Enterprise Architecture (EA) Tools unterstützen Unternehmen und Organisationen dabei, mit ihren IT-Strategien die Geschäftsziele optimal zu unterstützen. Sie sorgen ebenfalls dafür, dass Unternehmen ihre Roadmaps für die digitale Transformation geordnet vorantreiben können. EA Tools bieten dafür unter anderem Collaboration-, Reporting-, Testing- und Simulationsfunktionen. Mit deren Hilfe lassen sich Modelle implementieren, die Geschäfts- und IT-Prozesse gezielt verbessern.

Um die beste Lösung für Ihr Unternehmen zu finden, sollten Sie zuerst prüfen, ob sich das jeweilige Tool mit Ihrem Technologie-Stack integrieren lässt. Anschließend gilt es abzuwägen, ob die Informationen, Diagramme und Tabellen, die die Software zur Verfügung stellt, für das Unternehmen auch einen echten Nutzwert haben.

Empfehlenswerte Enterprise-Architecture-Tools

Nachfolgend finden Sie einen Überblick über die wichtigsten Enterprise-Architecture-Tools – in alphabetischer Reihenfolge. Sie stellen einen Mix aus Visualisierungs-, Collaboration- und Project-Management-Funktionen bereit und unterstützen eine Vielzahl von Enterprise Architecture Frameworks.

Ardoq

Nachdem zuerst über einfache Formulare Informationen von Usern, Entwicklern und sonstigen Stakeholdern im Unternehmen eingesammelt wurden, lässt sich mithilfe von Ardoq ein digitaler Zwilling der gesamten Organisation erstellen. Der Ansatz setzt also darauf, die Menschen, die in ihren Rollen mit den verschiedensten Systemen arbeiten, realistisch in ihrer Arbeitswelt abzubilden.

Jede Mitarbeiterin und jeder Mitarbeiter im Unternehmen kann später von den Netzwerkvisualisierungen und Datenfluss-Diagrammen profitieren, um seine eigene Rolle optimal zu unterstützen und den Arbeitsplatz immer wieder anzupassen und zu modernisieren. Das Tool lässt sich mit den wichtigsten Cloud-Plattformen integrieren. Es bietet eine API, die individuelle Anpassungen in allen wichtigen Programmiersprachen (Python, C#, Java, etc.) ermöglicht.

Wichtigste Use Cases:

• “Architektonischen Stress” bei Lastspitzen simulieren, falls größere Veränderungen bevorstehen;

• Verstehen, wie verändertes Nutzerverhalten neue Anforderungen generiert;

• Application Portfolio Management, um besser strategisch zu planen.

Atoll Group SAMU

Das EA-Tool SAMU macht die Enterprise Architecture sichtbar, indem es tiefe Verknüpfungen zwischen On-Premises-Systemen, dem Cloud-Layer und Tools für das Business Process Management aufzeigt. Das Tool der Atoll Group bietet vielfältige Integrationsmöglichkeiten, zum Beispiel mit Monitoring-Tools (etwa Tivoli, ServiceNow), Configuration-Management-Datenbanken (zum Beispiel CA, BMC) oder Service-Organisations-Tools (BMC, HPE). Alle Informationen fließen in ein zentrales Datenmodell ein, das um den zusätzlichen Input der Stakeholder weiter angereichert wird.

Wichtigste Use Cases:

• Enterprise-Architektur visualisieren;

• strategische Planungsprozesse und Architektur-Reviews mit Informationen unterfüttern;

• mithilfe einer visuellen Verständnisgrundlage die Kommunikation verbessern.

Avolution Abacus

Dieses Tool erfasst die Breite und den Umfang der Unternehmensarchitektur mit Hilfe eines auf Diagrammen basierenden Dashboards. Die Integration mit gängigen Tools wie SharePoint, Excel, Visio, Google Sheets, Technopedia oder ServiceNow vereinfacht die Nutzung. Abacus wurde inzwischen auch um einen Machine-Learning-Layer ergänzt, der es Anwendern ermöglicht, ein Modell zu trainieren, das ihnen beispielsweise hilft zu erkennen, wer im Unternehmen für welches System verantwortlich ist.

Wichtigste Use Cases:

• die IT für das gesamte Unternehmen “öffnen”, um ein allgemeines Verständnis der Datenflüsse zu erzeugen;

• umfassendes Enterprise Modeling, um eine Roadmap für künftige Entwicklungen zu erstellen;

• Business-Metriken tracken, die mit der Unternehmens-Performance zusammenhängen.

BOC Group ADOIT

ADOIT soll Teams dabei unterstützen, Ressourcen zu verwalten, Bedarfe vorherzusagen und Assets zu tracken. Dazu mappt das Tool jedes System oder Softwarepaket mit einem Objekt. Die Datenflüsse zwischen den Systemen werden in Beziehungen umgewandelt, die von diesen Objekten mithilfe eines anpassbaren Metamodells erfasst werden. Geschäftsprozesse können auf ähnliche Weise über ein gut integriertes Begleitprodukt namens ADONIS modelliert werden. ADOIT ist Web-basiert und lässt sich auch mit Tools wie Atlassian Confluence integrieren, um die Datenerfassung und -entwicklung zu beschleunigen.

Wichtigste Use Cases:

• ein unternehmensweites Modell erstellen, das bei sämtlichen Teammitgliedern ein Verständnis über den Stack schafft – und wie man diesen verbessern kann;

• vollständiger Zugriff auf EA-Daten über eine Mobile-Anwendung;

• bei Fusionen und Übernahmen den Tech-Bereich durch genaues Asset-Mapping orchestrieren.

Bizzdesign Hopex

Nach der Übernahme von Mega International zählt die Hopex-Plattform zum Portfolio von Bizzdesign. Sie soll dabei unterstützen, Unternehmensanwendungen zu modellieren und dabei ein Verständnis der von ihnen unterstützten Geschäfts-Workflows schaffen. Dabei liegt ein Schwerpunkt auf den Bereichen Data Governance und Risikomanagement. Hopex basiert auf Microsoft Azure und stützt sich auf eine Reihe offener Standards wie GraphQL und REST Queries, um Informationen aus Komponentensystemen zu sammeln. Das Reporting ist mit den Office-Tools von Microsoft sowie mit grafischen Lösungen wie Tableau und Qlik integriert.

Wichtigste Use Cases:

• datengestützte Erkenntnisse herbeiführen, um Cloud- und Anwendungsbereitstellung zu steuern;

• akkurate Nutzungsmodelle erstellen, um Architekturanforderungen zu verstehen;

• eine Bedarfsschätzung mit Umfragen und anderen Tools vornehmen, um für die Zukunft zu planen.

Bizzdesign Horizzon

Das Tool dient dazu, Business Workflows und den zugrundeliegenden Tech-Stack zu modellieren. Dazu bietet Horizzon ein Graph-basiertes Modell, das Daten von sämtlichen Stakeholdern einsammelt und diese an eine Analytics-Engine weitergibt. Im Ergebnis entstehen Diagramme, die den aktuellen Systemzustand widerspiegeln. Wichtige Schwerpunkte dieses Tools sind Change Management und Zukunftsplanung: Horizzon ist nicht zuletzt dafür konzipiert worden, die Risiken eines Redesigns zu minimieren. Das Toolset unterstützt die wichtigsten Frameworks ArchiMate, TOGAF und BPMN. Neben Mega hat Bizzdesign im Januar 2025 auch den EA-Geschäftsbereich der Software AG – Alfabet – übernommen.

Wichtigste Use Cases:

• Vorhersage zukünftiger Anforderungen durch Predictive Modeling;

• Orchestrieren von Workflows auf der Basis der technischen und der Business-Architektur;

• Antizipieren von Risiken sowie Security- und Governance-Problemen durch die Modellierung von Datensicherheitsanforderungen.

Capstera

Das Tool von Capstera fokussiert darauf, die Business Architecture selbst abzubilden. Value und Process Maps helfen dabei, die Rollen der verschiedenen Unternehmensbereiche zu definieren und nachzuverfolgen. Dabei können im laufenden Prozess Verknüpfungen mit den zugrundeliegenden Softwarprodukten und Tools hinzugefügt werden.

Wichtigste Use Cases:

• Reports erstellen, die sich erst einmal mit der Business-Architektur selbst beschäftigen;

• Beziehungen zwischen Menschen, Abteilungen und Rollen analysieren;

• die langfristige strategische Planung vorantreiben.

Clausmark Bee360

Teammitglieder, die Clausmarks Flaggschiffprodukt Bee360 (früher Bee4IT) verwenden, wollen eine einfache “Single Source of Truth” über die Workflows im Unternehmen. Ziel ist es, verschiedenen betrieblichen Rollen intelligentere Entscheidungen zu ermöglichen. Das Modul Bee360 FM (Finanzmanagement) bietet etwa die Möglichkeit, Kosten nachzuvollziehen und zuzuordnen. Die Anwender können verschiedene solcher Module miteinander verknüpfen, um EAM, Finanzmanagement, Portfolio Management und Agile Planning nahtlos zu integrieren – bei maximaler Transparenz.

Wichtigste Use Cases:

• C-Suite-Ebene befähigen, Projekte zu managen und Assets zuzuweisen;

• präzise digitale Zwillinge entwickeln, um ein Verständnis über Datenflüsse zu schaffen und künftige Erweiterungen zu planen;

• integrierte Wissensdatenbank aufbauen, um alle digitalen Workflows zu tracken.

EAS

Das Essential-Paket von EAS (Enterprise Architecture Solutions) nahm als Open-Source-Projekt seinen Anfang und hat sich inzwischen zu einer kommerziell verfügbaren Cloud-Lösung weiterentwickelt. Das Tool erstellt ein Metamodell, das die Interaktionen zwischen Systemen und Geschäftsprozessen beschreibt. Ebenfalls enthalten sind Pakete, um gängige Business Workflows wie Datenmanagement oder DSGVO-Compliance zu tracken.

Wichtigste Use Cases:

• den technischen Reifegrad der eigenen Architektur evaluieren;

• Sicherheit und Governance durch besseres Asset Tracking optimieren;

• wachsende Systemkomplexität kontrollieren und managen.

OrbusInfinity

Orbus Software hat Anfang 2025 die Akquisition seines Konkurrenten Capsifi abgeschlossen. Der Anbieter stellt mit OrbusInfinity eine Enterprise-Transformation-Plattform auf KI-Basis zur Verfügung, die schnellere, bessere Entscheidungen, Kosteinesparungen und Risikominimierung verspricht. Architecture-Teams sollen mit Hifle von OrbusInfinity mit einer Vielzahl von Stakeholdern interagieren können, um eine “digitale Blaupause” ihres Unternehmens zu generieren, die eine einheitliche Sicht auf das aktuelle und künftige Geschäft realisieren soll. Diverse Drittanbieter-Tools lassen sich außerdem mit der Plattform integrieren, darunter etwa von Microsoft, Flexera, ManageEngine oder ServiceNow.

Wichtigste Use Cases:

• Stakeholder-Management;

• Enterprise-Landschaften visualisieren;

• Entscheidungsfindung und Datenanalyse automatisieren.

Planview Enterprise One

Planview bietet eine ganze Reihe von Produkten, mit denen Unternehmen Teamwork, Prozesse und die Enterprise Architecture nachvollziehen können. Die Enterprise Tools sind in drei Kategorien unterteilt: strategisches Portfolio-Management, Produktportfolio-Management und Projektportfolio-Management. Im Zusammenspiel entstehen hardware- und Software-übergreifende Layer, die rollenbasierte Perspektiven für Führungskräfte und Teammitglieder eröffnen. Das Toolset integriert mit gängigen Ticket-Tracking-Systemen wie Jira, um Workflow-Analysen und Reports zu erstellen. Inzwischen hat Planview nach einer Übernahme neue Tools in sein Portfolio integriert, die früher unter den Namen Daptiv, Barometer und Projectplace bekannt waren.

Wichtigste Use Cases:

• eine langfristige, strategische Vision für die Architekturentwicklung aufbauen;

• Entwicklungsarbeit auf Projektebene tracken und in eine beliebige Strategie integrieren;

• mit Fokus auf die Customer Experience und die Produktstruktur den Change vorantreiben.

QualiWare Enterprise Architecture

Das Enterprise Architecture Tool von QualiWare ist Teil einer größeren Sammlung von Modellierungswerkzeugen, die darauf abzielt, sämtliche Geschäftsprozesse zu erfassen. Beispielsweise ist es möglich, einen digitalen Zwillinge zu bauen, mit dem sich Customer Journeys nachvollziehen lassen. Qualiware hat diverse KI-Algorithmen integriert, um Dokumentation und Process Discovery zu optimieren.

Wichtigste Use Cases:

• ein kollaboratives Ökosystem für Business Manager aufbauen, das ein Verständnis von der Enterprise Architecture vermittelt;

• architektonische Designelemente erfassen, um ein Wissens-Ökosystem rund um den Stack aufzubauen;

• eine breite Beteiligung in Sachen Dokumentationserstellung und -überprüfung fördern.

Quest Erwin Evolve

Das Erwin Evolve Tool von Quest hat sich von einem Datenmodellierungs-Tool zu einem System für Enterprise-Architecture- und Geschäftsprozess-Modellierung weiterentwickelt. Um die Komplexität moderner, ineinandergreifender Softwaresysteme und der von ihnen gemanagten Geschäftsprozesse zu durchdringen, können Anwender auf benutzerdefinierte Datenstrukturen zurückgreifen. Das Web-Tool erstellt Modelle, rollenbasierte Diagramme und andere Visualisierungen, die in allgemein zugängliche Dashboards einfließen. Zum Paket gehört ein KI-basiertes Modellierungs-Tool, das Whiteboard-Skizzen integrieren kann.

Wichtigste Use Cases:

• einen digitalen Zwilling für die strategische Modellierung der Enterprise Data Architecture erstellen;

• Customer Journeys verstehen;

• Services und Systeme mit Application Portfolio Management tracken.

SAP LeanIX Enterprise Architecture Suite

Die Tool-Sammlung von LeanIX umfasst unter anderem Enterprise Architecture Management und andere Bereiche, die für Aufgaben wie SaaS– und Value-Stream-Management wichtig sind – etwa um Cloud-Deployments und darauf laufende Services zu tracken. Die Daten die dabei über die IT-Infrastruktur gesammelt werden, fließen in ein grafisches Dashboard ein. Das Tool ist eng mit wichtigen Cloud-Workflow-Tools wie Confluence, Jira, Signavio und Lucidchart integriert. Das ist für Teams von Vorteil, die diese Tools bereits nutzen, um ihre Entwicklungsstrategien zu planen und umzusetzen. Seit November 2023 ist LeanIX Teil von SAP.

Wichtigste Use Cases:

• Anwendungsmodernisierung und Cloud-Migration managen;

• Obsoleszenz von Software-Services evaluieren;

• Kosten kontrollieren und managen.

ServiceNow

Die Tool-Sammlung von ServiceNow lässt sich auf verschiedene Architekturtypen herunterbrechen, darunter Assets, DevOps, Security und Service. Die Tools katalogisieren die unterschiedlichen Hardware- und Softwareplattformen, um Workflows und Datenflüsse im Unternehmen abzubilden und zu verstehen. Ausführliche Reportings und detaillierte Dashboards ermöglichen Analysen, auf deren Grundlage Risiken minimiert und die Ausfallsicherheit der Systeme erhöht werden können.

Wichtigste Use Cases:

• Tracken von Assets, Services und Systemen, die das Unternehmen ausmachen;

• Governance-Themen, Risikobegrenzung, IT-Management und Security Operations werden in einer Plattform zusammengeführt;

• durch die Integration von CRM-Tools lassen sich auch kundenorientierte Services managen.

Sparx Systems

Um Teams und Projekte verschiedener Größe und Komplexität zu unterstützen, hat Sparx vier Versionen seines EA-Tools entwickelt. Allen gemeinsam ist eine UML-basierte Modellierung, mit der sich die Komponenten komplexer Systeme tracken lassen. Eine Simulations-Engine ermöglicht “War Gaming” und vermittelt ein Verständnis darüber, wie sich Fehler ausbreiten und kaskadieren können. Sparx stellt zudem eine Vielzahl von vorgefertigten Design Patterns bereit, um Teams bei der Modellierung zu unterstützen.

Wichtigste Use Cases:

• Nachfrage- und Lastveränderungen zur Prognose künftiger Anforderungen simulieren;

• (potenzielle) Probleme durch eine Verbindungs-Matrix im Auge behalten;

• Dokumentation erstellen.

Unicom System Architect

System Architect ist eines der Angebote aus Unicoms Team Blue. Es handelt sich um ein Tool, das ein Metamodell verwendet, um automatisiert so viele Daten wie möglich über die laufenden Systeme zu sammeln – manchmal auch durch ein Reverse Engineering von Datenflüssen. Dieses systemweite Datenmodell kann über benutzerdefinierte Dashboards Teammitgliedern aller Rollen zugänglich gemacht werden. Ein weiteres erwähnenswertes Feature: Die Ressourcenzuweisung lässt sich mit Hilfe von Simulationen optimieren.

Wichtigste Use Cases:

• Was-wäre-wenn-Fragen zum Architekturmodell stellen;

• ein Metamodell von Daten und Systemen aufbauen;

• Migrations- und Transformationspläne erstellen.

ValueBlue BlueDolphin

Dieses EA-Tool sammelt Daten auf dreierlei Art:

1. Es importiert Basisdaten auf der Grundlage standardgesteuerter Automatisierung (ITSM, SAM).

2. Es arbeitet mit den Dateiformaten von Architekten und Systemdesignern – etwa ArchiMate oder BPMN.

3. Es gibt Fragebögen an andere Stakeholder heraus, die auf anpassbaren Vorlagen basieren.

Die aufbereiteten Informationen werden in einer visuellen Umgebung bereitgestellt, die Auskunft über die historische Entwicklung von Systemen gibt.

Wichtigste Use Cases:

• systemweite Daten von internen und externen Stakeholdern automatisiert und formularbasiert erfassen;

• zukunftsorientierte Reportings erzeugen, um den Change zu überwachen und voranzutreiben;

• Kooperation und Zusammenarbeit durch offenes Data Reporting fördern.

(fm)

Dieser Artikel ist im Original bei unserer Schwesterpublikation CIO.com erschienen.

The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.

In brief:

• AI is transforming software as a service (SaaS), and the old ways of keeping score no longer apply.
• Smart companies are evolving new metrics that provide deeper insight into how AI-native software is performing in a new marketplace.
• These changes impact everything from pricing to valuations.

The transformation of the software-as-a-service (SaaS) industry toward AI-native operating companies is rapidly changing the unit of value across the industry.

The traditional metric of seats — which measured access — is rapidly giving way to credits designed to measure work performed. This evolution is upending the industry in multiple ways, impacting everything from pricing to enterprise valuations.

While many companies still cling to seat-based metrics to measure growth, efficiency and durability, the future is likely to be one in which companies utilize a credit-centric metrics framework, with seats and outcomes as the bookends of a spectrum.

Why do software companies need new metrics?

Why the rethink, and why now? There are five major forces that are driving this shift:

1. The unit of value is changing. Seats measured who could access software, and credits measure what the software actually does. But in an AI-native world, agents don’t have seats; they have workloads. Over the past 18 months, every major SaaS platform has moved to some forms of credit or consumption unit.
2. The cost of goods sold (COGS) is exploding. AI inference adds real per-unit costs that scale with usage. In an AI-native world, software companies can’t scale to infinite users at near‑zero marginal cost as before.
3. Buying is moving up the org chart. AI-native applications shift purchasing to higher-level operators — such as line-of-business leaders or chief operating officers — which expands the market from software budgets to labor budgets. And because AI agents replace services as well as software, the total market opportunity is 3x to 10x larger than traditional SaaS.
4. Time to value (TTV) is collapsing. With AI-native tools, customers start seeing meaningful results in weeks rather than quarters. Onboarding and setup are fast, workflows are pre-built, and there’s no need for extensive customer success or professional services — dramatically reducing implementation time and costs.
5. Retention is bifurcating. AI forces clarity in a way that traditional SaaS couldn’t. Products that can provide value become even “stickier” and retain customers. Those that don’t churn faster. In an AI-native marketplace, the middle disappears.

How this shift is impacting pricing

Given how AI-native software is transforming the market, the shift to more variable pricing options is inevitable.

Seats won’t go away completely. Subscription pricing based on the number of users is stable and predictable and will continue to work for some customers. Tokens — the use of pass-through pricing for underlying compute — will fit those customers where the AI feature is commoditized or the buyer wants transparency into costs.

Credits will likely become the dominant architecture because they provide a simple metric for both customers and providers. The vendor sets the conversation ratio between credits and underlying compute, shielding the customer from inference cost details. Credits are easy to understand and can be packaged into annual contracts for multiple features and products.

Finally, the industry will likely see some move toward outcome-based pricing for results such as resolved tickets, recovered revenue or qualified leads. This strategy will mostly be limited to verticals where it is easy to prove AI impacted the result.

Where a software vendor sits on this spectrum is a signal of differentiation and pricing power. Credits are where most defensible AI-native businesses are landing because they balance customer predictability with vendor margin control.

How AI upends classic SaaS metrics

When SaaS was in its infancy, companies settled on key metrics designed to answer a small set of core questions. Are we growing? Are customers using the product? Are we retaining and expanding accounts?

But as AI upends software itself, it is also requiring companies to adopt new metrics to track success. These new metrics fall into three primary buckets, rebuilt around the pricing spectrum described earlier and the trend toward credits as the primary frame:

Revenue composition

• Committed credit annual recurring revenue (ARR) vs. burndown ARR: Measuring the credits sold on annual commitment vs. those consumed and replenished. This is the single most important split for valuation. Committed credits behave like subscription and burndown behaves like usage.
• Credit utilization rate: The percentage of purchased credits consumed per period. This is a leading indicator of renewal sizing.
• Credit burn velocity: How fast is a customer consuming their credits, and is that consumption increasing or decreasing quarter over quarter? This metric predicts expansion or contraction before it shows up in ARR.
• Effective price per credit: The real revenue per credit after discounts, overage and rollover, which can detect revenue leakage and help companies set smarter guide rails.

Margin reality

• Credit margin: The gross profit the company earns per credit after subtracting inference costs. This is the core economic unit for AI-native, usage-based businesses — the replacement for gross margin per seat used in SaaS.
• Inference-adjusted gross margin: By carving out AI inference costs separately in the P&L statement, you can see true AI margins, avoid hiding deterioration inside blended SaaS margins, and clearly distinguish AI economics from legacy SaaS economics.
• Compute leverage ratio: This metric measures how efficiently the business converts compute spend into revenue. It shows whether your AI margins are improving as you scale.
• AI-adjusted “Rule of 40”: This updated metric recalibrates the traditional growth and profitability benchmark to account for AI’s lower gross margins and variable inference costs, giving a more accurate picture of business health for AI-native companies.

Behavioral and value signals

• Time-to-first outcome: Replaces traditional onboarding metrics. Tracks how fast a customer reaches their first measurable result.
• Adoption: AI-native adoption is measured by workflow penetration and active agent density, not seat count. As AI replaces human-driven usage, the unit of adoption shifts from people to automated workflows and agents.
• Net credit retention (NCR): Credit-volume retention across the customer base, tracked separately from net recurring revenue to avoid price-change impact.

Along with these new metrics, the industry’s transformation is prompting companies to retire or recalibrate old SaaS measures, including per-seat ARR as a primary key performance indicator (KPI), traditional magic number calibrated to subscription dynamics, unadjusted Rule of 40, customer success metrics tied to human touchpoints, and blended gross margin without AI COGS carve-outs.

What does this mean for enterprise value calculations?

As the internal metrics of success change, so do the ways the investment community measures growth and long-term viability.

Increasingly, a company’s valuation multiple depends on whether its revenue behaves like committed subscription ARR or volatile usage ARR, and the commit‑to‑burndown ratio is the metric investors use to decide where the company fits.

For example, a business with 80% committed credit ARR could trade closer to subscription comps and one with 80% burndown could trade closer to usage comps even though both have the same types of customers. Being able to proactively explain the commit‑to‑burndown mix can help companies avoid undervaluation.

In addition, utilization is expected to replace net promoter scores and seat usage as the primary predictor of churn or expansion. Low utilization guarantees downsizing at renewal, so companies must track utilization cohorts the same way SaaS tracks logo retention cohorts today.

We’re also seeing an inversion of the operating model, with R&D and COGS moving up the P&L and sales and marketing (S&M) and customer success (CS) moving down or sideways. The net operating leverage profile is structurally different from classical SaaS, and the cost-to-scale curve looks different too.

Finally, credit margin engineering is a hidden value-creation lever. The gap between price per credit and cost per credit is set by the software vendor and can be optimized. Most operators have barely started managing this rigorously, and the ones who do will pull away on margin.

What this means for leaders, boards and investors

The shift from classic SaaS metrics to new AI‑native measures isn’t cosmetic. It represents the seismic change the industry is experiencing as AI matures and transforms products and organizations.

While these metrics — and perhaps others yet to be determined — may evolve over time, there is no doubt they are already changing how AI companies allocate capital, price products, incent sales teams, evaluate performance and communicate with investors.

It’s important to remember that SaaS metrics were practical tools for a specific era of software. As that era draws to a close, winning companies will choose new metrics that shape behavior and drive smart decision-making.

The views reflected in this article are the views of the author and do not necessarily reflect the views of Ernst & Young LLP or other members of the global EY organization.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Cloudflare recently beat Q1 2026 earnings. Revenue up 34% year over year. EPS ahead of consensus. Full-year guidance raised. Then, in the same breath, they announced 1,100 layoffs, 20% of the company. CEO Matthew Prince’s explanation: “The way we work at Cloudflare has fundamentally changed.”

Block did the same thing. Beat guidance, raised outlook, cut 4,000+ jobs. Both framed it as architecting for the AI era.

This is not a contradiction. This is the new math boards are running. And if you’re a CIO who hasn’t started running it yourself, you’re behind.

The benchmark has moved

AI-native companies have quietly reset what “efficient” means for a technology organization. Midjourney generates over $500M in revenue with roughly 160 employees, over $3M per head. Anthropic hit a $14B annualized run rate in early 2026 with fewer than 3,000 employees. Across the top AI-native startups, the average revenue per employee is $3.48M, nearly twelve times the traditional SaaS benchmark of $300K.

Boards aren’t comparing you to your 2019 self anymore. They’re comparing you to Anthropic.

This is the pressure Cloudflare and Block are responding to. They’re not cutting people because the business is struggling. They’re cutting because investors have internalized a new denominator. Headcount is no longer a proxy for capacity; it’s a liability on the efficiency ratio.

For CIOs, this creates a hiring problem that looks nothing like the cloud or mobile talent gaps of the past decade. Those gaps were about volume: hire 100 cloud engineers, absorb the cost, build the capability… This one is about density; you’re not looking for 100 people. You’re looking for 10 who can deliver what 100 couldn’t, and justify $1M or more in value per seat.

Finding bodies to fill seats has never been easier. Finding people who operate at that level of leverage is a different problem entirely.

‘Acqui-hires’ are a shortcut with a hidden cost

Companies have figured out that recruiting AI-native talent one by one is too slow and that it’s faster to buy a team. Google’s acquisition of the Windsurf founders, Meta bringing in the Scale AI team, Accenture’s string of AI-focused acquisitions: these are acqui-hires dressed up as M&A. The premium on experienced AI talent is high enough, and the urgency real enough, that organizations are skipping traditional hiring loops entirely and buying their way in.

I’ve been on the other side of this. My company, MadKudu, was acquired by HG Insights specifically to bring AI-native capability into an established enterprise business. HG needed change agents who had already figured out how to build and ship in this new era, not just people who’d read about it. That’s the thesis behind most of these deals.

But there’s a cost that doesn’t show up in the acquisition price.

AI-native teams are fast because they operate with a different set of defaults: full access to tools, minimal governance layers, the ability to experiment and ship without a six-week approval cycle. That operating model is not a perk; it’s the fundamental mechanism. It’s why a team of 10 can do what an enterprise team of 100 can’t.

When you acqui-hire that team and then slot them into your existing approval processes, you’ve bought the people and killed the engine. The change agents you paid for become change-frustrated. The attrition that follows is expensive and predictable.

The harder realization: acquiring an AI-native team means accepting how they work. That requires deliberately carving out space for them to operate differently, not just tolerating it but institutionalizing it. The acquisition is an organizational change program, not just a hiring event.

The CIO’s real problem

The governance stack most enterprise organizations run was designed for a headcount world. Every tool vetting cycle, every vendor review, every security approval was calibrated assuming you were managing a large team where consistency and control were the primary objectives.

That calculus breaks when your goal is talent density. The same approval processes that protect against data leaks are now the reason your best people can’t do their best work. When it takes six weeks to approve a tool that your competitor’s team is already shipping with, you’ve traded velocity for the perception of safety.

The practical fix is structured experimentation: clear guardrails, defined boundaries, but explicit permission to try tools before deciding whether to roll them out broadly. Gating everything prevents you from ever discovering what 10x productivity looks like.

The skills inventory question is also more nuanced than it sounds. Job titles won’t tell you where the leverage is. You need to map the actual tasks within each function and assess which can be automated or augmented with AI. That’s where you find the people who, with the right tools, become your $1M/employee talent, not because you hired differently, but because you enabled better.

