandozeilen-Interface und eine Bibliothek, um SBOMs aus Container-Images und Dateisystemen zu erzeugen.

• Grype ist ein einfach zu integrierendes Tool, um Container-Images und Dateisysteme auf Schwachstellen zu scannen.

Zusammen können diese beiden Werkzeuge Software-Stücklisten in jeder Phase des Entwicklungsprozesses erzeugen, von Quellcode-Repositories und CI/CD-Pipelines bis hin zu Container-Registries und Laufzeiten. Diese SBOMs werden in einem zentralen Repository aufbewahrt, um vollständige Transparenz und kontinuierliches Monitoring zu gewährleisten – auch nach der Bereitstellung. Die Tools von Anchore unterstützen CycloneDX, SPDX und das proprietäre SBOM-Format von Syft. Das Anbieterunternehmen bündelt seine SBOM-Funktionalität in der Plattform Anchore Enterprise 4.0 Software SCM (Supply Chain Management).

FOSSA

Die Flaggschiff-Programme von FOSSA sind ein Open Source License Compliance Manager und ein Open Source Vulnerability Scanner. Der Ansatz von FOSSA sieht vor, dass Sie das SBOM-Tool in Ihr bevorzugtes Versionskontrollsystem wie GitHub, BitBucket oder GitLab integrieren. Sie können auch die CLI von FOSSA verwenden und das Tool lokal ausführen oder es in Ihre CI/CD-Pipeline integrieren.

In jedem Fall identifiziert FOSSA im Rahmen eines Projektscans automatisch sowohl direkte als auch indirekte Abhängigkeiten in der Codebasis.

GitLab (ehemals Rezilion)

Beim DevSecOps-Anbieter ist SBOM Teil seiner ganzheitlichen Software-Sicherheits- und Schwachstellen-Systeme. Dynamic SBOM verwendet eine dynamische Laufzeitanalyse, um die Angriffsfläche Ihrer Software zu monitoren. Es sucht also ständig nach bekannten Schwachstellen in den Komponenten. Neben der Bereitstellung eines Live-Inventars aller Softwarekomponenten in Ihren CI/CD-, Staging- und Produktionsumgebungen wird Ihre SBOM ständig aktualisiert. Sie können Ihre Software Bill of Material im CycloneDX-Format und als Excel-Tabelle exportieren.

Nach der Übernahme durch GitLab wurden die SBOM-Funktionalitäten von Rezilion im Jahr 2022 in die DevSecOps-Plattform integriert.

Mend

Früher unter dem Namen WhiteSource bekannt, bietet Mend eine Vielzahl von SCA-Tools (Software Composition Analysis) an. Eine SBOM-Funktionalität ist in das SCA-Toolset integriert. Die Lösung von Mend ist weniger ein Entwicklerprogramm oder ein CI/CD-Tool – sondern vielmehr ein Open-Source-Lizenz- und Sicherheitsmechanismus für Programmierer.

Mit Hilfe von Mend lassen sich sämtliche Softwarekomponenten tracken, direkte und indirekte Abhängigkeiten identifizieren, Schwachstellen aufdecken, Remediationspfade bereitstellen und automatisch SBOM-Einträge aktualisieren.

SPDX SBOM Generator

Dieses eigenständige Open-Source-Tool tut das, was sein Name verspricht: SPDX-SBOMs aus aktuellen Paketmanagern oder Build-Systemen erstellen. Sie können seine CLI verwenden, um SBOM-Daten aus Ihrem Code zu erzeugen. Das Tool erzeugt Berichte über Komponenten, Lizenzen, Copyrights und Sicherheitsreferenzen Ihres Codes. Diese Daten werden in der SPDX v2.2-Spezifikation exportiert.

Start Left Security

Dieses SBOM-Tool wird als Software-as-a-Service (SaaS) angeboten. Auf der Grundlage einer patentierten, anwendungszentrierten Integrationsmethodik kombiniert das ehemals unter dem Namen TauruSeer bekannte Angebot seine Cognition-Engine-Sicherheitsüberprüfung mit SBOM. Das Paket hilft Ihnen, Ihren Code für Ihre Entwickler und Kunden abzusichern und zu tracken.

