Enterprises typically operate separate systems for internal and external DNS because the two serve different audiences. Public DNS resolves names for services meant to be reached from the internet. Private DNS resolves internal resources, such as databases and internal applications, that should never be visible outside the corporate network. 

While public DNS is usually a single system, private DNS is often scattered across on-premises appliances, cloud-native resolvers, and split-horizon setups, where the same hostname resolves to a different answer depending on whether the query comes from inside or outside the network. Coordinating those deployments across headquarters, branch offices, and multiple clouds means ongoing manual synchronization work for network teams. 

Private DNS itself is not a new concept. It is already available from hyperscalers and established enterprise DNS vendors, but it typically runs apart from public DNS, with its own console, control plane and policy engine.

Cloudflare’s answer is a product it calls Internal DNS.

“Many organizations already use Cloudflare for their public DNS,” Enrique Somoza, product, performance and infrastructure at Cloudflare, told Network World. “Internal DNS extends that same platform to private DNS, so public and private are managed from the same global network and control plane.” 

How it works

Query handling starts at the resolver, not at the zone. That consolidation extends to daily operations as well.

“Instead of operating two separate DNS systems, customers use one API, one audit trail, one dashboard, and one policy engine for every DNS query—whether it is for a public website or an internal application,” Somoza said.

Policy first. The resolver sits ahead of every lookup, not behind it. “Architecturally, Cloudflare Gateway becomes the resolver that customers connect to, and can use WARP, DNS over HTTPS, DNS over TLS, or traditional DNS,” Somoza said. “Gateway evaluates zero -trust policies first, then routes the query to the appropriate DNS view based on context, such as source IP, device posture, or network location.”

No public path in. Internal zones sit outside the public DNS hierarchy entirely. “Internal zones are never assigned public nameservers—they are only reachable through Gateway, so every query is evaluated before it is resolved,” Somoza said.

One hostname, multiple answers. Branch offices, data centers and cloud environments no longer each need their own resolver stack. “Operationally, this simplifies environments that span branch offices, data centers, and multiple clouds,” Somoza said. “The same internal hostname can return different answers depending on where the request originated without maintaining separate resolver infrastructure, conditional forwarders, or duplicate zone files.”

Somoza described the underlying objective in direct terms: “The goal is to make internal DNS behave like a single service instead of a collection of independent deployments,” he said.

View selection. The same hostname can resolve to different IP addresses depending on where the request comes from. Gateway makes that call using several client signals. 

“View selection is policy driven,” Somoza said. “Gateway resolver policies evaluate the context of each DNS query, including attributes like source IP, device identity, or network location and determine which DNS view should answer the request.”

A view is a container, not a separate infrastructure stack. Somoza explained that a view is simply a logical grouping of internal zones. For example, a company could have separate views for Europe and North America, or for corporate users and operational technology networks.

Latency and resilience. Internal DNS inherits its performance characteristics from Cloudflare’s existing public network. “Internal DNS runs on Cloudflare’s global network, so queries are answered by the nearest available Gateway location, helping keep latency low for connected users,” Somoza said. “Because Internal DNS runs on the same global infrastructure as Cloudflare’s public DNS, it benefits from the same anycast architecture, geographic distribution, and resilient network design.”

How this differs from split-horizon DNS

Internal DNS replaces the duplicate-zone model traditional split-horizon setups depend on.

“Before migrating, many organizations maintain multiple versions of the same internal DNS zones across headquarters, branch offices, and cloud environments,” Somoza explained. “Conditional forwarders determine which resolver answers each query, and keeping those environments synchronized becomes an ongoing operational task.”

Internal DNS collapses those duplicate zones into a single authoritative copy split across views instead. “With Internal DNS, that configuration becomes much simpler,” Somoza said. “A customer might create a single corp.internal zone in Cloudflare and define multiple DNS views.”

For example, users in headquarters could receive one internal IP address for wiki.corp.internal, while branch offices receive a different address. Somoza emphasized that the zone itself only exists once. “Instead of maintaining multiple copies of the same configuration, administrators manage a single source of truth,” he said.

Early use cases and migration challenges

Not surprisingly, Somoza noted that the first use case Cloudflare sees for Internal DNS is for split-horizon DNS consolidation. There is also interest from organizations that operate across multiple cloud providers that want one consistent internal DNS service instead of managing separate DNS platforms in each environment.

Another common use case is extending zero-trust policies to internal name resolution. “Customers already use Gateway to control access to internet traffic, and Internal DNS lets them apply similar policy decisions before internal names are resolved,” Somoza said.

When it comes to migration, the friction customers report during migration is procedural rather than architectural.

“Customers need to think through API permissions, connectivity, and how existing local DNS forwarding rules interact with Gateway,” Somoza said. “Those are all well understood migration steps and customers often run both environments in parallel before completing the transition.”

Over the past year, I had the same conversation with almost every team starting an AI initiative. Should we build on Semantic Kernel, AutoGen or Foundry?

At first it felt like the most important architectural decision we’d make. Each framework had its own philosophy, each promised to be the foundation for enterprise AI, and picking the wrong one felt like an expensive mistake. I spent a lot of time helping teams weigh the trade-offs.

Looking back, I think we were asking the wrong question. I certainly was.

I watched teams spend months debating SDKs while the decisions that actually decided whether their applications survived production went unexamined. Some built elaborate orchestration layers for workflows that a few deterministic functions would have handled. Others avoided agent frameworks entirely and later found they’d designed themselves into a corner.

Then Microsoft settled it for us. It introduced the unified Agent Framework, quietly moved Semantic Kernel and AutoGen into maintenance mode, and the debate I’d spent months refereeing was suddenly over. Turns out the answer to “which of the three” was “none of the three, here’s a fourth.” The framework hit version 1.0 and general availability in April 2026, stable across .NET and Python.

What surprised me wasn’t the decision. It was how fast a debate that had eaten so much of our attention stopped mattering. Microsoft changed the menu.

It didn’t change the meal.

The framework was never the hard part

Framework selection dominated almost every early conversation I had about enterprise agents. Which SDK do we standardize on? Which orchestration model gives us the most flexibility? Which one is Microsoft actually betting on?

Fair questions. But after a year of watching these projects play out, I’ve slowly come around to a different view. Those weren’t the questions that decided anything.

The first question I ask now is much smaller. Does this thing actually need an agent?

It sounds obvious, and I still get it wrong sometimes. But it’s the mistake I see most. On one project, a team spent weeks designing a multi-agent workflow for a process that ran the same four steps every time: read a document, validate it, call an API, send a notification. The diagrams looked great. The system in production didn’t. A few well-tested functions would have been easier to build, easier to maintain and a lot easier to trust.

Part of this is just that “agent” has become the word everyone reaches for. Sometimes it’s the right call. Sometimes it’s a workflow we already knew how to build, wearing a newer label. An agent earns its complexity when it genuinely has to decide things you can’t predetermine, choosing between tools, adapting to what it finds, working out its own next step. If you already know every step, you have a workflow, and a workflow is usually the better engineering choice. The consolidation didn’t change that. It just made it easier to see.

What building production agents actually taught me

Once I stopped fixating on frameworks, the same three problems kept showing up. None of them had anything to do with the SDK.

Context beats model choice

Early on I spent a lot of time comparing models, the way you’d agonize over a restaurant menu and then order what you always order. Now I spend most of it thinking about context, which is far less fun and far more useful.

I’ve watched good models fail because they were handed too much, not too little. One team I worked with gave the model access to nearly every internal document they had on the theory that more information meant better answers. It went the other way. Responses got slower, less consistent and sometimes skipped right past the thing that actually mattered. When we cut the context down to only what the task needed, the quality jumped almost immediately. I didn’t predict that. It taught me to be suspicious of “just give it everything.”

The best agent systems I’ve worked on weren’t the ones with the biggest context windows. They were the ones careful about what reached the model, and when. That’s not something the framework hands you.

Failure is where the real work is

Most agent demos look great because they’re built around the happy path. Production doesn’t extend that courtesy.

I remember a project where everything held up in testing. Then a downstream API timed out after the agent had already completed several earlier steps. We couldn’t just restart, because part of the business process had already gone through. We ended up spending far more time on recovery logic than we ever spent on prompts. That project changed how I think about this work. The hard part was never getting the model to make a decision. It was making sure the system didn’t fall apart when reality refused to follow the script.

Tool calls fail partway through. APIs return inconsistent data. Models call the same tool over and over because the last answer wasn’t what they wanted. That’s not the exception; that’s a normal Tuesday. Whether you retry, roll back, pause for a human or push on with partial results is a judgment call, and no framework is going to make it for you.

Identity is the real security boundary

This one surprised me most. The moment an agent stops being a chatbot and starts touching real business systems, identity matters more than orchestration.

Every project gets to the same question eventually. Who is this agent actually acting as? The developer’s credentials? A service account? The user who asked? Get it wrong and you’ve built something autonomous running with more access than any single person should have, which is exactly the kind of thing that looks fine until an audit. The Agent Framework, like most modern tooling, makes it easier to wire agents to tools through standards like the Model Context Protocol. That helps. But where human approval belongs, what needs extra authorization, how much rope to give the thing, those are still yours to decide.

The surprises weren’t technical

Here’s what I didn’t see coming. The hardest part of last year wasn’t technical at all. It was organizational. The moment a team heard “agent,” expectations shifted under everyone’s feet. Business stakeholders started expecting full autonomy. Developers assumed the thing could reason its way through anything. People started designing for flexibility before we’d even agreed on what problem we were solving. The word did damage before any code did. I found myself spending as much time resetting expectations as I did discussing architecture.

Build for change, not for today’s winner

I don’t think the teams that struggled last year picked the wrong framework. Semantic Kernel was reasonable. AutoGen was reasonable. Foundry made sense for plenty of cases. I’d have signed off on any of them.

The ones that got hurt put all their eggs in one framework, treating it as the foundation of the whole system instead of as one more dependency. Microsoft provided a migration path. But teams that had tightly coupled their applications to framework-specific abstractions discovered that migrating and rewriting are not the same thing. That wasn’t Microsoft’s doing. It was their own architecture’s. The teams that moved easily had kept their business logic, prompts and orchestration loose enough to evolve independently of any one SDK. For them, the change was a manageable project, not a teardown.

For what it’s worth, nobody I work with is treating this as an emergency. Most are moving the smaller workloads first, watching how they behave and leaving the production-critical systems alone until they actually understand the new abstractions. That’s the right instinct. And I doubt this is the last consolidation we’ll see, the ecosystem is still young, frameworks will keep absorbing each other and over time the differences between them will be operational more than architectural.

I don’t regret the framework debates, honestly. They were reasonable at the time. What changed wasn’t Microsoft’s roadmap.

It was mine. Watching these systems run in production taught me that the framework is the easiest piece to swap out. Recovery logic, context management, security boundaries, the business workflow itself, those stay with you long after today’s SDK gets replaced by tomorrow’s.

So, Microsoft made one decision easier by turning three frameworks into one. Good. Five years from now we’ll be on different tools, and we’ll still be asking the same handful of questions.

Does this actually need an agent? Does it have the right context? Can it recover when something breaks, because something will? Is it acting as the right person?

Those questions outlast every rewrite. That’s where I’ve learned to put my effort.

Frameworks come and go. Good architecture has to survive all of them.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Revenue from IBM’s z mainframe portfolio declined 42% in the quarter ended June 30, dragging infrastructure revenue down 7% compared to the year-ago quarter. But Big Blue executives remain positive on the mainframe’s role as an important AI platform.

After warning of an earnings shortfall, IBM lowered its full-year forecast. It now expects 2026 revenue to grow between 4% and 5%, rather than its previous forecast of more than 5% growth. Some parts of its business did well: Software revenue grew 5% in the second quarter to $7.76 billion, fueled by 11% growth in hybrid cloud, 18% growth in data, and 3% growth in automation.

On the infrastructure side, IBM posted second-quarter revenue of $3.8 billion, which is down 7%. Within that business, distributed infrastructure grew 37%, but those gains were offset by a 10% decline in hybrid infrastructure and IBM Z’s 42% drop.

In a July 14 letter to investors released prior to IBM’s July 22 earnings call, CEO Arvind Krishna warned of the earnings shortfall and laid out current challenges. He related the infrastructure performance shortfall to “wrapping on the launch of z17 in the second quarter” and stated: “Given this was the strongest start to a mainframe program in our history, we expected Infrastructure revenue to decline low-single digits for the year, beginning this quarter. What played out was worse than our expectations, driven by a shortfall in our Z performance and the associated software stack, primarily in Transaction Processing.”

In the last few weeks of June, customers shifted capex spending and started purchasing more AI infrastructure components in the form of servers, storage, and memory “to secure supply-constrained infrastructure ahead of expected price increases,” Krishna stated. “This dynamic impacted client buying patterns. While we anticipated some supply chain related impact in our expectations, we did not anticipate the magnitude of the capex reprioritization.”

Yet despite challenges this last quarter, z17 remains at nearly 130% growth program-to-program, according to IBM. That’s “well ahead of z16, which was our strongest program on record, with clients representing 85% of installed MIPs maintaining or growing capacity,” the July 14 letter stated.

Mainframe infrastructure momentum is expected to continue, and IBM is anticipating strong workload growth and AI-driven capacity expansion as clients modernize mission-critical systems and emphasize resiliency and security, Krishna said during the company’s Q2 2026 earnings call on July 22.

“AI is driving incremental capacity growth and new workloads as clients look to run AI closer to their most sensitive data,” IBM senior vice president and CFO James Kavanaugh said in the call. “We are seeing strong early adoption of our AI innovations with nearly 50% of z17 customers investing in AI capabilities with Spyre AI accelerator, and clients deploying Watson X Code Assistant for Z are growing MIPS capacity three times faster than those who are not.”

“In a world where infrastructure costs are rising and efficiency matters more than ever, IBM Z offers a compelling economic advantage,” Kavanaugh continued. “Depending on the size and complexity of workloads, clients can realize a 2 to 15x total cost of ownership benefit versus moving these workloads off the platform, reinforcing why the platform remains central to their operations and positioning us to capture additional value as AI workloads grow.”

“We see no evidence of clients moving off mainframe,” Kavanaugh added. “Clients continue to invest in IBM Z to modernize mission-critical workloads with a focus on resiliency and security.”

In responding to an analyst question, Kavanaugh said three key things drive mainframe demand and purchasing requirements:

“One is capacity workload. It’s the most important determinant. 85% Of the installed MIPS capacity out there in the marketplace today running all those core mission critical workloads are either stable or growing. Clients are adding capacity and workload to mainframe, the viability. And by the way, that’s coming in new AI workloads, analytics workloads, Linux-based workloads, and those MIPS are growing program to date over 15 to 20% installed capacity,” Kavanaugh said.

Number 2 is economic factors. “We don’t talk a lot about this, but I think it’s important for our investors to understand things like total cost of ownership. Depending on the size and complexity of the workload, we have anywhere from a 2 to a 15x TCO advantage running on the mainframe [over smaller server systems]. Again, we do not see any evidence of clients migrating off mainframe and lease propensity, which is a great indicator,” Kavanaugh said.

The third driver is AI. “When you look at it, applications, data security, all on the platform, we do 450 billion inferences per day at 1 millisecond with 8 nines availability,” Kavanaugh said. “We’ve got clients that have already purchased over 50% of our Spire inferencing, and those clients that have purchased that are growing MIPS capacity, the way [we monetize value], by over three times faster than others.”

The model of the forward deployed engineer is sweeping through enterprise IT like a gold rush, and I’m concerned that many companies don’t understand what they’re signing up for.

Let’s start with the headline numbers. AWS announced a $1 billion investment in a new Forward Deployed Engineering organization. Google Cloud committed $750 million to expand similar programs. Microsoft has been running Azure-focused embedded engineering teams for years, including partnerships with Accenture to scale forward deployed engineering practices. All three are pitching the same story: We’ll send engineers to work directly with your teams, help you deploy AI, and accelerate your digital transformation. You get top-tier technical talent for free, and we get to partner with you on your journey.

It sounds reasonable on the surface. It sounds collaborative, even generous. But I’ve been in this industry long enough to know that when a multi-billion-dollar company offers you something for free, they’re sure to get much more than they give.

What you actually get

The forward deployed engineer model isn’t new. The consulting industry has been doing some version of it for decades. What makes this different is the scale and the direct financial incentive behind it.

These engineers work for the cloud provider. They’re not your employees. They’re not independent consultants. They’re technically excellent professionals who are being paid to solve your immediate problems while simultaneously building relationships and architectures that favor their employer’s ecosystem. Think about it from their perspective. Those forward engineers are evaluated on whether customers succeed with their employer’s platform. They’re rewarded when enterprises adopt more services from that platform. Their career advancement depends on making AWS, Google Cloud, or Microsoft Azure the obvious choice for all of your technical decisions.

This isn’t a criticism of the individual engineers. Many of them are genuinely talented and genuinely want to help. But they’re operating within a system that rewards specific outcomes, and those outcomes align with the vendor’s financial interests, not necessarily yours.

The problem no one talks about

Here’s what I see happening at enterprises right now. A company decides they need help deploying AI. A cloud provider offers to embed engineers at no additional cost. Those engineers work alongside internal teams, make architectural recommendations, and help build out systems. Six months later, the company has a production AI system running on a single cloud platform, built by people with deep expertise in that specific platform.

The problem? Nobody evaluated whether that platform was actually the best choice for the business. Nobody looked at alternatives. Nobody asked whether a multicloud architecture or best-of-breed approach might deliver better results at lower cost.

The engineers embedded in these programs are not going to recommend that you split your workloads across providers. They’re not going to suggest you use open source tools where they make sense. They’re not going to point you toward a competitor when their employer’s solution will work well enough. That’s not how these programs are designed to function. What you’re getting is optimized architecture for a single cloud brand, not optimized architecture for your business.

The financial reality will hit

The bills are going to come due, and they’re going to be painful. I’ve watched this pattern play out before. When enterprises lock into a single cloud provider through these embedded engineering programs, they often discover two or three years later that they’re paying premiums that their more independent-thinking competitors avoided.

The reasons are straightforward. When you’re architecting systems around a single platform, you naturally fall into usage patterns that favor that platform’s pricing structures. You use their managed databases instead of portable alternatives. You adopt their AI services instead of evaluating third-party options. You build workflows that only work within their ecosystem. And when it comes time to renegotiate or benchmark against alternatives, you find that migrating would cost more than accepting whatever pricing they offer.

I’ve spent the past decade helping companies untangle from these situations. I’ve seen organizations with cloud bills 15 to 20 times higher than they should be, unable to migrate because their entire AI infrastructure is built on proprietary services that only work on one platform. The forward deployed engineer programs are accelerating this problem. They’re making it easier to get into these situations and harder to get out.