This is also where the build-versus-buy question gets genuinely tricky. As AI reshapes how products are built and delivered, your internal operating model — how you work, how fast you ship, how you use data — is becoming core IP. Outsourcing delivery means outsourcing the part of the organization where your competitive advantage is now being built.

Closing the gap without slowing down

The AI talent wars are not primarily a recruiting problem. They’re a rethinking of what organizations are supposed to look like.

Boards have a new benchmark. Cloudflare, Block, Amazon, Meta and others have already started restructuring to meet it, publicly, painfully, even while beating their numbers. The question for CIOs isn’t whether this pressure arrives; it’s whether you’re ahead of it or behind it when it does.

The organizations that navigate this well won’t win by outbidding competitors for a handful of elite engineers. They’ll win by designing operating systems that amplify the leverage of the talent they do have, by enabling their best people rather than constraining them, and by treating AI fluency as a core organizational capability rather than a niche specialization.

Talent density is the new headcount model. The sooner your governance, your tooling and your board conversations reflect that, the better positioned you’ll be when the next efficiency report lands.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Four months of Claude Code — that’s all it took for Uber to burn through its entire annual budget for AI. Token after token, engineers embraced the platform with few control mechanisms tying costs to outcomes. The result was a budget runaway and a clear case study in how limited oversight snowballs into an AI blowout.

This is a phenomenon I like to call “shadow tokens” — AI credits paid for by the company but largely invisible to decision-makers. Too many engineers have the final say over how much they consume and, therefore, what it costs. This all-you-can-eat attitude is part of the reason why Microsoft is reportedly winding down many internal licenses across key engineering teams and why one in five organizations is missing its AI spend forecast by more than 50%.

And the trend is only accelerating. By 2028, Gartner predicts that AI coding costs (driven by this kind of ungoverned consumption) will be as much per developer as the salary companies pay that person.

LLMs and agents introduce a new class of variable cost that scales with behavior rather than headcount, putting enterprises on the hook for tools that balloon with workload. I don’t see this as enterprises overspending because they’re reckless — it’s down to a lack of managerial oversight, budget alignment that demands a proven return on investment, and engineer education on how much is too much.

Going forward, CIOs need to thread the AI needle between governance that encourages transparency and reasonable spend without stifling innovation.

When shadow tokens result in real costs

The issue is that AI isn’t a traditional line item. Previously, enterprise leaders onboarded software-as-a-service (SaaS) with a good idea of the total cost. An allocated software seat or annual contract was a known quantity. The cloud added some variation (with fluctuations depending on hosting size), but instances were still modelable. AI flips this status quo on its head — the unit of consumption is behavior and the cost is exponential.

And these specifics aren’t immediately apparent at pilot. Tools can appear inexpensive in controlled experiments yet unpredictably scale depending on session length, context window size, model selection and whether agents run in parallel. This is the fallacy of the $20-per-seat enterprise plan — tokens are charged separately at API rates with no ceiling. The final dollar value of any session is set by factors that finance can’t always model in advance, particularly when these decisions usually rest with the engineers themselves.

According to Deloitte, only 21% of organizations deploying agents have a mature governance model, a real concern because they’re token-eating machines. This is what was happening at Uber — Claude Code in agentic mode was autonomously reading codebases, planning changes across dozens of files and opening pull requests. Each step quickly adds up, with Anthropic’s own documentation noting that agents consume approximately seven times as many tokens as standard sessions.

This is shadow IT and shadow AI, evolved. This time, however, many leaders approved the tool in question without guardrails governing consumption. AI hype adds fuel to the fire and normalizes long sessions. Uber’s CTO, for example, described a company-wide shift toward “agentic software engineering” with employees “who are quietly experimenting, quietly shipping and quietly pushing things forward”. This is an exciting way to test the limits of what’s possible, certainly, but it’s also a position that goes a long way to explaining how the company spent its annual AI budget by April.

Shifting the culture from usage to yield

Engineers haven’t done anything wrong here. In fact, they’re adopting and experimenting as instructed, with Uber creating leaderboards and ranking users by token consumption. More use led to a better ranking, reflecting a culture that lauds new ways of doing things. This behavior is known as “tokenmaxxing,” and its principal knock-on effect is shadow tokens — quantity-over-quality processes that leaders struggle to control until they’re fully realized in the budget. Of course, if management treats adoption metrics as performance metrics, then engineers can’t be blamed for using more tokens. The tension is that the teams driving adoption aren’t the ones managing spend.

None of this is meant to dismiss AI’s productivity possibilities and potential return on investment. Developers save 3.6 hours per week, achieve 60% higher pull request throughput and cut onboarding time in half with automation. Meanwhile, Uber shared that roughly 11% of live backend updates were written by agents with no human in the loop. However, these wins aren’t the problem — it’s that too many teams aren’t connecting input to output. I’ve spoken to admins who discovered their token spend had tripled in a single quarter after using heavier models or accidentally doubling up on agentic applications. Nobody knew until the financial damage was done.

Automation needs to happen sustainably with an eye on the bottom line. In my view, a much better metric for achieving this is AI yield — the measurable business or engineering output generated per dollar spent on tokens. Otherwise, without a feedback loop, even genuinely productive teams are flying blind.

Stopping token waste before an AI blowout

Creating that throughline between AI investment and token consumption starts with established financial metrics. This is possible via maximum spend limits (dictated by spend tagging, workload tiering and cost-per-output benchmarks) per team or project. Then, any additional allocation requires approval, closing the loop between the engineers spending the tokens and the leaders paying for them. AI isn’t cheap and teams should demonstrate a bang for their buck.

This is something we do with our engineering team at Hexnode. Resource allocation for Claude Code and Cursor is tied directly to ROI rather than letting consumption run open-ended. Given the pay-as-you-go nature of these tools, a firm usage limit per team offers simple but essential control.

Similarly, there’s room to apply some of the governance principles IT uses for device management. Things like policy enforcement, role-based access, real-time monitoring and automated alerts can flag usage behavior in advance. Uncovering such insights at the token layer works to identify power users and prevent excessive spending.

We also need to encourage cultures that praise outputs that actually achieve efficiency. AI applications that result in shipping faster, reducing rework and cutting review cycles are gains that should be celebrated. If your company hosts leaderboards, frame unnecessary token burn as wasteful rather than valuable. The organizations creating healthier consumption habits work with their engineers to understand not just how to use AI, but what responsible use looks like and what it costs.

This is a conversation teams need to have now. Anthropic just ended flat-rate pricing for programmatic workloads from June 15. Now, agents, continuous integration pipelines and automated workflows draw from a dedicated monthly credit pool billed separately from the subscription. Once that pool is exhausted, agent tasks either stop entirely or overflow to extra billing. Work can either get very expensive or grind to a halt for teams that aren’t prepared.

Getting a grip on shadow tokens means better rules and tools connecting spend to outcomes. Only by building the financial and cultural infrastructure that encourages sustainable adoption can leaders see what they’re spending, connect it to what they’re getting and course-correct before the costs become a crisis. Ultimately, shadow tokens are only invisible if we choose not to look.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Predicting an outage is tricky business, but CIOs might want to circle Oct. 11, 2026, through Jan. 11, 2027, for likely trouble of a potentially widespread and puzzling nature.

That’s because a relatively trivial update to DNSSEC on Oct. 11, one that will take full effect by Jan. 11, is likely to deliver a series of seemingly unrelated system outages. This will come from oceans of dependencies from third-party, shadow, agentic, gen AI, SaaS, homegrown, and legacy apps — among many other quiet executable hiding spots, including virtual environments and containers.

Sai Joshitha Kathari, senior site reliability engineer at payment card giant Visa, says most enterprises have far more DNS-related exposure than they realize because of these many dependencies.

“This has the potential to create real downstream destruction when unresolved failures sit underneath important business functions,” Kathari says. 

The danger is that so many of these issues are either unknown to IT or handled by a third-party vendor and no one in IT has had reason to ask those vendors about DNS updates. 

“The risky areas are usually not the obvious managed DNS services. They are the older internal applications, hardcoded resolvers, containerized workloads, sidecar configurations, custom scripts, partner integrations, VM images, stale base images, and service-to-service dependencies that nobody has touched in a long time,” Kathari explains. “These systems can keep working quietly for years, then fail during a DNS or certificate-related change because they bypassed the normal platform standards.”

Independent technology analyst Carmi Levy says that CIOs need to take this event very seriously. 

“The two-pronged deadline — October 11, 2026, when the new Key Signing Key (KSK) begins signing the root zone, and January 11, 2027, when the old key is retired — should be marked in red on everyone’s calendar, just as December 31, 1999, once was,” Levy says. “Failure to comply could result in websites, critical business applications, and related resources dropping off the face of the Earth once the transition is complete.”

Levy adds: “Custom-built code that lives outside conventional support mechanisms may or may not function when the DNS changes go into effect.”

The DNSSEC update itself is straightforward, but it is also the first significant DNSSEC change — specifically a change in the trust anchor — since 2018. 

The rollout statement noted that “the trust anchor is formally known as the Domain Name System Security Extensions (DNSSEC) root zone Key Signing Key (KSK). The KSK is the cryptographic key at the core of the DNSSEC trust anchor and is used to verify that DNS responses are legitimate and have not been modified in transit.”

Expect nearly every enterprise to be impacted

Kim Davies, vice president of IANA Services and president of public technical identifiers at ICANN, says the extent of the impact on enterprises is unknowable, given the nature of shadow IT and other edge cases. 

But based on the massive number of dependencies both known and unknown in the typical global enterprise, Davies guesses that just about every enterprise will be impacted, to varying degrees. 

“In highly complex organizations, it is very likely there will be some impact in the corners, in the margins, of the organization,” Davies tells CIO. “DNS is such a core technology that underpins everything.”

As the updates propagate, hiccups will materialize, Davies notes. “When the system cannot validate the [DNS] information, it will treat it as suspect and DNS lookups will fail.”

Visa’s Kathari says, “Enterprises should expect some secondary DNS-related glitches when major DNSSEC-related changes happen, not necessarily because the core infrastructure teams will ignore the update, but because large environments have many hidden dependency paths.”

Making this problem far worse, Kathari notes, is that the glitches will likely initially look like anything other thana DNS glitch. That will force IT staff to waste a vast number of hours chasing causes that ultimately prove to be unrelated to the incidents. 

“The impact for CIOs is that DNS failures rarely announce themselves as DNS failures. They look like application timeouts, broken logins, failed API calls, queue lag, payment failures, partner connectivity issues, or random regional instability,” Kathari explains. “That makes troubleshooting slower because teams may spend hours looking at the application, database, network, or cloud provider before realizing name resolution is part of the failure path.”

Sanchit Vir Gogia, chief analyst at Greyhound Research, agrees that IT will likely spin its wheels chasing the wrong ghosts.

“A validation failure rarely stays in its lane. It surfaces as an application error, an API timeout, or a reachability problem, which turns a resolver fault into a coordination failure,” Gogia says. “The application team blames the network, the network team blames the cloud, and the user simply watches work stop.”

“Images and templates are the frontier most teams miss,” Gogia adds. “A resolver fixed in summer can be broken again in October the instant a stale golden image is redeployed, because automation no longer lets configuration drift slowly. It restores yesterday’s assumptions at machine speed.”

It is widely expected that enterprises will not have any problems executing the change or, more likely, relying on their hyperscalers to properly handle the change. That is the concern. 

“CIOs are being distracted so much with AI and this is such a deep in the weeds infrastructure issue that this can and willcatch people off-guard,” Justin Greis, CEO of consulting firm Acceligence, tells CIO. “I think we’ll see a meaningful number of enterprise disruptions associated with the DNSSEC trust anchor rollover. Not because the update itself is especially difficult, but because it will expose weaknesses that already exist inside many organizations.”

Most enterprise IT operations have had no reason to compile a comprehensive list of all DNS dependencies, but many will be instantly discovered in January. 

Potentially widespread fallout

A major retailer, for example, might suddenly be unable to connect with FedEx to arrange for deliveries or a hospital may find that test results are no longer being shared with patient portals. It might manifest as an assembly line that halts because an IIoT component can no longer share files with its vendor system or a truck fleet that stops being tracked. 

“There will almost certainly be systems that fall through the cracks. Some will be legacy applications that rely on outdated DNS configurations that have not been updated in years,” Greis says. “Others will be business-unit-developed tools, contractor-built solutions, embedded systems, manufacturing and industrial systems, or highly customized workloads that operate outside normal IT oversight. These are the types of systems that often surface during infrastructure events like this.”

Greis adds that many enterprises will discover in January problems created by their own automation.

“Over time, enterprises build layers of processes, templates, and deployment mechanisms that are reused across teams and environments,” Greis notes. “Even after DNS infrastructure is updated correctly, older settings can inadvertently be reintroduced through routine updates and system changes, creating intermittent and difficult-to-diagnose failures.”

The good news from this situation is that enterprises are not going to likely lose all DNS access if any of these glitches occur. But that may be of no comfort because even if the disruptions are only with small edge cases, that can still cause massive operational disruptions.

Cricket Liu, EVP and chief evangelist at Infoblox, gives the example of a DNS server that responds to factory-floor system queries.

“Or let’s say this disrupts [an enterprise’s key] SaaS application. All name resolution may stop and it will show a server failure. It will not deliver a response whenever I look anything up. That’s not subtle at all,” Liu says. “It’s highly likely that companies are going to see some effects.”

Back in 2017, the switchover was relatively uneventful, giving some CIOs hope that January 2027 will also be a non-event. But given the technology advancements in the last 10 years and the resulting tidal wave of new enterprise tech dependencies, few are realistically expecting no problems this go around. 

Impossible to predict what will happen

One of the top network experts on DNS effects in enterprises is Geoff Huston, chief scientist at the Asia Pacific Network Information Centre (APNIC), the regional Internet Registry administering IP addresses for the Asia Pacific region.

Huston says it is difficult to project what will happen in January until it happens.

“Just like the last time, we are flying blind with this key roll. Because nothing really terrible happened last time, there is some confidence that nothing terrible will happen this time, but we just can’t tell in advance as there are no good measurement approaches that allow us to peek inside the trust state of recursive resolvers,” he says.

As for potential edge-case glitches, Huston says it is possible, but if third-party vendors do not properly handle the update, there will be other issues as well, as the KSK cryptographic key used within DNSSEC signs and validates the keys that protect DNS records. 

“If it is not standards-compliant, then you have more problems than just the KSK roll,” Huston says, “as it raises the obvious question of ‘What else is not correctly implemented in the DNS resolver that I’m running?’”

As a silver lining, Acceligence’s Greis says any hiccups that result from the DNS KSK update may be a gift in disguise for CIOs. 

“The irony is that some of the most business-critical components in the technology stack are often the least visible because they work in the background,” Greis says. January “may reveal how much modern business resilience depends on infrastructure that many organizations rarely examine until something breaks. For CIOs, that’s the real lesson. This is not fundamentally a story about a DNS update. It is a story about operational visibility, resilience, and governance. Organizations that treat the rollover as a routine infrastructure task will likely complete the update and move on. Organizations that use it as an opportunity to understand and strengthen the foundations of their technology environment may gain far more value than simply avoiding an outage.”

For CIOs, learning from the startup ecosystem has never been more critical.

As pressure mounts to transform business operations with AI and agentic systems, IT leaders should be looking to those on the AI vanguard for insights into the strategic and technical decisions necessary to launch, grow, and thrive in today’s AI-disrupted business environment.

So why not immerse yourself in Silicon Valley’s most famous firehose of hyper-accelerated fail-fast and dream-big culture by registering for TechCrunch Disrupt 2026?

Three packed days of 200-plus sessions across six stages will spark new ideas for reshaping your AI strategy, provide fresh perspectives on the architectural, workflow, and resource decisions involved in moving AI from pilots to scale, and give you a sneak peek of business disruptions to come.

Get 10% off your TechCrunch Disrupt pass with the exclusive code CIO10. 

This year’s TechCrunch Disrupt, held Oct. 13-15 at San Francisco’s Moscone West, will feature big-picture conversations on what’s next in AI; discussions on how AI agents are rewriting SaaS, enterprise workflows, software pricing, and security; and demonstrations of AI’s future across robotics, manufacturing, defense, and industrial operations; and more.

Over 10,000 attendees will hear from 250-plus startup founders, technology executives, and enterprise IT leaders about how the future of programming is being rewritten, what enterprise AI security requires, how startups are orchestrating workloads across models while managing cost and reliability at scale, why creating a safety culture is essential for AI deployment, and how startups are deciding what work humans should own versus what should be delegated to AI as they work to build hybrid teams without losing speed, accountability, or culture.

And of course, the rising tide of enterprise-focused startups will be there seeking to bring agentic systems to your business workflows, as well as vendors familiar to your enterprise IT portfolios, such as AWS, Google, and Databricks, and enterprise IT colleagues creating mutually beneficial partnerships with the startup community, such as American Express.

That’s not to mention TechCrunch Disrupt’s signature Startup Battlefield, in which 200 standout companies showcase their innovations to compete for a $100K equity-free prize. The battlefield will give CIOs a rapid-fire, broad view of what’s possible — and a possible early look at the next big enterprise player. After all, Dropbox, Trello, and Cloudflare, among others, roamed that same battlefield before the world knew their names.

And with M&A now an early-stage startup strategy for many from day one, TechCrunch Disrupt’s exhibition floor provides IT leaders not just an opportunity to discuss the nuts and bolts of innovation architecture or how an upstart product can enhance your workflows, but a chance to find your next innovation partner, or more.

Leading-edge startups are figuring out how to make AI work at scale. Shouldn’t you be?

Don’t miss your chance to experience TechCrunch Disrupt 2026. Book your pass today and use the exclusive code CIO10 to save 10% before prices increase.

For CIOs, learning from the startup ecosystem has never been more critical.

As pressure mounts to transform business operations with AI and agentic systems, IT leaders should be looking to those on the AI vanguard for insights into the strategic and technical decisions necessary to launch, grow, and thrive in today’s AI-disrupted business environment.

So why not immerse yourself in Silicon Valley’s most famous firehose of hyper-accelerated fail-fast and dream-big culture by registering for TechCrunch Disrupt 2026?

Three packed days of 200-plus sessions across six stages will spark new ideas for reshaping your AI strategy, provide fresh perspectives on the architectural, workflow, and resource decisions involved in moving AI from pilots to scale, and give you a sneak peek of business disruptions to come.

Get 10% off your TechCrunch Disrupt pass with the exclusive code CIO10. 

This year’s TechCrunch Disrupt, held Oct. 13-15 at San Francisco’s Moscone West, will feature big-picture conversations on what’s next in AI; discussions on how AI agents are rewriting SaaS, enterprise workflows, software pricing, and security; and demonstrations of AI’s future across robotics, manufacturing, defense, and industrial operations; and more.

Over 10,000 attendees will hear from 250-plus startup founders, technology executives, and enterprise IT leaders about how the future of programming is being rewritten, what enterprise AI security requires, how startups are orchestrating workloads across models while managing cost and reliability at scale, why creating a safety culture is essential for AI deployment, and how startups are deciding what work humans should own versus what should be delegated to AI as they work to build hybrid teams without losing speed, accountability, or culture.

And of course, the rising tide of enterprise-focused startups will be there seeking to bring agentic systems to your business workflows, as well as vendors familiar to your enterprise IT portfolios, such as AWS, Google, and Databricks, and enterprise IT colleagues creating mutually beneficial partnerships with the startup community, such as American Express.

That’s not to mention TechCrunch Disrupt’s signature Startup Battlefield, in which 200 standout companies showcase their innovations to compete for a $100K equity-free prize. The battlefield will give CIOs a rapid-fire, broad view of what’s possible — and a possible early look at the next big enterprise player. After all, Dropbox, Trello, and Cloudflare, among others, roamed that same battlefield before the world knew their names.

And with M&A now an early-stage startup strategy for many from day one, TechCrunch Disrupt’s exhibition floor provides IT leaders not just an opportunity to discuss the nuts and bolts of innovation architecture or how an upstart product can enhance your workflows, but a chance to find your next innovation partner, or more.

Leading-edge startups are figuring out how to make AI work at scale. Shouldn’t you be?

Don’t miss your chance to experience TechCrunch Disrupt 2026. Book your pass today and use the exclusive code CIO10 to save 10% before prices increase.

Four months of Claude Code — that’s all it took for Uber to burn through its entire annual budget for AI. Token after token, engineers embraced the platform with few control mechanisms tying costs to outcomes. The result was a budget runaway and a clear case study in how limited oversight snowballs into an AI blowout.

This is a phenomenon I like to call “shadow tokens” — AI credits paid for by the company but largely invisible to decision-makers. Too many engineers have the final say over how much they consume and, therefore, what it costs. This all-you-can-eat attitude is part of the reason why Microsoft is reportedly winding down many internal licenses across key engineering teams and why one in five organizations is missing its AI spend forecast by more than 50%.

And the trend is only accelerating. By 2028, Gartner predicts that AI coding costs (driven by this kind of ungoverned consumption) will be as much per developer as the salary companies pay that person.

LLMs and agents introduce a new class of variable cost that scales with behavior rather than headcount, putting enterprises on the hook for tools that balloon with workload. I don’t see this as enterprises overspending because they’re reckless — it’s down to a lack of managerial oversight, budget alignment that demands a proven return on investment, and engineer education on how much is too much.

Going forward, CIOs need to thread the AI needle between governance that encourages transparency and reasonable spend without stifling innovation.

When shadow tokens result in real costs

The issue is that AI isn’t a traditional line item. Previously, enterprise leaders onboarded software-as-a-service (SaaS) with a good idea of the total cost. An allocated software seat or annual contract was a known quantity. The cloud added some variation (with fluctuations depending on hosting size), but instances were still modelable. AI flips this status quo on its head — the unit of consumption is behavior and the cost is exponential.

And these specifics aren’t immediately apparent at pilot. Tools can appear inexpensive in controlled experiments yet unpredictably scale depending on session length, context window size, model selection and whether agents run in parallel. This is the fallacy of the $20-per-seat enterprise plan — tokens are charged separately at API rates with no ceiling. The final dollar value of any session is set by factors that finance can’t always model in advance, particularly when these decisions usually rest with the engineers themselves.

According to Deloitte, only 21% of organizations deploying agents have a mature governance model, a real concern because they’re token-eating machines. This is what was happening at Uber — Claude Code in agentic mode was autonomously reading codebases, planning changes across dozens of files and opening pull requests. Each step quickly adds up, with Anthropic’s own documentation noting that agents consume approximately seven times as many tokens as standard sessions.

This is shadow IT and shadow AI, evolved. This time, however, many leaders approved the tool in question without guardrails governing consumption. AI hype adds fuel to the fire and normalizes long sessions. Uber’s CTO, for example, described a company-wide shift toward “agentic software engineering” with employees “who are quietly experimenting, quietly shipping and quietly pushing things forward”. This is an exciting way to test the limits of what’s possible, certainly, but it’s also a position that goes a long way to explaining how the company spent its annual AI budget by April.

Shifting the culture from usage to yield

Engineers haven’t done anything wrong here. In fact, they’re adopting and experimenting as instructed, with Uber creating leaderboards and ranking users by token consumption. More use led to a better ranking, reflecting a culture that lauds new ways of doing things. This behavior is known as “tokenmaxxing,” and its principal knock-on effect is shadow tokens — quantity-over-quality processes that leaders struggle to control until they’re fully realized in the budget. Of course, if management treats adoption metrics as performance metrics, then engineers can’t be blamed for using more tokens. The tension is that the teams driving adoption aren’t the ones managing spend.

None of this is meant to dismiss AI’s productivity possibilities and potential return on investment. Developers save 3.6 hours per week, achieve 60% higher pull request throughput and cut onboarding time in half with automation. Meanwhile, Uber shared that roughly 11% of live backend updates were written by agents with no human in the loop. However, these wins aren’t the problem — it’s that too many teams aren’t connecting input to output. I’ve spoken to admins who discovered their token spend had tripled in a single quarter after using heavier models or accidentally doubling up on agentic applications. Nobody knew until the financial damage was done.

Automation needs to happen sustainably with an eye on the bottom line. In my view, a much better metric for achieving this is AI yield — the measurable business or engineering output generated per dollar spent on tokens. Otherwise, without a feedback loop, even genuinely productive teams are flying blind.

Stopping token waste before an AI blowout

Creating that throughline between AI investment and token consumption starts with established financial metrics. This is possible via maximum spend limits (dictated by spend tagging, workload tiering and cost-per-output benchmarks) per team or project. Then, any additional allocation requires approval, closing the loop between the engineers spending the tokens and the leaders paying for them. AI isn’t cheap and teams should demonstrate a bang for their buck.

This is something we do with our engineering team at Hexnode. Resource allocation for Claude Code and Cursor is tied directly to ROI rather than letting consumption run open-ended. Given the pay-as-you-go nature of these tools, a firm usage limit per team offers simple but essential control.

Similarly, there’s room to apply some of the governance principles IT uses for device management. Things like policy enforcement, role-based access, real-time monitoring and automated alerts can flag usage behavior in advance. Uncovering such insights at the token layer works to identify power users and prevent excessive spending.

We also need to encourage cultures that praise outputs that actually achieve efficiency. AI applications that result in shipping faster, reducing rework and cutting review cycles are gains that should be celebrated. If your company hosts leaderboards, frame unnecessary token burn as wasteful rather than valuable. The organizations creating healthier consumption habits work with their engineers to understand not just how to use AI, but what responsible use looks like and what it costs.

This is a conversation teams need to have now. Anthropic just ended flat-rate pricing for programmatic workloads from June 15. Now, agents, continuous integration pipelines and automated workflows draw from a dedicated monthly credit pool billed separately from the subscription. Once that pool is exhausted, agent tasks either stop entirely or overflow to extra billing. Work can either get very expensive or grind to a halt for teams that aren’t prepared.

Getting a grip on shadow tokens means better rules and tools connecting spend to outcomes. Only by building the financial and cultural infrastructure that encourages sustainable adoption can leaders see what they’re spending, connect it to what they’re getting and course-correct before the costs become a crisis. Ultimately, shadow tokens are only invisible if we choose not to look.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Predicting an outage is tricky business, but CIOs might want to circle Oct. 11, 2026, through Jan. 11, 2027, for likely trouble of a potentially widespread and puzzling nature.

That’s because a relatively trivial update to DNSSEC on Oct. 11, one that will take full effect by Jan. 11, is likely to deliver a series of seemingly unrelated system outages. This will come from oceans of dependencies from third-party, shadow, agentic, gen AI, SaaS, homegrown, and legacy apps — among many other quiet executable hiding spots, including virtual environments and containers.

Sai Joshitha Kathari, senior site reliability engineer at payment card giant Visa, says most enterprises have far more DNS-related exposure than they realize because of these many dependencies.

“This has the potential to create real downstream destruction when unresolved failures sit underneath important business functions,” Kathari says. 

The danger is that so many of these issues are either unknown to IT or handled by a third-party vendor and no one in IT has had reason to ask those vendors about DNS updates. 

“The risky areas are usually not the obvious managed DNS services. They are the older internal applications, hardcoded resolvers, containerized workloads, sidecar configurations, custom scripts, partner integrations, VM images, stale base images, and service-to-service dependencies that nobody has touched in a long time,” Kathari explains. “These systems can keep working quietly for years, then fail during a DNS or certificate-related change because they bypassed the normal platform standards.”

Independent technology analyst Carmi Levy says that CIOs need to take this event very seriously. 

“The two-pronged deadline — October 11, 2026, when the new Key Signing Key (KSK) begins signing the root zone, and January 11, 2027, when the old key is retired — should be marked in red on everyone’s calendar, just as December 31, 1999, once was,” Levy says. “Failure to comply could result in websites, critical business applications, and related resources dropping off the face of the Earth once the transition is complete.”

Levy adds: “Custom-built code that lives outside conventional support mechanisms may or may not function when the DNS changes go into effect.”

The DNSSEC update itself is straightforward, but it is also the first significant DNSSEC change — specifically a change in the trust anchor — since 2018. 

The rollout statement noted that “the trust anchor is formally known as the Domain Name System Security Extensions (DNSSEC) root zone Key Signing Key (KSK). The KSK is the cryptographic key at the core of the DNSSEC trust anchor and is used to verify that DNS responses are legitimate and have not been modified in transit.”

Expect nearly every enterprise to be impacted

Kim Davies, vice president of IANA Services and president of public technical identifiers at ICANN, says the extent of the impact on enterprises is unknowable, given the nature of shadow IT and other edge cases. 

But based on the massive number of dependencies both known and unknown in the typical global enterprise, Davies guesses that just about every enterprise will be impacted, to varying degrees. 

“In highly complex organizations, it is very likely there will be some impact in the corners, in the margins, of the organization,” Davies tells CIO. “DNS is such a core technology that underpins everything.”

As the updates propagate, hiccups will materialize, Davies notes. “When the system cannot validate the [DNS] information, it will treat it as suspect and DNS lookups will fail.”

Visa’s Kathari says, “Enterprises should expect some secondary DNS-related glitches when major DNSSEC-related changes happen, not necessarily because the core infrastructure teams will ignore the update, but because large environments have many hidden dependency paths.”