Tern Project

Dieses quelloffene SBOM-Projekt lässt sich gut mit SPDX SBOM Generator kombinieren. Anstatt mit Paketmanagern oder Build-Systemen zu arbeiten, erzeugt dieses SCA-Tool und die Python-Bibliothek eine SBOM für Container-Images und Docker-Dateien. Darüber hinaus lassen sich auch SBOMs im SPDX-Format erzeugen.

Vigilant Ops

Dieser Cybersicherheitsanbieter aus dem Healthcare-Bereich konzentriert sich mit seiner InSight-Plattform auf Software-Stücklisten. Seine SaaS-Plattform generiert und pflegt zertifizierte SBOMs und sorgt für deren authentifizierten Austausch. Sie bietet Sicherheit durch kontinuierliche Schwachstellenüberwachung. Die SBOM-Zertifizierung verwendet patentierte Algorithmen, um sicherzustellen, dass alle Komponenten validiert und Schwachstellen verlinkt sind.

Die Sicherheitsfunktionen können auch für SBOMs verwendet werden, die von anderen Programmen erstellt wurden. Diese werden sowohl im Ruhezustand als auch während der Übertragung verschlüsselt.

Dieser Artikel ist im Original bei unserer Schwesterpublikation CSOonline.com erschienen.

Whether you are using an AI code generator, vibe coding, or applying spec-driven development methodologies, your job doesn’t end with AI writing the code. Whether you’re using AI to develop applications, APIs, data pipelines, AI agents, or other automations, writing the code is just one part of the job. Developers must still perform code validation, test applications, automate deployment, and configure infrastructure.

According to one survey, only 16% of a developer’s time is spent writing code. The remaining 84% is spent on other activities including defining requirements, triaging bugs, and addressing vulnerabilities.

Additionally, while AI code generation speeds up development, it can come at the cost of quality and collaboration. In Atlassian’s State of Teams 2026 survey, nearly 50% of respondents say their AI outputs aren’t reliably high quality and admit that using AI is a compromise between speed and quality. Knowledge workers say the pressure to execute is also problematic, with 87% saying they lack time to coordinate and 70% saying their processes aren’t well-optimized for AI.

So, although AI capabilities have changed drastically in the past few years, code-generation tools are not the only ways AI can improve software development. In fact, developers should seek additional AI capabilities to support the full software development life cycle (SDLC). Here are five recommendations for the AI coding stack. 

Scale up testing environments

If coding is faster, development teams should have suitably configured environments that they can use to quickly and easily test changes against real APIs and databases. Testing apps and AI agents against environments that don’t mimic production can slow down development.

“Remote + local” development environments (local execution with remote context) are one option to accelerate testing. Developers can code locally on their own physical or virtual machine, but build and deploy to remote instances. Additionally, when developing AI agents, developers need an execution environment, such as secure sandboxes or ephemeral virtual machines.

“GenAI has been a step-change for developer productivity, absorbing the repetitive work of writing boilerplate, tests, and refactors so engineers can focus on intent and design,” says Aviram Hassan, CEO and cofounder at MetalBear. “But by compressing the time it takes to produce all of this, genAI has also exposed what’s always been the real bottleneck in the SDLC: the feedback loop against the real world. Validating code and configurations against a realistic cloud environment still depends on the same slow build-and-deploy cycles teams have tolerated for years.”

The goal should be to remove the friction and delays from where developers code to a complete, real-world infrastructure they can use to validate changes. Three tools to review are mirrord, Signadot, and Telepresence.

Validate the AI-generated code

At a recent Coffee With Digital Trailblazers LinkedIn Live event that I hosted on AI coding competencies, one speaker shared how he quickly went from a short spec to more than 10,000 lines of AI-generated code. He admitted he didn’t have the time, expertise, or tools to validate the code. He’s not alone. In Sonar’s State of Code Developer Survey, 96% of developers don’t fully trust AI’s output, but only 48% always verify it before committing.