Think before you commit

Before you accept one of these programs, consider these three recommendations.

First, require independent architecture oversight from day one. Hire or engage architects who work for your company, not for your cloud provider. They should evaluate every recommendation made by embedded engineers against business requirements and compare options across providers. This isn’t about being suspicious of the engineers. It’s about ensuring that decisions are made with your interests in mind.

Second, demand a clear exit strategy before you begin. Ask the cloud provider to document which proprietary services you’re using, what migration paths exist, and what the cost would be to move to an alternative platform. If they can’t provide that information, or if the migration costs seem impossibly high, that’s a sign that you’re building technical debt that will be very expensive to service later.

Third, benchmark your costs continuously. Set up internal processes to compare your cloud spending against industry benchmarks and against what your competitors might be paying for similar workloads. Don’t wait until your contract renewal to discover that you’re paying premium prices. Monitor expenses from the beginning, and be willing to challenge your cloud provider if you’re not getting value that justifies the cost.

The bottom line

The forward deployed engineers are solving real problems. Enterprises genuinely struggle with AI deployment, and having experienced engineers available to help is valuable. I’m not suggesting these programs are fundamentally bad. However, they’re being marketed as neutral partnerships when they’re actually strategic sales programs designed to lock enterprises into specific platforms. The helpful engineers showing up at your office are building dependencies that will be very difficult to break. The “free” technical assistance is being funded by margins on services you’ll be buying for years.

Go in with your eyes open. Use these programs but add your own independent oversight. Build architectures that you could leave if you needed to. And don’t let the immediate satisfaction of having problems solved today blind you to the financial consequences that will arrive tomorrow.

What is cloud native? Cloud native defined

The term “cloud-native computing” encompasses the modern approach to building and running software applications that exploit the flexibility, scalability, and resilience of cloud computing. The phrase is a catch-all that encompasses not just the specific architecture choices and environments used to build applications for the public cloud, but also the software engineering techniques and philosophies used by cloud developers.

The Cloud Native Computing Foundation (CNCF) is an open source organization that hosts many important cloud-related projects and helps set the tone for the world of cloud development. The CNCF offers its own definition of cloud native:

Cloud native practices empower organizations to develop, build, and deploy workloads in computing environments (public, private, hybrid cloud) to meet their organizational needs at scale in a programmatic and repeatable manner. It is characterized by loosely coupled systems that interoperate in a manner that is secure, resilient, manageable, sustainable, and observable.

Cloud native technologies and architectures typically consist of some combination of containers, service meshes, multi-tenancy, microservices, immutable infrastructure, serverless, and declarative APIs — this list is not exhaustive.

This definition is a good start, but as cloud infrastructure becomes ubiquitous, the cloud native world is beginning to spread behind the core of this definition. We’ll explore that evolution as well, and look into the near future of cloud-native computing.

Cloud native architectural principles

Let’s start by exploring the pillars of cloud-native architecture. Many of these technologies and techniques were considered innovative and even revolutionary when they hit the market over the past few decades, but now have become widely accepted across the software development landscape.

Microservices. One of the huge cultural shifts that made cloud-native computing possible was the move from huge, monolithic applications to microservices: small, loosely coupled, and independently deployable components that work together to form a cloud-native application. These microservices can be scaled across cloud environments, though (as we’ll see in a moment) this makes systems more complex.

Containers and orchestration. In could-native architectures, individual microservices are executed inside containers — lightweight, portable virtual execution environments that can run on a variety of servers and cloud platforms. Containers insulate the developers from having to worry about the underlying machines on which their code will execute. That is, all they have to do is write to the container environment. 

Getting the containers to run properly and communicate with one another is where the complexity of cloud native computing starts to emerge. Initially, containers were created and managed by relatively simple platforms, the most common of which was Docker. But as cloud-native applications got more complex, container orchestration platforms that augmented Docker’s functionality emerged, such as Kubernetes, which allows you to deploy and manage multi-container applications at scale. Kubernetes is critical to cloud native computing as we know it — it’s worth noting that the CNCF was set up as a spinoff of the Linux Foundation on the same day that Kubernetes 1.0 was announced — and adhering to Kubernetes best practices is an important key to cloud native success. 

Open standards and APIs. The fact that containers and cloud platforms are largely defined by open standards and open source technologies is the secret sauce that makes all this modularity and orchestration possible, and standardized and documented APIs offer the means of communication between distributed components of a larger application. In theory, anyway, this standardization means that every component should be able to communicate with other components of an application without knowing about their inner workings, or about the inner workings of the various platform layers on which everything operates.

DevOps, agile methodologies, and infrastructure as code. Because cloud-native applications exist as a series of small, discrete units of functionality, cloud-native teams can build and update them using agile philosophies like DevOps, which promotes rapid, iterative CI/CD development. This enables teams to deliver business value more quickly and more reliably.

The virtualized nature of cloud environments also make them great candidates for infrastructure as code (IaC), a practice in which teams use tools like Terraform, Pulumi, and AWS CloudFormation, to manage infrastructure declaratively and version those declarations just like application code. IaC boosts automation, repeatability, and resilience across environments—all big advantages in the cloud world. IaC also goes hand-in-hand with the concept of immutable infrastructure—the idea that, once deployed, infastructure-level entities like virtual machines, containers, or network appliances don’t change, which makes them easier to manage and secure. IaC stores declarative configuration code in version control, which creates an audit log of any changes.

Foundry

How the cloud-native stack is expanding

As cloud-native development becomes the norm, the cloud-native ecosystem is expanding; the CNCF maintains a graphical representation of what it calls the  cloud native landscape that hammers home to expansive and bewildering variety of products, services, and open source projects that contribute to (and seek to profit from) to cloud-native computing. And there are a number of areas where new and developing tools are complicating the picture sketched out by the pillars we discussed above.   

An expanding Kubernetes ecosystem. Kubernetes is complex, and teams now rely on an entire ecosystem of projects to get the most out of it: Helm for packaging, ArgoCD for GitOps-style deployments, and Kustomize for configuration management. And just as Kubernetes augmented Docker for enterprise-scale deployments. Kubernetes itself has been augmented and expanded by service mesh offerings like Istio and Linkerd, which offer fine-grained traffic control and improved security

Observability needs. The complex and distributed world of cloud-native computing requires in-depth observability to ensure that developers and admins have a handle on what’s happening with their applications. Cloud-native observability uses distributed tracing and aggregated logs to provide deep insight into performance and reliability. Tools like Prometheus, Grafana, Jaeger, and OpenTelemetry support comprehensive, real-time observability across the stack.

Serverless computing.  Serverless computing, particularly in its function-as-a-service guise, offers to strip needed compute resources down to their bare minimum, with functions running on service provider clouds using exactly as much as they need and no more. Because these services can be exposed as endpoints via APIs, they are increasingly integrated into distributed applications, operating side-by-side with functionality provided by containerized microservices. Watch out, though: the big FaaS providers (Amazon, Microsoft, and Google) would love to lock you in to their ecosystems.  

FinOps. Cloud computing was initially billed as a way to cut costs — no need to pay for an in-house data center that you barely use — but in practice it replaces capex with opex, and sometimes you can run up truly shocking cloud service bills if you aren’t careful. Serverless computing is one way to cut down on those costs, but financial operations, or FinOps, is a more systematic discipline that aims to aligns engineering, finance, and product to optimize cloud spending. FinOps best practices make use of those observability tools to best determine what departments and applications are eating up resources.

How cloud-native architecture is adapting to AI workloads

Enterprises deploy larger AI models and make use of more and more real-time inference services. That’s putting demands on cloud-native systems and forcing them to adapt to remain scalable and reliable.

For instance, organizations are re-engineering cloud environments around GPU-accelerated clusters, low-latency networking, and predictable orchestration. These needs align with established cloud-native patterns: containers package AI services consistently, while Kubernetes provides resilient scheduling and horizontal scale for inference workloads that can spike without warning.

Kubernetes itself is changing to better support AI inference, adding hardware-aware scheduling for GPUs, model-specific autoscaling behavior, and deeper observability into inference pipelines. These enhancements make Kubernetes a more natural platform for serving generative AI workloads.

AI’s resource demands are amplifying traditional cloud-native challenges. Observability becomes more complex as inference paths span GPUs, CPUs, vector databases, and distributed storage. FinOps teams contend with cost volatility from training and inference bursts. And security teams must track new risks around model provenance, data access, and supply-chain integrity.

Application frameworks for building distributed cloud-native apps

Microsoft’s Aspire is one of the most visible examples of a shift towards application frameworks to simplify how teams build distributed systems. Opinionated frameworks like Aspire provide structure, observability, and integration out of the box so developer don’t need to stitch together containers, microservices, and orchestration tooling by hand.

Aspire in particular is a prescriptive framework for cloud-native applications, bundling containerized services, environment configuration, health checks, and observability into a unified development model. Aspire provides defaults for service-to-service communication, configuration, and deployment, along with a built-in dashboard for visibility across distributed components.

While Aspire was originally aligned with Microsoft’s .NET platform,Redmond now sees it as having a  polyglot future. This positions Aspire as part of a broader trend: frameworks that help teams build cloud-native, service-oriented systems without being locked into a single language ecosystem. Several other frameworks are gaining traction: Dapr provides a portable runtime that abstracts many of the plumbing tasks in cloud-native distributed applications, and Orleans offers an actor-model-based framework for large-scale systems in the .NET world, and Akka gives JVM teams a mature, reactive toolkit for elastic, resilient services.

Frameworks and tools in the expanding cloud-native ecosystem

While frameworks like Aspire simplify how developers compose and structure distributed applications, most cloud-native systems still depend on a broader ecosystem of platforms and operational tooling. This deeper layer is where much of the complexity—and innovation—of cloud-native computing lives, particularly as Kubernetes continues to serve as the industry’s control plane for modern infrastructure.

Kubernetes provides the core abstractions for deploying and orchestrating containerized workloads at scale. Managed distributions such as Google Kubernetes Engine (GKE), Amazon EKS, Azure AKS, and Red Hat OpenShift build on these primitives with security, lifecycle automation, and enterprise support. Platform vendors are increasingly automating cluster operations—upgrades, scaling, remediation—to reduce the operational burden on engineering teams.

Surrounding Kubernetes is a rapidly expanding ecosystem of complementary frameworks and tools. Service meshes like Istio and Linkerd provide fine-grained traffic management, policy enforcement, and mTLS-based security across microservices. GitOps platforms such as Argo CD and Flux bring declarative, version-controlled deployments to cloud-native environments. Meanwhile, projects like Crossplane turn Kubernetes into a universal control plane for cloud infrastructure, letting teams provision databases, queues, and storage through familiar Kubernetes APIs. These tools illustrate how cloud-native development now spans multiple layers: developer-focused application frameworks like Aspire at the top, and a powerful, evolving Kubernetes ecosystem underneath that keeps modern distributed applications running.

Advantages and challenges for cloud-native development

Cloud native has become so ubiquitous that its advantages are almost taken for granted at this point, but it’s worth reflecting on the beneficial shift the cloud native paradigm represents. Huge, monolithic codebases that saw updates rolled out once every couple of years have been replaced by microservice-based applications that can be improved continuously. Cloud-based deployments, when managed correctly, make better use of compute resources and allow companies to offer their products as SaaS or PaaS services. 

But cloud-native deployments come with a number of challenges, too:

• Complexity and operational overhead: You’ll have noticed by now that many of the cloud-native tools we’ve discussed, like service meshes and observability tools, are needed to deal with the complexity of cloud-native applications and environments. Individual microservices are deceptively simple, but coordinating them all in a distributed environment is a big lift.
• Security: More services executing on more machines, communicating by open APIs, all adds up to a bigger attack surface for hackers. Containers and APIs each have their own special security needs, and a policy engine can be an important tool for imposing a security baseline on a sprawling cloud-native app. DevSecOps, which adds security to DevOps, has become an important cloud-native development practice to try to close these gaps.
• Vendor lock-in: This may come as a surprise, since cloud-native is based on open standards and open source. But there are differences in how the big cloud and serverless providers works, and once you’ve written code with one provider in mind, it can be hard to migrate elsewhere.
• A persistent skills gap: Cloud-native computing and development may have years under its belt at this point, but the number of developers who are truly skilled in this arena is a smaller portion of the workforce than you’d think. Companies face difficult choices in bridging this skills gap, whether that’s bidding up salaries, working to upskill current workers, or allowing remote work so they can cast a wide net. 

Cloud native in the real world

Cloud native computing is often associated with giants like Netflix, Spotify, Uber, and AirBNB, where many of its technologies were pioneered in the early ’10s. But the CNCF’s Case Studies page provides an in-depth look at how cloud native technologies are helping companies. Examples include the following:

• A UK-based payment technology company that can switch between data centers and clouds with zero downtime
• A software company whose product collects and analyzes data from IoT devices — and can scale up as the number of gadgets grows
• A Czech web service company that managed to improve performance while reducing costs by migrating to the cloud

Cloud-native infrastructure’s capability to quickly scale up to large workloads also make it an attractive platform for developing AI/ML applications: another one of those CNCF case studies looks at how IBM uses Kubernetes to train its Watsonx assistant. The big three providers are putting a lot of effort into pitching their platforms as the place for you to develop your own generative AI tools, with offerings like Azure AI Foundry,Google Firebase Studio, and Amazon Bedrock. It seems clear that cloud native technology is ready for what comes next.

Learn more about related cloud-native technologies:

• Platform-as-a-service (PaaS) explained
• What is cloud computing
• Multicloud explained
• Agile methodology explained
• Agile development best practices
• Devops explained
• Devops best practices
• Microservices explained
• Microservices tutorial
• Docker and Linux containers explained
• Kubernetes tutorial
• CI/CD (continuous integration and continuous delivery) explained
• CI/CD best practices

In the past year, cloud outages have exposed a hard truth about the modern digital economy: A disruption at one hyperscaler can quickly spread far beyond a single vendor’s platform. Failures in cloud control planes, identity systems, storage layers, and core regions have disrupted business operations, developer workflows, and consumer services worldwide. From Google Cloud’s internetwide disruption to repeated outages at AWS and Microsoft Azure, the pattern is now impossible to ignore. As organizations deepen their dependence on a small number of providers, resilience, redundancy, and contingency planning are becoming strategic necessities rather than purely technical concerns. Just consider this list of recent sizeable outages in the past year alone:

• Google Cloud, June 12, 2025: Google Cloud suffered a major outage that disrupted its own services and rippled across the internet, affecting platforms including Spotify and other downstream applications.
• AWS, October 20, 2025: AWS experienced a significant outage linked to a network health monitor issue, disrupting businesses worldwide and, once again, underscoring the concentration risk surrounding its US-East-1 region.
• Microsoft Azure, October 29, 2025: Azure’s global outage generated more than 18,000 user reports at its peak. It was tied to a configuration change in Azure Front Door’s global control plane.
• Microsoft Azure, February 2–3, 2026: Azure endured another major outage lasting more than 10 hours after a misconfiguration in Microsoft-managed storage accounts triggered cascading failures across virtual machine operations and managed identities.
• AWS, May 2026: AWS was hit by a serious US-East-1 outage caused by a thermal event and power loss at a Virginia data center, impairing core services including EC2 and EBS.

What once seemed exceptional is now a regular occurrence that organizations must accept as part of doing business in the cloud. This normalization of infrastructure-layer failures should concern every technology leader who has been told that the cloud is the reliable, enterprise-grade foundation for their digital transformation initiatives.

A staggering financial impact

The financial impact of these outages on enterprises is substantial and often underestimated. When a cloud platform goes down, companies lose revenue in direct proportion to the outage’s duration and their reliance on the affected services. For large enterprises processing millions of transactions per hour, even a two-hour outage can cost tens of millions of dollars in lost revenue. Beyond direct losses, there are reputational damages, customer churn, and the operational costs of incident response and recovery.

When your e-commerce platform goes down during a peak shopping period, you don’t just lose the sales from that two-hour window. You lose customer trust that extends well beyond the outage itself. When your enterprise collaboration tools become unavailable, productivity grinds to a halt across your entire organization. When your data processing pipeline stalls, downstream analytical capabilities that drive critical business decisions are delayed or entirely compromised. The true cost of a cloud outage extends far beyond the immediate period of unavailability.

SLAs don’t help much

Many enterprise tech leaders are frustrated by their limited recourse during outages. Cloud service-level agreements (SLAs) often offer service credits that are far below actual damages. These agreements also usually absolve providers of responsibility for indirect or consequential damages, subject to a cap that rarely reflects the true cost of an outage.

In essence, enterprises are being asked to trust platforms they don’t control with business-critical operations, while accepting terms that provide minimal protection when things go wrong. This fundamentally imbalanced relationship favors the provider at the customer’s expense.

Resilient architecture

This situation demands a fundamental shift in how enterprises approach cloud architecture and infrastructure planning. The days of simply migrating everything to a single hyperscaler and assuming reliability will follow are over. Organizations need to deliberately build resilience into their platforms by embracing architectural approaches that reduce dependence on any single provider or service.

A hybrid architecture that combines cloud-based and on-premises infrastructure enables organizations to shift workloads during outages while maintaining control of critical systems. Similarly, a multicloud strategy that distributes applications and data across multiple providers reduces the blast radius of any single provider’s failure. These approaches, without question, introduce complexity and require more sophisticated management tools and operational expertise. However, the alternative—accepting that your business continuity depends entirely on the reliability of platforms you cannot control—is increasingly untenable.

The challenge is that achieving resilience through heterogeneity introduces management complexity that many organizations are not prepared to handle. Using multiple cloud providers and on-premises infrastructure requires learning different operational models, maintaining diverse skill sets, and managing different tools across your environment. Licensing costs, integration efforts, and ongoing operational overhead are significant.

However, the organizations that invest in this complexity will be better positioned to maintain business continuity when the next major cloud failure inevitably occurs. The question is not whether you can afford to invest in resilience, but whether you can afford not to.

Three things to do now

The practical reality is that organizations cannot simply wait for cloud providers to solve this problem. The economics of the industry make it unlikely that service-level agreements will become significantly more favorable to customers. The complexity of modern cloud infrastructure means that outages will continue to occur regardless of the investments providers make in reliability. Therefore, enterprises must take responsibility for their own resilience.

Here are the three things enterprises should be doing right now:

First, enterprises should conduct a comprehensive audit of their cloud dependencies to identify single points of failure across their architecture. This means mapping every application, data store, and integration point to determine exactly what would happen if a specific cloud service went offline. Most organizations discover they have far more dependencies on a single provider than they realized, and many of those dependencies are undocumented. An audit will serve as the foundation for a deliberate resilience strategy that prioritizes redundancy for the most critical systems. 