Making this problem far worse, Kathari notes, is that the glitches will likely initially look like anything other thana DNS glitch. That will force IT staff to waste a vast number of hours chasing causes that ultimately prove to be unrelated to the incidents. 

“The impact for CIOs is that DNS failures rarely announce themselves as DNS failures. They look like application timeouts, broken logins, failed API calls, queue lag, payment failures, partner connectivity issues, or random regional instability,” Kathari explains. “That makes troubleshooting slower because teams may spend hours looking at the application, database, network, or cloud provider before realizing name resolution is part of the failure path.”

Sanchit Vir Gogia, chief analyst at Greyhound Research, agrees that IT will likely spin its wheels chasing the wrong ghosts.

“A validation failure rarely stays in its lane. It surfaces as an application error, an API timeout, or a reachability problem, which turns a resolver fault into a coordination failure,” Gogia says. “The application team blames the network, the network team blames the cloud, and the user simply watches work stop.”

“Images and templates are the frontier most teams miss,” Gogia adds. “A resolver fixed in summer can be broken again in October the instant a stale golden image is redeployed, because automation no longer lets configuration drift slowly. It restores yesterday’s assumptions at machine speed.”

It is widely expected that enterprises will not have any problems executing the change or, more likely, relying on their hyperscalers to properly handle the change. That is the concern. 

“CIOs are being distracted so much with AI and this is such a deep in the weeds infrastructure issue that this can and willcatch people off-guard,” Justin Greis, CEO of consulting firm Acceligence, tells CIO. “I think we’ll see a meaningful number of enterprise disruptions associated with the DNSSEC trust anchor rollover. Not because the update itself is especially difficult, but because it will expose weaknesses that already exist inside many organizations.”

Most enterprise IT operations have had no reason to compile a comprehensive list of all DNS dependencies, but many will be instantly discovered in January. 

Potentially widespread fallout

A major retailer, for example, might suddenly be unable to connect with FedEx to arrange for deliveries or a hospital may find that test results are no longer being shared with patient portals. It might manifest as an assembly line that halts because an IIoT component can no longer share files with its vendor system or a truck fleet that stops being tracked. 

“There will almost certainly be systems that fall through the cracks. Some will be legacy applications that rely on outdated DNS configurations that have not been updated in years,” Greis says. “Others will be business-unit-developed tools, contractor-built solutions, embedded systems, manufacturing and industrial systems, or highly customized workloads that operate outside normal IT oversight. These are the types of systems that often surface during infrastructure events like this.”

Greis adds that many enterprises will discover in January problems created by their own automation.

“Over time, enterprises build layers of processes, templates, and deployment mechanisms that are reused across teams and environments,” Greis notes. “Even after DNS infrastructure is updated correctly, older settings can inadvertently be reintroduced through routine updates and system changes, creating intermittent and difficult-to-diagnose failures.”

The good news from this situation is that enterprises are not going to likely lose all DNS access if any of these glitches occur. But that may be of no comfort because even if the disruptions are only with small edge cases, that can still cause massive operational disruptions.

Cricket Liu, EVP and chief evangelist at Infoblox, gives the example of a DNS server that responds to factory-floor system queries.

“Or let’s say this disrupts [an enterprise’s key] SaaS application. All name resolution may stop and it will show a server failure. It will not deliver a response whenever I look anything up. That’s not subtle at all,” Liu says. “It’s highly likely that companies are going to see some effects.”

Back in 2017, the switchover was relatively uneventful, giving some CIOs hope that January 2027 will also be a non-event. But given the technology advancements in the last 10 years and the resulting tidal wave of new enterprise tech dependencies, few are realistically expecting no problems this go around. 

Impossible to predict what will happen

One of the top network experts on DNS effects in enterprises is Geoff Huston, chief scientist at the Asia Pacific Network Information Centre (APNIC), the regional Internet Registry administering IP addresses for the Asia Pacific region.

Huston says it is difficult to project what will happen in January until it happens.

“Just like the last time, we are flying blind with this key roll. Because nothing really terrible happened last time, there is some confidence that nothing terrible will happen this time, but we just can’t tell in advance as there are no good measurement approaches that allow us to peek inside the trust state of recursive resolvers,” he says.

As for potential edge-case glitches, Huston says it is possible, but if third-party vendors do not properly handle the update, there will be other issues as well, as the KSK cryptographic key used within DNSSEC signs and validates the keys that protect DNS records. 

“If it is not standards-compliant, then you have more problems than just the KSK roll,” Huston says, “as it raises the obvious question of ‘What else is not correctly implemented in the DNS resolver that I’m running?’”

As a silver lining, Acceligence’s Greis says any hiccups that result from the DNS KSK update may be a gift in disguise for CIOs. 

“The irony is that some of the most business-critical components in the technology stack are often the least visible because they work in the background,” Greis says. January “may reveal how much modern business resilience depends on infrastructure that many organizations rarely examine until something breaks. For CIOs, that’s the real lesson. This is not fundamentally a story about a DNS update. It is a story about operational visibility, resilience, and governance. Organizations that treat the rollover as a routine infrastructure task will likely complete the update and move on. Organizations that use it as an opportunity to understand and strengthen the foundations of their technology environment may gain far more value than simply avoiding an outage.”

Cloudflare recently beat Q1 2026 earnings. Revenue up 34% year over year. EPS ahead of consensus. Full-year guidance raised. Then, in the same breath, they announced 1,100 layoffs, 20% of the company. CEO Matthew Prince’s explanation: “The way we work at Cloudflare has fundamentally changed.”

Block did the same thing. Beat guidance, raised outlook, cut 4,000+ jobs. Both framed it as architecting for the AI era.

This is not a contradiction. This is the new math boards are running. And if you’re a CIO who hasn’t started running it yourself, you’re behind.

The benchmark has moved

AI-native companies have quietly reset what “efficient” means for a technology organization. Midjourney generates over $500M in revenue with roughly 160 employees, over $3M per head. Anthropic hit a $14B annualized run rate in early 2026 with fewer than 3,000 employees. Across the top AI-native startups, the average revenue per employee is $3.48M, nearly twelve times the traditional SaaS benchmark of $300K.

Boards aren’t comparing you to your 2019 self anymore. They’re comparing you to Anthropic.

This is the pressure Cloudflare and Block are responding to. They’re not cutting people because the business is struggling. They’re cutting because investors have internalized a new denominator. Headcount is no longer a proxy for capacity; it’s a liability on the efficiency ratio.

For CIOs, this creates a hiring problem that looks nothing like the cloud or mobile talent gaps of the past decade. Those gaps were about volume: hire 100 cloud engineers, absorb the cost, build the capability… This one is about density; you’re not looking for 100 people. You’re looking for 10 who can deliver what 100 couldn’t, and justify $1M or more in value per seat.

Finding bodies to fill seats has never been easier. Finding people who operate at that level of leverage is a different problem entirely.

‘Acqui-hires’ are a shortcut with a hidden cost

Companies have figured out that recruiting AI-native talent one by one is too slow and that it’s faster to buy a team. Google’s acquisition of the Windsurf founders, Meta bringing in the Scale AI team, Accenture’s string of AI-focused acquisitions: these are acqui-hires dressed up as M&A. The premium on experienced AI talent is high enough, and the urgency real enough, that organizations are skipping traditional hiring loops entirely and buying their way in.

I’ve been on the other side of this. My company, MadKudu, was acquired by HG Insights specifically to bring AI-native capability into an established enterprise business. HG needed change agents who had already figured out how to build and ship in this new era, not just people who’d read about it. That’s the thesis behind most of these deals.

But there’s a cost that doesn’t show up in the acquisition price.

AI-native teams are fast because they operate with a different set of defaults: full access to tools, minimal governance layers, the ability to experiment and ship without a six-week approval cycle. That operating model is not a perk; it’s the fundamental mechanism. It’s why a team of 10 can do what an enterprise team of 100 can’t.

When you acqui-hire that team and then slot them into your existing approval processes, you’ve bought the people and killed the engine. The change agents you paid for become change-frustrated. The attrition that follows is expensive and predictable.

The harder realization: acquiring an AI-native team means accepting how they work. That requires deliberately carving out space for them to operate differently, not just tolerating it but institutionalizing it. The acquisition is an organizational change program, not just a hiring event.

The CIO’s real problem

The governance stack most enterprise organizations run was designed for a headcount world. Every tool vetting cycle, every vendor review, every security approval was calibrated assuming you were managing a large team where consistency and control were the primary objectives.

That calculus breaks when your goal is talent density. The same approval processes that protect against data leaks are now the reason your best people can’t do their best work. When it takes six weeks to approve a tool that your competitor’s team is already shipping with, you’ve traded velocity for the perception of safety.

The practical fix is structured experimentation: clear guardrails, defined boundaries, but explicit permission to try tools before deciding whether to roll them out broadly. Gating everything prevents you from ever discovering what 10x productivity looks like.

The skills inventory question is also more nuanced than it sounds. Job titles won’t tell you where the leverage is. You need to map the actual tasks within each function and assess which can be automated or augmented with AI. That’s where you find the people who, with the right tools, become your $1M/employee talent, not because you hired differently, but because you enabled better.

This is also where the build-versus-buy question gets genuinely tricky. As AI reshapes how products are built and delivered, your internal operating model — how you work, how fast you ship, how you use data — is becoming core IP. Outsourcing delivery means outsourcing the part of the organization where your competitive advantage is now being built.

Closing the gap without slowing down

The AI talent wars are not primarily a recruiting problem. They’re a rethinking of what organizations are supposed to look like.

Boards have a new benchmark. Cloudflare, Block, Amazon, Meta and others have already started restructuring to meet it, publicly, painfully, even while beating their numbers. The question for CIOs isn’t whether this pressure arrives; it’s whether you’re ahead of it or behind it when it does.

The organizations that navigate this well won’t win by outbidding competitors for a handful of elite engineers. They’ll win by designing operating systems that amplify the leverage of the talent they do have, by enabling their best people rather than constraining them, and by treating AI fluency as a core organizational capability rather than a niche specialization.

Talent density is the new headcount model. The sooner your governance, your tooling and your board conversations reflect that, the better positioned you’ll be when the next efficiency report lands.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.

In brief:

• AI is transforming software as a service (SaaS), and the old ways of keeping score no longer apply.
• Smart companies are evolving new metrics that provide deeper insight into how AI-native software is performing in a new marketplace.
• These changes impact everything from pricing to valuations.

The transformation of the software-as-a-service (SaaS) industry toward AI-native operating companies is rapidly changing the unit of value across the industry.

The traditional metric of seats — which measured access — is rapidly giving way to credits designed to measure work performed. This evolution is upending the industry in multiple ways, impacting everything from pricing to enterprise valuations.

While many companies still cling to seat-based metrics to measure growth, efficiency and durability, the future is likely to be one in which companies utilize a credit-centric metrics framework, with seats and outcomes as the bookends of a spectrum.

Why do software companies need new metrics?

Why the rethink, and why now? There are five major forces that are driving this shift:

1. The unit of value is changing. Seats measured who could access software, and credits measure what the software actually does. But in an AI-native world, agents don’t have seats; they have workloads. Over the past 18 months, every major SaaS platform has moved to some forms of credit or consumption unit.
2. The cost of goods sold (COGS) is exploding. AI inference adds real per-unit costs that scale with usage. In an AI-native world, software companies can’t scale to infinite users at near‑zero marginal cost as before.
3. Buying is moving up the org chart. AI-native applications shift purchasing to higher-level operators — such as line-of-business leaders or chief operating officers — which expands the market from software budgets to labor budgets. And because AI agents replace services as well as software, the total market opportunity is 3x to 10x larger than traditional SaaS.
4. Time to value (TTV) is collapsing. With AI-native tools, customers start seeing meaningful results in weeks rather than quarters. Onboarding and setup are fast, workflows are pre-built, and there’s no need for extensive customer success or professional services — dramatically reducing implementation time and costs.
5. Retention is bifurcating. AI forces clarity in a way that traditional SaaS couldn’t. Products that can provide value become even “stickier” and retain customers. Those that don’t churn faster. In an AI-native marketplace, the middle disappears.

How this shift is impacting pricing

Given how AI-native software is transforming the market, the shift to more variable pricing options is inevitable.

Seats won’t go away completely. Subscription pricing based on the number of users is stable and predictable and will continue to work for some customers. Tokens — the use of pass-through pricing for underlying compute — will fit those customers where the AI feature is commoditized or the buyer wants transparency into costs.

Credits will likely become the dominant architecture because they provide a simple metric for both customers and providers. The vendor sets the conversation ratio between credits and underlying compute, shielding the customer from inference cost details. Credits are easy to understand and can be packaged into annual contracts for multiple features and products.

Finally, the industry will likely see some move toward outcome-based pricing for results such as resolved tickets, recovered revenue or qualified leads. This strategy will mostly be limited to verticals where it is easy to prove AI impacted the result.

Where a software vendor sits on this spectrum is a signal of differentiation and pricing power. Credits are where most defensible AI-native businesses are landing because they balance customer predictability with vendor margin control.

How AI upends classic SaaS metrics

When SaaS was in its infancy, companies settled on key metrics designed to answer a small set of core questions. Are we growing? Are customers using the product? Are we retaining and expanding accounts?

But as AI upends software itself, it is also requiring companies to adopt new metrics to track success. These new metrics fall into three primary buckets, rebuilt around the pricing spectrum described earlier and the trend toward credits as the primary frame:

Revenue composition

• Committed credit annual recurring revenue (ARR) vs. burndown ARR: Measuring the credits sold on annual commitment vs. those consumed and replenished. This is the single most important split for valuation. Committed credits behave like subscription and burndown behaves like usage.
• Credit utilization rate: The percentage of purchased credits consumed per period. This is a leading indicator of renewal sizing.
• Credit burn velocity: How fast is a customer consuming their credits, and is that consumption increasing or decreasing quarter over quarter? This metric predicts expansion or contraction before it shows up in ARR.
• Effective price per credit: The real revenue per credit after discounts, overage and rollover, which can detect revenue leakage and help companies set smarter guide rails.

Margin reality

• Credit margin: The gross profit the company earns per credit after subtracting inference costs. This is the core economic unit for AI-native, usage-based businesses — the replacement for gross margin per seat used in SaaS.
• Inference-adjusted gross margin: By carving out AI inference costs separately in the P&L statement, you can see true AI margins, avoid hiding deterioration inside blended SaaS margins, and clearly distinguish AI economics from legacy SaaS economics.
• Compute leverage ratio: This metric measures how efficiently the business converts compute spend into revenue. It shows whether your AI margins are improving as you scale.
• AI-adjusted “Rule of 40”: This updated metric recalibrates the traditional growth and profitability benchmark to account for AI’s lower gross margins and variable inference costs, giving a more accurate picture of business health for AI-native companies.

Behavioral and value signals

• Time-to-first outcome: Replaces traditional onboarding metrics. Tracks how fast a customer reaches their first measurable result.
• Adoption: AI-native adoption is measured by workflow penetration and active agent density, not seat count. As AI replaces human-driven usage, the unit of adoption shifts from people to automated workflows and agents.
• Net credit retention (NCR): Credit-volume retention across the customer base, tracked separately from net recurring revenue to avoid price-change impact.

Along with these new metrics, the industry’s transformation is prompting companies to retire or recalibrate old SaaS measures, including per-seat ARR as a primary key performance indicator (KPI), traditional magic number calibrated to subscription dynamics, unadjusted Rule of 40, customer success metrics tied to human touchpoints, and blended gross margin without AI COGS carve-outs.

What does this mean for enterprise value calculations?

As the internal metrics of success change, so do the ways the investment community measures growth and long-term viability.

Increasingly, a company’s valuation multiple depends on whether its revenue behaves like committed subscription ARR or volatile usage ARR, and the commit‑to‑burndown ratio is the metric investors use to decide where the company fits.

For example, a business with 80% committed credit ARR could trade closer to subscription comps and one with 80% burndown could trade closer to usage comps even though both have the same types of customers. Being able to proactively explain the commit‑to‑burndown mix can help companies avoid undervaluation.

In addition, utilization is expected to replace net promoter scores and seat usage as the primary predictor of churn or expansion. Low utilization guarantees downsizing at renewal, so companies must track utilization cohorts the same way SaaS tracks logo retention cohorts today.

We’re also seeing an inversion of the operating model, with R&D and COGS moving up the P&L and sales and marketing (S&M) and customer success (CS) moving down or sideways. The net operating leverage profile is structurally different from classical SaaS, and the cost-to-scale curve looks different too.

Finally, credit margin engineering is a hidden value-creation lever. The gap between price per credit and cost per credit is set by the software vendor and can be optimized. Most operators have barely started managing this rigorously, and the ones who do will pull away on margin.

What this means for leaders, boards and investors

The shift from classic SaaS metrics to new AI‑native measures isn’t cosmetic. It represents the seismic change the industry is experiencing as AI matures and transforms products and organizations.

While these metrics — and perhaps others yet to be determined — may evolve over time, there is no doubt they are already changing how AI companies allocate capital, price products, incent sales teams, evaluate performance and communicate with investors.

It’s important to remember that SaaS metrics were practical tools for a specific era of software. As that era draws to a close, winning companies will choose new metrics that shape behavior and drive smart decision-making.

The views reflected in this article are the views of the author and do not necessarily reflect the views of Ernst & Young LLP or other members of the global EY organization.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

SAP-Anwenderunternehmen stehen unter Druck, auf SAP S/4HANA zu wechseln, weil die Mainstream-Wartung für SAP ERP (SAP ECC 6.0) Ende 2027 ausläuft und die bis Ende 2030 geltende erweiterte Wartung kostenpflichtig ist.

Zwar stellt SAP mit der „SAP ERP, Private Edition, Transition Option“ eine weitere Wartungsverlängerung bis 2033 in Aussicht. Da diese einer Neuimplementierung gleichkommt, bleibt SAP-Kunden mehr Zeit für die Planung, die Analyse und das Changemanagement. Der Nachteil: Wer diese Option nutzt, läuft Gefahr, technologisch ins Hintertreffen zu geraten, da Innovationen nahezu ausschließlich für SAP S/4HANA bereitgestellt werden.

Zögerliche SAP-S/4HANA-Transformation trotz Wartungsdruck

Obwohl der Druck hoch ist, hat eine große Zahl der SAP-Bestandskunden die Transformation auf die seit 2015 verfügbare ERP-Suite offenbar noch nicht vollzogen. Eine COMPUTERWOCHE-Expertenrunde zeigte, wo die größten Hürden liegen und was erfolgreiche Projekte auszeichnet.

Warum etliche Unternehmen die Transformation vor dem regulären Wartungsende scheuen und stattdessen zwei Prozent Mehrkosten für die erweiterte Wartung einkalkulieren, brachte ein Teilnehmender auf den Punkt: Firmen haben über Jahrzehnte in ihre SAP-ERP-Lösung investiert und sie an individuelle Prozessanforderungen angepasst, damit die Abläufe entlang der Supply Chain reibungslos laufen. Er habe daher in den vergangenen zehn Jahren keinen Kunden erlebt, der freiwillig umsteigen wollte. Alle hätten gesagt, dass sie müssen.

Nach Erfahrungswerten eines weiteren Experten nutzen erst rund 20 Prozent der SAP-Kunden SAP S/4HANA als Kernapplikation produktiv, unter anderem, weil entsprechende Transformationsprojekte auf sieben bis neun Jahre angelegt sind.

Altlasten bremsen die SAP-S/4HANA-Transformation

Unternehmen, die sich für den Wechsel entscheiden, verzichten häufig auf jede Modernisierung. Sie vollziehen einen Eins-zu-eins-Umstieg ohne Code-Modifikation, sei es in Form einer System Conversion (Brownfield-Ansatz) oder per Lift and Shift in SAP Cloud ERP Private (früher: SAP S/4HANA Cloud Private Edition). Dabei ist eine große Zahl von SAP-ERP-Installationen gar nicht zukunftsfähig, weil sie auf Prozessen aus den 1990er Jahren basieren und im Lauf der Jahre durch zahlreiche Eigenentwicklungen erweitert wurden.

Nicht selten gibt es bis zu mehrere tausend kundeneigene Programme im Z/Y-Namensraum, die zum Teil nicht mehr genutzt werden und das System unnötig belasten. Die Experten waren sich einig, dass eine solche rein technische Migration, bei der Altlasten wie ABAP-Eigenentwicklungen mitgeschleppt werden, keinen Mehrwert für das Unternehmen bringt.

Es muss geprüft werden, welche Eigenentwicklungen beibehalten werden, weil sie wettbewerbsdifferenzierend und damit geschäftskritisch sind, und welche gelöscht werden müssen, weil sie nicht genutzt werden oder weil es dafür inzwischen SAP-Standardfunktionen gibt. Handlungsbedarf besteht auch bei einer dreistelligen Anzahl von Buchungskreisen, von denen niemand weiß, welche noch benötigt werden, oder bei zahlreichen Dubletten in den Kreditoren- und Debitorenstammdaten.

Studie “SAP S4HANA”: Sie können sich noch beteiligen!

Zum Thema SAP S4HANA führt die COMPUTERWOCHE derzeit eine Multi-Client-Studie unter IT-Verantwortlichen durch. Haben Sie Fragen zu dieser Studie oder wollen Partner bei dieser Studie werden, helfen wir Ihnen unter research-sales@foundryco.com gerne weiter.

Migrations-Tools und KI-Agenten beschleunigen den Umstieg

Um diesen Prüf- und Bereinigungsaufwand zu bewältigen, bietet SAP mehrere Tools, um die Transformation auf SAP S/4HANA zu vereinfachen: darunter SAP Activate, SAP Cloud ALM, Migration Cockpit, Readiness Check, Custom-Code-Check oder Modifikationsabgleich. Ergänzt werden sie durch Lösungen wie Signavio für die Prozessanalyse. Die Experten schätzen den Effizienzgewinn durch solche Migrationswerkzeuge auf 30 bis 50 Prozent.

Zusätzliche Produktivität versprechen KI-Agenten, die Altsysteme automatisiert analysieren, Code bereinigen und Datenflüsse transformieren. Das reduziert den Migrationsaufwand und beschleunigt den Umstieg.

Scope-Management als Schlüssel für den Projekterfolg

Einig waren sich die Teilnehmenden, dass SAP-S/4HANA-Transformationsprojekte in der Regel nicht an der Technologie scheitern, sondern an einer mangelhaften Scope-Definition und am unzureichenden Changemanagement.

Ein Scope-Management vor dem Projektstart, das berücksichtigt, wie viel Veränderung der IT-Organisation und den Fachbereichen zugemutet werden kann, sei essenziell für den Erfolg, sagte einer der Teilnehmenden. Es erfordert die Fähigkeit zu priorisieren und ein iteratives Vorgehen, bei dem zunächst geschäftskritische Must-haves und Quick Wins umgesetzt werden. Weniger wichtige Nice-to-haves folgen später. Wer dagegen in der Konzeptionsphase bereits den großen Wurf anstrebt, wird voraussichtlich scheitern. Als Beispiel wurde der direkte Umstieg auf ein SAP-S/4HANA-Kernsystem genannt, das nach dem Clean-Core-Ansatz von nicht mehr lauffähigen Programmen und obsoleten Erweiterungen bereinigt ist.

Genauso wichtig ist ein Change-Management, das Mitarbeitende von Beginn an einbezieht, die nötige Akzeptanz schafft und vom Top-Management aktiv unterstützt wird, sowie eine verbindliche Governance mit klaren Zielvorgaben. Unverzichtbar ist auch die Einbindung der Fachbereiche. Sie stellt die größte Herausforderung dar, da Unternehmen befürchten, dass durch die SAP-S/4HANA-Transformation zu viele personelle Ressourcen gebunden werden, die dann für Kernaufgaben fehlen. Kommt es vor, dass IT und Fachbereiche als Antipoden agieren, sollte ein Change-Coach als Vermittler eingesetzt werden.

Hybride Betriebsmodelle setzen sich langfristig durch

Bereits vor dem Projektstart muss abschließend geklärt sein, welches Betriebsmodell für SAP S/4HANA am besten zu einem Unternehmen und seinen Zielen passt, auch mit Blick auf regulatorische Anforderungen. Das ist häufig nicht der Fall, sodass das Projektteam unnötig Zeit damit verbringt, das passende Betriebsmodell zu ermitteln. Das bremst Transformationsvorhaben aus.

Nach Ansicht eines Teilnehmenden wird sich langfristig ein hybrides Betriebsmodell durchsetzen, bei dem der SAP-Kunde entscheidet, welche Elemente der SAP-S/4HANA-Landschaft in einer Hyperscaler-Cloud, einer souveränen Cloud und/oder On-Premises laufen. Eine weitere, weitgehend unbekannte Möglichkeit ist der Betrieb im Rahmen der Customer-Data-Center-Option (CDC) von SAP Cloud ERP Private (früher: SAP S/4HANA Cloud Private Edition), die aus Gründen wie Datenschutz, Leistung und Souveränität eine interessante Alternative sein kann.

Mehrere Experten stellen darüber hinaus fest, dass die vollwertige SaaS-Lösung SAP Cloud ERP Public (früher: SAP S/4HANA Cloud Public Edition) inzwischen verstärkt eingesetzt wird. Sie stellt vorkonfigurierte Kern-ERP-Funktionen (Best Practices) bereit und lässt sich relativ schnell einführen, ermöglicht aber kaum individuelle Anpassungen. Diese Abstriche nehmen Unternehmen in Kauf, um von regelmäßigen, automatischen Upgrades und technologischen Innovationen zu profitieren.

Kritisiert wurde allerdings, dass die Cloud-Diskussion häufig unter begrifflichen Unschärfen leidet. So macht der Betrieb von SAP S/4HANA in einer Hyperscaler- oder SAP-Cloud die Lösung noch lange nicht zum Software-as-a-Service-Angebot. Solche Ungenauigkeiten irritierten SAP-Kunden und bremsten die Entscheidungsfindung. Letztlich sind beim Cloud-Betrieb auch die Kosten entscheidend. Zwar wollen viele Unternehmen anfangs maximale Sicherheit mit Private Network und Confidential Computing, wählen dann aber günstigere Commercial-Cloud-Angebote. Ausnahmen bilden regulierte Branchen und der öffentliche Sektor.

Ob hybrides Betriebsmodell oder Kostenfrage, am Ende entscheidet über den Projekterfolg nicht allein die Technologie, sondern auch, wie diszipliniert Scope und Wandel im Unternehmen gesteuert werden.

Teilnehmer der Round-Table “SAP S4HANA 2027”

AI agents can turn a clear description into working software, the engineer’s judgement is what makes the difference: deciding what to build, catching the tradeoff the agent didn’t know to weigh, and owning the call on whether the result is right.

That judgement has always been the hard part of engineering. It just used to be bundled into the act of writing code, where a skilled engineer did it while typing. As agents take on more of the typing, that judgement separates out and becomes the clear center of the role. Leaders who adapt early will get their metrics, their talent pipelines, and their delivery models working with this shift rather than against it.

Judgement is defining, constraining, and deciding

Judgement is all about defining the problem precisely enough that an agent builds the right thing. It’s setting the constraints the agent won’t infer on its own. It’s spotting the tradeoff buried three layers down that only shows up if you understand the system. And it’s looking at a finished implementation and knowing whether it’s genuinely good enough to ship.

This is the harder part of the job and the real driver of quality. It was easy to underrate when it lived inside day-to-day coding. Now it’s what separates a strong team from an average one.

The shift changes where time, growth, and metrics go

If the high-value activity is intent, review, and judgement rather than raw output, a few assumptions are worth revisiting.

Where engineers spend their time. Less of the day goes to producing boilerplate and mechanical implementation, and more goes to the reasoning that used to get squeezed to the edges: framing the problem and owning the judgement calls that determine quality.

How teams grow their people. Defining problems well, spotting risk, and critically evaluating work you didn’t write yourself have always been senior skills. When agents handle more of the mechanical work, those skills become learnable earlier. That puts the emphasis on leaders to teach the reasoning: why a choice gets made and how to weigh the tradeoffs that come with it.

What you measure. Lines shipped, tickets closed, and velocity charts all measured throughput of the old scarce resource. They say very little about the new one. The teams that adapt will start measuring the quality of intent going in and the reliability of judgement coming out, because that’s where the results now live.

Reinvest the time you get back

The tempting response is to treat the freed-up capacity as pure speed: same work, same tooling, just faster. That captures the easy win and misses the real one. If engineers spend their reclaimed time reviewing a rising volume of agent output with no better context than before, review quietly becomes the new constraint, and you’ve moved the problem rather than solved it.

The organizations that get ahead will invest the reclaimed capacity into the judgement layer: creating stronger specs and acceptance criteria before work starts, building review practices that test agent output against intent, and capturing the reasoning behind decisions where the next person can find it, so it doesn’t have to be reconstructed every time. That’s how the shift becomes an advantage for your team.

The through-line for leaders

The engineering job is moving up a level, from executing the work to directing and validating it. That’s a more strategic role, and it rewards clarity of thought over speed of output. Leaders who see the shift early can help their engineers grow into the work that’s now most valuable.

See how leading engineering organizations are operationalizing this shift at jira.dev.