“Agentic software development is generating code faster than any team can manually review it, but speed without confidence only results in technical debt,” says Scott Sanders, corporate vice president of engineering at Sonar. “What’s needed to avoid this is an automated independent verification layer embedded directly into the development workflow—one that unifies code quality and code security into a single, deterministic platform to deliver actionable intelligence before code ever reaches the repository.”

A big concern is that AI-generated code can produce 1.4 times as many critical issues as code created by developers, according to CodeRabbit’s State of AI Versus Human Code Generation Report. Top issues include code readability, cross-site scripting, code formatting errors, and incorrect concurrency control.

Another challenge is that 82.4% of AI tools originate from third-party packages, according to Snyk’s 2026 State of Agentic AI Adoption. The implication is that development teams have much more code to validate than they develop themselves, whether by humans or AI code generators.

“When tools like Cursor are installing dependencies and running actions on a developer’s behalf, they can unintentionally pull in malicious or unvetted packages,” says Randall Degges, vice president of AI engineering and developer relations at Snyk. “That’s why techniques like intercepting tool calls, validating inputs and outputs, enforcing least-privilege access, and isolating credentials are becoming foundational to how AI-driven development systems operate. Without security embedded directly into the agent loop, teams risk shipping faster into more exposure, not less.”

According to Qodo’s report on The AI Coding Paradox, 89% of enterprise engineering teams have experienced an AI-generated code incident and have had a production outage caused by AI-generated code. Development teams building a large portfolio of AI agents or heavily relying on AI code-generation capabilities may want to look at AI code-review tools that provide more contextual analysis than basic static code review tools.

“Current AI coding assistants suffer from a severe amnesia problem, and each session starts without memory of an organization’s unique context, subjective standards, and business logic,” says Itamar Friedman, CEO and cofounder at Qodo. “To safely scale AI, it requires integrating stateful systems equipped with persistent organizational memory that continuously learn from past pull requests and automatically enforce enterprise-specific governance. Ultimately, developers need tools that ensure code is guided by continuously learning organizational experience rather than just raw machine-generated code.”

Tools to review include static application security testing (SAST), software composition analysis (SCA), software bill of materials (SBOM), and AI code review tools.

Security and end-to-end testing

Even when AI-generated code passes all the tests, how can devops teams validate whether it meets business and non-functional technical requirements? Many devops teams have invested in continuous testing, and some support continuous deployment, but the underlying assumptions behind those practices are being challenged now by who is coding and how much code is being generated. 

Some spec-driven development platforms aim to bridge the gap. Tools like Appian Composer and SAP Joule Studio 2.0 generate product requirements documents (PRDs) before coding, enabling the introduction of business acceptance criteria. These tools create knowledge graphs from the business processes implemented on their platforms and provide environments for validating AI agents before deployment.

“For most organizations, the AI code-generation methodology question matters less than the verification question,” says Gal Vered, CEO and cofounder at Checksum.ai.  “Whether your team is prompting from intent or working from specs, AI-generated code still needs to be validated against a production environment before it ships.”

Beyond functional testing, developers must look at new security concerns, especially as AI agents integrate with Model Context Protocol servers. “Most teams are stacking generation tools on top of review tools and on top of testing tools, but without security validation embedded at every stage, you’re just automating the path to your next breach,” says Harshit Agarwal, CEO at Appknox. “Mature teams treat security feedback as a non-negotiable part of the build loop, running automated checks continuously rather than catching issues after the fact.”

Add observability tools

Developers save an average of 3.6 hours per week with AI coding tools, according to one report, and the more experienced engineers achieve the largest productivity gains.

What’s one way to blow these savings? When defects get pushed to production, it’s often the site reliability engineers and senior developers who are left to triage and resolve the issue. Establishing observability practices as a devops non-negotiable is a development investment that pays off significantly to help diagnose issues, resolve errors, and improve performance.

“In data and AI systems, even small changes like model updates, tool decisions, or shifts in data flow can silently cascade into issues no one anticipated, and the AI agent has no way to know that,” says Barr Moses, cofounder and CEO at Monte Carlo. “Leading teams are addressing this by embedding observability across the entire agentic stack, particularly at precommit checkpoints, so agents can surface the true impact of changes before they go live.”