Second, enterprises should implement a hybrid architecture that incorporates on-premises infrastructure for their most critical workloads. Mission-critical systems must have an alternative path to operation when cloud services fail. The key is to identify which systems truly require this level of protection and which can tolerate cloud-only deployment. A phased approach that starts with the most sensitive workloads and expands over time allows organizations to build expertise with hybrid systems and refine their processes as they go.

Third, enterprises must establish formal disaster-recovery testing procedures that specifically target cloud provider outages rather than traditional site failures. Most organizations test their disaster recovery capabilities against scenarios such as a data center failure or a natural disaster, but they rarely test what happens when a cloud API becomes unresponsive or a cloud region goes dark. Regular testing of these scenarios will expose gaps in the architecture that might otherwise remain hidden until an actual outage occurs.

Here’s the bottom line: Don’t put all your eggs in a single basket. Accept that cloud platforms will continue to fail, and plan your architecture accordingly. The investment in resilience will pay for itself the next time your primary cloud provider experiences an outage. Your competitors will be scrambling while your business continues to operate.

AWS is offering to help enterprises address the growing cost of retaining telemetry for talkative AI applications with a new engine for its managed Amazon OpenSearch Service optimized for log analytics, which it claims can reduce storage costs by 70% and at the same time deliver better price-performance.

AI and agentic applications are generating more telemetry than conventional observability architectures were built to manage economically, forcing enterprises to balance retaining the operational data needed for security, compliance and incident response against rising related infrastructure costs.

The new engine will allow customers to continue using the same management console, APIs, security model and networking configuration as the service’s existing general-purpose engine, while storing data in Apache Parquet format and maintaining Lucene search indexes for searchable fields, AWS said.

It uses Apache Calcite to parse and optimize queries before routing analytical operations to Apache DataFusion and search predicates to Lucene, allowing search and analytical aggregation to run within the same query, AWS executives wrote in a blog post.

The optimized engine supports SQL and Piped Processing Language (PPL), they said.

Keeping costs down without losing detail

In a recent survey of enterprises’ log management practices, Dynatrace found that AI workloads drove a 93% increase in log volume over the previous year, organizations to exclude an average of 86% of log data to manage costs and system capacity.

“Managing growing log volumes while keeping the cost almost flat is a persistent challenge that enterprises share,” said Ashish Chaturvedi, executive research leader at HFS Research.

“Most end up dropping retention windows or sampling logs, which is exactly when you lose the data you need for unanticipated incidents,” he said.

Shashi Bellamkonda, principal research director at Info-Tech Research Group, said AI agents have broken the math behind general purpose OpenSearch: “Constant background queries from agents touching logs didn’t fit the cost and performance assumptions baked into the original engine. The bill got too big. Enterprises started going blind on purpose.”

But the new AWS engine could help, said HyperFrame Research AI stack analyst Stephanie Walter, even if users realize only some of the gains that AWS promises.

“Lower storage costs can translate into longer retention periods, better compliance support, and more complete incident investigations,” Walter said.

Cheaper retention could also help CIOs curb tool sprawl as it reduces the incentive to fragment observability tooling across vendors purely for cost arbitrage, according to Bellamkonda. “Tool sprawl carries its own tax: integration overhead, headcount to maintain five dashboards instead of one,” he said.

Migration and compatibility could temper adoption

However, the analysts cautioned that realizing those benefits may require more work than AWS’s emphasis on compatibility initially suggests.

“AWS states that the optimized engine can’t be added to an existing domain and can’t be enabled on individual indices within a general-purpose domain. Adoption means standing up a new domain and migrating ingestion pipelines to it, making the transition more involved for engineering teams than a simple lift-and-shift,” Bellamkonda said.

Another point against the new engine, according to Chaturvedi, is its lack of support for Domain Specific Language (DSL).

This means that enterprises with existing OpenSearch deployments built around DSL queries or workloads that need frequent updates may need to rewrite dashboards, alerts and automation workflows before moving to the optimized engine, potentially extending migration timelines, Chaturvedi said.

Those implementation considerations are likely to influence the pace of adoption of the new engine more than the technology behind it, Bellamkonda said: “Migration friction, not cost, usually keeps enterprises on infrastructure they’ve outgrown.”

“AWS lowered the friction inside the migration by supporting ingestion through the same Bulk API and client libraries, which means no changes to ingestion pipelines or application code. However, it didn’t remove the migration entirely,” he said. The new optimized engine for Amazon OpenSearch Service has been made generally available.

This article originally appeared on InfoWorld.

AWS is offering to help enterprises address the growing cost of retaining telemetry for talkative AI applications with a new engine for its managed Amazon OpenSearch Service optimized for log analytics, which it claims can reduce storage costs by 70% and at the same time deliver better price-performance.

AI and agentic applications are generating more telemetry than conventional observability architectures were built to manage economically, forcing enterprises to balance retaining the operational data needed for security, compliance and incident response against rising related infrastructure costs.

The new engine will allow customers to continue using the same management console, APIs, security model and networking configuration as the service’s existing general-purpose engine, while storing data in Apache Parquet format and maintaining Lucene search indexes for searchable fields, AWS said.

It uses Apache Calcite to parse and optimize queries before routing analytical operations to Apache DataFusion and search predicates to Lucene, allowing search and analytical aggregation to run within the same query, AWS executives wrote in a blog post.

The optimized engine supports SQL and Piped Processing Language (PPL), they said.

Keeping costs down without losing detail

In a recent survey of enterprises’ log management practices, Dynatrace found that AI workloads drove a 93% increase in log volume over the previous year, organizations to exclude an average of 86% of log data to manage costs and system capacity.

“Managing growing log volumes while keeping the cost almost flat is a persistent challenge that enterprises share,” said Ashish Chaturvedi, executive research leader at HFS Research.

“Most end up dropping retention windows or sampling logs, which is exactly when you lose the data you need for unanticipated incidents,” he said.

Shashi Bellamkonda, principal research director at Info-Tech Research Group, said AI agents have broken the math behind general purpose OpenSearch: “Constant background queries from agents touching logs didn’t fit the cost and performance assumptions baked into the original engine. The bill got too big. Enterprises started going blind on purpose.”

But the new AWS engine could help, said HyperFrame Research AI stack analyst Stephanie Walter, even if users realize only some of the gains that AWS promises.

“Lower storage costs can translate into longer retention periods, better compliance support, and more complete incident investigations,” Walter said.

Cheaper retention could also help CIOs curb tool sprawl as it reduces the incentive to fragment observability tooling across vendors purely for cost arbitrage, according to Bellamkonda. “Tool sprawl carries its own tax: integration overhead, headcount to maintain five dashboards instead of one,” he said.

Migration and compatibility could temper adoption

However, the analysts cautioned that realizing those benefits may require more work than AWS’s emphasis on compatibility initially suggests.

“AWS states that the optimized engine can’t be added to an existing domain and can’t be enabled on individual indices within a general-purpose domain. Adoption means standing up a new domain and migrating ingestion pipelines to it, making the transition more involved for engineering teams than a simple lift-and-shift,” Bellamkonda said.

Another point against the new engine, according to Chaturvedi, is its lack of support for Domain Specific Language (DSL).

This means that enterprises with existing OpenSearch deployments built around DSL queries or workloads that need frequent updates may need to rewrite dashboards, alerts and automation workflows before moving to the optimized engine, potentially extending migration timelines, Chaturvedi said.

Those implementation considerations are likely to influence the pace of adoption of the new engine more than the technology behind it, Bellamkonda said: “Migration friction, not cost, usually keeps enterprises on infrastructure they’ve outgrown.”

“AWS lowered the friction inside the migration by supporting ingestion through the same Bulk API and client libraries, which means no changes to ingestion pipelines or application code. However, it didn’t remove the migration entirely,” he said. The new optimized engine for Amazon OpenSearch Service has been made generally available.

Before Tobi Lütke ran Shopify, he learned programming through Germany’s apprenticeship system⁠, the way people have learned trades forever: in a shared workshop, watching people who already knew what they were doing. More recently, describing Shopify’s River, he reached for a related word: Lehrwerkstatt⁠, a teaching workshop where “the whole shop floor is the classroom.”

X has been agog by the numbers around River⁠, Shopify’s Slack-native AI agent. In total, 5,938 Shopify employees worked with River across 4,450 different Slack channels, and River now coauthors roughly one in eight merged pull requests across the company. It’s a big deal, but understanding why it works that way is the most important part.

River can read code, run tests, open pull requests, query the data warehouse, inspect production traces, and sometimes push back on a plan it thinks is bad. Great. Lots of companies will have clever coding agents someday soon. Some already do.

The interesting part is that River doesn’t work alone; it works where everyone can see it.

Betting on the workshop

I’ve already argued that agents reward explicit, consistent, well-documented software. They like the “boring” stuff, such as schemas, tests, conventions, clean setup instructions, and codebases that don’t require a deep retrospective with the one engineer who remembers why the build script has to run twice. Dropping an agent into a messy repo is mostly an efficient audit of your engineering discipline. Agents hold up a mirror to our engineering practices.

This is where Shopify comes off looking good. Without all the engineering pre-work, River wouldn’t be a success. In early 2024⁠, the company says it had many repositories, bespoke development environments, and slow feedback loops. It then made two unpopular but critically important choices: moved to a monorepo called World and built dev environments, continuous integration, and production images on Nix as one reproducible substrate.

Shopify recognized that “code is going to be increasingly written with AI, and our infrastructure needs to be the substrate for that.” But the company did more than insist on legible code: It started to create shared memory of that code across the company.

Collective coding

River has one design constraint that every enterprise architect should pay attention to: It only works in public Slack channels. No direct messages. No private groups. You summon River where other people can watch, join, search, and learn. That sounds like a small product choice, but it’s not. It’s the operating model, kind of like open sourcing code development within Slack.

Because of this design constraint, every River session becomes a visible transcript. Shopify can then mine those transcripts, see recurring patterns, and feed them back into River’s skills, prompts, and defaults. One engineer’s hard-won fix at two o’clock becomes the next engineer’s starting point at four o’clock. The model doesn’t need to be retrained for the company to get smarter, and developers don’t need to go out of their way to document things. The work just has to leave a trace.

That’s the Lehrwerkstatt, productized. Everyone gets to watch the agent work.

Now compare that with how most enterprises are deploying AI. One developer works with a private chatbot in a private IDE in a private window that no one else will ever see. Multiply that by a few thousand. Each person discovers a clever way to investigate a flaky test, explain a troublesome service boundary, or avoid a migration trap. Then the session closes, and the discovery dies. Sure, the developer may go faster, but the company is no better off than it was yesterday.

The transcript is the artifact

One mistake enterprises have made with knowledge management is treating documentation as something people write after the work. This rarely works. Few employees (developers or otherwise) want to undertake the tedium of documenting what they already did. Not unless someone is paying them to do it.

River suggests a better pattern: The work itself creates the documentation.

Not every transcript is useful, of course. Most probably aren’t. But the useful ones can become skills, defaults, examples, runbooks, repo instructions, or links that help the next person avoid starting from zero. Shopify says River sessions are searchable and reproducible, and the company feeds patterns from those sessions back into River’s skills, prompts, and defaults. That’s not a chatbot; it’s a learning loop.

This is where the usual “AI will make developers more productive” framing feels too small. The more interesting claim is that AI can make software organizations more teachable. However, this won’t happen by default. The shop floor needs to be institutionalized or the enterprise will remain an atomized collection of productivity silos.

A magic memory file

This is where agents.md⁠ is useful, but only if properly used. agents.md describes itself as a README for agents and says it’s now used by more than 60,000 open source projects. How should a developer use it? GitHub, based on analysis of more than 2,500 repositories⁠, gives some clear guidance: Put commands early, be specific, provide real examples, and set explicit boundaries.

In other words, write down what matters.

But don’t mistake the file for the capability. ETH Zurich researchers recently tested whether repository-level context files actually help coding agents⁠ and found that they often reduce task success while increasing inference cost by more than 20%. InfoQ summarized⁠ their finding this way: LLM-generated context files often hurt, and human-written ones should focus on non-inferable details, such as custom tools, unusual build commands, and highly specific project constraints.

That’s the enterprise opportunity.

Public GitHub projects often don’t have much non-inferable domain knowledge to encode, but enterprise software is filled with it: odd quirks such as why the pricing service can’t be called during checkout in a certain region, or which legacy API looks dead but still supports a major customer, or why the data model says one thing but revenue recognition says another. Etc., etc.

That’s the context worth preserving, rather than directory maps an agent can discover or generic coding preferences. That’s what the shop-floor version of agents.md looks like: Not a static file that someone auto-generates and forgets, but rather the residue of observed work. Agents struggle, humans correct, patterns emerge, and only the durable lessons become instructions.

You’re not Shopify

If all this sounds great (and it should), then it’s worth a word of warning: You probably won’t be able to copy Shopify, any more than you could have (or should have) copied Google. You’re not Shopify. Most companies shouldn’t wake up Monday and announce a monorepo migration, a Nix conversion, and a Slack-only agent because River sounds cool. That approach has worked for Shopify, but it doesn’t mean it will work for you.

The useful approach for any company that isn’t Shopify is to ask different questions: Where does agent work happen in your company and who learns from it? If the answers are “in private” and “nobody,” you’ve got problems. I’m not saying that every agent session belongs in a public channel. You absolutely should not dump customer data, security incidents, HR issues, or privileged production context into a companywide AI water cooler. Boundaries still matter. In some cases, they matter more because agents can move faster and touch more systems than humans do, as I’ve warned.

But the principle survives the caveats: Agent work should be inspectable, reusable, and improvable where appropriate. The organization should be able to see the path from question to tool call to failed attempt to correction to pull request to reusable knowledge.

Shared learning is the new (old) way

For years, developer experience mostly meant removing friction for individuals: faster setup, better docs, nicer APIs, etc. Those are all still good. But agentic development adds a new requirement: shared learning.

A great developer experience now needs other things: Can the next developer benefit from the last agent session? Can the agent explain not just what it changed, but what it learned? Can a private breakthrough become a team asset without creating a surveillance nightmare? And no, visibility isn’t surveillance, and the goal is not to grade every keystroke or turn developers into content producers for the corporate memory machine. The goal is to make valuable work observable enough that it compounds.

This is a management problem as much as a tools problem. Developers will use agents because agents help them get work done. At this point, you’d struggle to get them to stop. Still, they won’t voluntarily produce beautiful organizational memory as a side effect unless the workflow makes it natural. You need to make the shared shop floor the golden path, as I’ve applied in various ways for years.

In the River story, humans are still the teachers. The organization is still responsible for deciding what counts as good work. The system still needs judgment, taste, security, cost control, and review. The magic happens when all this work is done in the open where the organization can learn from the teaching.

That’s the real promise of agentic coding inside enterprises. Not that every developer gets a private genius, but rather that every developer can tap into collective genius. Lütke learned his trade in a room where the craft was visible, and apprentices learned by watching the work. The companies that win the agent era will rebuild that room for software.

In short, the smartest thing your AI can do isn’t to code faster. It’s to work in public.

For years, enterprises have maintained separate systems for processing transactional (OLTP) and analytical (OLAP) data, even if that meant moving data between them. However, the rise of autonomous agents and AI applications needing immediate access to data while generating volumes of operational data themselves, has exposed the cost and complexity of maintaining those separate systems.

The industry’s response has been quick, with data warehouse and database vendors proposing a wave of competing approaches to collapsing those data silos. In the past few weeks Databricks unveiled LTAP and EDB introduced converged analytics, while late last year Snowflake launched pg_lake, all of which offer different blueprints for bringing transactional, analytical and AI workloads closer together.

Now it’s the turn of distributed PostgreSQL provider pgEdge, which has introduced a beta version of ColdFront, a PostgreSQL-native hot-and-cold data tiering architecture that automatically moves older data into Apache Iceberg object storage while keeping PostgreSQL as the only database that applications need to interact with.

In ColdFront’s architecture, hot and cold refer to newer and older data, respectively.

The approach of keeping PostgreSQL as the primary interface is what sets ColdFront apart from the other architectures emerging in this space, differing in where the center of gravity for data lies, according to analysts.

Databricks’ LTAP keeps operational applications connected to a lakehouse where analytics and AI are performed, EDB keeps PostgreSQL as the operational source of truth while exposing data through Iceberg for analytical engines, and Snowflake’s pg_lake writes PostgreSQL data directly into Iceberg so both PostgreSQL and Snowflake can query the same data, said Ashish Chaturvedi, leader of executive research at HFS Research.

ColdFront, by contrast, treats Iceberg only as a transparent storage tier behind PostgreSQL, automatically moving older data out of the database while keeping applications on the same tables and SQL, Chaturvedi said.

The result, according to pgEdge cofounder Phillip Merrick, is that queries against recent data continue to run on PostgreSQL, while requests for older records are transparently executed using DuckDB’s embedded analytical engine, allowing applications to use the same SQL without introducing ETL pipelines, separate query paths, or application changes.

That also means older records stored in Iceberg can be updated through PostgreSQL without requiring application changes, enabling what Merrick described as a “cold writable tier.”

Why writable cold storage matters

That cold writable tier could resonate with enterprises seeking to balance data residency, sovereignty, regulatory compliance and the growing operational demands of the agentic era, particularly because competing approaches generally require sacrificing at least one of those objectives.

As enterprises retain growing volumes of historical operational data generated by AI applications for audit and regulatory purposes, they increasingly need the ability to correct, delete or modify records, for example to comply with data protection and privacy laws, even after they have been moved into lower-cost storage, which other rival approaches complicate, said Amit Chandak, chief analytics officer at IT consulting firm Kanerika.

ColdFront can simplify those processes, said Chaturvedi: “In most tiering systems, cold (older) data is read-only, so a GDPR deletion request on archived data means restore-delete-rearchive, which is a half day job. ColdFront’s architecture would allow you to UPDATE and DELETE archived rows through one SQL statement.”

The rival architectures make different tradeoffs, with Databricks asking enterprises to adopt a proprietary lakehouse as the operational center of gravity, Snowflake requiring applications to distinguish between PostgreSQL and analytical tables, and EDB still requiring archived data to be brought back into active PostgreSQL before it can be modified, he said.

Those tradeoffs are particularly significant for regulated industries, according to Igor Ikonnikov, advisory fellow at Info-Tech Research Group, who said enterprises in financial services, healthcare and government increasingly want to keep sensitive operational data on customer-controlled infrastructure while preserving the ability to modify historical records to meet evolving regulatory obligations.

The DuckDB dependency

Despite their architectural differences, all the vendors are masking an emerging convergence at another layer of the stack that CIOs should take note of: an increasing dependence on DuckDB.