Your CFO has a simple question. “We’re spending more on AI. What are we getting for it?” Most CIOs cannot answer it — not because AI isn’t creating value, but because the accounting systems we inherited were built before AI existed as a category of labor.

This June, the conversation shifted from token maxing to token cutting. The New York Times reported that Meta, Uber, Walmart and Amazon are capping employee AI usage. Uber blew through its 2026 AI budget in four months. Satya Nadella started framing it as human capital versus token capital.

All of that is true. None of it answers the CFO. Capping tokens is an input lever, not an output measure. And the human-versus-token framing names two sources of labor when the reality is four.

The enterprise now has 4 sources of labor

There are humans. There are humans assisted by AI. Humans are working alongside AI. And humans are managing AI. Sources two through four are all supervised machine labor at different intensities — none of them have a line item, a manager or an hourly rate. In our 2026 AI Labor Report, 78% of leaders view AI as both software and a labor force. The org chart has not caught up. Neither has the P&L.

Most enterprises are stuck at A-Level 1 with no accounting for any of it, while quietly sliding into A-Level 2. The job descriptions have not caught up. The budget has not caught up. You cannot upskill into a role that has not been named.

AI is the only category of work the modern enterprise has ever bought without a system of record for what it produced.

What you are actually running is supervised machine labor

The model does a first pass. A human makes it usable. One hundred percent of leaders we surveyed said AI work requires human review before it ships; 34% said substantial editing. That is a workforce with no manager, no hourly rate and no line on the income statement.

The accounting breaks in 3 places at once

Under GAAP: COGS if it helps produce the product, OpEx if it does work for you. The same workflow can hit all three buckets at once. A tier-one support resolution involves the human’s salary (OpEx), the AI’s tokens (COGS if support is a delivered service), and the supervisor’s review time (OpEx). Three buckets. One piece of work. No reconciliation. The token invoice arrives from Anthropic or OpenAI and gets coded to OpEx-software because that is what the bill looks like. Audit partners will be asking about this by next year.

When you call AI a tool, you book it like software. When you call it labor, you have to ask which kind and what it is producing.

The per-employee number is the wrong unit

Per-employee AI spend collapses a workforce into a per-head average. It hides the only number that matters: What AI is producing inside each workflow.

Lanai measured two teams inside the same finance organization. Same monthly prep and variance analysis. AI took the same amount of time to produce outputs of similar quality. The only variable was the model each team reached for by default — a choice nobody had made deliberately and nobody had seen until it was measured.

The gap existed for months before anyone saw it.

Faith-based budgeting — the organizational equivalent of putting money in the collection plate and hoping God handles the ROI — is what made it invisible.

AI labor orphaning

That is not a measurement problem. It is a category error. We call it AI Labor Orphaning. AI does the work. The output gets credited to the human who approved it. The token bill lands in OpEx-software. The supervision time absorbs into salaried hours nobody is auditing. Eighty-seven percent of leaders admitted AI output is sometimes or always credited entirely to the human employee. This is the last-click attribution problem of the AI era, running in reverse.

What fills the vacuum? Belief. Forty-three percent assume that if AI was involved, it contributed. Only twelve percent have a clear methodology. Seventy-nine percent are worried AI budgets will be cut because they cannot connect spend to results. The cuts are not coming because AI does not work. They are coming because nobody can prove that it did.

Capping tokens may look like responsible governance, but it is like turning off a staticky radio rather than tuning the dial. The companies cutting AI budgets in 2026 will discover in 2027 that they cut the workflows that worked alongside the ones that did not.

The real cost of AI is not the model. It is the redesign

Three layers. Most organizations only manage the first.

What to actually do

The 12% of organizations that can answer the CFO treat AI like every other category of labor — with a cost per AI Work Hour that is accounted for by a set of AI assistants, co-pilots and agents that are held accountable to performance standards. 

• Audit the four sources separately. Each A-Level has different token economics, SaaS implications and human redesign requirements.
• Find the embedded SaaS repricing before your next renewal. Pull your top 20 contracts. Ask whether AI features previously included are now priced incrementally.
• Redesign the human role at A-Level 2 before you scale it. You cannot upskill into a role that has not been named.
• Build a system of record before you build the next agent. Start with one department. Two weeks. You will find something that surprises you.
• Stop calling it a tool. Start calling it labor. The language determines the chart of accounts.

When your blended AI rate is $22 an hour, the conversation shifts from ‘we spent $340,000 on AI’ to ‘we acquired a skilled workforce at $22 an hour.’ That sentence is defensible. A vendor invoice is not.

The CIOs who will have a defensible AI story in 2027 are the ones who renamed the work in 2026. Not because technology changed. Because they finally built the accounting to see it.

Findings are drawn from the 2026 AI Labor Report, fielded by Wakefield Research with 200 senior technology leaders at US enterprises of 1,000-plus employees, March 20–April 8, 2026 (±6.9pp at 95% confidence).

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Model Context Protocol (MCP) verbindet KI-Agenten mit Datenquellen und erfreut sich im Unternehmensumfeld wachsender Beliebtheit. Allerdings ist auch MCP nicht frei von Sicherheitslücken, wie entsprechende Entdeckungen, etwa beim SaaS-Anbieter Asana oder dem IT-Riesen Atlassian gezeigt haben. Inzwischen hat sich jedoch einiges in Sachen MCP-Sicherheit getan. Einerseits wurden mit Blick auf das Kernprotokoll etliche Fortschritte erzielt. Beispielsweise in Form von Support für OAuth sowie für Authentifizierungs-Server von Drittanbietern und Identity-Management-Systeme. Darüber hinaus wurde inzwischen auch eine offizielle MCP Registry geschaffen, die einen Überblick über sichere, öffentlich verfügbare MCP-Server bietet.

Dennoch bestehen weiterhin Sicherheitslücken, die sich für diverse Cyberschandtaten ausnutzen lassen – Prompt Injection, Tool Poisoning, Token-Diebstahl, Server-übergreifende Attacken oder manipulierte Messages sind nur einige von vielen Beispielen. Mit anderen Worten: Unternehmen, die sich beim Aufbau von Agentic-AI-Systemen einen Wettbewerbsvorteil verschaffen wollen, müssen erhebliche Anstrengungen unternehmen, um zu gewährleisten, dass sensible Daten nicht nach außen dringen. Glücklicherweise gibt es diverse Tools, die dabei Unterstützung versprechen.

In diesem Artikel lesen Sie:

• was Security-Tools für MCP leisten sollten, und
• welche Angebote in diesem Bereich interessant sind.

Das sollten MCP-Sicherheitslösungen können

Die Gefahr von Datenlecks, Prompt Injections und weiteren Sicherheitsbedrohungen besteht unabhängig davon, ob Unternehmen:

• ihre eigenen KI-Agenten mit MCP-Servern von Drittanbietern,
• ihre eigenen MCP-Server mit Drittanbieter-Agenten, oder
• ihre eigenen Server mit den eigenen Agenten verbinden.

Soll heißen: Unternehmen müssen in jedem Fall Autorisierungen und Berechtigungen überprüfen, detaillierte Zugriffskontrollen implementieren und alles protokollieren. Daraus ergeben sich auch die Anforderungen für MCP-Sicherheitslösungen. Diese sollten bieten:

• MCP-Servererkennung. Für Mitarbeiter eines Unternehmens ist es einfach, MCP-Server herunterzuladen und zu nutzen. Mit Scan-Services für MCP-Server können Unternehmen sämtliche Instanzen von Schatten-MCP-Servern in ihrer Umgebung finden.
• Laufzeitschutz. KI-Agenten kommunizieren mit MCP-Servern in natürlicher Sprache. MCP-Sicherheits-Tools sollten deshalb in der Lage sein, diese Kommunikation auf Sicherheitsprobleme wie Prompt Injections hin zu überwachen.
• Authentifizierungs- und Zugriffskontrollen. Das MCP-Protokoll unterstützt inzwischen OAuth, aber das ist nur ein erster Schritt. Für zusätzliche Sicherheit empfehlen sich Tools mit integrierten Kontroll-Frameworks für Zero Trust und Least Privilege.
• Logging und Observability. Tools und Plattformen sollten zudem die Möglichkeit bieten, MCP-Protokolle zu sammeln, Sicherheitsteams über Richtlinienverstöße zu informieren, Compliance-Daten zu erfassen oder Protokolle in die bestehende Sicherheitsinfrastruktur einzuspeisen.

MCP-Security-Angebote

Im Folgenden haben wir die Anbieter von MCP-Security-Tools in drei Kategorien aufgeteilt. Diese Aufstellung erhebt keinen Anspruch auf Vollständigkeit.

Hyperscaler

Für Unternehmen, die sich vollständig auf eine bestimmte Cloud-Plattform verlassen, bieten die MCP-Tools des jeweiligen Hyperscalers einen einfachen Einstieg.

• Amazon Web Services (AWS) hat Mitte 2025 seine eigene agentenbasierte KI-Plattform eingeführt. Amazon Bedrock AgentCore umfasst ein Gateway, das mehrere Protokolle unterstützt (darunter auch MCP), ein Identity-Management-System sowie Observability.
• Microsoft bietet einen grundlegenden Azure-MCP-Server an, inklusive Support für Azure Key Vault. Darüber hinaus unterstützen auch Azure AI Foundry Agent Service und Azure API Management das Model Context Protocol. Zudem bietet Microsoft mit dem Agent Framework auch ein Open-Source-Entwicklungskit, das sowohl MCP als auch Agent2Agent unterstützt und beispielsweise Schutz vor Prompt Injections verspricht.
• Google Cloud kündigte Anfang 2025 seine MCP Toolbox für Datenbanken an – inklusive integrierter Authentifizierung und Observability. Außerdem hat der Hyperscaler auch eine Referenzarchitektur veröffentlicht, um MCP-Server auf seiner Cloud-Plattform abzusichern.

Große Plattformanbieter

• Der IT-Dienstleister Cloudflare hat mit MCP Server Portals ein Tool veröffentlicht, mit dem Unternehmen MCP-Verbindungen zentralisiert absichern und überwachen können. Die Funktion ist Bestandteil der Cloudflare-One-Plattform.
• Palo Alto Networks hat mit Blick auf MCP-Sicherheit mehrere Eisen im Feuer. Mit Prisma AIRS hat das Unternehmen einen eigenen, intermediären MCP-Server veröffentlicht. Dieser sitzt zwischen den KI-Agenten und dem eigentlichen MCP-Server und erkennt schadhafte Inhalte und Daten. Das Tool MCP Security ist hingegen Bestandteil von Cortex Cloud WAAS und überprüft die MCP-Kommunikation an der Netzwerkgrenze auf bösartige Aktivitäten.
• SentinelOne gewährt mit seiner Singularity Platform ebenfalls Einblick in die MCP-Interaktionskette und bietet zum Beispiel Warnmeldungen und automatisierte Incident Response für MCP-Server auf lokaler oder Remote-Ebene.
• Die Plattform von Acuvity (seit Februar 2026 Teil von Proofpoint) verspricht, MCP-Server umfassend abzusichern. Dafür sorgt laut dem Anbieter eine Kombination aus Least-Privilege-Execution, unveränderlichen Laufzeiten, kontinuierlichen Schwachstellenscans, Authentifizierung und Bedrohungserkennung.
• Daneben hat auch Broadcom MCP-Sicherheitsfunktionen für VMware Cloud Foundation angekündigt, die künftig mehr Sicherheit für agentenbasierte Workflows gewährleisten sollen.

Startups

• Das API-Security-Startup Akto hat eine MCP-Security-Plattform im Angebot. Sie umfasst ein Discovery Tool, um MCP-Server in Unternehmensumgebungen zu identifizieren, Security-Testing-Werkzeuge sowie Monitoring- und Threat-Detection-Funktionen.
• Invariant Labs bietet mit MCP-Scan ein quelloffenes Tool, das die statische Analyse und Echtzeitüberwachung von MCP-Servern ermöglicht. Mit Guardrails hat das Startup auch ein kommerzielles Produkt im Angebot. Dabei handelt es sich um einen Proxy. Der zwischen KI-Agenten und MCP-Servern sitzt und vor Security-Risiken schützen soll. Das Tool befähigt Anwender außerdem dazu, Richtlinien aufzusetzen.
• Highflame (vormals Javelin) addressiert ebenfalls das Thema MCP-Sicherheit. Etwa mit Funktionen wie MCP-Server auf Risiken zu scannen oder Datenanfragen zu überprüfen.  
• Lasso Security stellt ein Open-Source-MCP-Gateway zur Verfügung, das die Konfiguration und das Lebenszyklusmanagement von MCP-Servern ermöglicht und Messages um sensible Informationen bereinigt.

(fm)

Dieser Artikel ist im Original bei unser Schwesterpublikation CSOonline.com erschienen.

A large majority of IT and security leaders are confident in their teams’ ability to detect when an AI agent has gone rogue, but few are able to take quick action to mitigate the fallout when an agent exceeds its intended scope.

Nine in 10 IT and security leaders surveyed by IT observability vendor WanAware believe in their capabilities to find malfunctioning agents, but only 26% acknowledge that they can trace the downstream impact within minutes. Over 45% say it would take hours to understand the full impact of an agent incident.

That delay between detection and mitigation can be a huge problem, says Jeffrey Collins, WanAware’s CEO. The survey suggests IT leaders are overconfident about their ability to control agents, he adds.

And here, timing is critical, Collins says, given that malfunctioning agents can lead to major outages and data breaches — damage that can start within seconds, he notes.

“That’s truly the gap here. It’s not if you understand it; it’s when you understand it,” Collins says. “If your average time to just knowing about an event is measured in days, weeks, or months, you have a serious problem right now.”

While it’s not always easy to tell whether an agent has gone beyond its scope, it’s even harder to tell the downstream impacts, he adds.

“What’s been affected if one machine was compromised, either from our own AI usage as a customer or from someone else’s, what else could happen, and how can we understand that quickly?” Collins asks.

Machine speed

Kevin Paige, field CISO at IT solutions provider C1, agrees that time is of the essence when an AI agent malfunctions.

“The problem is that agents move at machine speed, so the gap between an agent malfunctioning and you catching it isn’t measured in minutes, it’s measured in actions,” he says. “Every minute it’s wrong it’s still working, and because it’s usually running on borrowed standing credentials, the damage spreads across everything those credentials can reach before anyone can pin it on the agent.”

In many cases, organizations with rogue agents don’t find out from their own detection tools, but from customers, auditors, or broken downstream systems, he says.

“That’s the worst way to learn,” Paige adds. “The longer-term cost is trust, because one incident like that and the business pulls back on agents entirely, so failing to contain a malfunction fast is also what stalls adoption.”

The problem with detecting rogue agents is that many organizations have built in visibility but not control, he says.

“When an agent goes out of scope it’s rarely dramatic,” Paige adds. “Usually, it’s using access it legitimately has, for a purpose nobody signed off on, which means your access model doesn’t even flag it. So you find out after the fact, and you fix it by hand.”

IT teams can stop agents that exceed their scope, but only if controls were built in before the agent was deployed, adds Chris Camacho, COO of Abstract Security.

“Every agent should have its own identity, narrowly scoped permissions, and a complete audit trail,” he says. “Just as important, organizations need the ability to immediately revoke that identity or suspend the agent without manually hunting through multiple consoles during an incident.”

Part of the challenge is that an agent’s activity is spread across identities, cloud platforms, SaaS applications, APIs, and security tools that were not designed to tell a complete story, Camacho says. Security teams often have to piece together events from multiple basic questions such as, what did the agent access, and what changed?

“Most organizations know where they’ve deployed AI agents,” he adds. “That’s very different from knowing exactly what an agent did after something unexpected happens.”

The organizations that most successfully manage agents won’t be the ones that deploy the most, he says. “They’ll be the ones that can explain every action an agent took, prove it operated within policy, and stop it immediately when it doesn’t,” he adds.

Confidence isn’t reality

The survey’s results make sense to Joe Brinkley, director of offensive security research and community at pentest firm Cobalt. The high confidence in detecting malfunctions is compliance paperwork, whereas the minority of respondents who can detect problems quickly is the reality on the ground, he says.

“Tracing agent impact fast is brutal,” Brinkley says. “These systems do not run on fixed code paths. They use nondeterministic reasoning across a web of different APIs. Traditional logs only catch isolated events. They completely miss the full execution chain.”

By the time an anomaly alert hits, an agent has already executed multiple downstream actions, he adds.

In some cases, agent malfunctions are related to data flow vulnerabilities, such as when a prompt injection from an untrusted input such as a malicious email overwrites the system instructions, he says.

“We need to be clear about the actual technology; the AI is not waking up angry,” Brinkley says. “The agent suddenly thinks its official job is to dump your database. It spends tokens as fast as possible to do that.”

Agents are also vulnerable to loop failures, when they hit API errors and try to self-correct, he adds.

“It hits that same broken endpoint 10,000 times in two minutes,” he says. “It drains your budget and causes a self-inflicted denial of service. It is an automated wrecking ball moving faster than your monitoring can log it.”

Brinkley recommends that IT leaders put “hard kill” switches at the API layer to stop agents going out of scope.

“You can stop it, but soft guardrails are useless,” he says. “Do not try to patch the prompt or filter the text. You have to treat the agent like a compromised user account. Pull the OAuth tokens and kill the access immediately.”

Something interesting happened during an internal evaluation of AI meeting transcription tools at Tungsten Automation. The products worked. They weren’t bad. But sitting across from the pricing, we kept asking the same question: what exactly are we paying for?

We already had a secure enterprise AI environment. Building a meeting summary workflow took days, not months. We customized the outputs, injected our own internal context, and controlled security our way instead of working around someone else’s roadmap. We built it. It works better. We own it.

That’s not a knock on those vendors. It’s a signal of something more fundamental happening across enterprise software.

The moat was never the product

For two decades, SaaS rode a favorable asymmetry: building internal tools was hard, integrations were messy, and even modest automation required developers and long timelines. Buying was faster and cheaper than building. That asymmetry fueled the explosion of SaaS into every corner of the enterprise stack.

AI is collapsing that asymmetry. Large language models and agentic workflows can orchestrate APIs, move data between systems, generate interfaces, and automate business logic with a fraction of the engineering effort required even two years ago. The integration friction that once protected entire product categories is evaporating.

The vendors most exposed are not the deeply embedded enterprise platforms. They’re the lightweight workflow layers, the products that essentially put a polished interface on top of accessible data and relatively straightforward processes. Reporting dashboards. Meeting tools. Narrow productivity applications. These products created value by simplifying implementation. That rationale is getting harder to sustain when implementation is no longer the real barrier.

Here’s the part most analyses miss: it’s not just that AI makes development faster. It’s that agents change the integration model entirely. For 30 years, enterprise software was built for humans navigating UIs. Agentic systems don’t use UIs. They call APIs, read from multiple sources simultaneously, and move data freely across systems. The switching costs that once made incumbent software sticky are collapsing, because an agent doesn’t care which UI it used last quarter.

The SaaS that survives

The question isn’t whether SaaS survives. It’s which SaaS survives.

The companies with durable positions are not the ones with the cleanest interface. They’re the ones that transfer operational risk customers genuinely cannot absorb themselves. Compliance. Regulatory certification. Accumulated domain expertise. Liability.

Think about compliant invoicing across 140 countries. That’s not a workflow someone builds in a sprint. The certifications alone take years. A single regulatory change in one jurisdiction can break an AP process for a global enterprise overnight. Customers don’t pay for that capability because it’s technically complex. They pay because they cannot afford to own the risk of getting it wrong.

That’s the distinction that matters: AI lowers the cost of building software. It does not lower the cost of absorbing risk. The vendors who understand this are building durable businesses. The ones who don’t are quietly subsidizing their customers’ internal build programs.

Software sells features. Platforms sell accountability.

The prototype trap

The danger for enterprise buyers right now is overcorrection. Every successful prototype looks like a cost-saving opportunity. Very few survive the jump to production.

Building a workflow with generative AI is becoming straightforward. Maintaining it is not. Models evolve. Outputs drift. Governance requirements tighten. What worked cleanly in a controlled environment behaves differently at scale, and the failure mode is worse than traditional software. Rule-based automation, when it fails, fails obviously. Agents fail silently, confidently, at scale, often with a completely reasonable-sounding explanation.

Engineering teams that take on AI-powered systems need to solve for observability, model drift, access controls, audit trails, and long-term maintenance ownership. In regulated industries, they need to demonstrate exactly how the system reached every decision. That’s not a weekend project. That’s an ongoing operational commitment that compounds over time as models change and regulatory requirements evolve.

Before a team decides to replace an external platform with internal AI tooling, the honest question isn’t, “Can we build this?” The real question is, “Are we prepared to own this in production, for years, as the underlying models change beneath us?” Sometimes the answer is yes. Often the answer is no, and the true cost only becomes visible after the vendor contract is canceled.

Build vs. partner: a sharper frame

The build vs. buy framing has always been too binary. The right question is build vs. partner.

Partner for the capabilities where risk transfer, regulatory complexity, and domain expertise create genuine value your team cannot replicate. Build for the capabilities that actually differentiate your business from your competitors. Don’t burn your best engineers rebuilding compliant invoice processing or production-grade document extraction. Those aren’t competitive advantages. They’re table stakes, and someone else has already paid the cost, across decades, to make them reliable.

The organizations getting this right are honest about where they create unique value. They focus development there, and partner for everything else. The ones getting it wrong are vibe-coding solutions to non-differentiating problems while their actual competitive moat goes unattended.

The true value of software

We’re not watching the death of SaaS. We’re watching the end of the friction-based value proposition: the idea that software is worth renewing because integration used to be painful. That rationale is largely gone.

What survives is software that does something customers cannot reasonably replicate internally: absorb risk, maintain regulatory compliance, deliver operational reliability at scale, and bring genuine domain expertise into a production-grade system that someone else already stress-tested for years.

The vendors who recognize this are already repositioning around accountability, governance, and outcomes. The ones who haven’t will find the next renewal conversation noticeably harder.

Software sells features. Platforms sell accountability. That distinction is about to separate a lot of winners from a lot of cautionary tales.

—

New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.

Site reliability engineers (SREs) have the tough assignment of resolving thorny performance and reliability issues. But their primary mission is to provide devops teams with operational insights and to suggest implementation improvements on business system performance, security, and overall robustness.

Google introduced its SRE playbook in 2003, but it took some time for the role’s definition, tools, and techniques to become mainstream. Startups were the first to adopt observability for cloud-native applications and create dedicated SRE positions. As tools matured and SRE responsibilities became more clearly defined, larger enterprises assigned SREs to work as a bridge between devops and IT ops teams to improve resilience across a wider range of applications, APIs, and data pipelines.

SRE is a career path for multidisciplinary engineers with strong investigative instincts, sharp data analytics skills, and the temperament to perform under pressure. It has become a critical responsibility as tech became mission-critical for enterprises, and it is a growing role in the genAI era as more businesses deploy AI agents.

But the critical need for resiliency and greater technological complexity brings new challenges for SREs. According to the 2026 State of Production Reliability and AI Adoption report, 44% of respondents experienced an outage linked to ignored or suppressed alerts in the past year, and 35% report their engineers occasionally ignore or dismiss alerts due to alert fatigue. More than 70% of alerts received are not actionable, according to 57% of organizations.

So, is AI making the SRE’s role easier and helping businesses run more reliable technology operations? On the other hand, AI is also driving complexity, as companies deploy genAI tools and AI agents across more business functions and seek to automate more decision-making across operations.

AIops and agentic ops aid SREs

Over the past decade, SRE responsibilities have become somewhat easier through improvements in monitoring platforms, observability practices, tools for centralizing operational data, and AI applied in IT operations (AIops). But during the heat of resolving an outage or performance issue, it’s not easy to correctly identify what system triggered the issue versus other downstream systems impacted by it.

According to the Komodore 2025 Enterprise Kubernetes Report, 79% of production incidents originate from recent system changes, including deployments and changes to compute environments. But the other 21% of incidents stem from issues outside of the business’s control, including network failures, third-party changes, and cloud provider failures.

“SREs using AI capabilities succeed or fail in the moment an incident unfolds, when engineers are deciding what to investigate next,” says Itiel Shwartz, CTO at Komodor. “If the system streamlines root cause detection, connects signals to recent changes, and explains its reasoning in a way engineers recognize, it earns trust. If it adds uncertainty or demands extra validation, it gets sidelined, regardless of how bespoke the model behind it may be. What’s less obvious is what it takes to make AI for SREs work in production, and how different that reality is from prototypes, demos, or early internal builds.”

AIops is not a new capability, especially in using machine learning to correlate logs, metrics, and traces across monitoring and alerting systems. IT service management and SREs have been using AIops to reduce the mean time to resolve incidents and to perform accurate root cause analysis (RCA) efficiently. Agentic ops is the next wave of genAI operational capabilities, including tools for monitoring AI agents, managing their access rights, and detecting AI model accuracy drift.

 “AI is useful during major incidents because it can pull together a lot of context into a few clear sentences, which is exactly what an SRE needs in the moment,” suggests Shani Shoham, chief revenue officer at OpenObserve. “The complexity of architecture and the different tooling make it easier for AI than for a human, but autonomous resolution is still a way off.”

AI’s impact on people and burnout

The business pressure to keep systems up, secure, and performing well is a 24/7 stressful responsibility. According to The SRE Report 2025 from Catchpoint, 36% of SREs often or always experience elevated stress during an incident, and 28% said the stress persists even after the incident is resolved. AI capabilities may prove to be a game-changer in helping SREs avoid burnout and reduce stress.

“AI can improve RCA by taking in a much larger incident context than any engineer can hold at 3am, reasoning across traces, logs, metrics, deploys, config changes, alerts, ownership, and recent production behavior,” says Noam Levy, founding engineer and field CTO at Groundcover. “Beyond attempting a full RCA, its immediate value is distilling the signals that actually matter, reconstructing a clear timeline of cause and effect, and helping engineers separate correlation from likely causality. Once a fix is deployed, agents can also verify remediation by comparing pre- and post-fix behavior, but this depends on broad access to rich, correlated production signals and a cost model that does not discourage adoption or experimentation.”

Not only are incidents resolved faster and with less stress, but AI can also free up SRE time to focus on proactive work and create a career path for junior developers into SRE roles. Quais Taraki, CTO at EDB Postgres AI, adds, “AI reduces toil by automating repetitive tasks while accelerating incident resolution through copilots that correlate signals across distributed systems, allowing SREs to focus more on resilience strategies like chaos engineering and failure analysis.”

AI can have long-lasting operational impacts, especially for organizations looking to deploy more mission-critical technology and AI capabilities. Two longer-term benefits of AI for SREs are reducing the number of bridge calls needed for incident response and the number of engineers required in “war rooms” to coordinate root cause analyses.

“When something goes wrong, AI that guides SREs can do the full analysis, get to the root cause, and perform the remediation,” says Spiros Xanthos, founder and CEO of Resolve AI. “AI also helps avoid many escalations, and when escalations are needed, it targets the right people from the network, infrastructure, and the application teams. AI for SREs centralizes operational intelligence, exposes tribal knowledge, and can guide more junior developers.” 

AI agent reliability

While AI capabilities have been a net positive in helping SREs improve system reliability, the growth of AI code generators, vibe coding, and spec-driven development is adding to their workloads. According to one study, 41% of all global code is now AI-generated, and Gartner predicts that 40% of new enterprise production software will be created using vibe coding techniques by 2028.

But coding velocity is creating new issues for SREs as AI pull requests have 1.4 times more critical issues and 1.7 times more major issues, according to CodeRabbit. “AI-assisted development has created an unprecedented velocity of code reaching production, expanding surface area, edge cases, and failure rates faster than traditional SRE practices can absorb,” says Vinod Jayaraman, cofounder and CTO at NeuBird AI. “The speed of shipping has far outpaced the speed of understanding what breaks in production. To close this loop, SREs need enterprise agents that can capture precise diagnostic context, including correlated traces, service dependencies, and anomaly timelines, and structure it as actionable input for the engineers and AI coding tools responsible for the fix.”

The growing number of AI agents deployed to production creates new challenges. AI agents are not just code; they have multiple failure points. They are built using language models, connect to proprietary sources for context, and integrate with Model Context Protocol servers to support more complex workflows. Changes are ongoing and not deployment events, so the SRE’s job of identifying the source of performance and accuracy drifts isn’t trivial. 

“Traditional SRE was built for systems that fail in reproducible ways, but agents fail differently and drift when a model provider pushes an update, and behavior shifts silently with no baseline for comparison,” says Mohammed Aboul-Magd, vice president of product at SandboxAQ. “Most organizations can’t even answer the basics: how many agents are running, what they have access to, and whether they’re still doing what they were built to do.”

“Every time a senior engineer leaves, they take years of learned failure patterns with them, and the next outage starts from square one,” adds Ronak Desai, cofounder and CEO at Ciroos. “Using AI for compounding operational memory changes that, and every incident your system resolves, the AI learns it.”

SREs should take a leadership role in emerging best practices, including defining their standards for AI agent non-functional acceptance criteria, observability practices, and release-readiness criteria. SREs should update their service-level objectives (SLOs) and define error budgets for AI agents in production.

Ryan Downing, vice president and CIO of enterprise business solutions at Principal Financial Group, says, “Standard SLOs and error budgets give teams the guardrails, and AI helps interpret the telemetry against those targets, reducing noise so engineers can get to the real issue faster and automate parts of remediation before customers are impacted.”