While many devops teams have mature observability practices for APIs, applications, and data integrations, observability practices for AI agents are relatively new. One technique to consider is AI tracing platforms with notation queues for human review and LLM-as-judge evals. A second option is to implement an AI gateway with observability, caching, routing, and cost-tracking capabilities.

Develop reusable agent skills

One last element of the AI stack, especially for organizations heavily investing in AI agent development, is to adopt best practices for developing reusable skills embedded in code-generating tools.

“A key emerging pattern is purpose-built AI skills: reusable, scoped instructions that give agents deep context for specific tasks, rather than relying on general-purpose prompting alongside antagonist agents that challenge other agents’ outputs,” says Phillip Goericke, CTO of NMI. “The defining shift is that developers are no longer writing code with AI assistance—they’re architecting the systems that produce and validate it.”

Development organizations that leverage code-generation tools are recognizing that coding is just one part of delivering business value from AI and resilient AI agents. Developing AI skills and establishing an AI stack are steps toward scaling to a dependable AI software development life cycle.

With headquarters in Johannesburg, South Africa, Absa also operates in many other African countries, with international offices in Europe and the US. Running an organization across several markets has its unique complexities, especially in the integration layer, because each region has its own systems, business processes, regulatory requirements and data standards.

For Absa, replacing an integration layer that had reached breaking point was a fundamental shift in its banking philosophy. It wasn’t just a technical project. Duplication was rampant, complexity was baked in, and reusability was non-existent. Every change had far-reaching ripple effects, and each new channel had to be built from scratch. As it stood, making the improvements the business demanded at the speed required to remain competitive was impossible.

According to Tamu Dutuma, Absa’s head of technology strategy for Africa Regions, this integration layer had been in place for close to a decade. While it played an important role in enabling business in the past, it was too difficult to maintain and no longer aligned to current standards and ways of working.

Integration standardization

Absa evaluated a range of available solutions in the market, but given the complexity of integrating with legacy systems across a multi-country financial environment, the team decided a more tailored approach was required.

“It was critical to establish the right architecture from the outset, which is why we worked with a strategic partner to build a solution that could better meet our specific integration needs, while also creating a stronger foundation for future scalability,” says Dutuma.

Balancing the long-term benefits of standardization against the immediate complexity of making the shift meant taking time to understand the upstream and downstream impact. The team had to be realistic about how they would standardize banking services, systems, and integrations while keeping disruption to a minimum.

As part of this process, Absa aligned with globally recognized standards, including BIAN, which provides a common framework for designing and integrating banking systems. The goal is to give banks a blueprint to successfully modernize complicated legacy architectures by defining standardized business capabilities, service domains, APIs, and data models.

The new integration layer provided three critical things for the business: decoupling and abstraction, standardization, and strategic orchestration. This meant separating customer-facing channels from core banking and backend services, using BIAN frameworks to enforce strict governance, and orchestrating only where necessary to keep the architecture lean.

Choosing the right implementation strategy

With this plan in mind, the bank needed to decide how to execute it. “We took a phased approach to the rollout, starting with a specific use case, our chatbot Chat Banking in our Africa Regions business,” says Dutuma. “This allowed us to build and test the new integration layer in a controlled, practical way. From there, we introduced an architecture principle that all new initiatives would integrate through this platform, while only time-critical projects continued to rely on the legacy environment.” The goal was to set a North Star project, which allowed them to quickly demonstrate value.

But this wasn’t a copy-paste exercise, and everything didn’t fit perfectly from the start. The bank admits that managing legacy outliers remains one of the biggest challenges on this modernization journey. Data mapping was another challenge. To ensure data moved correctly and quickly from one system to another, Absa had to build a data mapping framework to automate parts of the process.

As the project progressed and the team ironed out these kinks, they gradually migrated existing services to the new layer. “This wasn’t a like-for-like replacement,” he says. “We were also simplifying and standardizing the architecture, which required careful mapping, redesign, and end-to-end testing across both channels and core systems.”