“ColdFront uses DuckDB to execute queries against data stored in Iceberg. Snowflake’s pg_lake routes Iceberg queries through pgduck_server, and Databricks’ Lakebase also relies on DuckDB internally for parts of its analytical processing. As a result, DuckDB is rapidly becoming the de facto embedded analytics engine for this new generation of PostgreSQL-Iceberg architectures,” Ikonnikov said.

That growing dependence creates what the analyst described as a concentration risk: “If DuckDB faces licensing changes, security vulnerabilities, performance bottlenecks or governance issues, the impact would ripple across multiple products simultaneously.”

As a result, CIOs should understand the maturity and roadmap of the shared components these architectures increasingly depend on.

However, that similarity in shared components will not make evaluation of these competing architectures easier for CIOs.

Most enterprises already have established data architectures, said Michael Leone, principal analyst at Moor Insights & Strategy, arguing that CIOs should evaluate these platforms based on where their data, developers and operational workflows already reside rather than assuming one architecture fits every environment.

For enteprises still defining their long-term data strategy, Leone recommended standardizing on Iceberg first since all four architectures support the open table format and enterprises will retain the flexibility to replace the front-end database or analytical platform later without migrating the underlying data.

Even that portability, however, has limits, Ikonnikov cautioned.

“The issue is Iceberg catalog governance. All four approaches write to Iceberg, but they use different catalogs and their interoperability across vendors remains an open problem. When agents from different systems need to query the same Iceberg tables, catalog federation becomes a real operational challenge.”

For years, enterprises have maintained separate systems for processing transactional (OLTP) and analytical (OLAP) data, even if that meant moving data between them. However, the rise of autonomous agents and AI applications needing immediate access to data while generating volumes of operational data themselves, has exposed the cost and complexity of maintaining those separate systems.

The industry’s response has been quick, with data warehouse and database vendors proposing a wave of competing approaches to collapsing those data silos. In the past few weeks Databricks unveiled LTAP and EDB introduced converged analytics, while late last year Snowflake launched pg_lake, all of which offer different blueprints for bringing transactional, analytical and AI workloads closer together.

Now it’s the turn of distributed PostgreSQL provider pgEdge, which has introduced a beta version of ColdFront, a PostgreSQL-native hot-and-cold data tiering architecture that automatically moves older data into Apache Iceberg object storage while keeping PostgreSQL as the only database that applications need to interact with.

In ColdFront’s architecture, hot and cold refer to newer and older data, respectively.

The approach of keeping PostgreSQL as the primary interface is what sets ColdFront apart from the other architectures emerging in this space, differing in where the center of gravity for data lies, according to analysts.

Databricks’ LTAP keeps operational applications connected to a lakehouse where analytics and AI are performed, EDB keeps PostgreSQL as the operational source of truth while exposing data through Iceberg for analytical engines, and Snowflake’s pg_lake writes PostgreSQL data directly into Iceberg so both PostgreSQL and Snowflake can query the same data, said Ashish Chaturvedi, leader of executive research at HFS Research.

ColdFront, by contrast, treats Iceberg only as a transparent storage tier behind PostgreSQL, automatically moving older data out of the database while keeping applications on the same tables and SQL, Chaturvedi said.

The result, according to pgEdge cofounder Phillip Merrick, is that queries against recent data continue to run on PostgreSQL, while requests for older records are transparently executed using DuckDB’s embedded analytical engine, allowing applications to use the same SQL without introducing ETL pipelines, separate query paths, or application changes.

That also means older records stored in Iceberg can be updated through PostgreSQL without requiring application changes, enabling what Merrick described as a “cold writable tier.”

Why writable cold storage matters

That cold writable tier could resonate with enterprises seeking to balance data residency, sovereignty, regulatory compliance and the growing operational demands of the agentic era, particularly because competing approaches generally require sacrificing at least one of those objectives.

As enterprises retain growing volumes of historical operational data generated by AI applications for audit and regulatory purposes, they increasingly need the ability to correct, delete or modify records, for example to comply with data protection and privacy laws, even after they have been moved into lower-cost storage, which other rival approaches complicate, said Amit Chandak, chief analytics officer at IT consulting firm Kanerika.

ColdFront can simplify those processes, said Chaturvedi: “In most tiering systems, cold (older) data is read-only, so a GDPR deletion request on archived data means restore-delete-rearchive, which is a half day job. ColdFront’s architecture would allow you to UPDATE and DELETE archived rows through one SQL statement.”

The rival architectures make different tradeoffs, with Databricks asking enterprises to adopt a proprietary lakehouse as the operational center of gravity, Snowflake requiring applications to distinguish between PostgreSQL and analytical tables, and EDB still requiring archived data to be brought back into active PostgreSQL before it can be modified, he said.

Those tradeoffs are particularly significant for regulated industries, according to Igor Ikonnikov, advisory fellow at Info-Tech Research Group, who said enterprises in financial services, healthcare and government increasingly want to keep sensitive operational data on customer-controlled infrastructure while preserving the ability to modify historical records to meet evolving regulatory obligations.

The DuckDB dependency

Despite their architectural differences, all the vendors are masking an emerging convergence at another layer of the stack that CIOs should take note of: an increasing dependence on DuckDB.

“ColdFront uses DuckDB to execute queries against data stored in Iceberg. Snowflake’s pg_lake routes Iceberg queries through pgduck_server, and Databricks’ Lakebase also relies on DuckDB internally for parts of its analytical processing. As a result, DuckDB is rapidly becoming the de facto embedded analytics engine for this new generation of PostgreSQL-Iceberg architectures,” Ikonnikov said.

That growing dependence creates what the analyst described as a concentration risk: “If DuckDB faces licensing changes, security vulnerabilities, performance bottlenecks or governance issues, the impact would ripple across multiple products simultaneously.”

As a result, CIOs should understand the maturity and roadmap of the shared components these architectures increasingly depend on.

However, that similarity in shared components will not make evaluation of these competing architectures easier for CIOs.

Most enterprises already have established data architectures, said Michael Leone, principal analyst at Moor Insights & Strategy, arguing that CIOs should evaluate these platforms based on where their data, developers and operational workflows already reside rather than assuming one architecture fits every environment.

For enteprises still defining their long-term data strategy, Leone recommended standardizing on Iceberg first since all four architectures support the open table format and enterprises will retain the flexibility to replace the front-end database or analytical platform later without migrating the underlying data.

Even that portability, however, has limits, Ikonnikov cautioned.

“The issue is Iceberg catalog governance. All four approaches write to Iceberg, but they use different catalogs and their interoperability across vendors remains an open problem. When agents from different systems need to query the same Iceberg tables, catalog federation becomes a real operational challenge.”

This article first appeared on InfoWorld.

AI has emerged as a top priority for businesses and a vehicle for transformation, as evidenced by Accenture research: 97% of executives believe AI will transform their company and industry. But as companies move from AI pilots to scaling AI across the enterprise, we have had repeated conversations with CIOs and technology leaders who are arriving at the same uncomfortable realization: AI stack decisions are not easily reversible.

Unlike earlier eras of enterprise IT, where abstraction layers insulated applications from hardware choices, today’s AI stack—the infrastructure, technologies and frameworks that powers AI systems – tends  to be tightly co-engineered, with stronger dependencies in the underlying compute layers. Choices made about models, runtimes and compute platforms now shape cost structures, performance ceilings and strategic flexibility. AI-ready infrastructure has re-emerged as a new source of differentiation, and with it, a new kind of vendor lock-in.

At the center of this shift is the move from training – building AI models – to inference, where those models are used in production to generate outputs from new data. While early attention focused on the cost of training large models, enterprises are now scaling AI across the organization, running models continuously across workflows. This shift significantly changes the economics of AI.

For instance, agentic AI is reshaping infrastructure architecture and platforms because inference is becoming persistent, stateful and increasingly data intensive. As AI Factories scale, the focus is shifting from peak model performance toward sustainable token economics, where the key differentiators are lowest cost per generated token, power efficiency and infrastructure utilization at scale. In this environment, achieving those outcomes requires full-stack optimization across compute, networking, memory, storage and data fabrics, curated and integrated across ecosystem partners. Secure multitenancy and confidential computing are becoming core design principles, and enterprise AI is now ready to be industrialized at scale.

Modern AI infrastructure is a strategic bet

What makes AI infrastructure different is not just scale, but integration. Modern AI systems are built on tightly co-engineered stacks where GPU accelerators, high-bandwidth interconnects, compilers and runtimes are designed in tandem to maximize throughput and efficiency for AI workloads.

To get the massive computing power required for AI, providers design their hardware and software to work exclusively with one another. This has shifted enterprise decision-making from choosing hardware one piece at a time to committing to ecosystems. And that commitment carries consequences.

In traditional IT environments, applications could also generally move across environments with a manageable amount of effort. In AI systems, that assumption breaks down. What appears portable at the model or application layer often depends on deeply optimized components underneath that layer, such as memory handling and compiler frameworks like CUDA or ROCm that are fine-tuned to specific hardware.

We find it useful to think about AI systems as a layered structure:

Accenture

While upper layers retain some flexibility, dependencies increase as you move downward. Changing your foundational AI provider often means having to rebuild and re-optimize large portions of your technology from scratch.

This is why infrastructure decisions in AI feel less like procurement choices and more like strategic, high-stakes bets.

Why switching AI platforms is harder than it looks

In theory, switching platforms should be straightforward. Models can be retrained, applications rewritten, and infrastructure replaced. In reality, the cost of switching extends far beyond hardware or licensing.

• The first challenge is engineering effort. Migrating to different platforms requires engineers to revalidate model behavior, re-tune inference pipelines, and rebuild performance baselines. During this period, teams spend most of their time stabilizing and not innovating.
• The second challenge is hidden dependency. Over time, system optimization becomes tied to a specific stack. This might include latency expectations, batching strategies, orchestration logic and even human workflows. These ties are not always obvious, but they shape how systems behave in production.
• The third challenge is timing. There is never a convenient time to migrate, especially factoring in rising AI infrastructure and inference costs, competitive pressure or scaling demands. Organizations are often forced to switch platforms precisely when disruption is hardest to absorb.

Rethinking performance vs control

Despite these barriers, organizations do switch. In our experience, this typically happens under three conditions.

One common trigger is when the opportunity cost of staying begins to outweigh the cost of leaving. As performance gaps widen across competing ecosystems, inefficiencies accumulate to the point that remaining on the current platform is no longer viable. Another driver comes from shifts in vendor dynamics. Pricing volatility, supply constraints, or misalignment in product roadmaps can introduce risks that force a re-evaluation. Finally, regulatory requirements, data sovereignty constraints or geopolitical shifts can force platform changes regardless of technical preference.

Across all three strategies, one principle stands out. Lock-in is not inherently negative, and openness is not inherently superior. Timing matters more than ideology.

Given these dynamics, the central question for CIOs is not how to avoid lock-in, but how to manage it deliberately. This represents a significant shift in strategies that previously considered vendor lock-in as a detriment. In practice, we see three broad approaches emerge, each reflecting a different balance between performance and control.

Some organizations take a performance-first approach. They optimize deeply within a specific ecosystem because performance directly drives business outcomes. Eli Lilly’s AI Factory is a strong example. The company has invested heavily in a tightly integrated NVIDIA-based stack to maximize throughput and utilization. In this case, infrastructure is a competitive lever and not merely a support function. Higher switching costs are accepted because near-term performance advantages are decisive.

Others lean toward a portability-first model. These organizations prioritize flexibility, governance, and long-term independence over absolute performance. BNP Paribas illustrates this well through its internal LLM platform built on open-source models and controlled infrastructure. By retaining ownership of the stack, the bank ensures data sovereignty, regulatory alignment and predictable cost.

A growing number are adopting a hybrid approach. Rather than applying a single strategy across the enterprise, they segment workloads based on sensitivity to performance, cost and governance. For example, in late 2024, JPMorganChase outlined its approach at a leading cloud and technology conference. It described combining a firm-wide internal AI platform with cloud-based services to move generative AI into production at scale. This reflects a broader enterprise pattern of pairing internally controlled environments with external ecosystems to balance control, scalability and cost.

A performance advantage is only valuable if it lasts long enough to justify the lock-in it creates. Similarly, portability only matters if the ecosystem evolves in ways that make switching worthwhile. This is where many organizations struggle. They evaluate platforms based on current benchmarks rather than the direction of the ecosystem.

In practice, we encourage leaders to track a set of evolving signals. These range from the maturity of open compiler ecosystems and improvements in cross-platform runtimes, to shifts in performance per watt and increasing regulatory focus on sovereign AI. Together, these indicators help determine whether the industry is moving toward convergence or further fragmentation.

Conclusion

AI is forcing a reset in how technology leaders think about IT architecture. The goal for CIOs is no longer to eliminate dependency, but to choose it consciously and manage and revisit that choice over time.

In our experience, the most effective organizations treat this as a dynamic problem. They evaluate where performance truly differentiates them, where flexibility protects them, and how quickly those boundaries are shifting. They also recognize that some degree of re-platforming is inevitable and plan for it, rather than treating it as a failure.

Ultimately, AI infrastructure strategy is not about optimizing for today’s conditions. It is about getting ready for where the ecosystem is going next. The leaders who navigate this well are not those who avoid lock-in entirely, but those who understand when to embrace it when to limit it and when to move beyond it before the market forces that decision on them.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

I recently spent some time reflecting on the announcements from Google Cloud Next 2026, as well as a series of vendor briefings and a handful of enterprise architecture engagements, where the same question kept coming up across different venues: once an organization has agents, who governs them? For two years, the enterprise AI conversation has been a conversation about models — whose is largest, whose is cheapest, whose context window stretches furthest.  Virtually no one was talking about data and semantic context.

After getting some perspective, I was forced to consider that model obsession might have finally fizzled out under the grim reality of non-existent ontologies and limited to no semantic context for enterprise data. The interesting question is no longer which model an enterprise runs. It is who controls the connective context layer — the agentic control plane — that decides what those agents know, what they are allowed to do and who is accountable when a thousand of them are running at once. Whoever owns that layer owns the next decade of enterprise AI and judging by the “marketecture” of every major vendor at Next 2026, the industry has reached the same conclusion.

The urgency here is clearly not a slide-ware exercise. Gartner has reported an exponential surge in enterprise inquiries about multi-agent systems and predicts that 40% of enterprise applications will embed task-specific agents by the end of 2026, up from less than 5% a year earlier. Yet the same analysts deliver an equally important counterweight: Gartner also expects more than 40% of agentic AI projects to be canceled by the end of 2027, citing escalating cost, an expanded risk surface and governance that no one built in advance. The 2026 Gartner Hype Cycle for Agentic AI makes the diagnosis plain — governance, security and FinOps capabilities are proliferating precisely because enterprises are alarmed about accountability and control as agents grow more autonomous and interconnected. Exponential demand colliding with non-existent guardrails is the environment Google walked into. So, what is the path forward to a control plane an enterprise can actually trust?

What Google actually brought to Next 2026

I’m not ardent supporter of single-ecosystem architectures.  That’s not the world we live in and interoperability has always prevailed as the final arbiter of truth.  Beneath all the agent drama, however, Google’s message was fundamentally architectural. The company repositioned Gemini less as a standalone model and more as the connective and contextual tissue binding data systems, applications and agent runtimes, and assembled Big Query, Alloy DB, Spanner and its managed Spark service into a new category it calls the Agentic Data Cloud. As Constellation Research observed, the standardization of data on Apache Iceberg has put the data layer itself in play, and Google responded by stacking its assets into a cross-cloud lakehouse and a knowledge catalog, complete with migration tooling pointed squarely at Snowflake and Databricks.

Three pillars define the offering. The first is a federated data layer built on the principle of reach, not relocation. By integrating Cross-Cloud Interconnect directly into the data plane and pairing it with the Apache Iceberg REST Catalog, Google lets agents query data residing on AWS or Azure as though it were local, with no egress fees and extends bi-directional federation in preview to Databricks’ Unity Catalog, Snowflake’s Polaris and the AWS Glue Data Catalog, according to Google’s own technical briefings and independent analysis. Google data cloud managing director Yasmeen Ahmad summarized in Google’s Next ’26 announcement with characteristic economy: you don’t move the data, you connect it.

The second pillar is a semantic layer — the Knowledge Catalog, an evolution of Dataplex — which uses Gemini to tag assets, infer relationships and map business meaning so that agents are grounded rather than, as one analysis put it, fast but blind. Critically, its retrieval is permission-aware, meaning agents can only retrieve and act on assets they are explicitly authorized to see — a design choice that fuses context delivery and access control into a single operation. The third pillar is a build layer, the Data Agent Kit, which ships as portable skills, MCP tools and IDE extensions that drop into VS Code, Claude Code, Gemini CLI and Codex, deliberately declining to impose a new proprietary interface.

This is a credible and, to Google’s credit, a mostly real offering.  A control plane, however, is a claim, not a feature, and the term deserves more focus and detail than vendors typically provide.   An agentic control plane is not a product it is a semantically governed set of domain services and underlying structured and unstructured data.   How we federate agentic access and data with intention and governance means everything.

What an interoperable control plane requires

A control plane governs how a system behaves rather than performing the work itself. For agents, a genuine control plane must deliver at least five functions, and an interoperable one must deliver them across vendor, model and cloud boundaries rather than only within a single domain or scope.

The first is identity. Agents are a new class of non-human actors, and an enterprise must be able to authenticate them and manage their actions. Microsoft’s competing Agent 365, unveiled at Ignite 2025, is built explicitly around a registry of which agents exist, plus access control and security — as an Ignite 2025 industry analysis noted, that identity is foundational. The second is context and semantics, the half of the problem the data clouds have collectively rushed toward. The third, and the most consistently underplayed, is action governance — control not merely over what an agent can read, but over what it can do: the writes, the state changes, the transactional operations. The fourth is observability and lifecycle management, the simulate-evaluate-monitor-optimize loop across an agent fleet, where Google’s integrated offering is, by most accounts, the most complete a hyperscaler has yet shipped. The fifth is economics; the reason so many projects are forecast to fail is partly cost, and FinOps for agentic AI is now an expressly named discipline on Gartner’s Hype Cycle.

Interoperability cuts across all five, and here the industry has done something genuinely impactful and useful: it has agreed on protocols. The Model Context Protocol, originated by Anthropic and since donated to the Linux Foundation under multi-vendor governance, standardizes how an agent connects to tools and data. The Agent2Agent protocol, originated by Google and likewise moved to the Linux Foundation, governs how agents discover and delegate to one another across organizational boundaries. Forrester predicts that 30% of enterprise app vendors will launch their own MCP servers in 2026, and Gartner’s Anushree Verma positions standardized protocols as the enabler of the seamless interoperability that, by 2028, will let networks of specialized agents collaborate dynamically across applications.