AI raises the SRE’s business impact

The more dramatic shift in site reliability engineering is an evolution of its business scope. IT leaders focus on uptime, performance, and issue resolution, as well as understanding their impacts. Business leaders will look to IT and SREs to identify, determine root cause, and remediate a broader class of issues, including rogue AI agents and the impacts of rapidly deploying new agentic capabilities. 

“AI agents are handing SREs categories of problems they’ve never had to solve before, specifically failures defined in business terms, not technical ones,” says Blake Sherwood, distinguished technologist for AI and platform strategy at Smarsh. “Traditional reliability engineering is built around latency, errors, and crashes, but agents now fail due to skipped compliance steps or outcomes that looked fine technically but were wrong contextually. Most SRE teams aren’t wired for that yet.”

The question is whether SREs with AI-augmented tools can keep up with the velocity, complexity, and business urgency of deploying new AI business capabilities.

A sandbox security hole that could lead to remote code execution (RCE), patched last week by ServiceNow, is being actively exploited in the wild, according to a report from threat intel firm Defused. 

The report, posted on X, said the firm is “observing in-the-wild exploitation of the ServiceNow pre-auth sandbox-escape RCE (CVE-2026-6875).”

Defused CEO Simo Kohonen, in an interview with CSO Online, noted that it appeared that the attacker has changed its tactics from those documented in an earlier proof of concept (PoC) from researchers at Searchlight Cyber, in response to ServiceNow patches and defenses. The company had implemented five different mitigations in its code base, which “neutered” the initial attack methodology, he said, adding that, overall, his team is seeing more attack method tweaks than it used to see. 

“We are seeing a lot of [attack] variations, much more so than a year ago, for the same vulnerability,” Kohonen said. Attackers “now have more tools to build their own stuff.”

However, he admitted that his team has thus far only observed this exploit an in the wild exploitation “once, by one actor.” 

In response to the report, ServiceNow issued a statement saying that it has not yet directly seen any such exploitations. 

“ServiceNow is aware of a cybersecurity company’s recent publication regarding exploitation activity associated with a previously disclosed security vulnerability, identified as CVE-2026-6875. Based on our investigation to date, we have not observed evidence that this activity is related to instances that ServiceNow hosts,” the emailed statement said. “We have provided updates and patches designed to address this issue, and we encourage our self-hosted and ServiceNow-hosted customers to apply the relevant patches if they have not already done so.”

A ‘repeatable failure point’

Analysts and consultants said the bigger concern with this hole is that it focuses on the lack of protections in the sandbox, which many security and IT teams have relied on for years. 

“The vulnerability lets an attacker bypass ServiceNow’s scripting sandbox entirely, and researchers are now seeing exploitation using a different technique than the one originally published, which means signature-based defenses built on the first proof of concept are unlikely to catch every variant,” said Frank Dickson, group VP for security at IDC.

“A compromise that starts in the cloud tenant can end up inside the corporate network, turning a SaaS incident into an on-premises one,” he pointed out. “And because ServiceNow frequently houses HR records, CMDB asset data, and the ticketing system itself, an attacker sitting inside it may have visibility into how the incident response team is tracking the incident.”

Dickson added that this incident is further proof that both IT and security teams need to reevaluate their patching methodologies. 

“Enterprises outsource patching for platforms like ServiceNow to the vendor, but keep the risk that comes from what those platforms touch: HR records, CMDB inventories, and now on-premises systems through MID Server integration. Control sits with the vendor, liability sits with the enterprise, and that mismatch argues for treating core SaaS platforms as part of the internal attack surface, not externalized vendor risk,” he said, noting that as vendors embed more AI-driven scripting into their platforms, the sandbox boundary becomes “a repeatable failure point.”

Because of this, he advised, “CISOs should start asking every AI-enabled SaaS vendor how that boundary is architected and tested, before the next version of this story breaks elsewhere.”

Noah Kenney, principal consultant at Digital 520, said the sandbox escape is the more disturbing element of the issue. 

“The significance is not that ServiceNow had a critical bug, so much as the fact that the bug is a sandbox escape in the AI Platform, which means the containment layer specifically built to run untrusted AI-driven code safely is the thing that failed,” he said. “CISOs have been told repeatedly that the sandbox is what makes enterprise AI safe to deploy, but we’re now seeing the sandbox breaking and that should reframe how CISOs think about every feature sitting behind a similar wall.”

Addition of AI increases blast radius

This is yet another example where AI is fundamentally changing just about every IT and security rule, he pointed out.

“Enterprises are bolting AI onto their most privileged systems of record faster than anyone is updating the threat models for those systems, and the AI layer is becoming the softest part of the hardest targets,” Kenney said. “The real question for a CISO is how many of your critical platforms shipped an AI feature in the past year, and whether a single person in your organization can tell you what that did to the pre-auth attack surface. Most cannot, and that is the actual exposure.”

Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, agreed.

“A vulnerability that gives an attacker a foothold in the ServiceNow instance is now also a vulnerability that gives them access to whatever AI agents are running inside that instance, along with any capability tokens, service accounts, or delegated permissions those agents hold,” Mahapatra said. “The blast radius of a ServiceNow compromise in 2026 is meaningfully larger than the same compromise would have been in 2023, and most enterprise security programs have not caught up to that shift.”

Defused’s Kohonen said that he did not disagree with the sandbox concerns, but he stressed that enterprise CISOs have long ago abandoned the belief that sandboxes are secure. 

“Nothing is foolproof, and having a sandbox is better than not having one,” he said. “But the belief that a sandbox removes all of the risk is incredibly dumb,” especially in the reality of today’s threat landscape, which contains “an endless conveyor belt of exploits.”

A sandbox security hole that could lead to remote code execution (RCE), patched last week by ServiceNow, is being actively exploited in the wild, according to a report from threat intel firm Defused. 

The report, posted on X, said the firm is “observing in-the-wild exploitation of the ServiceNow pre-auth sandbox-escape RCE (CVE-2026-6875).”

Defused CEO Simo Kohonen noted in an interview that it appeared that the attacker has changed its tactics from those documented in an earlier proof of concept (PoC) from researchers at Searchlight Cyber, in response to ServiceNow patches and defenses. The company had implemented five different mitigations in its code base, which “neutered” the initial attack methodology, he said, adding that, overall, his team is seeing more attack method tweaks than it used to see. 

“We are seeing a lot of [attack] variations, much more so than a year ago, for the same vulnerability,” Kohonen said. Attackers “now have more tools to build their own stuff.”

However, he admitted that his team has thus far only observed this exploit an in the wild exploitation “once, by one actor.” 

In response to the report, ServiceNow issued a statement saying that it has not yet directly seen any such exploitations. 

“ServiceNow is aware of a cybersecurity company’s recent publication regarding exploitation activity associated with a previously disclosed security vulnerability, identified as CVE-2026-6875. Based on our investigation to date, we have not observed evidence that this activity is related to instances that ServiceNow hosts,” the emailed statement said. “We have provided updates and patches designed to address this issue, and we encourage our self-hosted and ServiceNow-hosted customers to apply the relevant patches if they have not already done so.”

A ‘repeatable failure point’

Analysts and consultants said the bigger concern with this hole is that it focuses on the lack of protections in the sandbox, which many security and IT teams have relied on for years. 

“The vulnerability lets an attacker bypass ServiceNow’s scripting sandbox entirely, and researchers are now seeing exploitation using a different technique than the one originally published, which means signature-based defenses built on the first proof of concept are unlikely to catch every variant,” said Frank Dickson, group VP for security at IDC.

“A compromise that starts in the cloud tenant can end up inside the corporate network, turning a SaaS incident into an on-premises one,” he pointed out. “And because ServiceNow frequently houses HR records, CMDB asset data, and the ticketing system itself, an attacker sitting inside it may have visibility into how the incident response team is tracking the incident.”

Dickson added that this incident is further proof that both IT and security teams need to reevaluate their patching methodologies. 

“Enterprises outsource patching for platforms like ServiceNow to the vendor, but keep the risk that comes from what those platforms touch: HR records, CMDB inventories, and now on-premises systems through MID Server integration. Control sits with the vendor, liability sits with the enterprise, and that mismatch argues for treating core SaaS platforms as part of the internal attack surface, not externalized vendor risk,” he said, noting that as vendors embed more AI-driven scripting into their platforms, the sandbox boundary becomes “a repeatable failure point.”

Because of this, he advised, “CISOs should start asking every AI-enabled SaaS vendor how that boundary is architected and tested, before the next version of this story breaks elsewhere.”

Noah Kenney, principal consultant at Digital 520, said the sandbox escape is the more disturbing element of the issue. 

“The significance is not that ServiceNow had a critical bug, so much as the fact that the bug is a sandbox escape in the AI Platform, which means the containment layer specifically built to run untrusted AI-driven code safely is the thing that failed,” he said. “CISOs have been told repeatedly that the sandbox is what makes enterprise AI safe to deploy, but we’re now seeing the sandbox breaking and that should reframe how CISOs think about every feature sitting behind a similar wall.”

Addition of AI increases blast radius

This is yet another example where AI is fundamentally changing just about every IT and security rule, he pointed out.

“Enterprises are bolting AI onto their most privileged systems of record faster than anyone is updating the threat models for those systems, and the AI layer is becoming the softest part of the hardest targets,” Kenney said. “The real question for a CISO is how many of your critical platforms shipped an AI feature in the past year, and whether a single person in your organization can tell you what that did to the pre-auth attack surface. Most cannot, and that is the actual exposure.”

Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, agreed.

“A vulnerability that gives an attacker a foothold in the ServiceNow instance is now also a vulnerability that gives them access to whatever AI agents are running inside that instance, along with any capability tokens, service accounts, or delegated permissions those agents hold,” Mahapatra said. “The blast radius of a ServiceNow compromise in 2026 is meaningfully larger than the same compromise would have been in 2023, and most enterprise security programs have not caught up to that shift.”

Defused’s Kohonen said that he did not disagree with the sandbox concerns, but he stressed that enterprise CISOs have long ago abandoned the belief that sandboxes are secure. 

“Nothing is foolproof, and having a sandbox is better than not having one,” he said. “But the belief that a sandbox removes all of the risk is incredibly dumb,” especially in the reality of today’s threat landscape, which contains “an endless conveyor belt of exploits.”

This article originally appeared on CSOonline.

Im Dev-Umfeld verschwimmt die Grenze zwischen Programmieren und Prompten schon seit einigen Jahren. Auf die Spitze getrieben wird diese Entwicklung vom Vibe-Coding-Trend: Frühe KI-Entwickler-Tools wie GitHub Copilot waren vornehmlich darauf ausgelegt, Devs zu unterstützen. Etwa, indem sie Funktionen und Syntax ergänzten oder Boilerplate-Code aus Kommentaren generierten. Kommt ein Vibe-Coding-Ansatz zum Zug, beginnen menschliche Entwickler hingegen gar nicht erst damit, Code zu schreiben.

Dieses Konzept führt nicht nur zu veränderten Workflows, sondern erfordert auch, ein neues Mindset. Schließlich wird die Programmierarbeit mit Vibe Coding eher zu einer Art Live-Prototyping. In diesem Artikel lesen Sie:

• warum Vibe Coding Vibe Coding heißt,
• inwieweit sich dieser Ansatz für Unternehmen eignet,
• wie Vibe-Coding-Workflows konkret aussehen (können),
• welche Tools in diesem Bereich zu empfehlen sind,
• welche Risiken Sie dabei auf dem Schirm haben sollten, sowie
• Tipps dazu, wie Sie Vibe Coding effektiv in der Praxis umsetzen.

Vibe Coding – Begriffsdefinition

Der Begriff Vibe Coding wurde Anfang 2025 vom OpenAI-Mitbegründer Andrej Karpathy geprägt. Der KI-Experte trat den Trend mit einem Post auf dem Kurznachrichtendienst X los.

There's a new kind of coding I call "vibe coding", where you fully give in to the vibes, embrace exponentials, and forget that the code even exists. It's possible because the LLMs (e.g. Cursor Composer w Sonnet) are getting too good. Also I just talk to Composer with SuperWhisper…

— Andrej Karpathy (@karpathy) February 2, 2025

In diesem beschreibt Karpathy die Vibe-Coding-Methodik als eine neue Coding-Form, bei der man sich ganz den “Vibes” hingibt und vergisst, dass der Code überhaupt existiert. Amy Mortlock, Vice President of Marketing beim OSINT-Spezialisten ShadowDragon, erklärt das Konzept etwas weniger kryptisch: “Beim Vibe Coding beschreibt man in natürlicher Sprache, was man möchte, und die KI generiert dann die gesamte Anwendung und kümmert sich um alle technischen Details.”

Vibe Coding setzt also darauf, die traditionelle Programmierarbeit durch dialogorientierte Anweisungen und Kooperation mit einem KI-Assistenten zu ersetzen. Statt detaillierte Spezifikationen zu entwerfen und diese an die Engineers weiterzugeben, können Produktmanager, Fachexperten – oder jeder andere, der eine Idee hat – in einfacher Sprache beschreiben, wie das Ergebnis aussehen soll. Die KI-Software erledigt dem Rest in Echtzeit. Allerdings geht es dabei weniger darum, die Softwareentwicklung durchgängig zu automatisieren.

Vielmehr stehen Mindset-Veränderungen im Fokus: Warum sollte man nicht der KI die Mechanik überlassen und sich stattdessen auf die Ausrichtung, das Feedback, den Flow und die “Vibes” konzentrieren? Schließlich werden die Modelle, die Tools wie Cursor oder GitHub Copilot zugrunde liegen, immer performanter. Deswegen sehen auch viele Developer ihre Arbeit inzwischen vorwiegend als einen Dialog mit der KI – statt sich zeilenweise selbst durch Syntax zu wühlen.

Und obwohl auch bei einem Vibe-Coding-Ansatz diverse Probleme und Herausforderungen auf den Plan treten können (dazu später mehr): Die Technik gewinnt zunehmend an Popularität – auch im Unternehmensumfeld.

Vibe Coding im Unternehmen

Wie das in der Praxis konkret aussieht, beschreibt Charles Ma, Softwareentwickler beim Observability-Spezialisten Chronosphere: “Viele unserer Entwickler nutzen Tools wie Cursor und Claude Code. Wir fördern deren Einsatz sogar über ein Nutzungs-Leaderboard. Dabei betrachten wir die Tools jedoch als Assistenten, nicht als Dev-Ersatz. Unser Code-Review-Prozess ist weiterhin Pflicht für jeden Produktionscode – und wir sehen eher davon ab, viele unserer oder gar externe Tools mit KI zu verbinden.”

In der Perspektive von Achint Agarwal, Vice President of Product beim KI-Anbieter Pramata, hat Vibe Coding vor allem die Art und Weise verändert, wie Teams vom Konzept zum Prototyp gelangen: “Früher mussten UI/UX-Designer und Entwickler zusammenarbeiten, um eine Idee in etwas zu verwandeln, mit dem Kunden interagieren konnten. Dieser Prozess konnte leicht mehrere Wochen dauern und diverse Überarbeitungsrunden umfassen.”

Heute, so Agarwal, könne ein Produktmanager oder Fachexperte einfach in natürlicher Sprache formulieren, was er sich vorstellt, und die KI generiere funktionierenden Code in Prototyp-Qualität. “Bei dieser Veränderung geht es um mehr als nur Geschwindigkeit: Auch die Qualität der Ergebnisse ist besser, weil die Person, die den Anforderungen am nächsten steht, während des gesamten Prozesses die Kontrolle behält und es keine Reibungsverluste durch Übergaben gibt”, fügt der Manager hinzu.

Auch Agarwal sieht in Vibe Coding kein Substitut für die traditionelle Softwareentwicklung, sondern vor allem ein Explorations- und Validierungs-Tool: “Dev-Teams ist es damit möglich, in kurzer Zeit funktionierende Prototypen zu erstellen, diese mit Kunden zu testen und zu überprüfen, ob die Idee sinnvoll ist. Fällt diese Prüfung positiv aus, kann der Prototyp an die Engineers gehen, die ihn mit Blick auf Skalierbarkeit, Sicherheit und langfristige Integrationen weiter ausbauen.”

Wie sieht ein Vibe-Coding-Workflow aus?

Es gibt keine allgemeingültige Blaupause für Vibe Coding. Entsprechend gehen auch die Ansichten darüber auseinander, wie ein typischer Vibe-Coding-Workflow aussieht. Kostas Pardalis, Data Infrastructure Engineer beim KI-Lösungsanbieter Typedef, beschreibt diesen als agilen, vierstufigen Prozess:

• die Erkundungsphase, in der der “Vibe”, der Zweck und die Einschränkungen definiert werden.
• die Gestaltungsphase, in der ein funktionierender Prototyp erstellt und verfeinert wird.
• die Grounding-Phase, die genutzt wird, um Struktur und Datenintegrität hinzuzufügen.
• die Operationalisierungsphase, in der Versionierung, Evaluierung und Governance hinzukommen.

Steve Croce, Field CTO beim Open-Source-Unternehmen Anaconda, steht hingegen auf dem Standpunkt, dass der Vibe-Coding-Workflow davon abhängig ist, ob ein Prototyp, eine Zwischenlösung oder eine vollständige Produktionsapplikation entwickelt werden soll. Basierend darauf, orientiert sich der Vibe-Coding-Workflow in der Vision des Technologieentscheiders eher am traditionellen Software Development Lifecycle – fußt jedoch ebenfalls auf vier Stufen:

• In der Phase der Planungs- und Anforderungsanalyse könnten Produktmanager und UX-Teams demnach voll und ganz auf Vibe Coding setzen und so vor der formellen Entwicklung klickbare Prototypen und Machbarkeitstests erstellen.
• Im Rahmen der Design-Phase kann KI laut Croce dabei unterstützen, Architekturen und Dokumentationen zu erstellen. Der Manager weist allerdings darauf hin, dass es in dieser Phase auch hilfreich sein könne, erfahrene Engineers oder Architekten hinzuziehen, um die Einhaltung von Standards und die Reusability interner Systeme zu gewährleisten.
• Als Kernbereich der Vibe-Coding-Experience sieht Croce die Implementierungs- und Testphase: Ein KI-Agent könne an dieser Stelle die gesamte Anwendung erstellen und darüber hinaus auch Repositories strukturieren und Tests durchführen. Der Experte rät Unternehmens-Teams jedoch mit Blick auf die Testabdeckung und Konformitätsprüfungen auch in dieser Phase dazu, menschliche Profis hinzuzuziehen.
• In der Bereitstellungs- und Wartungsphase könne KI laut dem CTO dazu genutzt werden, Apps bereitzustellen und zu warten. Dieser Part könne jedoch auch vollständig außerhalb der Vibe-Coding-Erfahrung abgewickelt werden, um den Unternehmensanforderungen zu entsprechen, so Croce.

Empfehlenswerte Vibe-Coding-Tools

Vibe-Coding-Tools decken ein breites Spektrum ab: Vom leicht zugänglichen, dialogorientierten Builder für nicht-technische Teams, bis hin zu integrierten Entwicklungsumgebungen (IDEs), die Engineers umfassende Kontrollmöglichkeiten bieten und zuverlässige Anwendungen gewährleisten. Die Wahl des richtigen Tools hängt von den Fähigkeiten des Teams, dem Projektziel und dem benötigten Maß an Governance ab.

Eine kleine Auswahl empfehlenswerter Tools für Vibe-Coding-Zwecke:

• Cursor ist eine KI-integrierte IDE, mit der sich mehrere Dateien bearbeiten lassen.
• Replit ist eine gute Wahl für Browser-basierte Entwicklungsarbeit.
• Bolt und Lovable sind Builder, eignen sich vor allem für schnelles Brainstorming und zeichnen sich durch überschaubaren technischen Aufwand aus. Diese Tools sind daher auch für Einsteiger geeignet.
• Windsurf und Zed sind vollständige IDEs, die darauf ausgelegt sind, Vibe-Coding-Funktionen in traditionelle Dev-Umgebungen zu integrieren.

Diese Risiken birgt Vibe Coding

Trotz der genannten Vorteile birgt der Vibe-Coding-Ansatz auch diverse Risiken mit Blick auf die Wartbarkeit und Anfälligkeit der generierten Logik. So warnt etwa ShadowDragon-Managerin Mortlock: “Sicherheitslücken und technische Schulden sind die Hauptprobleme in Zusammenhang mit Vibe Coding. KI kann manchmal unsichere Pattern oder auch veraltete Bibliotheken einbinden.”

Zudem sei KI-generierter Code in den meisten Fällen auch länger, was das Debugging langwierig und mühsam gestalten könne, erklärt Mortlock. Sie fügt hinzu: “KI verweist unter Umständen auch auf nicht existierende Packages, was auch böswillige Akteure ausnutzen könnten. Was wie funktionierender Code aussieht, kann versteckte Fallen bergen.”

Charles Ma, Software Engineer beim Observability-Spezialisten Chronosphere, sieht ein weiteres Problem, das die Angriffsfläche potenziell vergrößert: “Selbst erfahrene Engineers können selbstzufrieden werden und dann Probleme übersehen, die ihnen sonst nicht entgangen wären. Sobald KI-Tools mit externen Systemen verbunden sind oder Websuchen durchführen, besteht außerdem das Risiko von Prompt Injections und Toolchain-Exploits.”

Infrastruktur-Profi Pardalis fokussiert mit Blick auf die Risiken von Vibe Coding vor allem die Bereiche Volatilität und Sichtbarkeit: Weil dieser Ansatz für schnelle Iterationen und Modellautonomie förderlich sei, bestünden die Hauptrisiken in unkontrollierter Variabilität und undurchsichtigen Quellen. Um diese Probleme zu bekämpfen, appelliert Pardalis für:

• Lineage Tracking: Jede Version wird committet und verwendet Frameworks mit integrierter Traceability.
• Evaluierungsschleifen: Qualitäts- und Regressionsprüfungen werden automatisiert durchgeführt.
• Governance-Layer: Prompt-Historien werden auditiert und sensible Daten gefiltert.

Der Engineering-Profi ist der Ansicht, dass eine expressive, modellgesteuerte Softwareentwicklung und eine deterministische Infrastruktur unter disziplinierten Rahmenbedingungen koexistieren können: “Letztendlich verspricht Vibe Coding kein Chaos, sondern strukturierte Kreativität. Sie entwickeln Ideen schnell, setzen sie aber sicher um. Mit anderen Worten: Freiheit am Anfang, Disziplin im weiteren Verlauf – so kann Vibe Coding tatsächlich in Produktionsumgebungen skaliert werden.”

6 Tipps für effektives Vibe Coding

Da Sie nun umfassend über alle Aspekte des Vibe-Coding-Ansatzes informiert sind, geben wir Ihnen abschließend noch ein paar Tipps an die Hand, um Ihre eigene Initiative erfolgreich umzusetzen. Diese haben wir aus unseren Gesprächen mit den im Artikel zitierten Spezialisten zum Thema extrahiert

• Beginnen Sie mit Zielen, nicht mit Funktionen: Beschreiben Sie zunächst die gewünschte User Experience und die wesentlichen Geschäftsprobleme, die mit der Initiative gelöst werden sollen. Dabei müssen Sie es nicht übertreiben und jeden Button oder Screen definieren – für relevante Lösungen ist es entscheidend, der KI so genau wie möglich zu beschreiben, was erreicht werden soll.
• Planen Sie voraus: Vibe Coding ist nicht in der Lage, eine gute Architektur zu ersetzen. Bevor Sie KI hinzuziehen, sollten Sie deshalb sicherstellen, dass Design und Spezifikationen stimmen. Das erleichtert es der KI, “Intent” in kohärente Systeme zu übersetzen.  
• Verstehen Sie KI als Partner: Es gilt, mit Vibe-Coding-Tools zu kollaborieren. Diese Werkzeuge brauchen Anleitung und ihre Ergebnisse müssen überprüft werden. Blindes Vertrauen kann an dieser Stelle kontraproduktiv sein. Sie sollten deshalb nicht zögern, die KI-generierte Logik in Frage zu stellen.
• Nutzen Sie Frameworks, Kontext und Beispiele: Etablierte Frameworks zu nutzen, erspart es Ihnen alles von Grund auf neu zu entwickeln. Die KI mit Beispielanwendungen zu füttern oder (vertrauenswürdige) MCP-Server hinzuzuziehen, um Kontext in größeren Projekten zu managen, kann ihre Fähigkeiten erweitern.  
• Halten Sie Menschen – und Security – im Loop: Setzen Sie auch bei Vibe- respektive KI-Coding-Tools auf das Least-Privilege-Prinzip – und Review-Prozesse. Engineering Best Practices anzuwenden, empfiehlt sich ebenfalls: Generieren Sie Tests, verifizieren Sie Funktionalitäten. Und betrachten Sie die Tools als Kreativitäts- und Produktivitäts-Support. Nicht als Substitut für Skills und Knowhow.
• Iterieren und verfeinern Sie: Nehmen Sie mit Blick auf Vibe Coding Abstand vom Streben nach Perfektion (auch wenn es Ihnen widerstrebt) und finden Sie sich möglichst frühzeitig mit unvollkommenen Ergebnissen ab. Tracken Sie Prompts, cachen Sie Checkpoints und verfeinern Sie die Ergebnisse – solange, bis der “Flow” zu einer zuverlässigen Funktionalität wird.

(fm)

Dieser Artikel ist im Original bei unserer Schwesterpublikation Infoworld.com erschienen.

For three decades, enterprise software has been a buy-it decision. Packaged software from SAP, Oracle and Salesforce covered roughly 80% of requirements at a fraction of the cost of building. The economics were obvious, and for traditional applications, they still are.

AI is introducing a wrinkle that is forcing even the most committed enterprise software customers to rethink their options. AI is a layer that sits across your data, your processes, and your decisions. Where that layer runs and who controls it is an architecture question, and most of the enterprise community is still treating it as a procurement one.

The appeal of vendor-embedded AI is clear: automated operational decisions, smarter supplier and merchandising choices, and friction-free workflows built into the systems enterprises already rely on. The catch is that these capabilities almost universally depend on your data living in the vendor’s cloud environment. For most large enterprises, it sits on-premises, in hyperscale cloud infrastructure they manage themselves, or in private data centers. That gap between where your data is and where your vendor’s AI assumes it should be creates a fundamental strategic fork in the road.

Build vs. buy is a category error

The framing I keep hearing is “build vs. buy your AI strategy.” It implies that some organizations are out there training foundation models from scratch. Nobody serious is doing that. The real choice sits across three distinct approaches, and conflating them leads to poor decisions:

• Buy embedded. Use the AI capabilities your vendor ships natively inside their platform: the assistant baked into your ERP, your CRM, your HCM suite. Lowest integration cost, fastest time to value, tightest fit with the application data.
• Buy platform. Adopt the vendor’s AI infrastructure layer and build your own assistants and agents on top of it. More flexible, but you remain inside the vendor’s architectural boundary and subject to their governance model.
• Compose. Connect a third-party model (Claude, GPT, Gemini, an open-weight model running in your own environment) directly to your existing landscape. Maximum control, maximum integration burden, and full responsibility for what comes out the other end.

These are not equivalent options at different price points. They make different assumptions about where your data lives, who governs the AI, and how much architectural change you’ll absorb to get there. Vendor pitches sometimes blur the distinction on purpose. Enterprise leaders can’t afford to.

The vendor AI stack has an assumption baked in

Every embedded AI capability ships with an unstated architectural prerequisite: your data must be where the AI can see it, in the shape it expects, under the governance the vendor enforces.

For organizations with clean, modern cloud estates, that is often a reasonable trade. For the long tail of large enterprises running heavily customized environments on private or hybrid infrastructure, that trade becomes a precondition, one you must meet before the AI conversation can even begin. Whether meeting it makes sense depends on your starting point, your sector’s regulatory posture, and your appetite for migration risk. None of those are uniform across organizations.

That’s the part that gets glossed over in vendor keynotes. The AI demo on stage assumes a destination architecture the audience hasn’t necessarily reached yet. Large enterprise customers are carrying an unusually heavy technology burden right now. Many are simultaneously managing platform modernization programs that have been building for over a decade, alongside pressure to migrate to vendor-managed cloud infrastructure. Sitting above both is a boardroom-level directive to demonstrate meaningful AI progress fast. The vendor path to AI and the boardroom path to AI can diverge sharply, and enterprises need to make selective, strategic decisions about where to adopt AI first to maximize value and minimize risk.

Sovereignty isn’t a slogan, it’s an architecture constraint

The conversation about sovereignty has been hijacked by both sides. One camp treats every SaaS adoption as a sovereignty violation. The other dismisses every sovereignty concern as Luddite resistance. Neither is useful.

What’s happening in real customer conversations – particularly in DACH, public sector, and financial services – is more specific. Organizations are drawing a distinction between running their applications in a vendor’s cloud (which is broadly fine, well understood, decades of precedent) and enriching their data and processes inside a vendor’s AI model (which has less precedent, is harder to reverse, and carries material implications for competitive position).

Enriching your data inside a vendor’s AI model is the genuinely new question, and organizations that conflate it with their existing cloud posture tend to defend the wrong perimeter.