Banking on the future

For Dutuma, this multi-year journey has allowed Absa to incrementally modernize the environment while continuing to support ongoing business delivery. And the project has delivered several strategic wins, from a drastic reduction in time-to-market to an equally dramatic reduction in costs. Standardization also opened additional opportunities for innovation across the business. For example, using a standardized API catalog enables plug-and-play integration capabilities, which means developers aren’t reinventing the wheel for every project. Where there used to be 20 disparate payment services, for instance, because everything is standardized, there are now four, which markedly reduces maintenance costs.

 “This also provides a stronger foundation for Absa Group’s open banking initiatives, enabling selected services to be securely exposed for integration with FinTech partners and other ecosystem players,” he says. Plus, integrating new channels has become more straightforward, as teams can now leverage consistent, reusable integration patterns. This makes it easier to scale digital capabilities and accelerate delivering new customer-facing solutions.

This project, according to Dutuma, wasn’t just about fixing the old tech, but enabling cloud readiness and creating a leaner, modular application stack that can be used across other markets. Now, Absa doesn’t need to build a unique integration for a wallet in Botswana or for internet banking in Tanzania. There’s a common middleware layer across all regions, allowing countries to independently replace or upgrade core applications without affecting the broader regional footprint. In this way, Absa has essentially dissociated geography from technology to reduce complexity, improve interoperability, and ensure that different systems all speak the same language.

The end of pure specialization

For years, software organizations optimized around specialization. Product managers owned requirements. Engineers owned implementation. Designers owned UX. QA owned quality. The model worked – until product velocity became a competitive advantage measured in weeks instead of quarters.

Today, AI is accelerating another shift that I believe will fundamentally reshape how high-performing technology teams operate: the rise of the product engineer.

As Chief Technology Officer of akirolabs, an AI-augmented strategic procurement platform serving enterprise-scale clients, including Fortune 500 organizations, I’ve spent the last several years evolving our engineering model through three distinct stages. First, I dismantled highly specialized silos. Then I transitioned the organization toward more flexible generalists. Eventually, our operating model revealed that the teams performing best in the AI era were neither traditional specialists nor pure generalists, but engineers deeply embedded in product thinking and business context. I formalized and operationalized this role internally as a product engineer model, adapting an increasingly common industry pattern to enterprise AI delivery.

This role does not replace product managers. Instead, this operating model elevates strong product managers by removing operational friction. In our organization, product managers became more focused on customers, roadmap prioritization, requirement validation and strategic direction. With the help of AI-assisted prototyping and vibe-coding tools, they also became more technical, capable of creating early concepts and functional drafts before engineering implementation even began.

At the same time, engineers developed a much deeper understanding of the product domain, customer workflows and business priorities. Instead of waiting for every edge-case clarification or micro-decision from product leadership, they became capable of making many product-level decisions independently within clearly defined boundaries.

I translated this operating model into three repeatable principles, which I structured as a corporate playbook:

• Product context ownership. Engineers are expected to deeply understand customer workflows and business goals, not just technical tasks.
• Distributed decision-making. Teams are empowered to make smaller product and implementation decisions without escalating everything upward.
• AI-native execution. Engineers use AI tools not as assistants for isolated coding tasks, but as integrated collaborators throughout delivery cycles.

That combination fundamentally changed how our teams operated.

What the product engineer changes

The operational impact became visible relatively quickly.

Internal operating metrics collected across engineering delivery cycles indicate that development velocity improved by approximately 15-25% after the operating model was introduced. Refinement meetings became shorter and less frequent because engineers already understood the “why” behind features, not just the technical requirements. The release timelines decreased by at least 10-15% for the same scopes. Measurements were conducted across release cycles over a period of 12 months and included delivery speed, refinement time and production defects.