What is key here — and what enterprise leaders miss — is that open protocols deliver portable messages, not a portable control plane. Two agents can exchange tasks across clouds in A2A all day long, but identity, semantics, action governance, observability and cost remain platform functions.  A2A and MCP have ensured that the communication protocol has been commoditized.  The final frontier and the competitive moat is not the communication and access protocol, it is the semantic context and the business ontology

Where Google is strong, and where leaders should look twice

Google deserves real credit for embracing open standards where it counts. It adopted MCP across its own services, repositioned Apigee as an MCP bridge that turns any standard API into a governed agent tool and built its federation story on the open Iceberg REST Catalog rather than a proprietary format. Technology Business Research (TBR) characterized this as a meaningful strategic shift: a company historically defensive about keeping data inside BigQuery now signals that it cares less about where data physically resides than about ensuring Gemini is the semantic context layer generating value on top of it.

That repositioning is exactly the lock-in risk an enterprise must carefully consider, and two limitations matter significantly and deserve an architect’s attention. The first is that federation is not the same as unified control. In my view, TBR’s analysis is totally on point: The Knowledge Catalog addresses upper-stack governance but is not an operational catalog in the way that Databricks’ Unity Catalog, Snowflake’s Polaris and AWS Glue are — those systems govern the underlying Iceberg tables. Google reads into them; it does not replace them. The second is that the focus of lock-in has simply moved up the stack to the semantic context and ontology layers.  Moor Insights & Strategy and others all have cautionary tales that exiting Google-managed semantics, Gemini agents or BigQuery abstractions may prove harder than migrating the data itself. The semantics and the orchestration are now the sticky layer. I think this is a logically coherent and impressive strategy, but for every gain, something is lost.  That loss is exactly the moment where an enterprise either preserves its independence or succumbs to lock-in for convenience and expedience.

There is a maturity gap also worth mentioning here as well. One widely-circulated analysis of Next 2026 carried its verdict in the title — the agent stack is ready, the semantic engine isn’t — arguing that the Knowledge Catalog, however promising, is not yet the governed business-context layer a true enterprise operating system demands and remains more aspirational than operational. With much of the federation and catalog functionality still in preview, optimism is the right approach from my perspective, not “all-in” commitment.

Meanwhile, the competition is playing a different game

The competitors are not building the same artifact, and the differences are instructive. The data-cloud catalogs — Databricks Unity Catalog, Snowflake Polaris and Cortex, AWS Glue, Microsoft Fabric — govern data and, increasingly, semantics; the entire field now accepts that agents need context, not merely access, as industry analysis of the field documents. Their structural limit is that catalog constraints are frequently informational rather than strictly enforced, and metric-oriented semantic layers model measures rather than actions or state changes. They excel at conversing with data and remain weaker at agents that act. The agent-management planes, exemplified by Microsoft’s Agent 365, approach the problem from fleet control — registry, identity, observability — and are excellent for organizations living inside Microsoft 365, bounded by that same dependence.

Palantir Foundry represents a genuinely different category. Where catalogs register tables and semantic layers define metrics, Foundry is built around an ontology that models entities, their typed relationships and the actions that can be taken against them — semantics in service of operational execution, not merely analytics.  That distinction is the single most important idea for anyone designing an agentic control plane today. As Atlan frames it, a semantic layer hands agents governed metrics, which solves half the problem; agents that reason across domains and act need a knowledge-representation layer underneath — what things are, how they relate and what operations are possible. A control plane that governs reads but not writes, metrics but not actions, is fundamentally limiting for agents, and semi-autonomous action is the entire point.    It is also worth noting, the semantic layer itself is now standardizing: the Open Semantic Interchange initiative, launched in late 2025 by Snowflake, dbt Labs, Salesforce and a coalition of partners under an Apache 2.0 license, finalized its v1.0 specification in early 2026. Just as MCP and A2A commoditized the agent communication protocols, OSI aims to commoditize semantic portability.

A blueprint for enterprise leaders

As always, the path forward is clear enough to state but extremely demanding to execute. An interoperable agentic control plane is not a product an enterprise purchases from a single vendor; it is an architecture it composes — open standards at the commoditized layers, owned assets at the differentiating one. Drawing on both the Next 2026 announcements and recent architectural engagements, I would urge leaders to prioritize four design commitments.

First, standardize on open formats at the storage layer. Apache Iceberg and its REST Catalog deliver genuine data portability, and this is the one element of Google’s model worth adopting wholesale, precisely because the broader industry already has. Second, standardize on open protocols at the agent layer— A2A between agents and MCP to tools and systems — so that a Gemini agent, a Claude agent and a partner’s agent can interoperate without any one of them owning the others. Third, own the semantic and ontology layer in the middle. Don’t just model metrics but entities, relationships and the typed actions agents may perform; this is what delivers semantic portability and keeps the vendor lock-in at bay and in the enterprise’s own hands rather than a vendor.   Fourth, own the control-plane core components — identity, registry, observability and policy — so that governance remains independent of any single platform.

Any vendor relationship that requires managed semantics will make it intentionally harder to migrate data.   The architectural response should never be to place those semantics in any single vendor’s control in the first place. Federation buys data portability; an owned ontology buys semantic portability; open protocols buy agent portability. Composed together, they close the gap that the analysts identified.

The vendors will continue to make the case that the control plane is a product. The analysts — Gartner on governance and failure rates, Forrester on protocol proliferation, TBR and Moor on the limits of federation — are collectively telling enterprise leaders something more useful: it is an architectural decision, and the organizations that treat it as one, that build adaptive governance before their agentic minions outpace them and that preserve the option to change their minds, will be the ones still in command of their AI a decade from now.

Google Cloud Next 2026 is a genuinely strong architecture, and there is no doubt that it is the most complete agentic control-plane offering any hyperscaler has yet shipped. It is also the clearest illustration to date of why no enterprise should outsource its control plane to anyone. The shift from owning models to owning the control plane is not just underway; for organizations serious about operating at the speed of an agent-driven business, it is inevitable. The winning move at this point is to show up with an architecture, not a purchase order.

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time, as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects. 

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Your board is asking. Your legal team is asking. Your auditors will be asking: Should AI workloads move to sovereign cloud, or stay on AWS, Azure or GCP? European enterprises have already run this experiment — under real regulatory pressure, with real money and real consequences. Many discovered that sovereign cloud alone didn’t deliver the control they expected. The real control point turned out to be somewhere else entirely.

Europe ran this experiment first, under regulatory pressure US enterprises are only starting to feel. With DORA fully in force since January 2025, NIS2 enforcement underway across EU member states and the EU AI Act’s high-risk system provisions taking effect in August 2026, European enterprises — particularly in financial services, critical infrastructure and manufacturing — have spent two years migrating workloads, renegotiating contracts and writing sovereign cloud into board-level risk frameworks. The hyperscalers responded. AWS launched its European Sovereign Cloud in January 2026. Microsoft and Google followed with their own sovereignty offerings. The market arrived.

US enterprises are not far behind. The SEC’s cybersecurity disclosure rules, CISA’s AI security guidance, proposed state-level AI regulations and growing board-level scrutiny of AI governance are creating comparable pressures on this side of the Atlantic. If your organization runs AI workloads on behalf of EU clients, operates EU subsidiaries or simply faces the question of where sensitive AI training data and model outputs should live — you are already in this conversation. The European experience is your preview.

What has not arrived is clarity on what you actually get — and what you do not. At the European Identity and Cloud Conference in Berlin this May, the mood among practitioners had shifted measurably from previous years. The cheering for the sovereign cloud concept was over. What was happening on stage and in the corridors was a careful, sometimes uncomfortable, dissection of the gap between marketing slides and operational reality. (EIC returns to Berlin in May 2027.)

The conference agenda made the shift visible. Where previous years centered on sovereign cloud architecture and vendor selection, the 2026 program’s trending themes — as mapped in the closing session — were AI security, identity fabric, workload identity management, and crypto agility. Sovereign cloud had become assumed infrastructure. The practitioner conversation had moved to what you build on top of it, and who controls that layer.

Martin Kuppinger, distinguished analyst and co-founder of KuppingerCole, observed the same shift: “Cloud sovereignty had a much larger role at this year’s EIC, with a differentiated discussion about whether and where it is needed. There is common sense that sovereignty is not a value in its own right — the required level depends on the use case and a proper risk assessment. There is no binary model for sovereignty.”

Sovereign cloud, on the slides, looks like control. In the contracts, service matrices and AI agent deployments, it often looks more like a very expensive illusion.

The control question nobody answers clearly

When enterprises talk about sovereign cloud, they are usually thinking about data residency — where the data lives. European data center, European jurisdiction. But data residency is the beginning of the conversation, not the end.

The harder questions are about control. Who holds the encryption keys, and who can compel access to them under what legal circumstances? Who sees the metadata, the access logs, the telemetry from your workloads? When you run AI inference or model training on a sovereign cloud platform, who controls the model registry, the training data pipeline, the output logs? And when an AI agent acts autonomously on your behalf — scheduling workloads, provisioning resources, making access decisions — whose infrastructure is that agent running on, and who can observe what it does?

These are not hypothetical concerns. The CLOUD Act of 2018 gives US authorities the ability to compel US companies to produce data stored abroad, regardless of where the servers sit. European sovereign cloud offerings from US hyperscalers are structured to address this — through operational separation, European legal entities and customer-managed keys — but the structures are new, partially tested and vary significantly between providers.

Germany’s BSI has raised the stakes further. In April 2026, the agency published its Criteria Enabling Cloud Computing Autonomy (C3A): The first framework to operationalize what cloud sovereignty actually means in technical terms, including disconnect scenarios, staff residency requirements and an extraordinary provision for federal takeover of cloud operations in defense scenarios. Formally non-binding, the criteria are widely expected to become the de facto benchmark for German federal procurement — and a likely template for EU-level frameworks now in the legislative pipeline. For US CISOs, the direction of travel is clear: Regulatory definitions of cloud sovereignty are tightening, and the gap between “data in Europe” and “operationally sovereign” is only going to widen.

Identity is where sovereignty actually lives

The clearest theme at EIC 2026 was that identity — not network perimeter, not data residency — is where cloud sovereignty either holds or breaks down. The argument is becoming hard to avoid.

Jason Keenaghan, who leads identity management strategy at Thales, framed it directly: “Identity is shifting from an IT function to a regulated infrastructure. The most important question for the next decade will be: Who is in control?”

For a US CISO, this shift is very real: Identity governance is moving from pure IT plumbing to a regulated control surface that auditors, regulators and even enterprise customers in RfPs will increasingly scrutinize. The question of “who is in control” is no longer philosophical. It is contractual.

Here’s the problem. You can put your data in a Frankfurt data center with customer-managed keys. But if your identity governance is weak — if you do not know which human users, service accounts and AI agents have access to what, and under what conditions — your sovereignty posture is only as strong as your weakest identity. A compromised privileged account does not care about data residency.

This is particularly acute for AI workloads. Agentic AI systems — models that act autonomously, make API calls, provision resources, access data — are creating a new category of non-human identities that most enterprises’ IAM systems were never designed to manage. Consider a concrete example I have seen in client environments: An LLM-based deployment agent with standing access to production Kubernetes clusters. It schedules workloads, provisions resources and makes access decisions autonomously. If that agent runs on sovereign cloud infrastructure but its identity — its credentials, its permissions, its audit trail — is not properly governed, your sovereignty posture is exactly as strong as the weakest link in that agent’s access chain. If you are running similar agents in US-based cloud regions today, the same identity blind spots exist — even if you never touch a sovereign cloud region.

Sebastian Rohr, an IAM consultant and IDPro member who has spent two decades on enterprise identity architectures, distilled the requirements for governing AI agents in practice: “Every agent needs an assigned non-human identity. A solid on-behalf-of delegation model must be established. An audit trail via SIEM integration is required. No long-lived credentials, no API keys — only ephemeral credentials. Context-based authentication and fine-grained access control. Agents must be managed as real identities. And once that foundation exists: Risk-based, continuous re-authentication combined with the ability for real-time revocation. Do we have all these capabilities everywhere today? Not necessarily — but designing the architecture for it? That is entirely possible.”

For AI agents in particular, the practical question is this: Can you list every agent running in your environment, govern its entitlements and revoke access in real time? If not, you do not truly control the workload — regardless of which cloud region it runs in.

What practitioners at EIC kept coming back to is not a sovereign cloud answer. It is an identity governance answer. Sovereign cloud buys you legal protection and data residency. Identity governance gives you operational control — and increasingly, it is the layer where AI workload sovereignty actually has to be enforced.

When sovereign cloud is worth it — and when it is not

For US CISOs managing EU operations, EU subsidiaries or EU customers, the practical question is not whether sovereign cloud is philosophically correct. It is whether the additional cost and complexity deliver sufficient risk reduction for specific workloads. Most organizations I have worked with are over-applying sovereign cloud to workloads that do not need it, while under-applying it to the ones that do.

A working framework, refined across two years of European deployments. Use this as a quick triage for which workloads truly justify a sovereign cloud premium. As Kuppinger puts it: “Within an organization, varying levels of sovereignty demand for different use cases are the norm, not the exception.”

Five things European enterprises learned the hard way

• Sovereign cloud does not mean the hyperscaler cannot see your metadata. Customer-managed keys protect data at rest. They do not prevent the platform from logging access patterns, API calls and resource consumption. Know what your provider logs and where those logs go. For US CISOs: This matters for any hyperscaler operating under foreign data localization requirements you may face as the regulatory landscape evolves.
• Early sovereign cloud offerings had real service gaps — and exit is harder than expected. Many advanced AI/ML services were unavailable at launch; enterprises that committed early ended up running hybrid architectures more complex than anticipated. And lock-in in sovereign cloud contexts is harder to escape than standard cloud. Build exit strategy into procurement decisions before you sign.
• Identity governance cannot be deferred. The enterprises that got the most value from sovereign cloud investments had already done the identity governance work — asset inventory, access classification, non-human identity management. For US CISOs facing similar AI governance and resilience requirements: This is the lesson that will hurt most if you have not done the work.
• Sovereign from a hyperscaler is not the same as sovereign from a European provider. AWS European Sovereign Cloud, Microsoft Cloud for Sovereignty and Google Sovereign Cloud are structurally different from offerings built by IONOS, Hetzner, OVHcloud or Deutsche Telekom. The former offers broader service catalogs with sovereignty controls layered on. The latter offer cleaner legal structures with narrower feature sets. Neither is universally better — and the choice should follow workload characteristics, not procurement preference.

What US CISOs should do now

If your organization has EU operations, subsidiaries or customers — or AI workloads sensitive enough that the regulatory direction in the US matters — these are decisions you will face. Three concrete steps.

1. Classify your workloads by sensitivity and regulatory exposure before you classify them by cloud type. Not everything needs sovereign cloud. But know which workloads do before a regulator, auditor or customer’s procurement team asks.

2. Audit your identity governance posture before your cloud strategy. Sovereign cloud without IAM maturity is expensive and insufficient. Governance has to happen at the identity layer, not the data center boundary.

3. Read the contracts carefully. Key management, metadata logging, law enforcement access and service continuity provisions vary significantly between providers. Legal and security need to review them together — and AI workload provisions deserve their own column.

Europe’s sovereign cloud experiment is still running. The early results suggest the regulatory pressure is real, the market response is genuine and the operational complexity is higher than the marketing suggested. AI workloads make it more complex, not less. That is not a reason to avoid sovereign cloud — it is a reason to approach it with clearer eyes than the first wave of European adopters had. Buy the jurisdiction. Then govern the identity. In that order.

Sovereign cloud buys you a jurisdiction. Identity governance buys you control. AI workloads need both, and most enterprises are buying only one.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

MUNICH — Amid trans-Atlantic political and trade tensions, digital sovereignty — once a relatively niche concern — has jumped to the top of the agenda for European organizations wary of their reliance on US technology suppliers.

For many, including European Union policy makers, increased use of open source software is a key part of the answer, offering an alternative to proprietary platforms from a handful of large US vendors.

That’s the view of Frank Karlitschek, CEO of Nextcloud, the German software vendor that bills itself as an open-source alternative to software suites from the likes of Microsoft and Google. 

Nextcloud

Karlitschek founded the company in 2016, forking OwnCloud’s open-source file-sharing software. Since then, Nextcloud has expanded its products to include a range of productivity and collaboration tools that organizations can install and run on their own servers or access via cloud providers. 

More recently, Nextcloud helped develop the Euro-Office application suite, which launched last week as an open source alternative to Microsoft Office and others, and continues to build out its Nextcloud Hub with AI assistant and agent features. The company now says revenues are growing at between 50% to 100% year over year.

Computerworld spoke to Karlitschek at Nextcloud Summit about momentum around digital sovereignty, the European Commission’s Tech Sovereignty Package proposals, and how Nextcloud hopes to evolve in the coming years.

The following interview was edited for length and clarity.

When Nextcloud launched, there was a big push in Europe away from on-premise software towards US cloud providers. How have attitudes towards open source and awareness of alternatives providers changed since then? “I’ve been doing open source since the ‘90s; at the time it was mostly for a nerdy audience — a very small group of people who really care about software and being in control. The sovereignty part was always there. It’s the core idea behind open source that you can understand what the software is doing, you can deploy it wherever you want, you can study it and change it, and so on. 

“At the time, it was very niche, and since then it’s really growing and growing. There are certain points in time that really accelerated the growth; something like the Snowden revelations, for example, or the whole discussion about GDPR and certain legislation. And then, of course, the current geopolitical situation.  

“I personally find it interesting that it grew from something that is just interesting for software developers, and now it’s on the geopolitical stage. I have meetings with big politicians who really care about it now, and I personally find it interesting that it’s increasingly understood by — I wouldn’t say the mainstream, but more and more people.

“At the beginning of Nextcloud, we mostly talked with IT managers looking for a solution; they care about how it works, the price and other things. But now we are also talking with the C-level people. It’s part of an overall strategy of a company, to say, ‘Hey, we need to look into the dependencies, we want to have a solution that fits into the strategy of the company.’

“In the past, it was like a commodity – it’s just some software, who cares? Now, it’s really part of the company strategy. That’s really interesting.”

There’s been a lot of interest around digital sovereignty over the past couple of years. To what degree is this translating into action, with organizations migrating away from US cloud providers? “The interest is gigantic. Everybody’s talking about it, we have so many contacts and people coming to us. Not everybody is doing it — a lot of people are just exploring and seeing what the options are. 

“Obviously, we hope that this will translate into actions in a few months. At the moment, it’s a lot of talking and exploring the options. As a company, we are also growing a lot in customer base.  But the interest in this space is even bigger; we see it as the beginning of a funnel.