Despite spending around $100 million annually with Amazon, Disney built its own internal AI system to house its corporate intelligence rather than rely on a hyperscaler’s AI offering. The decision came down to control. When your data represents decades of creative and commercial IP, you think carefully about where it lives and who can learn from it. Disney has become more open to SaaS over time. The AI sovereignty question is a separate debate from the SaaS debate and conflating the two leads organizations to the wrong conclusions.

At the other end of the spectrum, enterprises in heavily regulated environments treat data sovereignty as an absolute non-negotiable. Any AI model must run within their controlled environment, especially where sensitive data cannot touch the public internet. GDPR obligations reinforce this instinct across the European market, requiring organizations to maintain clear accountability for how personal data is processed inside AI systems, including vendor-managed ones.

AI-enriched data, meaning models that have learned the shape of your business processes, your supplier negotiations, your customer behavior, carries a different half-life and a different strategic value than the operational data underneath it. That deserves its own architectural decision, separate from your broader cloud strategy.

What this means in practice

Most large enterprise estates will end up with a mix of all three approaches, and where you draw the lines matters more than your overall posture.

Embedded AI capabilities are the right answer for in-application productivity: the assistant inside your ERP workflows, the agent inside your procurement or HR suite. That is where vendor embedding genuinely shines, and attempting to compose your own equivalent is typically a poor use of engineering resources.

Compose belongs elsewhere: in cross-application orchestration, in custom assistants over operational and observability data, and in agents that need to reach across multiple vendor systems and infrastructure layers in ways no single vendor stack will never natively support. Research from McKinsey suggests the most significant near-term productivity gains from enterprise AI will come precisely from these cross-system workflows, rather than from within individual applications. The most interesting enterprise AI work over the next eighteen months lives here, and it doesn’t require waiting for a migration to complete first.

That compose path isn’t free, and it’s important to be honest about the costs. Governance, audit trails, and accountability for hallucinated outputs become your problem, not the vendor’s. Prompt drift and evaluation discipline are real engineering costs that never appear in the proof-of-concept. Those costs scale with the complexity of your landscape and the number of systems your agents touch. Budget for them before deployment, not after your first production incident. None of that is a reason to avoid the path. It’s a reason to staff for it, honestly.

The real question

The build-vs-buy frame survives because it gives executives a binary choice along a familiar axis. AI sits somewhere else entirely.

The question worth putting on the table at your next architecture review is simpler:

Which decisions do we want our vendors’ AI to make, and which do we want to keep on our side of the boundary?

Answer that, and the right build/buy/compose mix flows from it. Skip it, and you will end up with the architecture your vendors prefer – which may or may not be the one your business needs.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Most organizations I work with have invested heavily in cloud security. They have endpoint detection tools, SIEM platforms, cloud security posture management, and skilled security teams running on a 24/7 shift. And yet, when I ask them a simple question — who has admin access in your Salesforce tenant right now? — The room goes quiet. Nobody knows. Not because they are negligent. Because they genuinely cannot see it.

That is the SaaS blind spot.

SaaS: Numbers speak volumes

I ask this question in almost every engagement: how many SaaS applications does your organization run? The answers I get range from 30 to maybe 50. The real number, once someone counts, is usually north of three hundred. AppOmni’s 2024 research put it even higher — 49% of Microsoft 365 organizations believed they had fewer than ten apps connected to their tenant when the actual average was over a thousand.

Here is the part that concerns me more than the count. Of all those applications, security teams have clear sight into maybe one in 10. The rest — where your customer records live, where your source code sits, where your financial reports get shared — nobody is watching. Not because the team is careless. Because the tools they have were never built to look there.

The following incidents will discuss these realities.

Salesforce in 2023

In April 2023, KrebsOnSecurity broke the story — Salesforce Community sites were quietly leaking sensitive data belonging to government agencies, banks, and healthcare providers. No sophisticated attack technique. Just the right API endpoint and a misconfigured guest user profile. The exposed records included Social Security numbers, account details, and home addresses. Salesforce was clear in its response: this was not a platform vulnerability. Administrators had misconfigured guest access policies, and nobody had checked.

Guest user profiles in Salesforce Communities can be granted access to data records. When administrators set those permissions too broadly — often without realizing it — unauthenticated external users can query that data straight through the API. Over 150,000 companies were potentially sitting in that window before anyone raised the alarm.

The pattern is always the same. Configuration made under time pressure, default set slightly too permissive, nobody looks at it again. SaaS applications accumulate these quiet exposures over months and years.

GitHub in 2022

In April 2022, GitHub disclosed that an attacker had used stolen OAuth tokens — issued to Heroku and Travis CI — to access and download private repository contents from dozens of organizations, including npm. GitHub’s own systems were never touched. The tokens came from third-party applications that users had authorized to connect to their accounts, and those applications had been quietly compromised.

The entry point was not GitHub. It was not even the organizations that lost their data. It was the CI/CD tools those organizations had connected to GitHub months or years earlier — tools that had been granted broad read and write permissions that were never revisited.

That is the OAuth problem in plain terms. The moment you authorize a third-party application; its security posture becomes your problem too. Most organizations have dozens of these connections sitting open across their SaaS platforms — and no one reviewing them.

Microsoft in 2023

The Microsoft case from 2023 is the one I bring up when people assume this only happens to careless organizations. Wiz Research found that Microsoft’s own AI team had exposed 38TB of internal data — private keys, passwords, and more than 30,000 internal Teams messages — through a single misconfigured Azure access token. The token was supposed to share one training dataset on GitHub. Instead, it opened an entire storage account to anyone who found the link.

What gets me about this one is the timeline. That token had been sitting there since October 2021. Nearly two years, inside Microsoft, before anyone caught it. If a team with that level of resources and expertise can leave a door open for two years, the idea that “we’d notice” is not much of a security strategy. And it’s worth noting — this wasn’t a database leak. It was Teams messages. The same collaboration tools your employees use every day are just as exposed as the platforms holding structured records.

Why traditional security tools miss this

Cloud Security Posture Management tools — CSPM — are designed to monitor infrastructure configuration: virtual machines, storage buckets, network rules, and IAM policies at the infrastructure level. They do an acceptable job at that layer. What they do not do is look inside SaaS applications. CISA’s Secure Cloud Business Applications (SCuBA) guidance specifically calls out the gap between infrastructure security tools and SaaS-layer visibility as one of the most under addressed areas in enterprise cloud security.

This is the gap SSPM was built to close. Instead of watching infrastructure, it watches the configuration of the SaaS applications themselves — permissions, sharing settings, who has access to what. And the distinction is not just academic. Infrastructure misconfigurations tend to expose systems. SaaS misconfigurations tend to expose data — directly, quietly, and often without any detectable attack activity at all.

What security teams should do now

You do not need to deploy a full SSPM platform tomorrow to start closing the gap. There are practical steps that move the needle immediately.

• Audit connected OAuth applications across your primary SaaS platforms. Revoke any integration that cannot be justified by a current business need.
• Common source of public data exposure: Review guest and external sharing permissions in Salesforce Communities and Microsoft SharePoint.
• Check whether legacy authentication protocols are disabled in Microsoft 365. Legacy auth bypasses MFA and becomes a potential entry point in enterprise environments.
• Establish a quarterly access review for high-privilege accounts in SaaS applications. Most organizations run annual reviews at best — that is not frequent enough for platforms that change configuration daily.
• A map of which SaaS applications hold sensitive data, and which have no security team ownership at all. That list will be longer than you expect.

The core issue is not that organizations are careless. It is that they have built security programs around the perimeter and the infrastructure, and SaaS applications grew up inside that perimeter without ever being brought into scope. The data is there. The access is there. The misconfiguration is often there too. What has been missing is the visibility to see it.

SSPM closes that gap. But even before a formal tool is in place, simply asking the question — what can the applications we already run see and share? — is a meaningful first step. In my experience, the answer surprises almost every organization that takes the time to look.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Meta is reportedly planning a cloud business that would sell access to AI computing power and models, extending its internal infrastructure into a commercial service for outside developers and enterprises. Reuters, citing Bloomberg’s reporting, noted that the planned offering would allow customers to access AI models hosted on Meta’s infrastructure and pay based on usage, effectively positioning the company in the infrastructure-as-a-service and AI platform markets. On the surface, this seems like a logical next step. If you are already spending enormous amounts of money to build AI infrastructure, there is a natural temptation to ask whether some of that investment can be monetized beyond your own internal use.

I have seen this pattern before. A company builds sophisticated internal systems, recognizes their value, and then begins to imagine that becoming a cloud provider is simply a matter of exposing those capabilities to external customers. It sounds straightforward, especially given the excitement around AI and the demand for high-performance infrastructure. But cloud computing is not just another distribution model. It is not simply a matter of offering on-demand multitenant services and charging a fee. It is a deeply operational, trust-based business in a market that punishes companies that do not fully understand what enterprise customers require.

A crowded neocloud market

The first problem Meta faces is that this is not an open opportunity. The neocloud space, meaning purpose-built AI infrastructure delivered as a service, is already crowded and increasingly difficult to enter. Amazon, Microsoft, and Google dominate the conversation for obvious reasons. They have years of cloud operating experience, broad service portfolios, global reach, mature ecosystems, and deeply established enterprise relationships. Oracle remains a serious player as well, especially in enterprise applications, data platforms, and performance-sensitive workloads. IBM still matters in hybrid cloud, operations, and industries where governance and regulatory rigor remain central.

That list alone should give Meta pause. These companies are not just infrastructure vendors. They are experienced cloud operators. They have spent years building not only the underlying platforms, but also the native capabilities enterprises now expect by default. Those capabilities include security, governance, identity management, observability, support, compliance, billing controls, resilience planning, and integration with the broader enterprise technology estate. These are not secondary features. They are part of the core value proposition.

This is why late entry into the cloud market is so hard. A new provider is not just competing on price or capacity. It is competing against accumulated trust. Enterprises are not casual buyers. They are selecting long-term operating environments for applications, data, AI models, and business-critical processes. They want confidence that the provider understands how these services will be consumed, governed, and supported over time. Meta is entering a market where the incumbents already have a major head start on all of those fronts.

Harder than it looks

Over the years, I have had many technology companies come to me and say they wanted to reposition their technology in the cloud space, either as software as a service or infrastructure as a service. In the beginning, enthusiasm is always high. The technology is impressive. The market size looks attractive. The revenue models appear compelling. Investors love the story. Then we begin to walk through what it really means to operate as a cloud provider, and the optimism usually fades fast.

The questions become very practical and very uncomfortable. How will tenants be isolated? How will identity and access controls work across different kinds of customers? What governance models will be built in natively? How will workloads be monitored, optimized, and secured? What does support look like 24 hours a day, across regions, across industries, across compliance boundaries? How will outages be handled, communicated, and remediated? How will the platform integrate with existing customer tools for operations, policy management, and security response? How much investment will it take just to become credible before you even begin to differentiate?

Once companies fully understand the complexities, market dynamics, and the capital and execution required to compete even with secondary players, many of them back off. They realize that cloud technology is not a packaging exercise. It is a transformation in how a company designs, operates, supports, sells, and evolves technology. That is why I remain skeptical when any company assumes it can translate internal infrastructure excellence into external cloud success without a very long, disciplined commitment.

Meta’s market readiness

Of course, Meta is not lacking in financial resources. If any company can afford to spend aggressively in this space, it is Meta. The company has the capital to build infrastructure, absorb losses, hire experienced talent, and stay in the market long enough to make a serious attempt. I would never argue that Meta is too small or too poor to try. Quite the opposite. If there is any non-traditional entrant with the financial scale to force itself into the conversation, Meta would be high on the list.

But money does not erase complexity. It only gives you the chance to confront it. The real question is not whether Meta can afford to become a cloud provider. The question is whether Meta has what it takes to become an excellent cloud provider. Those are two very different things. Enterprises are not going to move meaningful workloads to a new platform simply because the company behind it is wealthy or technically famous. They are going to ask whether the provider understands enterprise consumption patterns, enterprise risk, enterprise governance, and enterprise operations.

That is where the challenge becomes much more serious. Meta has extensive experience running infrastructure for itself. That is valuable, but internal operating excellence is not the same thing as external service maturity. Running systems for your own workloads allows a high degree of control over architecture, standards, priorities, and operating assumptions. Running systems for paying customers requires flexibility, consistency, transparency, and support across a wide range of use cases that you do not control. Those are very different disciplines, and companies often underestimate the gap between them.

What exactly is Meta?

Another concern here is strategic clarity. Meta already has a complicated market identity. It is a social media company, an advertising platform company, a hardware company, an AI company, and still, in the minds of many, the company that spent billions pursuing the metaverse. If it now wants to be viewed as a serious cloud infrastructure provider, it will need to explain not only what it is offering, but why customers should believe this is a durable long-term commitment and not just another adjacent experiment.

That uncertainty can be damaging. Customers want stable providers with clear strategic intent. They do not want to architect important systems around a platform if they suspect the provider may lose interest, shift direction, or reframe the business after a few years of uneven results. Cloud computing requires patience, consistency, and deep customer orientation. It is not a market where strategic ambiguity helps.

This could become confusing for Meta internally as well. Building a true cloud business demands focus. It demands years of investment in areas that may not be glamorous but are absolutely necessary, such as governance, operations, controls, support frameworks, partner programs, and enterprise sales alignment. If the company is not willing to make those sacrifices fully and for the long term, the initiative will struggle.

OpenClaw’s announcement that it has become a nonprofit foundation is generating IT excitement because of the potential for governance and development consistency that the popular platform has thus far lacked. Still, some worry about the risks created by the move. 

“Our ambition is for OpenClaw to be the Switzerland of AI. Neutral ground where every model and every lab can plug into the technology and collaborate on standards in the era of agents,” OpenClaw said in a post. “That work is already underway in Foundation-convened councils on agent identity, agent profiles, evals, and enterprise deployment.”

The statement, co-authored by OpenClaw creator Peter Steinberger, pointed out, “the great open source projects of our time — Linux, Apache, Mozilla — endure because a neutral steward stands behind them. That is the role we are taking on to keep OpenClaw MIT licensed, open, and independent so that everyone building on it can trust it will be here for the long term.”

But it reassured users that the original OpenClaw leadership is still in charge.

“Peter built this thing and Peter keeps making the calls, especially the technical ones. Since joining OpenAI earlier this year, he has continued to steward OpenClaw as an open and independent project, and OpenAI has made a commitment to keep it that way,” the post said. “The foundation is here to serve: good governance, stable funding, and paying the people who keep the claws alive.”

However, some analysts and consultants were skeptical about how much true independence Steinberger would have, given his salaried role with OpenAI. 

Neutrality claim in question

“The Switzerland of AI neutrality claim collapses under its own announcement,” said Noah Kenney, principal consultant at Digital 520. “OpenAI runs a team [at OpenAI] called Claw Labs that Peter leads and OpenAI is a major donor to OpenClaw. The ‘neutral steward’s’ chief technical decision maker is employed by one of the competing labs it is supposed to be neutral with.” To OpenAI, he said, OpenClaw is closer to a tax-exempt nonprofit subsidiary than it is to a neutral ‘Switzerland of AI.’

He pointed out that, in addition, Microsoft is shipping the enterprise version of OpenClaw, and Nvidia is shipping the hardware bundle. “This is being called the Switzerland of AI, but Switzerland does not have its central bank run by France,” he observed.

Kenney said that what the new OpenClaw has actually built is “a shared dependency that several competitors fund, staff, and steer, wrapped in a nonprofit structure. Enterprise IT should understand that structure, because treating OpenClaw as neutral is a mistake,” adding that CIOs need to look at this development devoid of the emotional component. 

“There is a strategic irony here that CIOs should sit with,” Kenney said. “If OpenClaw succeeds at becoming the universal agent substrate, then every model plugs into the same identity layer, the same profiles, and the same deployment plumbing. The thing every vendor is racing to own becomes a commodity that nobody owns.” He pointed out that, in the short term, that is genuinely good news for buyers because it means less lock-in and more portability.

“But,” he said, “when the connective tissue is free and natural, the only labs that benefit are the ones with the best models and the deepest distribution. Commoditize the layer below you and you compete on the layer where you are already strongest. The foundation is not a charity. It is the biggest players agreeing to stop fighting over the plumbing so they can fight over the water, and the enterprise is the one paying the water bill either way.”

Good news, bad news

Jason Andersen, principal analyst at Moor Insights & Strategy, liked the potential consistency that could emerge from the structural change, given the complexity of agent development today. 

“We are seeing a lot of OpenClaw variants hit the market, such as those from Nvidia as well as competing products from cloud and SaaS vendors. A common base helps solidify the common parts,” Andersen noted. “That said, a common challenge is the sustainability of these open source foundations over time. In addition to releasing code, these foundations need funding to evolve and grow. And that funding needs to come from continued momentum to incentivize existing members to increase investment and recruit new members to join.”

Andersen stressed that IT buyers need to keep an eye on the roadmap for any OpenClaw variant they choose to deploy, “as that will directly impact the foundation, and the momentum of the foundation and common base. If the common base loses momentum, it can lead to forks, or just a loss of innovation. When that happens, members tend to back away, which puts customers in limbo.”

But not everyone sees the promised structure as entirely good for IT.

Ishraq Khan, CEO at coding productivity tool vendor Kodezi, said, “most CIOs do not want to bet their future entirely on a single model vendor. They want Claude for some workloads, GPT for others, open models for sensitive environments, and potentially internally fine-tuned systems for specific use cases. The problem is that every vendor currently brings its own identity system, tool interfaces, permissions model, and operational assumptions. That fragmentation does not scale.”

He said, “the risk if standards fail is straightforward: every vendor builds its own closed ecosystem, enterprises become locked into individual stacks, and security becomes dramatically harder. The opportunity if OpenClaw succeeds is equally significant: enterprises get portable agents, common identity standards, interoperable tooling, and a healthier competitive market around models rather than ecosystems.”

Will it remain a nonprofit?

However, said Justin Greis, CEO of consulting firm Acceligence, one of the key details that IT executives will want to keep in mind is that OpenAI also began as a nonprofit, but it was quickly seen as not adhering to nonprofit objectives. 

“OpenAI’s transition from a nonprofit research organization into a more complex structure highlighted the challenge of maintaining mission alignment while scaling technology, capital, partnerships, and commercial operations,” Greis said. “OpenClaw has the opportunity to address some of those governance questions earlier by establishing clear principles around neutrality, transparency, and decision-making before the ecosystem becomes even larger and more valuable.”

He noted, “we have seen this pattern before with technologies like Linux and Kubernetes. The strongest open ecosystems succeeded because they created trusted foundations that enterprises could build upon. The technology was important, but the governance model that underpinned it was equally critical.”

Risks are ‘squarely in IT’s lap’

Consultant Brian Levine, executive director of FormerGov, echoed Greis’ concerns. 

“CIOs shouldn’t assume that this nonprofit will always be a nonprofit, or confuse being a nonprofit with actually being neutral or unbiased,” he said. “The risks are squarely in IT’s lap: autonomous agents ‘with their own identity’ acting on a user’s behalf blow straight through traditional IAM assumptions. Issues, such as agent identity, auditability, secret handling. Identity boundaries have not yet been reliably solved. Until they are, enterprises should treat OpenClaw agents like privileged service accounts, not like a browser plugin.”

Independent cybersecurity and risk advisor Steven Eric Fisher pointed to another IT exposure that might come from this OpenClaw transition: Cost.

“OpenClaw currently has a very high token burn rate in usage, which presents a significant cost consideration for large-scale enterprise adoption,” he said. “The skills marketplace introduces a new supply chain threat that enterprises will need to manage. Threat management, and specifically handling external marketplace elements, can be highly challenging for open-source operations. Ultimately, at scale, enterprise adoption could become a difficult balancing act between managing high operational costs and securing an expanded security surface.”

This article originally appeared on Computerworld.

Gen AI spending is moving beyond the familiar software model of seats, licenses, and pilots. As AI shifts from copilots to embedded workflows and autonomous agents, one user request can trigger multiple model calls, retrieval steps, retries, orchestration layers, and infrastructure events. A tool that looks affordable in pilot may behave very differently once connected to production systems or allowed to act with less human supervision.

According to Michael Corrigan, CIO of World Insurance Associates, AI introduces a fundamentally different cost model — one that’s usage driven, non-linear, and tightly coupled to business activity. “Success requires shifting from traditional IT budgeting to FinOps-style discipline where consumption, value, and governance are actively managed in real time,” he says.

Here are five ways CIOs can build that discipline before AI costs spiral.

Forecast AI by workflow, not by user

At World, a top 25 insurance broker with about 3,000 employees across roughly 300 locations, AI use falls into three broad categories, Corrigan says. One is broad tools, such as copilots. Another is embedded AI inside SaaS platforms. And the third is bespoke AI built around specific workflows and manual processes.

“The bespoke is the area that’s growing the most right now,” he says. “And that’s where the model, from a cost perspective, has really been shifting from a license seat cost to a token consumption or token burn cost, or even a hybrid.”

Seat-based pricing is relatively easy to forecast whereas consumption-based AI isn’t. Costs may depend on prompt complexity, output length, model choice, workflow design, and whether the system calls a model once or many times in the background.

World tries to manage that uncertainty by defining the business problem, success criteria, and expected operational improvement upfront. Pilots help estimate consumption before scaling, but Corrigan says they don’t remove the ambiguity.

“We’ll try our best in the pilot to understand what the consumption rate is, what the token burn rate is,” he says. But once a consumption-based workflow goes into production, he adds, an estimate is put into place. That estimate is informed, but still rough.

Elmer Morales, founder and CEO of koder.com, an agentic AI coding startup, says CIOs should think less about headcount and more about workflow mechanics. Agentic AI costs are driven by the number of decisions an agent makes, how often it retrieves external data, how much context it carries, and how many systems it touches.

“CIOs should start by mapping workflows, not necessarily users,” he says. “The relevant variable isn’t going to be the headcount but how many decisions an agent makes per task.”

Model the failure path, not just the happy path

Pilots can mislead because they often test the cleanest version of an AI workflow. Morales says many enterprises model agentic AI costs around the happy path: the user gives a clear prompt, the system understands the request, the agent completes the task, and the process ends. Production is messier.

“They generally don’t model for situations where the agent is going to need to go back and check its work and redo things,” Morales says. “A lot of times, agents are wrong, either because they hallucinate or they understood the problem incorrectly.”

In an agentic workflow, the system may check its work, call another tool, retrieve more data, or redo a step. While that may improve quality, it also adds cost.

The difference between copilots and agents is central. A copilot interaction is often one prompt and one response. An agentic workflow may involve agents moving through a decision tree, executing tasks in sequence or in parallel, and calling sub-agents or external systems along the way. “By the time it’s achieved the original goal, the agent might have made 50 or 100 model calls, compared with a single call for a traditional copilot prompt,” Morales says.

That’s why CIOs should require teams to model the failure path before production, like how many retries are allowed, how much context is resent, which tools can be called, when a human should intervene, and what happens when the agent can’t complete the task.

Build cost controls into the architecture

Traditional FinOps practices still matter, but AI requires more than retrospective dashboards and chargebacks.

According to Pavan Madduri, senior cloud platform engineer at industrial supply company Graigner, looking backward at usage data, as traditional FinOps often does, can be too late. Costs are shaped by prompt design, model selection, agent behavior, orchestration choices, and runtime loops.

“Dashboards or chargebacks, those are historical accounting,” he says. “The money’s already gone.” For AI, he argues, cost controls need to be embedded into the architecture. That includes hard token caps, retry-depth limits, maximum runtime limits, workload prioritization, background-job throttling, and cluster-level controls that prevent runaway consumption.

“The real FinOps means you need to have the cost constraints embedded into your architecture framework,” Madduri says.

Those controls also extend to infrastructure. Expensive GPUs may sit warm between jobs because systems need capacity available when inference demand arrives. Teams may pass huge schemas, databases, or thousands of lines of code into frontier models when a smaller or more focused prompt would do.

Enterprises should also adopt event-driven autoscaling, Madduri says. “Use tools like KEDA to scale GPU nodes down to zero the moment inference demand drops, so teams only pay for the windows when the silicon is actively crunching tokens.”

Corrigan says World uses rate limits, spend limits, alerts, and approval gateways for consumption-based tools. When users approach token consumption limits, automated alerts allow IT and the business to review whether the continued spend is justified.

“If it’s not meeting the success criteria we expected, you have to have the control in place to say we’re going to move on or kill that process,” Corrigan says.

Route work to the right model

CIOs can also reduce AI bill shock by avoiding a default assumption that every task requires the most powerful model available. While some tasks need advanced reasoning, many others don’t. A simple support ticket, log-parsing task, or structured database transaction may be handled by a smaller or cheaper model. A complex architecture decision, legal analysis, or multi-step reasoning task may justify a more powerful one.

“Choosing the right model for the right prompt and right question — that’s where you leverage the maximum from that model, and you can decrease the costing,” Madduri says. “If you default every single call to a frontier model, that’s architectural laziness.”

Morales makes a similar point. Not every step in an agentic workflow requires a top-of-the-line model. Model routing, he says, is the discipline of determining the best model for the task, and providing the relevant context when the model needs it.

According to Jim Olsen, CTO of enterprise software company ModelOp, CIOs should use the least expensive model that can accomplish the business goal. Using the biggest model for everything is easier, but expensive. “It’s like hiring the most expensive engineer to change a few colors in a website’s CSS, or visual styling,” he says. “You wouldn’t do that. You use the appropriate tools for the task.”

Tie consumption to business value

For Olsen, the deeper enterprise problem is AI value shock, not just bill shock. Spending $200,000 in a quarter on AI is justified if it produces $2 million in business value. The problem is spending heavily on use cases that don’t generate a meaningful return.

“Are you actually getting that return on investment, or are you just blowing tokens for something that’s not delivering the value to your business?” Olsen asks. Tracking token usage by user or department may show who consumed AI, but not whether the consumption mattered.

For most enterprise AI systems, Olsen says costs should be tied back to business use cases. A model may be used for HR document search, customer support, code review, problem resolution, or other functions. Each use case may draw on the same underlying models or agents, but the business value can be very different.

That’s why he argues that companies need an AI inventory, a record of which business workflows use which models, agents, providers, workflows, and systems. Without that inventory, enterprises can’t connect consumption to value.

Corrigan takes a similar approach from a governance perspective. At World, new AI ideas go through an intake process. Business users propose improvements, and IT, finance, operations, sales, and business stakeholders evaluate, prioritize, and monitor them from pilot through production.

That may be where the next stage of AI FinOps is heading, toward a clearer understanding of which AI consumption deserves to scale, not just to lower bills. So the question, as Olsen puts it, isn’t whether someone used a million tokens. It’s what are they using them for.

I attended several major technology conferences in 2025 where the first AI agents embedded in enterprise SaaS platforms were announced. Some of these agents showed promise and a glimpse into the future of work, while others looked like natural language extensions of a platform’s existing functionality.  

At the end of 2025, Anthropic and OpenAI launched new AI models and code-generating capabilities. More developers tried vibe coding, and some platforms launched spec-driven development capabilities. By February 2026, even The New York Times reported that the AI disruption had arrived, noting that code generators were building “apps that may be flawed, but credible.”

Wall Street investors took notice of the code-generation improvements and other disruptive factors, driving a selloff in SaaS stocks, now referred to as the “SaaSpocalypse.” Part of their concern stemmed from the belief that CIOs would use AI to write software that would replace SaaS solutions.

AI innovations from SaaS and solution providers

But I thought differently and wrote a response in my article asking whether AI is the end of SaaS as we know it. CIOs might use AI to accelerate application modernization, but I doubt they would replace their ERP, CRM, and even smaller SaaS point solutions by building them.

Instead, I believed it would be SaaS companies that would take the most advantage of AI code-generation capabilities.

This hypothesis drove me to attend nine conferences this spring to see how SaaS companies were launching AI agents and defining a new future of work. I wrote eight articles on what CIOs need to know about data management, agile organizations, marketing, ERPs, critical process management, and other evolutions to plan for in the AI era.

Now, looking across all nine conferences, I can draw some conclusions about how AI agents are shaping the future of work. Here are my learnings and what CIOs need to consider when evaluating and deploying AI agents in the workplace.

Agentic, human-in-the-middle, or augmenting human?

SaaS companies have very distinct perspectives on the future of work, including the extent to which humans will play which roles and whether and how quickly we’ll see agentic, fully automated work.

For example, Atlassian proclaimed, “step into the future of human-AI collaboration,” while SAP unveiled “the autonomous enterprise.” Snowflake aimed to “make AI real for business,” while Appian targeted “serious AI built on process.”

These vendors’ marketers had to decide whether to lead with AI, people, or business in their messaging, but so must CIOs as they contemplate their AI strategies and how to get employees to fully adopt AI agents.

Some CIOs see a fully automated agentic AI as the future, with human-in-the-middle as a transitional phase as departments build trust in AI agents’ decision-making and automation capabilities.

Other CIOs see AI more as a tool that delivers productivity improvements by augmenting human decision-making capabilities. Many of these CIOs see human augmentation as essential to supporting critical thinking, innovation, and creativity.

Deloitte’s State of AI Report, published in January, provides a benchmark. It states that 36% of IT leaders expect at least 10% of their jobs to be fully automated in the next year, and 82% expect to reach that benchmark in three years.