The gains became even more noticeable once AI development tools entered daily workflows. Product engineers are often particularly well positioned to work effectively with AI coding systems because they understand both technical implementation and product intent. They can formulate better prompts, decompose problems correctly and validate AI-generated outputs without requiring multiple translation layers between product and engineering teams. After integrating the product engineer operating model with modern AI tooling, our engineering organization recorded reductions of up to 35-45% in selected development and iteration cycles, reducing feature delivery cycle times from months to weeks.

While the effects cannot be isolated with scientific precision, internal measurements consistently indicated improvements after both organizational and tooling changes.

But the most important change was not speed. It was ownership. Traditional engineering structures often unintentionally discourage responsibility. Engineers become ticket executors instead of product contributors. Every ambiguous decision escalates upward to leadership, creating organizational bottlenecks that slow down execution and drain management capacity.

The product engineer model distributes decision-making more effectively. Many small- and medium-sized product decisions that previously required involvement from the executive suite can now be handled directly by engineers with strong domain understanding. This significantly reduces leadership overhead while increasing team autonomy.

At the same time, communication overhead decreases across the organization. Fewer refinement meetings are needed. Teams spend less time waiting for clarifications or approvals. The “bus factor” also improves significantly because more engineers can contribute across multiple parts of the product instead of relying on isolated domain experts. For agile enterprise platforms operating at our scale, this becomes especially important during vacations, employee transitions or periods of rapid growth.

While architecting this operating model, I also observed a profound shift in quality control. Engineers with real ownership become substantially more engaged in product quality and business outcomes. During the first six months following implementation, the number of production bugs decreased by roughly 25% while engineering engagement and initiative noticeably increased over time. Escaped defects declined further as teams began treating early issue prevention as a measurable engineering objective.

One example stood out particularly clearly. During a customer-facing enterprise feature rollout involving complex workflow customization requirements, the engineering pod was able to independently clarify edge cases, prototype implementation approaches with AI tooling and finalize several product-level decisions without waiting for additional product management cycles. What previously would have required multiple refinement sessions and cross-functional approvals was delivered within a significantly shorter release window while maintaining enterprise-grade quality standards.

For leadership teams, the effect is equally important. As CTO, I redesigned operating constraints that had previously created execution bottlenecks, allowing greater organizational focus toward strategy, customer relationships, architecture and long-term product direction. In fast-moving organizations, that shift alone can materially improve execution capacity.

What would it take to scale this model effectively

However, this model is not easy to implement. The biggest challenge is talent.

Not every engineer can become an effective product engineer. The role requires technical depth, product intuition, communication skills, business awareness and strong self-management. Hiring becomes more difficult because companies must evaluate candidates beyond coding ability alone. Organizations often face two options: conduct a far more selective hiring process or invest heavily in developing existing engineers into broader product-minded contributors. Both paths require significantly more effort and expense than traditional engineering structures.

There are also operational traps. One of the most dangerous mistakes is delegating product authority too early without sufficient leadership oversight or organizational maturity. Strong product engineers require strong frameworks around them: disciplined release processes, clear accountability boundaries, reliable testing infrastructure and experienced technical leadership. That operational rigor matters especially for us when supporting enterprise-scale environments and organizations operating at Fortune 500 scale, including Raiffeisen Bank International, Bertelsmann, Axpo, IFF and Ahold Delhaize, where stability and reliability are non-negotiable. In our organization, I introduced operating controls that reduced distributed decision-making risks through multi-stage testing environments, structured release management, automated validation pipelines and layered automated and manual review processes before production deployments.

AI introduces another layer of complexity. Some engineers overestimate the capabilities of AI tools and begin trusting generated outputs without proper validation. Others remain overly skeptical and underutilize tools that can dramatically improve productivity. Maintaining the right balance requires active involvement from engineering leadership and internal AI expertise.

Product engineers operate with greater autonomy, which means weak execution habits become far more visible and potentially far more damaging. This is why experienced leadership remains critical even in highly autonomous organizations.

The future of AI-native engineering organizations

Despite these challenges, I believe this organizational shift is only beginning.

For years, software development was optimized around specialization because communication costs between humans were lower than coordination costs between systems. AI changes that equation. As implementation becomes increasingly accelerated by AI, organizational bottlenecks – not coding itself – become the primary constraint on execution speed. The companies that adapt fastest may not be the ones with the largest engineering departments. They may be the organizations that redesign engineering roles around ownership, product understanding and AI-native execution.