‘In defense we see a lot of interest, then also everything around education is very important for us, then other regulated markets like the healthcare, for example. Finance is an interesting one.”

A lot of the conversations around digital sovereignty are tied to the current geopolitical situation and even the US administration. Do you see demand for sovereign technology as a structural change or are some organizations holding back to see how the situation improves in the future? “I see it as a long-term trend. If you look at the IT budgets and projects in the ‘90s, it was some something unimportant. It was, of course, important that the printer works and the fax machine works, but it was not definitely not strategic for the company. 

“And then in 2000, the whole cloud trend came up, and there was the big hope that this will save money. It was always the narrative with cloud computing that you can just outsource it and save money and it’s great. 

“Nowadays, people realize that it’s not something that you can just ignore. I wouldn’t say that everything comes back on premise, but people care about it now. They understand it’s not just a commodity, like water, or electricity that comes out of the wall and you don’t care what’s behind it. People realize that it’s something that has an impact on the future of an organization, from a vendor lock-in perspective, from a cost perspective, from an industry espionage perspective, and competitiveness. With open source, you’re more flexible. So, I think the trend that this is all more strategic and important for the future, this will go on.”

The European Commission recently published its Tech Sovereignty Package, including its open source strategy. Are these proposals sufficient to address the concern around digital sovereignty and support the open source ecosystem in Europe?

“It’s great, I really like it. I was actually surprised they listened so well. But now the real challenge is to actually do it; this still needs to happen. The description of the problem and a possible solution, this is all very good. I’m surprised, I’m happy about it, but to put this into actually binding law, this still needs happen.”

Would you like to see any changes to the current proposals before they’re gets passed into legislation? “At the moment, they have these four different risk levels, and the most critical one — No. 4 — is one where they accept only open source and European solutions. This is the highest risk level, but this is only for 1% of the market. I hope that it’s better understood that more than 1% should care about this more.

“If you have something which is completely not critical, maybe doesn’t possess any personal data at all — sure, it’s totally fine [to use non-EU suppliers]. But if you have GDPR requirements, espionage protection, no vendor lock-in, and so on, then there should be more of that [the highest requirement level].”

US firms have attempted to address European customers’ concerns in different ways, with sovereign marketed cloud services and joint ventures with European providers. Microsoft 365 Local is designed to run on premise. Where do you draw the line between what’s actually a sovereign solution and what some call ‘sovereignty washing? “Sovereignty has different dimensions, of course. But if you look at the problem of the CLOUD Act alone, which gives foreign agencies full access to the data here, then the whole idea that it’s enough to have European data centers — that’s not enough. It’s clearly written in the CLOUD Act, that even with [European] data centers, or subsidiaries, it still applies.  

“Microsoft tries to find a solution there with its Delos idea; a company that is owned by SAP — a German company — and Microsoft delivers only the software. But even then, you have this dependency, because software needs updates and software security updates. And if they’re not available, or if someone puts a backdoor into the software, which is possible, then you still have a problem. 

“So, they’re trying really, really hard to find a way around the problem, but it’s not easy for them.”

To look ahead a bit in terms of the product strategy, there were announcements for Nextcloud Hub this week around AI agents, and the program to work with independent software vendors. What do these say about Nextcloud’s future? “The overall product strategy will not change so much; it’s about having state-of-the-art collaboration software — but with a lot more control, security and safety — that’s open source and independent where you host it. So this will always stay, but of course, there’s some additional factors that come into play now, like the AI impact that we see and want to leverage with our agent strategy. 

“We’ve had this for one and a half years already, but we are expanding that. In the future, you might still use an interface in a classic way that you open documents and type in text and so on. But there are also a lot of operations that can be automated in the future with AI. And this is something we really invest a lot into. 

“Another aspect of AI is how easy it is to build custom software around it. The coding models are getting better all the time, which means there will be more and more custom business software. This is what we want to capture with our ISV program. Software development will become easier, but you don’t want to deploy just random software in your company, you want to have something that is tested, certified and secured, and that somebody’s accountable for it. This can be something we can provide at Nextcloud.”

Editor’s note: NextCloud paid for Matthew Finnegan’s travel and hotel costs for NextCloud Summit 2026, but had no editorial role in the creation of this story.

The ability for attackers to leverage automatic install script execution in npm will finally come to an end when expected changes arrive from GitHub in July. Coders will still be able to enable the function, but the default setting will block it. 

In V12, default settings are changing, GitHub said in its changelog, noting, “it turns an npm install behavior that runs automatically today into one you explicitly opt into.” 

Specifically, the post said, “allowScripts defaults to off: npm install will no longer execute preinstall, install or postinstall scripts from dependencies unless they are explicitly allowed in your project. This includes native node-gyp builds; a package with a binding.gyp and no explicit install script still gets blocked, because npm runs an implicit node-gyp rebuild for it. Prepare scripts from git, file, and link dependencies are blocked the same way.”

Analysts, consultants, and users generally applauded the change, but said that it would only narrow the exposure to supply chain attacks instead of eliminating it. 

Attacks likely to move elsewhere

Sonu Kapoor, maintainer for CVE Lite CLI in the OWASP Incubator Project, said that this change is likely to force the supply chain attacks that leveraged the automatic execution to move elsewhere.

“This does not eliminate npm supply chain risk, it removes a major automatic execution path,” Kapoor said. “Attackers can still move to other paths: malicious package code that runs at application runtime, compromised maintainer accounts, dependency confusion, typo-squatting, poisoned GitHub Actions workflows, malicious transitive dependencies, or stolen publishing tokens. This closes one very dangerous door, but it does not secure the whole house.”

Still, attacks leveraging the setting have been regularly used in supply chain attacks. 

However Alan Parkinson, director of secure medical device firm Threat Detective, said more sophisticated attackers have already moved beyond this hole. 

“The install script attack vector has been known for years,” Parkinson said. “Most security teams marked it as low risk and moved on to higher risk threats. What raised its profile wasn’t the technical exploitability changing, it was a run of high-profile victims and some threat actors openly chasing notoriety.”

He added, “the pre and post install scripts was never a clever attack vector to begin with. Running code from an install hook is crude and noisy, which is why it caused such visible damage. The more capable actors are already moving to other methods, so v12 mainly shuts the door on less sophisticated threat actors.”

Although GitHub declined an interview, Zach Steindler, a GitHub principal engineer, answered InfoWorld’s questions by email. He said the volume and pace of supply chain attacks forced the default settings change. 

“We’ve seen attackers target these capabilities to quickly propagate attacks from one compromised package to many. Years of security and usability research have shown that it’s not enough to make secure functionality available; the secure path has to be the default in order for it to be widely adopted,” Steindler said.

He added, “we believe that these changes are a great way to provide high impact secure defaults while still providing the option for some users to fall back on functionality they might need in some circumstances.”

Change overdue

Sanchit Vir Gogia, chief analyst at Greyhound Research, said that GitHub was the last of the repositories to make the setting default change. “Rivals moved first: Yarn, pnpm and Bun all block third party install scripts by default in their own ways,” Gogia said. “Npm is not inventing a new doctrine. It is finally adopting one.”

Steindler didn’t dispute Gogia’s comment. 

“It’s not easy being the stewards of the largest package repository in the world. Community consensus on what security capabilities should be standard, and when it’s okay to make breaking changes shifts over time. From our continual conversations with the community, it was clear it was time to make this change,” Steindler said.

“The recent attacks are alarming,” he noted, “but stewarding these package repositories is a multi-decade effort, not just a moment in time. As attacks evolve, so will our defensive security capabilities. We’re in this for the long haul.”

Gogia said that the change, although overdue, is a good one. 

“Npm is removing one of the most comfortable hiding places for software supply chain risk: code that executes the moment a developer types install,” Gogia said. “With npm v12, execution becomes something that must be approved, recorded in the project, and committed for review. That is not a design adjustment. It is a change in control philosophy.”

Bad defaults become infrastructure

Gogia had his own take on why GitHub waited so long.

“Npm waited because its risky default acquired a constituency. As far back as 2016, npm’s own position was that the convenience of install scripts outweighed the worm risk, with an opt-out flag for the cautious. The trade-off was a documented product decision, not an oversight,” he said.

“The trouble with bad defaults is that they become infrastructure,” he added. “Native module builds, browser installers such as Playwright and Cypress, Electron download flows and Husky hooks all grew around automatic execution. Turning it off became less a technical adjustment and more a constitutional reform.”

Liability changed hands

The real pressure for the change, however, came from regulators.

“The deeper answer is that the liability changed hands. Once regulation such as the EU Cyber Resilience Act and securities disclosure rules placed supply chain failure on corporate balance sheets, a documented unsafe default became indefensible,” Gogia said. 

Kapoor agreed that long-used procedures enabled this security hole to survive longer than it should have. 

“The reason this likely was not done long ago is compatibility,” he said. “Install scripts are not only used by attackers. Many legitimate packages use them to compile native modules, download platform-specific binaries, generate files, or complete setup steps. Changing the default breaks assumptions that have existed in the npm ecosystem for years. That is why these security changes often arrive slowly. The safer default is obvious from a security perspective, but painful from an ecosystem compatibility perspective.”

In addition, he noted, “the bigger point is that package managers are moving from implicit trust to explicit trust. That is the right direction. Developers should have to approve which dependencies are allowed to execute code during install. But approval cannot become a blind checkbox. Teams need visibility into which package wants to run a script, whether it is direct or transitive, why it is there, and whether it belongs in the project at all.”

Kapoor added that this change matters because install-time execution often happens in privileged environments with access to tokens, secrets, internal registries, build artifacts, or deployment paths. “Even if the script does not compromise production directly, it may be able to steal enough context to support the next stage of an attack,” he said.

Value in the pain

Cybersecurity consultant Brian Levine, executive director of FormerGov, agreed that the closing of this security hole is a very good thing. 

“It seems like virtually every major supply chain attack of the last decade has had the same original sin: code that ran automatically because the ecosystem let it. Npm finally closing that door by default is overdue, but it’s genuinely significant. This is the package manager for hundreds of billions of downloads a month,” Levine said.

“When npm changes its defaults, it changes the security posture of practically every enterprise dev environment on the planet. It may have been the last large code repository to still allow this kind of automated execution.”

Levine added that this change might not merely stop a security hole, but the new process may meaningfully improve security. 

“There’s actually something valuable buried in this migration pain. Having developers explicitly approve which packages can run code and commit that list to source control is a form of software supply chain governance that many organizations never had,” Levine said. “It creates an auditable record which is meaningful, especially for regulated industries.”

The ability for attackers to leverage automatic install script execution in npm will finally come to an end when expected changes arrive from GitHub in July. Coders will still be able to enable the function, but the default setting will block it. 

In V12, default settings are changing, GitHub said in its changelog, noting, “it turns an npm install behavior that runs automatically today into one you explicitly opt into.” 

Specifically, the post said, “allowScripts defaults to off: npm install will no longer execute preinstall, install or postinstall scripts from dependencies unless they are explicitly allowed in your project. This includes native node-gyp builds; a package with a binding.gyp and no explicit install script still gets blocked, because npm runs an implicit node-gyp rebuild for it. Prepare scripts from git, file, and link dependencies are blocked the same way.”

Analysts, consultants, and users generally applauded the change, but said that it would only narrow the exposure to supply chain attacks instead of eliminating it. 

Attacks likely to move elsewhere

Sonu Kapoor, maintainer for CVE Lite CLI in the OWASP Incubator Project, said that this change is likely to force the supply chain attacks that leveraged the automatic execution to move elsewhere.

“This does not eliminate npm supply chain risk, it removes a major automatic execution path,” Kapoor said. “Attackers can still move to other paths: malicious package code that runs at application runtime, compromised maintainer accounts, dependency confusion, typo-squatting, poisoned GitHub Actions workflows, malicious transitive dependencies, or stolen publishing tokens. This closes one very dangerous door, but it does not secure the whole house.”

Still, attacks leveraging the setting have been regularly used in supply chain attacks. 

However Alan Parkinson, director of secure medical device firm Threat Detective, said more sophisticated attackers have already moved beyond this hole. 

“The install script attack vector has been known for years,” Parkinson said. “Most security teams marked it as low risk and moved on to higher risk threats. What raised its profile wasn’t the technical exploitability changing, it was a run of high-profile victims and some threat actors openly chasing notoriety.”

He added, “the pre and post install scripts was never a clever attack vector to begin with. Running code from an install hook is crude and noisy, which is why it caused such visible damage. The more capable actors are already moving to other methods, so v12 mainly shuts the door on less sophisticated threat actors.”

Although GitHub declined an interview, Zach Steindler, a GitHub principal engineer, answered questions by email. He said the volume and pace of supply chain attacks forced the default settings change. 

“We’ve seen attackers target these capabilities to quickly propagate attacks from one compromised package to many. Years of security and usability research have shown that it’s not enough to make secure functionality available; the secure path has to be the default in order for it to be widely adopted,” Steindler said.

He added, “we believe that these changes are a great way to provide high impact secure defaults while still providing the option for some users to fall back on functionality they might need in some circumstances.”

Change overdue

Sanchit Vir Gogia, chief analyst at Greyhound Research, said that GitHub was the last of the repositories to make the setting default change. “Rivals moved first: Yarn, pnpm and Bun all block third party install scripts by default in their own ways,” Gogia said. “Npm is not inventing a new doctrine. It is finally adopting one.”

Steindler didn’t dispute Gogia’s comment. 

“It’s not easy being the stewards of the largest package repository in the world. Community consensus on what security capabilities should be standard, and when it’s okay to make breaking changes shifts over time. From our continual conversations with the community, it was clear it was time to make this change,” Steindler said.

“The recent attacks are alarming,” he noted, “but stewarding these package repositories is a multi-decade effort, not just a moment in time. As attacks evolve, so will our defensive security capabilities. We’re in this for the long haul.”

Gogia said that the change, although overdue, is a good one. 

“Npm is removing one of the most comfortable hiding places for software supply chain risk: code that executes the moment a developer types install,” Gogia said. “With npm v12, execution becomes something that must be approved, recorded in the project, and committed for review. That is not a design adjustment. It is a change in control philosophy.”

Bad defaults become infrastructure

Gogia had his own take on why GitHub waited so long.

“Npm waited because its risky default acquired a constituency. As far back as 2016, npm’s own position was that the convenience of install scripts outweighed the worm risk, with an opt-out flag for the cautious. The trade-off was a documented product decision, not an oversight,” he said.

“The trouble with bad defaults is that they become infrastructure,” he added. “Native module builds, browser installers such as Playwright and Cypress, Electron download flows and Husky hooks all grew around automatic execution. Turning it off became less a technical adjustment and more a constitutional reform.”

Liability changed hands

The real pressure for the change, however, came from regulators.

“The deeper answer is that the liability changed hands. Once regulation such as the EU Cyber Resilience Act and securities disclosure rules placed supply chain failure on corporate balance sheets, a documented unsafe default became indefensible,” Gogia said. 

Kapoor agreed that long-used procedures enabled this security hole to survive longer than it should have. 

“The reason this likely was not done long ago is compatibility,” he said. “Install scripts are not only used by attackers. Many legitimate packages use them to compile native modules, download platform-specific binaries, generate files, or complete setup steps. Changing the default breaks assumptions that have existed in the npm ecosystem for years. That is why these security changes often arrive slowly. The safer default is obvious from a security perspective, but painful from an ecosystem compatibility perspective.”

In addition, he noted, “the bigger point is that package managers are moving from implicit trust to explicit trust. That is the right direction. Developers should have to approve which dependencies are allowed to execute code during install. But approval cannot become a blind checkbox. Teams need visibility into which package wants to run a script, whether it is direct or transitive, why it is there, and whether it belongs in the project at all.”

Kapoor added that this change matters because install-time execution often happens in privileged environments with access to tokens, secrets, internal registries, build artifacts, or deployment paths. “Even if the script does not compromise production directly, it may be able to steal enough context to support the next stage of an attack,” he said.

Value in the pain

Cybersecurity consultant Brian Levine, executive director of FormerGov, agreed that the closing of this security hole is a very good thing. 

“It seems like virtually every major supply chain attack of the last decade has had the same original sin: code that ran automatically because the ecosystem let it. Npm finally closing that door by default is overdue, but it’s genuinely significant. This is the package manager for hundreds of billions of downloads a month,” Levine said.

“When npm changes its defaults, it changes the security posture of practically every enterprise dev environment on the planet. It may have been the last large code repository to still allow this kind of automated execution.”

Levine added that this change might not merely stop a security hole, but the new process may meaningfully improve security. 

“There’s actually something valuable buried in this migration pain. Having developers explicitly approve which packages can run code and commit that list to source control is a form of software supply chain governance that many organizations never had,” Levine said. “It creates an auditable record which is meaningful, especially for regulated industries.”

This article originally appeared on InfoWorld.

The strategic initiatives for Rajeev Khanna, CIO at insurance brokerage Trucordia, mirror those of most CIOs, with implementing AI throughout the organization at the top of the list.

But Khanna also includes cybersecurity, data and analytics projects, and innovation work as strategic priorities, saying they’re “all things we’re working on in parallel.”

While none of those initiatives stands out as unique, Khanna knows he can’t follow generic project templates or work toward vague objectives in any of those areas.

Rather, he’s using automation and AI to make his company’s workflows more efficient. He’s using technology to better serve Trucordia’s specific customer needs. And he’s enabling new products and services to differentiate the company in the market and fuel growth.

“Technology,” he adds, “is enabling business innovation and speed of delivery.”

Khanna’s strategic priorities — and the goals they’re meant to achieve — are representative of what CIO.com’s State of the CIO survey found to be the key strategic initiatives for IT today.

When asked to list their most strategically important technology initiatives, CIOs put generative AI at the top, followed by agentic AI and then data/business analytics.

Security/risk management and automation of IT and business processes round out the top five.

Farther down the list are the more conventional IT tasks, such as modernization efforts, cloud management, and developing applications for and migrating applications to the cloud.

CIOs, executive advisers, and IT analysts say IT’s list of strategic initiatives shows how tech execs are spending more energy shaping and enabling their organizations’ strategies and desired business outcomes — and focusing less on technology excellence as their primary objective.

“CIOs are spearheading the IT architecture, organizational structures, and process transformation necessary to drive adoption and business value at enterprise scale,” the State of the CIO survey found.

Such shifts underscore the ongoing evolution of the CIO role from operational order-taker to transformation leader, with CIOs actively engaged with business leaders to drive AI adoption and focus on high-value outcomes from all technology initiatives.