Many organizations will have a mix of AI agents, choosing automation where reliability at scale is possible, but opting for human augmentation in operationally critical or customer-facing domains. But how CIOs position AI agents is not only an operational strategy; it’s also a cultural statement that shapes employees’ embrace of AI and whether detractors vocalize job-loss fears.

In the short term, it will also weigh in on which AI agents to use from different partners and which areas to build in-house.

Many options to test and deploy AI agents

Many solution providers are demonstrating significantly more AI agents this year. For example, SAP went from 40 Joule Agents in 2025 to over 200 in 2026. Three technology capabilities are fueling this significant growth:

• Adobe, Appian, Boomi, Cisco, Domo, Salesforce, SAP, Snowflake, and others offer data fabrics and data-pipeline capabilities to connect data sources outside the primary workflows supported by their platforms. Appian, Pega, Quickbase, and SAP also centralize business process automation, an important starting point for developing AI agents.  
• MCP servers enable integration and communication between AI agents and are used to facilitate multistep agentic workflows. Virtually all the companies announcing major investments in AI agents are also announcing MCP integration capabilities and related partnerships.
• Solution providers are not just using AI code-generating capabilities; many are launching their own AI agent development tools. The first beneficiaries of these development tools are the solution providers themselves and their integration partners, who use them to accelerate the development of AI agents and make them available to customers.

The result is that CIOs will have many options about which agents to test, but will have to dedicate analysts to understand the capability, cost, and compliance trade-offs. Additionally, expect AI agent capabilities to evolve significantly over the next few years, so CIOs should continuously revisit their decisions regarding deployed AI agents, focusing on performance, benefits, and ROI.

CIOs should also watch for signs of shadow AI and employee confusion about which AI agents to experiment with on different platforms. The AI strategy should include a transparent, defined process for selecting, reviewing, evaluating, procuring, deploying, driving adoption, monitoring, and collecting end-user feedback around AI agents.

AI development capabilities for engineers and citizen builders

The apparent ease-of-use of AI code generators may lead some engineering teams to build AI agents rather than buy them from SaaS providers. But CIOs should quickly realize that coding is just one step in developing AI agents, and that aggressively pursuing a build strategy can lead to AI debt and increased AI costs.

DevOps teams can code AI agents using tools such as Claude, Codex, Lovable, and Replit — a do-it-yourself approach. Some SaaS companies are providing an alternative, with AI agent development tools that leverage the data, infrastructure, and governance baked into their platforms. Many of these development tools offer flexibility, allowing developer teams to select AI models and development environments.

Examples of new and enhanced AI development tools I saw at conferences this quarter include:

• Appian Composer and Agent Studio
• Atlassian Rovo Dev
• Boomi Companion
• Cisco Cloud Control Studio
• Domo App Catalyst
• Pega Infinity Studio
• Quickbase Pave
• Snowflake CoCo
• SAP Joule Studio.

I also reviewed Nutanix Agentic AI, a platform-as-a-service for accelerating the deployment of agentic AI workloads, and Adobe Firefly AI Assistant for creatives.

These development tools can target different audiences. Some look like low-code development tools targeted at software developers, whereas others are no-code and enable citizen developers, i.e., businesspeople, to develop applications and agents. Additionally, some of these tools support spec-driven development and generate artifacts such as product requirement documents (PRDs), data models, and testing capabilities.

Before commissioning AI development for apps and agents, CIOs should sponsor proofs of technical, data, modeling, security, and governance capabilities.

The context layer powering AI agents

Between AI agents and the enterprise’s intelligence, including structured data sources, defined business processes, and agent interactions (both human-to-agent and agent-to-agent), lies an evolving “context layer.”

This layer refers to the enterprise knowledge that AI agents draw on when evaluating signals and recommending or taking actions. Context may include a knowledge graph, a semantic layer, cleansed document repositories, and other knowledge bases.

The context layer, skills, tools, out-of-the-box agents, and governance capabilities are some areas to review where solution providers differentiate. Some examples: 

• Many support the Open Semantic Interchange, and some brand their context layers, such as the Atlassian Teamwork Graph, Boomi Knowledge Hub, and the SAP Knowledge Graph.
• Some are branding their guardrails, such as Adobe’s AI Brand Intelligence, Appian’s Private AI, and Quickbase AI Control Center.
• To manage AI agents at scale, some are extending the notion of data catalogs and other governance tools to the AI domain with products such as Boomi Connect, SAP AI Agent Hub, and Snowflake Horizon Catalog.

CIOs should recognize that while solution providers will compete on capabilities, the real “secret sauce” of the context layer lies in the company’s trusted data, well-defined business processes, and employee adoption of AI agents.

Conversational user experiences and coworkers

AI agents use the context layer, but also tap into skills, which encode the procedures they can follow, and tools, which prescribe the actions they can take. Before AI agents are ready to pilot, their governance, including permissions, approval gates, and other guardrails, must be defined. Other capabilities to look for when defining AI agents include orchestration, testing evals, and observability.

In 2025, many solution providers bolted on AI agents to their existing user experiences. This year, many solution providers showcased new conversational user experiences that employees can use instead of traditional ones built with forms, flows, reports, and static dashboards. Conversational user experiences are where AI agents and people come together, whether it’s human-in-the-middle or human augmentation.

Solution providers also grouped their AI agents into assistants or coworkers. For example, Adobe CX Coworker illustrates human augmentation, helping marketers manage campaigns with prompts and monitor their performance. SAP launched Joule Assistants across several business functions, including finance, human capital, supply chain, and customer experience. Other assistants, such as Appian AI Copilot, Atlassian Rovo, Cisco AI Assistant, Nutanix NIVA, and Snowflake CoWork, offer AI-first user experiences to assist different end-user types.

CIOs should demo these AI-first user experiences to glimpse the future of work.

Developers are already getting used to these experiences through code generators and vibe coding tools. Now, similar capabilities are being tailored across all business functions. CIOs should ramp up their change management programs to accelerate the adoption of these AI capabilities.

Solution providers are showcasing AI capabilities that can help CIOs reshape their businesses. But in Q2, there were only a few examples of how AI can help CIOs drive growth, evolve business models, or embed AI into customer-facing products. I expect to see a wave of further AI innovations that will go beyond productivity improvements and efficiencies and help CIOs pursue growth-driving digital transformation strategies.  

Sacolick travelled to conferences mentioned in this article as a guest of Adobe, Appian, Atlassian, Domo, Nutanix, SAP, and Snowflake. In addition, he was hired by Quickbase to speak at its conference.

OpenClaw’s announcement that it has become a nonprofit foundation is generating IT excitement because of the potential for governance and development consistency that the popular platform has thus far lacked. Still, some worry about the risks created by the move. 

“Our ambition is for OpenClaw to be the Switzerland of AI. Neutral ground where every model and every lab can plug into the technology and collaborate on standards in the era of agents,” OpenClaw said in a post. “That work is already underway in Foundation-convened councils on agent identity, agent profiles, evals, and enterprise deployment.”

The statement, co-authored by OpenClaw creator Peter Steinberger, pointed out, “the great open source projects of our time — Linux, Apache, Mozilla — endure because a neutral steward stands behind them. That is the role we are taking on to keep OpenClaw MIT licensed, open, and independent so that everyone building on it can trust it will be here for the long term.”

But it reassured users that the original OpenClaw leadership is still in charge.

“Peter built this thing and Peter keeps making the calls, especially the technical ones. Since joining OpenAI earlier this year, he has continued to steward OpenClaw as an open and independent project, and OpenAI has made a commitment to keep it that way,” the post said. “The foundation is here to serve: good governance, stable funding, and paying the people who keep the claws alive.”

However, some analysts and consultants were skeptical about how much true independence Steinberger would have, given his salaried role with OpenAI. 

Neutrality claim in question

“The Switzerland of AI neutrality claim collapses under its own announcement,” said Noah Kenney, principal consultant at Digital 520. “OpenAI runs a team [at OpenAI] called Claw Labs that Peter leads and OpenAI is a major donor to OpenClaw. The ‘neutral steward’s’ chief technical decision maker is employed by one of the competing labs it is supposed to be neutral with.” To OpenAI, he said, OpenClaw is closer to a tax-exempt nonprofit subsidiary than it is to a neutral ‘Switzerland of AI.’

He pointed out that, in addition, Microsoft is shipping the enterprise version of OpenClaw, and Nvidia is shipping the hardware bundle. “This is being called the Switzerland of AI, but Switzerland does not have its central bank run by France,” he observed.

Kenney said that what the new OpenClaw has actually built is “a shared dependency that several competitors fund, staff, and steer, wrapped in a nonprofit structure. Enterprise IT should understand that structure, because treating OpenClaw as neutral is a mistake,” adding that CIOs need to look at this development devoid of the emotional component. 

“There is a strategic irony here that CIOs should sit with,” Kenney said. “If OpenClaw succeeds at becoming the universal agent substrate, then every model plugs into the same identity layer, the same profiles, and the same deployment plumbing. The thing every vendor is racing to own becomes a commodity that nobody owns.” He pointed out that, in the short term, that is genuinely good news for buyers because it means less lock-in and more portability.

“But,” he said, “when the connective tissue is free and natural, the only labs that benefit are the ones with the best models and the deepest distribution. Commoditize the layer below you and you compete on the layer where you are already strongest. The foundation is not a charity. It is the biggest players agreeing to stop fighting over the plumbing so they can fight over the water, and the enterprise is the one paying the water bill either way.”

Good news, bad news

Jason Andersen, principal analyst at Moor Insights & Strategy, liked the potential consistency that could emerge from the structural change, given the complexity of agent development today. 

“We are seeing a lot of OpenClaw variants hit the market, such as those from Nvidia as well as competing products from cloud and SaaS vendors. A common base helps solidify the common parts,” Andersen noted. “That said, a common challenge is the sustainability of these open source foundations over time. In addition to releasing code, these foundations need funding to evolve and grow. And that funding needs to come from continued momentum to incentivize existing members to increase investment and recruit new members to join.”

Andersen stressed that IT buyers need to keep an eye on the roadmap for any OpenClaw variant they choose to deploy, “as that will directly impact the foundation, and the momentum of the foundation and common base. If the common base loses momentum, it can lead to forks, or just a loss of innovation. When that happens, members tend to back away, which puts customers in limbo.”

But not everyone sees the promised structure as entirely good for IT.

Ishraq Khan, CEO at coding productivity tool vendor Kodezi, said, “most CIOs do not want to bet their future entirely on a single model vendor. They want Claude for some workloads, GPT for others, open models for sensitive environments, and potentially internally fine-tuned systems for specific use cases. The problem is that every vendor currently brings its own identity system, tool interfaces, permissions model, and operational assumptions. That fragmentation does not scale.”

He said, “the risk if standards fail is straightforward: every vendor builds its own closed ecosystem, enterprises become locked into individual stacks, and security becomes dramatically harder. The opportunity if OpenClaw succeeds is equally significant: enterprises get portable agents, common identity standards, interoperable tooling, and a healthier competitive market around models rather than ecosystems.”

Will it remain a nonprofit?

However, said Justin Greis, CEO of consulting firm Acceligence, one of the key details that IT executives will want to keep in mind is that OpenAI also began as a nonprofit, but it was quickly seen as not adhering to nonprofit objectives. 

“OpenAI’s transition from a nonprofit research organization into a more complex structure highlighted the challenge of maintaining mission alignment while scaling technology, capital, partnerships, and commercial operations,” Greis said. “OpenClaw has the opportunity to address some of those governance questions earlier by establishing clear principles around neutrality, transparency, and decision-making before the ecosystem becomes even larger and more valuable.”

He noted, “we have seen this pattern before with technologies like Linux and Kubernetes. The strongest open ecosystems succeeded because they created trusted foundations that enterprises could build upon. The technology was important, but the governance model that underpinned it was equally critical.”

Risks are ‘squarely in IT’s lap’

Consultant Brian Levine, executive director of FormerGov, echoed Greis’ concerns. 

“CIOs shouldn’t assume that this nonprofit will always be a nonprofit, or confuse being a nonprofit with actually being neutral or unbiased,” he said. “The risks are squarely in IT’s lap: autonomous agents ‘with their own identity’ acting on a user’s behalf blow straight through traditional IAM assumptions. Issues, such as agent identity, auditability, secret handling. Identity boundaries have not yet been reliably solved. Until they are, enterprises should treat OpenClaw agents like privileged service accounts, not like a browser plugin.”

Independent cybersecurity and risk advisor Steven Eric Fisher pointed to another IT exposure that might come from this OpenClaw transition: Cost.

“OpenClaw currently has a very high token burn rate in usage, which presents a significant cost consideration for large-scale enterprise adoption,” he said. “The skills marketplace introduces a new supply chain threat that enterprises will need to manage. Threat management, and specifically handling external marketplace elements, can be highly challenging for open-source operations. Ultimately, at scale, enterprise adoption could become a difficult balancing act between managing high operational costs and securing an expanded security surface.”

Everything in Python is an object, or so the saying goes. If you want to create your own custom objects, with their own properties and methods, you use Python’s class object to do it. But creating classes in Python sometimes means writing loads of repetitive, boilerplate code; for example, to set up the class instance from the parameters passed to it or to create common functions like comparison operators.

Dataclasses, introduced in Python 3.7 (and backported to Python 3.6), provide a handy, less-verbose way to create classes. Many of the common things you do in a class, like instantiating properties from the arguments passed to the class, can be reduced to a few basic instructions by using dataclasses.

The backstage power of Python dataclasses

Consider this example of a conventional class in Python:

class Book:
    '''Object for tracking physical books in a collection.'''
    def __init__(self, name: str, weight: float, shelf_id:int = 0):
        self.name = name
        self.weight = weight # in grams, for calculating shipping
        self.shelf_id = shelf_id
    def __repr__(self):
        return(f"Book(name={self.name!r},
            weight={self.weight!r}, shelf_id={self.shelf_id!r})")

The biggest headache here is that you must copy each of the arguments passed to __init__ to the object’s properties. This isn’t so bad if you’re only dealing with Book, but what if you have additional classes—say, a Bookshelf, Library, Warehouse, and so on? Plus, typing all that code by hand increases your chances of making a mistake.

Here’s the same class implemented as a Python dataclass:

from dataclasses import dataclass

@dataclass
class Book:
    '''Object for tracking physical books in a collection.'''
    name: str
    weight: float 
    shelf_id: int = 0

When you specify properties, called fields, in a dataclass, the @dataclass decorator automatically generates all the code needed to initialize them. It also preserves the type information for each property, so if you use a linting too that checks type information, it will ensure that you’re supplying the right kinds of variables to the class constructor.

Another thing @dataclass does behind the scenes is to automatically create code for common dunder methods in the class. In the conventional class above, we had to create our own __repr__. In the dataclass, the @dataclass decorator generates the __repr__ for you. While you still can override the generated code, you don’t need to manually write code for the most common cases.

Once a dataclass is created, it is functionally identical to a regular class. There is no performance penalty for using a dataclass. There’s only a small performance penalty for declaring the class as a dataclass, and that’s a one-time cost when the dataclass object is created.

Advanced Python dataclass initialization

The dataclass decorator can take initialization options of its own. Most of the time, you won’t need to supply them, but they can come in handy for certain edge cases. Here are some of the most useful ones (they’re all True/False):

• frozen: Generates class instances that are read-only. Once data has been assigned, it can’t be modified. This is useful if instances of the dataclass are intended to be hashable, which allows them (among other things) to be used as dictionary keys. If you set frozen, the generated dataclass will also automatically have a __hash__ method created for it. (You also can use unsafe_hash=true to generate a __hash__ method for the dataclass, regardless of whether the dataclass is read-only or not, but that call invokes unsafe behavior.)
• slots: Allows instances of dataclasses to use less memory by only allowing fields explicitly defined in the class. The memory savings really only manifest at scale — e.g., when generating upwards of thousands of instances of a given object. If you’re only generating a couple of dataclass instances at a time, it probably isn’t worth it.
• kw_only: This setting makes all fields for the class keyword-only, so they must be defined using keyword arguments rather than positional arguments. This is a useful way to provide a dataclass instance’s arguments by way of a dictionary.

Customizing Python dataclass fields

How dataclasses work by default should be okay for the majority of use cases. Sometimes, though, you need to fine-tune how the fields in your dataclass are initialized. The following code sample demonstrates how to use the field function for fine-tuning:

from dataclasses import dataclass, field
from typing import List

@dataclass
class Book:
    '''Object for tracking physical books in a collection.'''
    name: str     
    condition: str = field(compare=False)    
    weight: float = field(default=0.0, repr=False)
    shelf_id: int = 0
    chapters: List[str] = field(default_factory=list)

When you set a default value to an instance of field, it changes how the field is set up depending on what parameters you provide. These are the most commonly-used options for field (though there are others):

• default: Sets the default value for the field. You should use default if you a) use field to change any other parameters for the field, and b) want to set a default value on the field on top of that. In the above example, we used default to set weight to 0.0.
• default_factory: Provides the name of a function, which takes no parameters, that returns some object to serve as the default value for the field. In the example, we wanted chapters to be an empty list.
• repr: By default (True), controls if the field in question shows up in the automatically generated __repr__ for the dataclass. In this case, we didn’t want the book’s weight shown in the __repr__, so we used repr=False to omit it.
• compare: By default (True), includes the field in the comparison methods automatically generated for the dataclass. Here, we didn’t want condition to be used as part of the comparison for two books, so we set compare=False.

Note that we adjusted the order of the fields so the non-default fields appeared first.

Controlling Python dataclass initialization

At this point, you might be wondering, “How do I get control over the init process to make more fine-grained changes if the __init__ method of a dataclass is generated automatically?” In these cases, you can use the __post_init__ method or or InitVar type.

__post_init__

If you include the __post_init__ method in your dataclass definition, you can provide instructions for modifying fields or other instance data:

from dataclasses import dataclass, field
from typing import List

@dataclass
class Book:
    '''Object for tracking physical books in a collection.'''
    name: str    
    weight: float = field(default=0.0, repr=False)
    shelf_id: Optional[int] = field(init=False)
    chapters: List[str] = field(default_factory=list)
    condition: str = field(default="Good", compare=False)

    def __post_init__(self):
        if self.condition == "Discarded":
            self.shelf_id = None
        else:
            self.shelf_id = 0

In this example, we’ve created a __post_init__ method to set shelf_id to None if the book’s condition is initialized as "Discarded". Note how we use field to initialize shelf_id, and pass init as False to field. This means shelf_id won’t be initialized in __init__, but it is registered as a field with the dataclass overall, with type information.

InitVar

Another way to customize Python dataclass setup is to use the InitVar type. This lets you specify a field that will be passed to __init__ and then to __post_init__, but won’t be stored in the class instance.

By using InitVar, you can take in parameters when setting up the dataclass that are only used during initialization. Here’s an example:

from dataclasses import dataclass, field, InitVar
from typing import List

@dataclass
class Book:
    '''Object for tracking physical books in a collection.'''
    name: str     
    condition: InitVar[str] = "Good"
    weight: float = field(default=0.0, repr=False)
    shelf_id: int = field(init=False)
    chapters: List[str] = field(default_factory=list)

    def __post_init__(self, condition):
        if condition == "Unacceptable":
            self.shelf_id = None
        else:
            self.shelf_id = 0

Setting a field’s type to InitVar (with its subtype being the actual field type) signals to @dataclass to not make that field into a dataclass field, but to pass the data along to __post_init__ as an argument.

In this version of our Book class, we’re not storing condition as a field in the class instance. We’re only using condition during the initialization phase. If we find that condition was set to "Unacceptable", we set shelf_id to None—but we don’t store condition itself in the class instance.

When to use Python dataclasses, and when not to

One common scenario for using dataclasses is to replace the namedtuple. Dataclasses offer the same behaviors and more, and they can be made immutable (as namedtuples are) by simply using @dataclass(frozen=True) as the decorator.

Another possible use case is replacing nested dictionaries (which can be clumsy) with nested instances of dataclasses. If you have a dataclass Library, with a list property of shelves, you could use a dataclass ReadingRoom to populate that list, then add methods to make it easy to access nested items (e.g., a book on a shelf in a particular room).

It’s also important to note, though, that not every Python class needs to be a dataclass. If you’re creating a class mainly to group together a bunch of static methods, rather than as a container for data, you don’t need to make it a dataclass. For instance, a common pattern with parsers is to have a class that takes in an abstract syntax tree, walks the tree, and dispatches calls to different methods in the class based on the node type. Because the parser class has very little data of its own, a dataclass isn’t useful here.

What is cloud native? Cloud native defined

The term “cloud-native computing” encompasses the modern approach to building and running software applications that exploit the flexibility, scalability, and resilience of cloud computing. The phrase is a catch-all that encompasses not just the specific architecture choices and environments used to build applications for the public cloud, but also the software engineering techniques and philosophies used by cloud developers.

The Cloud Native Computing Foundation (CNCF) is an open source organization that hosts many important cloud-related projects and helps set the tone for the world of cloud development. The CNCF offers its own definition of cloud native:

Cloud native practices empower organizations to develop, build, and deploy workloads in computing environments (public, private, hybrid cloud) to meet their organizational needs at scale in a programmatic and repeatable manner. It is characterized by loosely coupled systems that interoperate in a manner that is secure, resilient, manageable, sustainable, and observable.

Cloud native technologies and architectures typically consist of some combination of containers, service meshes, multi-tenancy, microservices, immutable infrastructure, serverless, and declarative APIs — this list is not exhaustive.

This definition is a good start, but as cloud infrastructure becomes ubiquitous, the cloud native world is beginning to spread behind the core of this definition. We’ll explore that evolution as well, and look into the near future of cloud-native computing.

Cloud native architectural principles

Let’s start by exploring the pillars of cloud-native architecture. Many of these technologies and techniques were considered innovative and even revolutionary when they hit the market over the past few decades, but now have become widely accepted across the software development landscape.

Microservices. One of the huge cultural shifts that made cloud-native computing possible was the move from huge, monolithic applications to microservices: small, loosely coupled, and independently deployable components that work together to form a cloud-native application. These microservices can be scaled across cloud environments, though (as we’ll see in a moment) this makes systems more complex.

Containers and orchestration. In could-native architectures, individual microservices are executed inside containers — lightweight, portable virtual execution environments that can run on a variety of servers and cloud platforms. Containers insulate the developers from having to worry about the underlying machines on which their code will execute. That is, all they have to do is write to the container environment. 

Getting the containers to run properly and communicate with one another is where the complexity of cloud native computing starts to emerge. Initially, containers were created and managed by relatively simple platforms, the most common of which was Docker. But as cloud-native applications got more complex, container orchestration platforms that augmented Docker’s functionality emerged, such as Kubernetes, which allows you to deploy and manage multi-container applications at scale. Kubernetes is critical to cloud native computing as we know it — it’s worth noting that the CNCF was set up as a spinoff of the Linux Foundation on the same day that Kubernetes 1.0 was announced — and adhering to Kubernetes best practices is an important key to cloud native success. 

Open standards and APIs. The fact that containers and cloud platforms are largely defined by open standards and open source technologies is the secret sauce that makes all this modularity and orchestration possible, and standardized and documented APIs offer the means of communication between distributed components of a larger application. In theory, anyway, this standardization means that every component should be able to communicate with other components of an application without knowing about their inner workings, or about the inner workings of the various platform layers on which everything operates.

DevOps, agile methodologies, and infrastructure as code. Because cloud-native applications exist as a series of small, discrete units of functionality, cloud-native teams can build and update them using agile philosophies like DevOps, which promotes rapid, iterative CI/CD development. This enables teams to deliver business value more quickly and more reliably.

The virtualized nature of cloud environments also make them great candidates for infrastructure as code (IaC), a practice in which teams use tools like Terraform, Pulumi, and AWS CloudFormation, to manage infrastructure declaratively and version those declarations just like application code. IaC boosts automation, repeatability, and resilience across environments—all big advantages in the cloud world. IaC also goes hand-in-hand with the concept of immutable infrastructure—the idea that, once deployed, infastructure-level entities like virtual machines, containers, or network appliances don’t change, which makes them easier to manage and secure. IaC stores declarative configuration code in version control, which creates an audit log of any changes.

How the cloud-native stack is expanding

As cloud-native development becomes the norm, the cloud-native ecosystem is expanding; the CNCF maintains a graphical representation of what it calls the  cloud native landscape that hammers home to expansive and bewildering variety of products, services, and open source projects that contribute to (and seek to profit from) to cloud-native computing. And there are a number of areas where new and developing tools are complicating the picture sketched out by the pillars we discussed above.   

An expanding Kubernetes ecosystem. Kubernetes is complex, and teams now rely on an entire ecosystem of projects to get the most out of it: Helm for packaging, ArgoCD for GitOps-style deployments, and Kustomize for configuration management. And just as Kubernetes augmented Docker for enterprise-scale deployments. Kubernetes itself has been augmented and expanded by service mesh offerings like Istio and Linkerd, which offer fine-grained traffic control and improved security

Observability needs. The complex and distributed world of cloud-native computing requires in-depth observability to ensure that developers and admins have a handle on what’s happening with their applications. Cloud-native observability uses distributed tracing and aggregated logs to provide deep insight into performance and reliability. Tools like Prometheus, Grafana, Jaeger, and OpenTelemetry support comprehensive, real-time observability across the stack.

Serverless computing.  Serverless computing, particularly in its function-as-a-service guise, offers to strip needed compute resources down to their bare minimum, with functions running on service provider clouds using exactly as much as they need and no more. Because these services can be exposed as endpoints via APIs, they are increasingly integrated into distributed applications, operating side-by-side with functionality provided by containerized microservices. Watch out, though: the big FaaS providers (Amazon, Microsoft, and Google) would love to lock you in to their ecosystems.  

FinOps. Cloud computing was initially billed as a way to cut costs — no need to pay for an in-house data center that you barely use — but in practice it replaces capex with opex, and sometimes you can run up truly shocking cloud service bills if you aren’t careful. Serverless computing is one way to cut down on those costs, but financial operations, or FinOps, is a more systematic discipline that aims to aligns engineering, finance, and product to optimize cloud spending. FinOps best practices make use of those observability tools to best determine what departments and applications are eating up resources.

How cloud-native architecture is adapting to AI workloads

Enterprises deploy larger AI models and make use of more and more real-time inference services. That’s putting demands on cloud-native systems and forcing them to adapt to remain scalable and reliable.

For instance, organizations are re-engineering cloud environments around GPU-accelerated clusters, low-latency networking, and predictable orchestration. These needs align with established cloud-native patterns: containers package AI services consistently, while Kubernetes provides resilient scheduling and horizontal scale for inference workloads that can spike without warning.

Kubernetes itself is changing to better support AI inference, adding hardware-aware scheduling for GPUs, model-specific autoscaling behavior, and deeper observability into inference pipelines. These enhancements make Kubernetes a more natural platform for serving generative AI workloads.

AI’s resource demands are amplifying traditional cloud-native challenges. Observability becomes more complex as inference paths span GPUs, CPUs, vector databases, and distributed storage. FinOps teams contend with cost volatility from training and inference bursts. And security teams must track new risks around model provenance, data access, and supply-chain integrity.

Application frameworks for building distributed cloud-native apps

Microsoft’s Aspire is one of the most visible examples of a shift towards application frameworks to simplify how teams build distributed systems. Opinionated frameworks like Aspire provide structure, observability, and integration out of the box so developer don’t need to stitch together containers, microservices, and orchestration tooling by hand.

Aspire in particular is a prescriptive framework for cloud-native applications, bundling containerized services, environment configuration, health checks, and observability into a unified development model. Aspire provides defaults for service-to-service communication, configuration, and deployment, along with a built-in dashboard for visibility across distributed components.

While Aspire was originally aligned with Microsoft’s .NET platform,Redmond now sees it as having a  polyglot future. This positions Aspire as part of a broader trend: frameworks that help teams build cloud-native, service-oriented systems without being locked into a single language ecosystem. Several other frameworks are gaining traction: Dapr provides a portable runtime that abstracts many of the plumbing tasks in cloud-native distributed applications, and Orleans offers an actor-model-based framework for large-scale systems in the .NET world, and Akka gives JVM teams a mature, reactive toolkit for elastic, resilient services.

Frameworks and tools in the expanding cloud-native ecosystem

While frameworks like Aspire simplify how developers compose and structure distributed applications, most cloud-native systems still depend on a broader ecosystem of platforms and operational tooling. This deeper layer is where much of the complexity—and innovation—of cloud-native computing lives, particularly as Kubernetes continues to serve as the industry’s control plane for modern infrastructure.

Kubernetes provides the core abstractions for deploying and orchestrating containerized workloads at scale. Managed distributions such as Google Kubernetes Engine (GKE), Amazon EKS, Azure AKS, and Red Hat OpenShift build on these primitives with security, lifecycle automation, and enterprise support. Platform vendors are increasingly automating cluster operations—upgrades, scaling, remediation—to reduce the operational burden on engineering teams.

Surrounding Kubernetes is a rapidly expanding ecosystem of complementary frameworks and tools. Service meshes like Istio and Linkerd provide fine-grained traffic management, policy enforcement, and mTLS-based security across microservices. GitOps platforms such as Argo CD and Flux bring declarative, version-controlled deployments to cloud-native environments. Meanwhile, projects like Crossplane turn Kubernetes into a universal control plane for cloud infrastructure, letting teams provision databases, queues, and storage through familiar Kubernetes APIs. These tools illustrate how cloud-native development now spans multiple layers: developer-focused application frameworks like Aspire at the top, and a powerful, evolving Kubernetes ecosystem underneath that keeps modern distributed applications running.