The product engineer model is ultimately not about combining responsibilities under a new title. It reflects a broader shift toward embedding product judgment directly into engineering execution and building teams capable of thinking, deciding and delivering at the speed modern products now demand.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

For years, Microsoft has hyped Windows 11 cas an OS with AI, and the company is finally putting the building blocks in place for that transformation.

Microsoft execs shared examples of how the company is integrating AI in Windows 11 at its Build event earlier this month, highlighting how AI models and agents will make the OS smarter, allowing users to interact with it using natural language and intent.

Specifically, Windows 11 PCs will provide unmetered intelligence so users can run AI for free without a network connection. “No token cost. No sensitive data leaves the device. It also reduces latency,” Anastasiya Tarnouskaya, product manager for Windows ML, said during a Build session.

Hardware makers introduced AI-capable hardware before the applications were available. But Tarnouskaya said more than 500 million PCs are already running local AI workloads. “Thanks to recent advancements in AI models, hardware, and the software stacks that run them, today, every Windows PC is becoming increasingly AI-capable,” she said. 

The AI experiences are blended into apps and the Windows UI, not working only as chatbots such as those offered by ChatGPT or Gemini. 

Microsoft Office, Photos and Teams already use on-device AI capabilities, with Outlook, for instance, summarizing emails using Microsoft’s Phi Silica model and a GPU on the PC.

“And it’s not just developers that are betting on local AI…, [companies] from Adobe to WhatsApp are building some incredible local AI-powered experiences.” Tarnouskaya said. Other early adopters include Canva, Affinity, and Speechify.

AI apps for Windows 11 proliferated after Microsoft shipped Windows ML last fall, she said. (Windows ML helps developers create offline AI applications without accessing cloud models. It maps applications, localized AI models and hardware such as GPUs and neural processors.)

Windows ML is part of Microsoft’s “Foundry” portfolio of products, which includes Foundry Local for running open-source models on Windows devices, and Windows AI APIs that automate tasks such as conversation summarization, speech recognition, and video upscaling.

Microsoft is also turning to AI agents to change how users interact with Windows 11. Users can describe a task through natural language, and a long-running agent will get to work and complete the action. “Windows is evolving into a platform where natural language can map to real system outcomes,” said Samantha Song, product manager for Windows at Microsoft.

Song demonstrated how users could just tell or type how they want to personalize colors, wallpaper, or menus, and the agent will do it. “There is no manual set up against themes, setting or lighting. The system treats it as one coherent action,” Song said.

For the effort to succeed, developers will need to create a skills file that maps how an agent behaves. That skill can then be reused over and over again, Song said.

“At the enterprise level, you could imagine a world where a user switches into a secure finance mode, and the system aligns apps, access boundaries and environment automatically,” Song said.

Microsoft also demonstrated how OpenClaw can be used to create personalized agents to run Windows functions.

At Build, LLMware.ai demonstrated an agent on a Qualcomm laptop that collects Jira issues in real-time, summarizes them locally, and emails daily summaries of top issues to the team. The agent runs automatically without prompting.

“You can get optimized performance on the NPU [neural processing unit] by running the model locally…and you also implement a scheduled run of your automated agents,” said Darren Oberst, co-founder of LLMWare.ai.

Samsung, Lenovo and others are rolling out — albeit slowly and carefully — agentic AI features under the moniker of ‘personal AI,’” said Leonard Lee, principal analyst at Next Curve. “The problem is ensuring safe deployment,” he said.

Microsoft’s efforts to embed AI in Windows will force enterprises to rethink hardware strategies, said Jack Gold, principal analyst at J. Gold Associates. And since AI chips excel at different tasks, Microsoft will have to support multiple chips to offer choice to enterprises, he said.

“We recommend — and others do, too — that any new PC purchases, especially for enterprise, be done with this in mind and purchase AI PCs during any upgrade cycle,” Gold said.