How CIOs are spending their time in 2026 reflects this, with the study finding that CIOs are devoting more time to working more closely with business leaders on potential AI initiatives, learning about emerging tech, and creating a framework and organizational structure to support AI initiatives. Compared to last year, they’ve cut back on negotiating with IT vendors, managing IT crises, controlling costs, and managing expenses.

CIO.com / Foundry

Tech enables new capabilities, products

Khanna’s focus reflects those findings. He’s prioritizing “new capabilities for the organization that are more differentiating and creating and launching new capabilities and products for clients in a more efficient way and at a faster pace,” he says — often through use of AI.

He’s also prioritizing projects that leverage data and analytics “to serve clients better and deliver products that fit market needs.” That includes, for example, incorporating large language models (LLMs) into analytics tools so that users can interrogate data using natural language.

And he’s doing all that with “cyber always top of mind” — a perennial task that requires constant attention.

“Given that cyber is a moving target, we need to work at staying current, modernizing, and staying ahead of the curve on what the bad actors are doing,” Khanna says. “That’s going to be a forever, ongoing focus.”

Scaling AI is the goal

Nick Nadgauda, global CIO at MetLife, similarly speaks about IT’s strategic initiatives as a business driver.

“As a CIO today, my most strategically important initiative is scaling artificial intelligence from pockets of experimentation into a core, trusted capability embedded in how the enterprise operates,” he says. “At MetLife, we view AI not as a standalone technology effort, but as a critical enabler of our strategy. It helps us sharpen decisions, simplify work, and ultimately deliver better outcomes for our customers and the business.”

To do all that, MetLife deployed MetIQ, an internal composite AI platform, that “allows teams to experiment, build, and deploy AI solutions in a secure, governed environment.” Nadgauda says the platform provides the company “the flexibility to adapt to rapidly evolving technologies while maintaining strong controls around data, privacy, and risk.”

Nadgauda’s IT team is also integrating AI into employee tools and processes, “so it becomes a thought partner that supports decisions earlier in the process, not just after the fact,” he explains.

IT is also “intentionally designing AI experiences, tools, and training that align to how people work in their roles,” Nadgauda says, noting that the organization gets “meaningful adoption” when employees see AI’s relevance to their day-to-day work.

All this, he adds, has made AI “a natural part of how work actually gets done across engineering, operations, and customer-facing teams.”

Like others, Nadgauda sees such work as evidence that the CIO’s role itself has become that strategic partner it has long aimed to be.

“It’s about shaping how the enterprise operates in a world where technology and business are fully intertwined. We need to always think about how we are making it easier for the business to move faster, make better decisions, and deliver stronger outcomes for customers,” he says.

Agentic AI becomes a priority

Likewise, Janardhan Santhanam, CIO of Tata Consultancy Services, considers transformation of the business as the strategic imperative for IT. Santhanam is using agentic AI to drive that. In the State of the CIO survey, 38% of respondents listed agentic AI as a strategically important tech initiative.

“Our most important initiative is redefining how our work gets done as an agentic enterprise,” he says, adding that the goal is to unlock “durable, nonlinear performance gains critical to our organization’s growth.”

As is the case with other CIOs, Santhanam has expanded his focus beyond IT infrastructure and even the IT realm to the whole organization to ensure success.

“In our view, this entails creating an AI-first culture amongst our workforce and resetting the operating model of internal functions and internal IT to one of ‘agents + apps + humans’ working together on intelligent decision‑making and autonomous execution,” he explains. “We have not just democratized AI infrastructure in the hands of all but also distributed agency to create 2x workers and teams.”

Furthermore, IT is reinventing processes across business departments to support desired business outcomes and add speed. Santhanam describes this work as creating “function-as-a-platform at scale.”

Reflecting another top strategic IT initiative identified in the State of the CIO survey, Santhanam stresses that IT has also prioritized security, privacy, and compliance as it advances its AI agenda.

Nearly all organizations have high hopes for agentic AI. An April 2026 study from HFS Research and Genpact found that 92% of surveyed executives believe agentic AI will fundamentally change how work is executed.

That has put pressure on CIOs to move forward with it, says Oz Vural, senior managing director of FTI Consulting.

“IT must move to agentic AI that can execute workflows and make real-time decisions within guardrails,” Vural says, noting that this is an opportunity for CIOs to contribute to increased revenue and EBITA “rather than just saving hours with automation.”

That is shifting a metric of CIO success to how quickly they deliver “time to intelligence,” he adds.

A holistic perspective on IT initiatives

CIOs, however, are hitting roadblocks on that quest.

Legacy tech, immature data programs, and skills gaps are stymying CIO ambitions around agentic AI and their other top initiatives, Vural says.

Such challenges reinforce the need for CIOs to continue prioritizing fundamental IT work, says Diane M. Carco, president and CEO of consulting firm Swingtide.

“In our time of rapidly developing technologies, I think the most strategically important initiative is clearing out the old to make way for the new,” Carco says. “Reducing technical debt by getting rid of shelfware and outdated, nonstandard systems is probably the most strategically sound and impactful thing a CIO can do to eliminate waste and improve customer satisfaction. Once that is done, plotting the right course of action for AI implementation is next.”

CIOs seem to agree on the importance of foundational IT work, as the State of the CIO Survey found that application modernization and cloud management were both cited as a strategic initiative by 20% of respondents, with infrastructure management cited by 17% and cloud infrastructure by 16%.

Given that such foundational technology initiatives are instrumental to those involving AI and leading-edge technologies, Ricki J Koinig, CIO of the Wisconsin Department of Natural Resources, says she doesn’t segregate some as strategic and others as not.

“I believe the most strategically important priorities for a CIO are often the ones that are not branded as standalone projects but instead underpin everything the organization does. In my view, three such initiatives are foundational to sustained success: innovation readiness, embedded cybersecurity, and organizational readiness,” she explains.

For Koinig, innovation readiness has become a defining capability. “Being ‘ready’ is no longer about keeping your asset management up-to-date or adopting a specific technology; it’s about continuously raising the bar of foundational work, including maintaining high-quality, governed data, ensuring collaboration, relevant input, and transparency in decision-making throughout key stakeholder layers, and sustaining operational discipline across systems and processes,” she says.

“Innovation readiness also requires a deliberate commitment to managing technical debt, routinely assessing the health of the technology landscape, and making conscious efforts to provide appropriate skills and capacity to move on actual mitigations,” she adds.

Meanwhile, cybersecurity “must evolve from a perceived constraint into an embedded capability within all functions — business as well as IT,” Koinig notes. It involves embedding best practices and requirements throughout the various units. “When done well, cybersecurity becomes organizational muscle memory that is intuitive, proactive, and inseparable from how work gets done, regardless of role.”

And then there’s organizational readiness — readiness for change, in particular.

“Innovation cannot take hold in environments that are culturally resistant or operationally unprepared to evolve,” Koinig says, noting that leaders must “intentionally cultivate a culture that embraces change as a constant, not a disruption, while aligning talent strategies to support that mindset.”

The need for a central data repository for enterprise analytics and gen AI has made the data lakehouse the default choice for enterprise data. Meanwhile, the emergence of open table standards makes the shift easier and reduces vendor lock-in for enterprises while also allowing for better integration between lakehouses and other enterprise systems and service providers.

Data lakehouses combine the structure of data warehouses with the flexibility of data lakes, making them versatile tools to make the most of any data the enterprise collects, whether it’s for business analytics, integration with other systems, or providing relevant context to LLMs.

The idea behind the data lakehouse is to merge together the best of what data lakes and data warehouses have to offer, says Gartner analyst Adam Ronthal.

Data warehouses also enable companies to store large amounts of structured data with well-defined schemas, as they’re designed to support a large number of simultaneous queries and deliver results quickly to many simultaneous users.

Data lakes, on the other hand, enable companies to collect raw, unstructured data in many formats for data analysts to hunt through. These vast pools of data have recently grown in prominence thanks to the flexibility they provide enterprises to store massive data streams without first having to define the purpose of doing so. 

According to Gartner, data lakehouses are the next step in the evolution of data architectures, merging these two capabilities into a single platform to overcome limitations of previous architectures, reducing complexity, streamlining data management, and supporting diverse workloads.

In late 2025, Gartner also released the first market guide for data lakehouse platforms. “The lakehouse is now firmly established as the architecture that most organizations will seek to standardize on,” wrote Ronthal and his co-authors in the report.

Meanwhile, data lakehouses themselves are also standardizing on the Apache Iceberg data table format, first created by Netflix in 2017, and donated to the Apache Software Foundation the following year. It hit the tipping point in 2024 with adoption by companies like Apple, LinkedIn, Adobe, and all the major cloud vendors. Even Databricks, which created the competing Delta Lake standard, now supports Iceberg natively.

Lakehouse vendors are opening their architecture more to allow better access to the data by third parties, says Gerry Szatvanyi, chief AI officer at consulting firm OSF Digital. “That wasn’t the case a few years ago,” he says.

And other enterprise service providers have been taking advantage of this, he says. For example, Salesforce Data Cloud can connect directly to Iceberg-formatted data.

“Salesforce has a Zero Copy access format, so it can connect its own data platform to another data lake without copying data into Salesforce,” says Szatvanyi.

And of course, as with everything else in the enterprise today, gen AI is having a big effect. Data lakehouses are particularly good for LLMs because they can provide critical business context for RAG embeddings and MCP access, the two most common ways to feed data into LLMs.

“Lakehouses are being accessed more by AI agents,” Szatvanyi says. “It’s the main thing I see happening.”

Even traditional business analytics is now increasingly handled via AI interfaces, he adds, democratizing user access to enterprise data.

In a recent IDC report, the leading vendors in the data platform space are Databricks, Google, Oracle, and Snowflake, with other major players including Microsoft, IBM, and Cloudera. IDC also listed Amazon SageMaker as a lakehouse platform to watch, but it only became widely available in early 2025, so wasn’t yet included among the top vendors.

Gartner includes Databricks, Google, Oracle, Snowflake, Microsoft, IBM, Cloudera and Amazon SageMaker on its list of representative vendors for data lakehouse platforms, among other firms.

The business benefits of data lakehouses

Docusign opted to go with Snowflake for the data platform used to train an internal agent for sales, and is training its ML models in order to serve customers more accurately. Information is pulled from Salesforce, and they’re also exploring Atlassian and ServiceNow, as well as other internal custom tools.

The information also goes out to LLMs using RAG embedding pipelines, and MCP connectivity is also being explored as the technology matures.

Other companies use data lakehouses for the flexibility of the data sources it supports and the volume of data they can handle.

Sega Europe, for example, began using the Amazon Redshift data warehouse to collect event data from its Football Manager video game back in 2016. At first this event, data consisted simply of players opening and closing games.

“But there was so much more data we could collect,” says Felix Baker, the company’s head of data services. “Like what teams people were managing, or how much money they were spending.”

Because of the data structures needed for inclusion in the data warehouse, data was coming in batches and it took too much time to analyze.

“We wanted to analyze the data in real-time,” Baker adds, but this functionality wasn’t available in Redshift at the time. “Databricks offered an out-of-the-box managed services solution that did what we needed without us having to develop anything,” he adds. In addition, the data lakehouse architecture enabled Sega Europe to ingest unstructured data, such as social media feeds.

The cost efficiencies enabled by providing a source for all of an organization’s structured and unstructured data is a value driver for data lakehouses, says Steven Karan, AI transformation lead at Capgemini, and it’s helped implement data lakehouses at leading organizations in financial services, telecom, and retail.

Moreover, data lakehouses store data in a way that it’s readily available for use by a wide array of technologies, from traditional business intelligence and reporting systems to ML and AI. “Other benefits include reduced data redundancy, simplified IT operations, a simplified data schema to manage, and easier to enable data governance,” Karan says.

Helping data emerge

One particularly valuable use case for data lakehouses is in helping companies get value from data previously trapped in legacy or siloed systems. For example, one Capgemini enterprise customer, which had grown through acquisitions over a decade, couldn’t access data related to resellers of their products.

“By migrating the siloed data from legacy data warehouses into a centralized data lakehouse, the client could understand at an enterprise level which of their reseller partners were most effective, and how changes such as referral programs and structures drove revenue,” he says.

One company capitalizing on the benefits of data lakehouses is life sciences, analytics, and services company IQVIA, which began using data lakehouses several years ago.

Before the pandemic, pharmaceutical companies running drug trials used to send employees to hospitals and other sites to collect data about things such as adverse effects, says Wendy Morahan, senior director of product management for clinical data analytics at IQVIA. “That’s how they make sure the patient is safe.”

Once the pandemic hit and sites were locked down, however, pharmaceutical companies had to scramble to figure out how to get the data they needed — and to get it in a way that was compliant with regulations, and fast enough to enable them to quickly spot potential problems.

Snowflake and Databricks gave the company the ability to store the raw data in any format, including images and audio, all in a single platform.

Lakehouse adoption growth

In a February report from Research and Markets, the data lakehouse market has been growing exponentially.

In 2025, it totaled $10.3 billion and is predicted to hit $12.6 billion by the end of this year, a compound growth rate of 22%. By 2030, this will be up to $27.3 billion, the research firm projects.

And according to a recent survey from Dremio, a lakehouse vendor, 63% of companies run most analytics on a lakehouse rather than a traditional warehouse, up from 55% in 2024.

Data lakehouses are also increasingly being used for IT and security workloads, says Ed Bailey, field CISO at telemetry vendor Cribl. “Previously, lakehouse providers were the realm of business data with a focus on structured data and SQL.”

Lakehouses can handle IT and security data at a lower cost, and this is a critical issue given the volumes of data in this space. “Even mid-sized companies produce much more IT and security data than business data,” he says. “Lakehouse vendors are finally starting to push into the market.”

But it’s still early, and initial solutions are immature and an awkward fit for this kind of data. “IT and security data are very different from business data,” he adds. For example, business data tends to be more predictable and well-structured. Plus, business users are more familiar with using data analytics tools than IT and security users. “This mismatch has been a serious obstacle to adoption,” he says.

Data lakehouses are also evolving in another way. Gartner says the lakehouse isn’t the ultimate solution but a transitional architecture on the way to more advanced systems, such as data fabric. The difference between the two is data lakehouses contain data from disparate systems, while data fabrics simply contain pointers to where the data is natively located.

An advantage of data fabrics is that the original security access controls and metadata are preserved and used, there’s no duplication of data, and no need to reconcile disparate standards.

“But it comes with some performance issues, and access isn’t that seamless,” says OSF Digital’s Szatvanyi.

A data fabric might be a good place for smaller companies to start, he says, or you can use both. “You can have a big chunk of data in a lakehouse and have a fabric for two or three secondary systems,” he says. “But I’d say the data lakehouse is the gold standard.”

Four years ago, when Broadcom announced plans to buy VMware, analysts recommended that enterprises start looking for an exit strategy based on Broadcom’s less-than-stellar track record with prior acquisitions. The fear was that Broadcom would raise prices, reduce support, and stop investing in the technology.

Some of those concerns have come to pass. Broadcom eliminated perpetual licenses, forced customers onto a more costly subscription model, pushed customers toward longer term contracts, raised the minimum licensed cores per order from 16 to 72, required that customers buy a full bundle of VMware products under the Virtual Cloud Foundation (VCF) banner, significantly reduced the number of resellers, and focused attention on the top 10,000 customers (out of a total customer base in excess of 300,000).

On the other hand, Broadcom has poured significant resources into VCF, as evidenced by the recent release of VCF 9.1, which the company describes as an AI- and Kubernetes-native private cloud platform with integrated security.

And CEO Hock Tan has articulated a clear vision for VMware as the indispensable platform for enterprises running both traditional and AI workloads in a private cloud setting.

“VMware Cloud Foundation, VCF, is the essential software layer in data centers integrating CPUs, GPUs, storage, and networking into a common, high-performance, private cloud environment,” Tan said during Broadcom’s earnings call in March. “As the permanent abstraction layer between AI software and physical chips, VCF cannot be disintermediated or replaced.” 

Whether Broadcom’s strategy is brilliant (from the Wall Street perspective) or diabolical (from the enterprise perspective), it seems to be working. Broadcom’s first quarter 2026 revenue was up 29%, and the company said it expects an astounding 47% year-over-year increase in the current quarter. While much of that is driven by chip sales, VMware revenue was up 13% year-over-year, and recurring VMware-based revenue growth is on pace for a 19% increase.

“Of our 10,000 largest customers, over 87% have now adopted VCF,” Tan boasted during the company’s March earnings call. “This growth reflects our success in converting our enterprise customers from perpetual vSphere to the full VCF software stack subscription.”

So, what happened to the mass migration away from VMware and onto alternative virtualization platforms or the public cloud? And is the Broadcom strategy sustainable over the long term?

Migration plans muddied by complexity

There’s no question that the disruption caused by Broadcom’s acquisition of VMware has resulted in virtually all customers investigating alternatives. And that’s where it gets murky, because the two-phase analysis of figuring out what it would take to extricate from the VMware platform, and then deciding on an alternative, is exceedingly complex.

Gartner analyst Paul Delory has pointed out that it could take a midsized organization two years and a large enterprise up to four years to untangle its dependency on VMware. The cost and complexity of that migration might cancel out any savings associated with a lower-cost alternative and might introduce additional risk, says Delory.

Companies that are actively seeking to move off VMware but have not done so already are facing a very difficult task, Keith Townsend, technology management consultant and founder of The CTO Advisor, tells Network World.

“More than technical difficulties are operational difficulties,” Townsend says. “VMware is not just a technology. It’s the established operating model for these customers’ software defined data center. This includes everything from capacity management, procurement and audit. Furthermore, any potential savings to move to a new platform may not be worth the operational risk or distraction from other projects, such as AI infrastructure.”

A recent survey commissioned by CloudBolt paints a similar picture, with 87% of respondents indicating that they are actively reducing their VMware footprint, but only 4% have completed a full migration. The complexity of migrating and associated costs were cited as the top roadblocks.

Forrester analyst Naveen Chhabra says he has spoken with hundreds of VMware shops over the past few years. “I see most companies reducing their VMware estate as much as possible,” he says. However, Chhabra adds that what’s possible is highly dependent on factors like how soon the current VMware license expires and how many VMware tools are in use.

Companies with a short time to renew and that use a ton of VMware have few options other than to stick with it for the time being. Customers that have a longer runway before contract renewal time and only use a small number of VMware tools are in a better position to migrate. They have time to analyze dependencies, come up with a migration/modernization plan, and explore alternatives.

But, for large enterprises, it’s even more complex than that. Faced with the choice of maintaining on VMware, migrating, or modernizing, enterprises are “doing all three simultaneously,” says Chhabra.

Law firm modernizes on Nutanix

Tim Conners, chief technology officer at the global law firm Simpson Thacher & Bartlett LLP (STB), tells Network World that concerns about the difficulty of migrating off VMware are somewhat overblown.

“There’s tons of fear out there, but it’s not as hard are they’re making it out to be. We built four new data centers in the past 12 months in all four corners of the planet, all powered by Nutanix, with pretty much zero down time,” Conners says.

STB was in a relatively unique position. The company’s data center hardware infrastructure, which includes HPE, Everpure (formerly Pure Storage), and Dell products, was approaching end of life. The firm needed to move its primary data center, plus it was experiencing rapid expansion across Europe, Asia, and Latin America. “We started looking at [questions such as] what does our future look like? Where do we want to go? How do we innovate? How do we scale? We needed to modernize our network for the AI revolution that we saw coming. We were a little lucky in the sense of the timing of all that,” says Conners.

While STB was primarily a VMware shop, there was some Nutanix gear in the mix, Conners said, and he had experience with Nutanix at prior jobs. The migration was driven not by cost concerns or dissatisfaction with VMware, but by a desire to modernize the infrastructure, to standardize across data centers, and to simplify from a three-tier architecture to an “all-in-one” box that integrates compute, storage and networking.

Since he was building out new infrastructure capacity in new locations, Conners didn’t have to move existing gear around, and could install the new hyperconverged infrastructure in a parallel operation. “We didn’t have to put servers on dollies,” he says.

The migration to an entirely new platform also gave Conners the opportunity to take a hard look at capacity needs, to “clean up” the existing infrastructure, and to right-size for the future, building in extra capacity to accommodate growth.

Conners says with Nutanix live migration tools, the cutover has been smooth, and the Nutanix HCI has delivered increased yield for his general compute and VDI environments. He adds that Nutanix service and support, which was a concern under Broadcom, has been top notch.

Is the Broadcom strategy sustainable?

According to Broadcom, 87% of the top 10,000 customers are re-upping on VCF. According to CloudBolt, 87% of survey respondents are actively reducing their VMware footprint. How can both things be true?

When Chhabra drills down into the numbers, he points out that if all of those VMware customers were absorbing massive price hikes, then Broadcom’s VMware revenue growth would reflect those skyrocketing numbers. The fact that VMware revenue is only growing at a modest 13% indicates that customers are renewing, but at the same time reducing their overall VMware footprint. By his calculations, the average customer is only renewing 25% of its VMware estate.

Steve McDowell, chief analyst and founder at NAND Research, notes that Broadcom’s VMware strategy isn’t focused on growing its customer base.

“Broadcom’s VMware strategy prioritizes monetizing the existing customer base over expanding it,” McDowell says. “It’s an approach that has already generated strong short-term financial results and promises to continue to deliver over the near-term. The challenge is that it’s a strategy that’s driving many customers to competitors.”

McDowell adds: “The critical question for 2026 and beyond is whether higher average revenue per customer can continue to outpace the inevitable churn from aggressive pricing shifts. Broadcom has delivered on its promise to investors in the near term, but sustaining momentum without further alienating its customer base will determine whether this high-stakes bet pays off in the long run.”

Broadcom is also banking on companies continuing to invest in private clouds rather than simply moving workloads to the public cloud. And Tan wants to cash in on AI-powered private cloud data centers.

Chhabra is not convinced about the latter. “How many companies will be able to get the infrastructure to run private AI models? Do companies have a business plan to do that? How much power is required to run hundreds of kilowatts of racks? Private cloud AI certainly has a story, but how much translates into revenue for VMware? That’s the question.”

Still, if Broadcom finds success outside its largest tier of VMware customers, there’s room for more growth. In Broadcom’s March earnings call, Tan noted that the largest 10,000 companies are finding success and value with VCF. “We are now looking at whether the next 20,000, 30,000 midsized companies see it the same way. Stay tuned.”

Three business units. One weekend. Zero governance checkpoints. That is what a Fortune 500 CIO I advise discovered last quarter when autonomous AI agents deployed by separate teams accessed customer databases, initiated vendor negotiations and generated compliance reports without a single human sign-off. Nobody verified the context protocols connecting those agents to enterprise systems. Nobody asked whether the AI’s decisions aligned with the company’s risk appetite. Nobody even knew the agents had been activated until Monday morning. The agents simply acted, and the enterprise had no mechanism to hold them accountable.

That scenario captures everything that has changed about the CIO role. Schaper et al. (2025) in the Journal of Information Technology demonstrated through analysis of U.S. firm patent portfolios that CIO characteristics directly shape digital exploration outcomes. The CIO is no longer an operational custodian. Bendig et al. (2023) in MIS Quarterly proved that CIO presence in the top management team shifts organizational attention toward digital innovation. The academic evidence and boardroom reality have converged: the CIO now architects enterprise competitiveness. But competitiveness without governance is recklessness. And most organizations have not caught up.

The structural transformation is not incremental

Deloitte’s 2025 Tech Executive Survey of 622 senior technology leaders found that 65% of CIOs now report directly to the CEO, up from 41% a decade ago. Thirty-six percent manage a profit-and-loss statement. Fifty-two percent of technology organizations are now viewed as revenue generators rather than service centers. Sixty-seven percent of CIOs aspire to the CEO role itself. These are not technologists playing at business. These are business leaders whose technological fluency is the single most potent competitive advantage their enterprises possess.

McKinsey crystallized this in their analysis A New Dawn for the Technology Officer, identifying four CIO archetypes:

• The Orchestrator, who leads digital strategy with P&L accountability
• The Builder, who creates AI-native revenue streams
• The Protector, who owns cybersecurity as revenue protection
• The Operator, who integrates technology so deeply into business that the boundary between IT and enterprise vanishes entirely.

The McKinsey Global Tech Agenda 2026 confirms that AI investment has surpassed cybersecurity and infrastructure modernization as the number-one CIO priority. Gartner’s 2026 survey of 3,186 respondents across 88 countries found that 94% of CIOs expect major shifts within 24 months, yet only 48% of digital initiatives currently meet targets. The gap between ambition and execution is precisely where CIO leadership matters most.

The governance vacuum that nobody is filling

Here is where strategic elevation collides with operational peril. A recent scholarly analysis by Sprongl (2026) argues persuasively that agentic AI does not create governance fragility so much as it exposes existing ambiguity in how organizations allocate decision rights and consequence ownership. When execution velocity exceeds authority response capacity, a structural accountability gap emerges. That gap is the CIO’s problem to solve.

The numbers are sobering. McKinsey’s agentic AI security analysis found that 80% of organizations have encountered risky behaviors from AI agents, including unauthorized data exposure and improper system access. Harvard Business Review’s 2024 analysis revealed a striking disconnect: While 76% of board members use generative AI in some capacity, only 12% of boards turn to the CIO for AI input. That gap is a governance failure waiting to happen. BlackFog’s 2026 survey found 49% of employees using unsanctioned AI tools. IBM’s 2025 Cost of Data Breach Report documented that shadow AI adds $670,000 to average breach costs, with 97% of AI-related breaches lacking proper access controls. CyberArk reports machine identities outnumber human identities 80 to 1 in most enterprises. Each represents an ungoverned attack surface.

The Model Context Protocol (MCP), launched by Anthropic in 2024 to standardize AI-to-enterprise data connections, illustrates the challenge perfectly. Documented incidents already include GitHub MCP data exfiltration, cross-tenant exposure through misconfigured integrations and remote code execution vulnerabilities. A systematic review of enterprise AI governance published in January 2026 found that while data governance and cybersecurity practices are relatively mature, significant weaknesses persist in the oversight of autonomous agentic AI systems. Researchers have confirmed that 41.7% of audited MCP implementations contain serious vulnerabilities.

Zero-trust AI governance: The playbook that works

Working with Fortune 500 clients across financial services, technology, entertainment and travel, I have observed a consistent pattern. Organizations that treat AI governance as a compliance checkbox fail. Organizations that embed zero-trust principles directly into their AI architecture succeed.

Every AI agent’s request to access enterprise data should be treated like an unknown visitor at the front door: verified, scoped and logged. The ContextGuard framework I developed at HCLTech applies zero-trust principles specifically to AI context protocol interactions across four layers: Cryptographic verification of AI server identity before any data exchange, least-privilege scope enforcement limiting each agent to the minimum tool access required for its specific task, continuous behavioral monitoring detecting anomalous agent-to-tool interactions in real time, and immutable audit trail generation aligned with NIST AI Risk Management Framework and ISO/IEC 42001. In practice, this means an agent authorized to query a customer database cannot simultaneously access financial systems or code repositories, even if the underlying MCP server technically supports those connections. The principle is simple: Trust nothing, verify everything, log always.

The Cloud Security Alliance’s Agentic Trust Framework validates this approach, treating agent autonomy as something earned through demonstrated trustworthiness across progressive maturity levels. Engin and Hand’s research on dimensional governance reinforces the point: Static risk categories are insufficient for systems whose autonomy shifts dynamically. Microsoft’s Entra Agent ID, which gives each AI agent its own unique identity within a zero-trust architecture, points in the same direction. The industry is converging on a single insight: autonomous AI requires autonomous governance.

The CIO who governs AI will govern the enterprise

Greg Carmichael went from CIO to CEO of Fifth Third Bancorp. Stephen Gillett moved from CIO of Starbucks to CEO of Google’s cybersecurity subsidiary. Dawn Lepore built Charles Schwab’s e-commerce operation as CIO before becoming CEO of Drugstore.com. Only 6% of Fortune 500 CEOs currently hold technology backgrounds. That number will climb, because when AI touches every revenue stream, every compliance obligation and every competitive decision, the executive who governs that technology at scale possesses an irreplaceable advantage.

Schmitt’s 2025 research on AI integration in the C-suite argues that existing executive roles are structurally inadequate for governing AI at enterprise scale. Whether the answer is a Chief AI Officer or an expanded CIO mandate, the implication is identical: Technology governance authority is migrating upward. Gartner’s Digital Vanguard CIOs already achieve 71% success rates on digital initiatives versus the 48% average. The differentiator is not budget or talent. It is governance rigor.

The modern CIO is no longer a technologist. The modern CIO is the governance architect of how enterprises think, decide and compete in an AI-mediated economy. The organizations that understand this will dominate their markets. The ones that do not will discover, too late, that the most dangerous decision they ever made was leaving AI governance to chance.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

A veritable garden of linters and type checkers has blossomed in the Python ecosystem. Pyright and Mypy are two of the most popular, while Astral’s ty and Meta’s Pyrefly are two promising Rust-based newcomers. We compared early-stage ty and Pyrefly last June. One year later, Meta has released Pyrefly 1.0.

Pyrefly is intended to stand out from the pack by way of a few key features. It’s written in Rust for performance and memory efficiency, and it has a number of intriguing forward-looking features, some still experimental.

Setting up Pyrefly

Pyrefly installs into a Python environment like any other Python type checker (pip install pyrefly) and brings with it no additional dependencies. Visual Studio Code users can work with Pyrefly via an extension, but the extension doesn’t give you access to the command-line tools offered by Pyrefly when it’s installed in a project venv.

You can start using Pyrefly right away, with no actual setup. If Pyrefly detects no configuration for a given project, it defaults to flagging only the most high-profile errors: syntax issues, unrecognized names, and so on. To start using Pyrefly’s more advanced features, you can add a [tool.pyrefly] section in pyproject.toml, or create a pyrefly.toml file, and populate those with your desired settings.

You can also run pyrefly init on your codebase and set things up automatically, including migrating existing settings from previous Pyrefly installs or from Mypy or Pyright. By default Pyrefly will use **/*.py* as the project’s includes directory, and will automatically ignore site package paths from your configured environment, thus sparing you potentially thousands of spurious errors from your venv’s installed packages.

Using Pyrefly

Once you have Pyrefly set up on a project, you’ll likely see an immense number of new errors. To silence all of them at once via # pyrefly: ignore comment directives, run pyrefly suppress. This will not only reduce the amount of error noise, but allow you to see what each error actually is from its suppression comments.

Suppression comments have another nice readability feature: they can be placed on the line before the offending error, rather than at the end of it. You can also pre-emptively suppress errors for an entire module with one directive at the top of the file, but having each error suppressed individually makes more sense. And while there’s a pyrefly suppress --remove-unused command to remove suppressions that have no actual error, there’s no command for stripping a codebase of all suppressions. However, because suppressions are consistently formatted, you could remove those suppressions with a simple regex-powered search-and-replace.

A currently experimental feature called baseline files borrows an idea from the basedpyright tool. You generate a project-wide .json file with pyrefly check --baseline that tracks all existing errors in the project, then only new errors apart from those will be reported. It’s a handy way to refactor a codebase when new work is being done on it, so that existing problems can be handled separately.

If you have the Pyrefly extension installed in VS Code, objects without existing type hints will have suggested type hints displayed as inlays if the types can be inferred from the code. These can be added with a right click, or inserted automatically across the codebase with the command pyrefly infer.

Advanced Pyrefly features

Two major third-party Python packages have direct type annotation support in Pyrefly. One is Django and its ORM, via the django-stubs package. Models, fields, relationships, class-based generic views, and many other features have typing support. The other package, Pydantic, gets support from Pyrefly for features like fields, dataclasses, and Pydantic’s own runtime validation logic. Pydantic validation can be “lax” (automatic coercion of types via unions) or “strict” (exact types required).

Many advanced Pyrefly features are still considered experimental, but have a lot of promise. With type coverage, for instance, you can use pyrefly report to generate a JSON report of how thoroughly types are used in the codebase. (This is not to be confused with the coverage package in Python, which describes test coverage for a codebase.)

Another experimental feature lets you generate stub files for a codebase by using static code analysis (not runtime analysis). PyTorch users also benefit from a form of experimental Pyrefly support. Tensor shapes can be described with types and type-checked across transformations. Note that the typing used for this is exclusive to Pyrefly, as there is no agreed-on standard for how to do this.

Pyrefly vs. Pyright and Mypy

Pyright and Mypy have been the default choices for linting and type checking in the Python world for some time now. Pyright is an easy default for Visual Studio Code users, as it’s part of Microsoft’s Python extensions for that editor, and Mypy offers extensibility and broader compatibility with older codebases. Pyrefly, on the other hand, is forward-looking, with fewer legacy concerns. It also has a higher score for test conformance than Mypy, though not a higher score than Pyright.

Other key differences include the type checking philosophy used by each, and their licensing. Pyrefly and Pyright infer as aggressively as possible, while Mypy’s default is to skip anything unannotated. And while Pyrefly and Mypy are MIT-licensed, only Pyright’s core functionality is MIT-licensed. Pylance, the language server extension for VS Code that is powered by Pyright, is proprietary.

Finally, Pyrefly’s Rust codebase gives it a default performance edge over both Mypy and Pyright, which are written in Python and TypeScript, respectively. Astral’s ty, also written in Rust, is still more prototype than mature project. Pyrefly has enough of a feature set right now that it’s already worth experimenting with—although that’s best done on a branch of your code where adding type annotations, suppression comments, and init files won’t pose a problem.

Apple will open the doors to developers at its Worldwide Developer Conference (WWDC) next week. Beyond a big push on AI and new OSes focused on stability and performance, what should developers expect? Mostly it’s about new APIs, Foundation Models, and App Intents; here’s what I’ve been able to figure out so far.

Foundation Models

Apple has been building new Apple Intelligence APIs. One way it is achieving this is to take models made with Google Gemini, then distill and shrink them to fit inside (and run on) its devices. The progression will be to introduce these as a new crop of Foundation models developers can use in their apps. There’s more:

• New APIs mean developers will be able to run Apple Intelligence tools such as summarization directly on the customer device, all offline, all private.
• Developers that use Apple’s standard text editing/entry views will gain access to improved Apple-developed tools inside their apps without custom-coding.
• Because intelligence takes place on the user’s device, neither developers nor users will need to pay for those AI tokens. This is a distinct cost and privacy-saving advantage for customers and developers.

App Intents: The next generation

Apple continues on its quest to convince developers to make features of their apps available for use via Siri with App Intents. Doing so requires developers to wrap their apps into semantic structures, enabling speech/text-based interaction. To help them achieve this, Apple is expected to introduce a complete redesign of its App Intents framework.

Speak as you wish

While users must say “Hey Siri” to invoke its attention today, the assistant will respond more dynamically to natural language. Combined with App Intents, that means users should be able to ask Siri to use a combination of apps to make things happen on the device.

A developer might build a travel app that can take an itinerary and hand it across to a budgeting tool, for example. The idea is that with a spoken or typed command, a person will be able to call on a collection of apps to identify the destination, create an itinerary, put together a to-do list, prepare relevant letters or emails, and assemble a budget — all invoked by the original command.

What about context?

We’re expecting Siri to become better at using the content of your screen, location, and other personal data as it seeks to provide more contextualized responses. We don’t yet know the extent or form in which Apple will make that information available to third-party developers to help contextualize their own apps. Apple’s focus on privacy matters a great deal, as does its relationship with regulators, some of whom will demand that data made available to Apple’s own apps be made available to third-party apps. These are important matters for Apple, app developers, and customers who want the convenience of AI without loss of privacy.

More consistent UI tools on Swift

Swift should get better at migrating legacy code, but the big speculation around it concerns Liquid Glass. Will Swift make it easier for developers to build consistent user interfaces that work properly across all Apple’s platforms? If it does, then it will help overcome one of the big criticisms of Apple’s liquid-inspired UI. Swift will also usher in the tools developers need to support agentic application coding.

Better vibes for Xcode

Vibe coding is everywhere, including within Xcode, which is expected to gain improved contextual and predictive understanding to help boost developer productivity. Xcode could also  introduce improved real-time architectural debugging hints, aiming to make it easier for developers to build bug-free apps.

A Mac you can wear: Vision OS

All the AI enhancements made available across Apple’s other products will also be offered to visionOS. That access takes the headset another step closer to becoming the Mac you wear like sunglasses.

Elsewhere

• A new Camera API means developers can build specialized, interactive buttons that users can deploy directly within the native iOS Camera interface. This should be a great way to use more sophisticated camera apps more naturally.
• Wallet Pass means apps will be able to ingest things like barcodes or gym passes for use within Wallet.
• Icon Composer might offer more tools designed to promote consistency.

Intel finally retires

Apple will abandon Intel support in macOS 27, which means developers will likely end support for legacy Intel applications in response.

After the gold rush

Once the lights go down on WWDC, Apple’s real test will be to see if its announcements help make AI useful, private, and affordable to developers and their customers. After all, if Apple gets AI right on a platform basis, it should be able to offer the kind of on-device intelligence no one else can match, at no charge to developers or users — a move that might yet kick-start AI innovation across its platforms. This will provide a moat around the Apple ecosystem, inside which developers can explore new potentials for AI to give customers the tools they need at costs they can afford.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon, and MeWe.