Advantages and challenges for cloud-native development

Cloud native has become so ubiquitous that its advantages are almost taken for granted at this point, but it’s worth reflecting on the beneficial shift the cloud native paradigm represents. Huge, monolithic codebases that saw updates rolled out once every couple of years have been replaced by microservice-based applications that can be improved continuously. Cloud-based deployments, when managed correctly, make better use of compute resources and allow companies to offer their products as SaaS or PaaS services. 

But cloud-native deployments come with a number of challenges, too:

• Complexity and operational overhead: You’ll have noticed by now that many of the cloud-native tools we’ve discussed, like service meshes and observability tools, are needed to deal with the complexity of cloud-native applications and environments. Individual microservices are deceptively simple, but coordinating them all in a distributed environment is a big lift.
• Security: More services executing on more machines, communicating by open APIs, all adds up to a bigger attack surface for hackers. Containers and APIs each have their own special security needs, and a policy engine can be an important tool for imposing a security baseline on a sprawling cloud-native app. DevSecOps, which adds security to DevOps, has become an important cloud-native development practice to try to close these gaps.
• Vendor lock-in: This may come as a surprise, since cloud-native is based on open standards and open source. But there are differences in how the big cloud and serverless providers works, and once you’ve written code with one provider in mind, it can be hard to migrate elsewhere.
• A persistent skills gap: Cloud-native computing and development may have years under its belt at this point, but the number of developers who are truly skilled in this arena is a smaller portion of the workforce than you’d think. Companies face difficult choices in bridging this skills gap, whether that’s bidding up salaries, working to upskill current workers, or allowing remote work so they can cast a wide net. 

Cloud native in the real world

Cloud native computing is often associated with giants like Netflix, Spotify, Uber, and AirBNB, where many of its technologies were pioneered in the early ’10s. But the CNCF’s Case Studies page provides an in-depth look at how cloud native technologies are helping companies. Examples include the following:

• A UK-based payment technology company that can switch between data centers and clouds with zero downtime
• A software company whose product collects and analyzes data from IoT devices — and can scale up as the number of gadgets grows
• A Czech web service company that managed to improve performance while reducing costs by migrating to the cloud

Cloud-native infrastructure’s capability to quickly scale up to large workloads also make it an attractive platform for developing AI/ML applications: another one of those CNCF case studies looks at how IBM uses Kubernetes to train its Watsonx assistant. The big three providers are putting a lot of effort into pitching their platforms as the place for you to develop your own generative AI tools, with offerings like Azure AI Foundry,Google Firebase Studio, and Amazon Bedrock. It seems clear that cloud native technology is ready for what comes next.

Learn more about related cloud-native technologies:

• Platform-as-a-service (PaaS) explained
• What is cloud computing
• Multicloud explained
• Agile methodology explained
• Agile development best practices
• Devops explained
• Devops best practices
• Microservices explained
• Microservices tutorial
• Docker and Linux containers explained
• Kubernetes tutorial
• CI/CD (continuous integration and continuous delivery) explained
• CI/CD best practices

Cloud computing continues to be the platform of choice for large applications and a driver of innovation in enterprise technology. Gartner forecasts public cloud spending alone to the public cloud services market alone will reach $1.42 trillion in current U.S. dollars, driven by AI workloads and enterprise modernization.

Driving this growth are the rise of AI and machine learning on the cloud, adoption of edge computing, the maturation of serverless computing, the emergence of multicloud strategies, improved security and privacy, and more sustainable cloud practices.

What is cloud computing?

While often used broadly, the term cloud computing is defined as an abstraction of compute, storage, and network infrastructure assembled as a platform on which applications and systems are deployed quickly and scaled on the fly.

Most cloud customers consume public cloud computing services over the internet, which are hosted in large, remote data centers maintained by cloud providers. The most common type of cloud computing, SaaS (software as service), delivers prebuilt applications to the browsers of customers who pay per seat or by usage, exemplified by such popular apps as Salesforce, Google Docs, or Microsoft Teams.

5 top trends in cloud computing

1. Agentic cloud ecosystems: The shift from AI as a tool to AI as an autonomous operator within cloud environments.
2. Sovereign and localized clouds: Meeting strict national data residency and digital sovereignty laws.
3. Specialized AI hardware access: Navigating the GPU capacity crunch through reserved instances and boutique AI clouds.
4. Integrated greenOps: Merging cost optimization with mandatory carbon-footprint reporting.
5. Industry-specific walled gardens: The maturation of vertical clouds into highly regulated, precompliant environments for finance and healthcare.

Next in line is IaaS (infrastructure as a service), which offers vast, virtualized compute, storage, and network infrastructure upon which customers build their own applications, often with the aid of providers’ API-accessible services.

When people refer to the “the cloud” today, they most often mean the big IaaS providers: AWS (Amazon Web Services), Google Cloud Platform, or Microsoft Azure. All three have become ecosystems of services that go way beyond infrastructure and include developer tools, serverless computing, machine learning services and APIs, data warehouses, and thousands of other services. With both SaaS and IaaS, a key benefit is agility. Customers gain new capabilities almost instantly without the capital investment in hardware or software on-premises — and they can instantly scale the cloud resources they consume up or down as needed.

According to Foundry’s Cloud Computing Study, 2025, enterprises are moving to the cloud to improve security and/or governance, increase scalability​, accelerate adoption of artificial intelligence and machine learning and other new technologies, replace on-premises legacy technology, ​improve employee productivity, and ensure disaster recovery and business continuity.

Hyperscalers now dominate cloud services

The largest cloud service providers are often described as hyperscalers, due to their capability to provide large-scale data centers across the globe. Hyperscalers typically offer a wide range of cloud services, including IaaS, PaaS, SaaS, and more.

As mentioned above, notable hyperscalers include Amazon Web Services (AWS), Google Cloud Platform, and Microsoft Azure. They offer the following capabilities.

• Scalability: Hyperscalers can handle massive workloads and scale resources up or down quickly.
• Cost-effectiveness: Hyperscalers often offer competitive pricing and economies of scale.
• Global reach: Hyperscalers operate data centers around the world, providing low-latency access to customers in different regions.
• Innovation: Hyperscalers are at the forefront of cloud innovation, offering new services and features.

Challenges of working with hyperscalers

• Vendor lock-in: Relying heavily on a single hyperscaler can create vendor lock-in, making it difficult to switch to another provider and charging large egress fees if you do move.
• Complexity: Hyperscalers offer a vast array of services, which can be overwhelming for some customers.
• Security concerns: Because hyperscalers handle sensitive data, security is a major concern.

AI, Agents, and the Sovereign Cloud

The AI-enabled enterprise has moved beyond simple chatbots. The focus has shifted to agentic workflows — autonomous systems that reside in the cloud and possess the authority to execute business processes, manage cloud spend, and self-patch security vulnerabilities without human intervention.

The shift to agentic infrastructure

Cloud providers are no longer just selling compute. They are selling inference-as-a-service. Modern cloud budgets are now dominated by the high cost of specialized GPU clusters (such as Nvidia’s Blackwell architecture). This has led to the rise of boutique AI clouds that compete with hyperscalers by offering bare-metal access to the latest silicon specifically for model training and fine-tuning.

Data sovereignty and private AI

A major shift in late 2025 is the move away from public AI models for sensitive data. Organizations are increasingly using retrieval-augmented generation (RAG) within walled garden environments. This ensures that a company’s proprietary data never leaves their specific cloud instance to train a provider’s base model.

Furthermore, sovereign AI has become a requirement for global operations. Governments now demand that the AI models processing their citizens’ data be hosted on infrastructure that is owned, operated, and governed within their own borders.

The challenges of ghost AI

Just as shadow IT plagued the 2010s, ghost AI—unauthorized AI agents running on corporate cloud accounts — has become a primary security risk. Managing these autonomous entities requires a new layer of AI governance, where the cloud provider automatically audits the intent and permissions of every running agent to prevent runaway costs or data leaks.

Cloud computing definitions

In 2011, NIST posted a PDF that divided cloud computing into three “service models” — SaaS, IaaS, and PaaS (platform as a service) — the latter being a controlled environment within which customers develop and run applications. These three categories have largely stood the test of time, although most PaaS solutions now are made available as services within IaaS ecosystems rather than as dedicated PaaS clouds.

Two evolutionary trends stand out since NIST’s threefold definition. One is the long and growing list of subcategories within SaaS, IaaS, and PaaS, some of which blur the lines between categories. The other is the explosion of API-accessible services available in the cloud, particularly within IaaS ecosystems. The cloud has become a crucible of innovation where many emerging technologies appear first as services, a big attraction for business customers who understand the potential competitive advantages of early adoption.

SaaS (software as a service) definition

This type of cloud computing delivers applications over the internet, typically with a browser-based user interface. Today, most software companies offer their wares via SaaS — if not exclusively, then at least as an option.

The most popular SaaS applications for business are Google’s G Suite and Microsoft’s Office 365. Most enterprise applications, including giant ERP suites from Oracle and SAP, come in both SaaS and on-premises versions. SaaS applications typically offer extensive configuration options as well as development environments that enable customers to code their own modifications and additions. They also enable data integration with on-prem applications.

IaaS (infrastructure as a service) definition

At a basic level, IaaS cloud providers offer virtualized compute, storage, and networking over the internet on a pay-per-use basis. Think of it as a data center maintained by someone else, remotely, but with a software layer that virtualizes all those resources and automates customers’ ability to allocate them with little trouble.

But that’s just the basics. The full array of services offered by the major public IaaS providers is staggering: highly scalable databases, virtual private networks, big data analytics, AI and machine learning services, application platforms, developer tools, devops tools, and so on. Amazon Web Services was the first IaaS provider and remains the leader, followed by Microsoft Azure, Google Cloud Platform, IBM Cloud, and Oracle Cloud.

PaaS (platform as a service) definition

PaaS provides sets of services and workflows that specifically target developers, who can use shared tools, processes, and APIs to accelerate the development, testing, and deployment of applications. Salesforce’s Heroku and Salesforce Platform (formerly Force.com) are popular public cloud PaaS offerings; Cloud Foundry and Red Hat’s OpenShift can be deployed on premises or accessed through the major public clouds. For enterprises, PaaS can ensure that developers have ready access to resources, follow certain processes, and use only a specific array of services, while operators maintain the underlying infrastructure.

FaaS (function as a service) definition

FaaS, the original and most basic version of serverless computing, adds another layer of abstraction to PaaS, so that developers are insulated from everything in the stack below their code. Instead of futzing with virtual servers, containers, and application runtimes, developers upload narrowly functional blocks of code, and set them to be triggered by a certain event (such as a form submission or uploaded file). All of the major clouds offer FaaS on top of IaaS: AWS Lambda, Azure Functions, Google Cloud Functions, and IBM Cloud Functions. A special benefit of FaaS applications is that they consume no IaaS resources until an event occurs, reducing pay-per-use fees.

Private cloud definition

A private cloud downsizes the technologies used to run IaaS public clouds into software that can be deployed and operated in a customer’s data center. As with a public cloud, internal customers can provision their own virtual resources to build, test, and run applications, with metering to charge back departments for resource consumption. For administrators, the private cloud amounts to the ultimate in data center automation, minimizing manual provisioning and management.

VMware remains a force in the private cloud software market, but the acquisition by Broadcom has created confusion and raised concerns among some customers about potential changes in pricing, licensing, and support. This could lead some organizations to explore alternative solutions.

OpenStack continues to be a popular open-source choice for building private clouds. It offers a flexible and customizable platform that can be tailored to specific needs. However, OpenStack can be complex to deploy and manage, and it may require significant expertise to maintain.

Kubernetes, a container orchestration platform that has gained significant traction in recent years, is often used in conjunction with other technologies like OpenStack to build cloud-native applications. Red Hat OpenShift is a comprehensive cloud platform based on Kubernetes that provides a managed experience for deploying and managing container-based, applications.

Many cloud providers offer their own cloud-native platforms and tools, such as AWS Outposts, Azure Stack, and Google Cloud Anthos.

Common factors to consider when evaluating private cloud platforms include the following:

1. Pricing: The initial cost of deployment and ongoing maintenance costs.
2. Complexity: The level of technical expertise needed to manage the platform.
3. Flexibility: The ability to customize the platform to meet specific needs.
4. Vendor lock-in: The degree to which the organization is tied to a particular vendor.
5. Security: The security features and capabilities of the platform.
6. Scalability: The capability to expand the platform to meet future needs.

Hybrid cloud definition

A hybrid cloud is the integration of a private cloud with a public cloud. At its most developed, the hybrid cloud involves creating parallel environments in which applications can move easily between private and public clouds. In other instances, databases may stay in the customer data center and integrate with public cloud applications — or virtualized data center workloads may be replicated to the cloud during times of peak demand. The types of integrations between private and public clouds vary widely, but they must be extensive to earn a hybrid cloud designation.

Public APIs (application programming interfaces) definition

Just as SaaS delivers applications to users over the internet, public APIs offer developers application functionality that can be accessed programmatically. For example, in building web applications, developers often tap into the Google Maps API to provide driving directions; to integrate with social media, developers may call upon APIs maintained by Twitter, Facebook, or LinkedIn. Twilio has built a successful business delivering telephony and messaging services via public APIs. Ultimately, any business can provision its own public APIs to enable customers to consume data or access application functionality.

iPaaS (integration platform as a service) definition

Data integration is a key issue for any sizeable company, but particularly for those that adopt SaaS at scale. iPaaS providers typically offer prebuilt connectors for sharing data among popular SaaS applications and on-premises enterprise applications, though providers may focus more or less on business-to-business and e-commerce integrations, cloud integrations, or traditional SOA-style integrations. iPaaS offerings in the cloud from such providers as Dell Boomi, Informatica, MuleSoft, and SnapLogic also let users implement data mapping, transformations, and workflows as part of the integration-building process.

IDaaS (identity as a service) definition

The most difficult security issue related to cloud computing is managing user identity and its associated rights and permissions across data centers and pubic cloud sites. IDaaS providers maintain cloud-based user profiles that authenticate users and enable access to resources or applications based on security policies, user groups, and individual privileges. The ability to integrate with various directory services (Active Directory, LDAP, etc.) and provide single sign-on across business-oriented SaaS applications is essential.

Leaders in IDaaS include Microsoft, IBM, Google, Oracle, Okta, Capgemini, Okta, Junio Corporation, OneLogin, and JumpCloud.  

Collaboration platforms

Collaboration solutions such as Slack and Microsoft Teams have become vital messaging platforms that enable groups to communicate and work together effectively. Basically, these solutions are relatively simple SaaS applications that support chat-style messaging along with file sharing and audio or video communication. Most offer APIs to facilitate integrations with other systems and enable third-party developers to create and share add-ins that augment functionality.

Vertical clouds

Key providers in such industries as financial services, healthcare, retail, life sciences, and manufacturing provide PaaS clouds to enable customers to build vertical applications that tap into industry-specific, API-accessible services. Vertical clouds can dramatically reduce the time to market for vertical applications and accelerate domain-specific B2B integrations. Most vertical clouds are built with the intent of nurturing partner ecosystems.

Other cloud computing considerations

The most widely accepted definition of cloud computing means that you run your workloads on someone else’s servers, but this is not the same as outsourcing. Virtual cloud resources and even SaaS applications must be configured and maintained by the customer. Consider these factors when planning a cloud initiative.

Cloud computing security considerations

Objections to the public cloud generally begin with cloud security, although the major public clouds have proven themselves much less susceptible to attack than the average enterprise data center.

Of greater concern is the integration of security policy and identity management between customers and public cloud providers. In addition, government regulation may forbid customers from allowing sensitive data off-premises. Other concerns include the risk of outages and the long-term operational costs of public cloud services.

Multicloud management considerations

To enhance their operational efficiency, reduce costs, and improve security, many companies are increasingly turning to multicloud strategies. By distributing workloads across multiple cloud providers, organizations can avoid vendor lock-in, optimize costs, and leverage the best-of-breed services offered by different providers.

This multicloud approach also improves performance and reliability by minimizing downtime and optimizing latency. Additionally, multicloud strategies strengthen security by diversifying the attack surface and facilitating compliance with industry regulations. Finally, by replicating critical workloads across multiple regions and providers, companies can establish robust disaster recovery and business continuity plans, ensuring minimal disruption in the event of catastrophic failures.

The bar to qualify as a multicloud adopter is low: A customer just needs to use more than one public cloud service. However, depending on the number and variety of cloud services involved, managing multiple clouds can become complex from both a cost optimization and a technology perspective.

In some cases, customers subscribe to multiple cloud services simply to avoid dependence on a single provider. A more sophisticated approach is to select public clouds based on the unique services they offer and, in some cases, integrate them. For example, developers might want to use Google’s Vertex AI Studio on Google Cloud Platform to build AI-driven applications, but prefer Jenkins hosted on the CloudBees platform for continuous integration.

To control costs and reduce management overhead, some customers opt for cloud management platforms (CMPs) and/or cloud service brokers (CSBs), which let you manage multiple clouds as if they were one cloud. The problem is that these solutions tend to limit customers to such common-denominator services as storage and compute, ignoring the panoply of services that make each cloud unique.

Edge computing considerations

You often see edge computing incorrectly described as an alternative to cloud computing. Edge computing is about moving compute to local devices in a highly distributed system, typically as a layer around a cloud computing core. There is typically a cloud involved to orchestrate all of the devices and take in their data, then analyze it or otherwise act on it. 

To the cloud and back – why repatriation is real

While public cloud offers scalability and flexibility, some enterprises are opting to return to on-premises infrastructure due to rising costs, data security concerns, performance issues, vendor lock-in, and regulatory compliance challenges. While the public cloud offers scalability and flexibility, on-premises infrastructure provides greater control, customization, and potential cost savings in certain scenarios leading some technology decision-makers to consider repatriation. However, a hybrid cloud approach, combining public and private cloud, often offers the best balance of benefits.

More specific reasons to repatriate including the following:

• Unanticipated costs, such as data transfer fees, storage charges, and egress fees, can quickly escalate, especially for large-scale cloud deployments.  
• Inaccurate resource provisioning or underutilization can lead to higher-than-expected costs.
• Stricter data privacy regulations require organizations to store and process data within specific geographic boundaries.  
• For highly sensitive data, companies may prefer to maintain greater control over security measures and access permissions. 
• On-premises infrastructure can offer lower latency, particularly for applications requiring real-time processing or high-performance computing.  
• Overreliance on a single cloud provider can limit flexibility and increase costs. Repatriation allows organizations to diversify their infrastructure and reduce vendor dependency.  
• Industries with stringent compliance requirements may find it easier to meet standards with on-premises infrastructure.  
• On-premises environments offer greater control over hardware, software, and network configurations, allowing for customized solutions.  

Benefits of cloud computing

The cloud’s main appeal is to reduce the time to market of applications that need to scale dynamically. Increasingly, however, developers are drawn to the cloud by the abundance of advanced new services that can be incorporated into applications, from machine learning to internet of things (IoT) connectivity.

Although businesses sometimes migrate legacy applications to the cloud to reduce data center resource requirements, the real benefits accrue to new applications that take advantage of cloud services and “cloud native” attributes. The latter include microservices architecture, Linux containers to enhance application portability, and container management solutions such as Kubernetes that orchestrate container-based services. Cloud-native approaches and solutions can be part of either public or private clouds and help enable highly efficient devops workflows.

Cloud computing, be it public or private or hybrid or multicloud, has become the platform of choice for large applications, particularly customer-facing ones that need to change frequently or scale dynamically. More significantly, the major public clouds now lead the way in enterprise technology development, debuting new advances before they appear anywhere else. Workload by workload, enterprises are opting for the cloud, where an endless parade of exciting new technologies invite innovative use.

SaaS has its roots in the ASP (application service provider) trend of the early 2000s, when providers would run applications for business customers in the provider’s data center, with dedicated instances for each customer. The ASP model was a spectacular failure because it quickly became impossible for providers to maintain so many separate instances, particularly as customers demanded customizations and updates.

Salesforce is widely considered the first company to launch a highly successful SaaS application using multitenancy — a defining characteristic of the SaaS model. Rather than each Salesforce customer getting its own application instance, customers who subscribe to the company’s salesforce automation software share a single, large, dynamically scaled instance of an application (like tenants sharing an apartment building), while storing their data in separate, secure repositories on the SaaS provider’s servers. Fixes can be rolled out behind the scenes with zero downtime and customers can receive UX or functionality improvements as they become available.

Jurassic Park wasn’t really about dinosaurs.

It was about arrogant people building systems they believed were controllable.

“Life finds a way” is probably the most famous line from the entire franchise. Ian Malcolm’s warning that no matter how sophisticated the technology becomes, no matter how expensive the fences are, and no matter how confident the operators feel, nature eventually escapes containment.

And in every movie, it does.

The dinosaurs always get out. The systems fail. Eventually, the humans lose control.

What makes Jurassic Park fascinating is that despite advanced monitoring, complex containment systems and sophisticated operational controls, the outcome never really changes. At its core, the story is about people mistaking visibility for control.

Cybersecurity has the same problem.

For years, security teams have operated under the assumption that with enough tooling, governance, process, maturity and spend, we can build environments that are effectively secure. Maybe not perfect, but secure enough that compromise becomes rare and manageable.

But attackers find a way.

Given enough time, skill or motivation, they eventually identify the weakness nobody considered. The overlooked privilege. The dependency nobody mapped. The misconfiguration hiding behind layers of dashboards, process, and compliance reporting.

We are already seeing this play out. Nation-state attacks are becoming increasingly sophisticated, while AI-driven exploit discovery is beginning to compress vulnerability research from weeks into minutes.

The raptors are learning faster now.

Mistaking visibility for control

That does not mean prevention no longer matters. The fences in Jurassic Park still slowed the dinosaurs down. They created friction. They reduced exposure. Modern security controls do the same thing.

But the failure in Jurassic Park was never simply that the fences broke.

It was that the entire system assumed the fences represented certainty.

Cybersecurity often makes the same mistake.

The industry has become incredibly good at demonstrating preparedness in controlled environments. Dashboards. Compliance reports. Tabletop exercises. RTO metrics. Recovery attestations.

Jurassic Park had dashboards too.

The problem is that visibility is often mistaken for survivability. Organizations can prove they monitored the environment, documented the process, and ran the exercise, while still having very little confidence that the business could continue operating during a genuine systemic failure.

Most organizations still operate with an implicit belief that compromise is exceptional rather than inevitable. Disaster recovery plans, business continuity workshops, and annual tabletop exercises are treated as evidence of resilience. In reality, many of them are carefully controlled simulations of a world that no longer exists.

Traditional disaster recovery was designed for an era where infrastructure changed slowly, applications were relatively static, and dependencies were limited enough that recovery assumptions could remain valid for months or even years.

That world is gone. AI killed it.

Environments now evolve constantly. Cloud infrastructure changes daily. AI-assisted development accelerates release cycles. Applications rely on sprawling third-party ecosystems. APIs connect systems in ways many organizations do not fully understand. Entire workloads appear and disappear dynamically.

The environment you tested last quarter may no longer exist today.

And yet many resilience programs still operate as if annual or quarterly testing provides meaningful confidence.

Most companies do not really test resilience.

They test optimism.

The backup fallacy

And nowhere is this overconfidence more obvious than backups.

Somewhere along the way, organizations confused “having backups” with “being resilient.” Those are not remotely the same thing.

A backup simply proves you stored a copy of something at a specific point in time. It does not prove you can survive.

Most recovery models were designed in the late 90s and early 2000s for relatively static systems and predictable infrastructure. The core philosophy has barely evolved since then, even as environments have become increasingly distributed, ephemeral, and interconnected.

Restoring data is not the same as restoring operations.

Restoring infrastructure is not the same as restoring business functionality. Modern application are complex and rely on ephemeral elements, third party components and applications as well as complex data flows not just data sets.

Very few organizations continuously validate whether they can recover full feature-function applications, maintain operational workflows, preserve data integrity, reconnect dependencies, restore permissions correctly, or continue operating under active attack conditions.

We built incredibly sophisticated telemetry for understanding how we die.

We built almost none for proving we can survive.

That gap is becoming impossible to ignore.

The recent rise of continuous resilience testing and recovery validation is not accidental. It reflects a growing realization that recovery assumptions themselves may no longer be trustworthy.

Static resilience models are struggling to survive dynamic infrastructure.

This is where resilience starts becoming an engineering problem rather than a compliance exercise.

When restoration assumptions fail

Because the real question is no longer, “How quickly can we restore the application?”

The real question is, “What happens if we cannot restore it?”

Jurassic Park repeatedly explored exactly this scenario. The real panic never started when the fences failed. It started when the operators realized they could not regain control quickly enough.

Businesses now face the same risk.

What happens if AWS experiences a prolonged outage? What happens if Azure Identity Services fail globally? What happens if Stripe, Salesforce, Slack, or Microsoft 365 disappear for days rather than hours?

Many organizations do not actually have business continuity strategies for those situations.

They have restoration assumptions.

Twenty years ago, most organizations directly owned large portions of their operational stack. Today, companies increasingly rent critical business capability from a relatively small number of providers.

Identity. Infrastructure. Communications. Payments. Collaboration. Customer operations.

The efficiency gains are enormous.

So is the concentration risk.

Resilience as an engineering discipline

Historically, business continuity planning assumed localized disruption. A building burned down. A regional data center failed. A storm impacted an office. The internet itself was not the dependency.

Today, entire businesses are built on tightly interconnected SaaS and cloud ecosystems where operational survivability depends on third parties remaining continuously available.

We optimized organizations for efficiency, automation, integration, and scale.

Not necessarily survivability.

That is why resilience needs to evolve beyond annual tabletop exercises and static recovery plans.

True resilience is not a binder sitting on a shelf. It is not a workshop performed once a year. It is not a recovery document written against an environment that changed six months ago.

It is a continuous understanding of the environment itself.

It requires live telemetry, operational visibility, dependency awareness, continuous validation, and the ability to adapt under changing conditions.

Adapting to chaos

The survivors in Jurassic Park only succeeded once they stopped pretending the environment was fully controllable and instead adapted to the reality in front of them.

Cybersecurity needs to make the same shift.

Attackers will keep adapting.

AI will accelerate faster than most governance models can handle.

Complexity will continue to outpace our assumptions about control.

The organizations that survive will not necessarily be the ones with the tallest fences. They will be the ones who understand their environments deeply enough to continue operating when control is lost.

The goal was never to eliminate chaos.

It was to survive long enough to adapt to it.

Because resilience is not about preventing chaos.

It is about operating through it.

Because eventually, one way or another, life finds a way.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

While many technology companies have slowed hiring or even launched significant layoffs, that doesn’t mean job opportunities have dried up for software developers. In fact, skilled developers—particularly those with knowledge of AI—are in demand in other industries.

The key to success for developers looking to snatch up these roles is to be well-prepared to meet the needs of potential employers in a variety of sectors.

“The demand for developers in non-tech sectors is real and growing, but the roles look different from what you’d find at a software company,” says Pragati Awasthi, assistant teaching professor of AI and data science at Drexel University.

“Across all these sectors, the common thread is that software is no longer a support function; it is embedded in core operations,” Awasthi says. “The developer in these environments is often the person translating domain-specific business problems into technical solutions, which requires a different profile than a pure product engineer at a tech firm.”

Opportunity knocks

The tech industry has long been a mainstay as far as employing software developers. But as these businesses trim staffs in efforts to cut expenses, that has impacted the hiring landscape. Even as the tech sector scales back, however, companies in industries such as financial services/fintech, healthcare/healthtech, retail/ecommerce, and manufacturing are looking to acquire programming talent.

“The unifying factor is data complexity,” Awasthi says. “These industries generate large volumes of sensitive, regulated, or operationally critical data, and they need developers who can build and maintain systems that handle it responsibly.”

While recruiting firm Summit Search Group has placed developers in roles with technology companies, “it is just as common to recruit them for roles outside this niche,” says Matt Erhard, managing partner at the company. “There are actually a fairly wide variety of roles available for developers in industries beyond tech,” Erhard says.

For example, in financial services Summit Search Group has seen significant hiring for back-end and data engineers who can build and maintain fraud detection systems, digital banking platforms, and regulatory tools, Erhard says. In healthcare, companies are hiring developers to build AI-driven diagnostics platforms and patient portals, or to work with systems that manage electronic health records, he says.

In manufacturing and industrial companies, developers are needed for systems integration and embedded software related to predictive maintenance, Internet of Things (IoT) systems, and smart factories. And in retail and ecommerce, there’s strong demand for full-stack developers and data developers who can handle logistics systems, omni-channel platforms, and personalization engines, Erhard says.

“One significant function where we’ve been placing developer talent lately is in developing business systems and internal applications,” Erhard says. These roles often have titles such as systems engineer or application developer, and professionals are hired to handle tasks such as customizing customer relationship management (CRM) or enterprise resource planning (ERP) platforms, building workflow automation tools or modernizing legacy systems, he says.

Other core functions for which Summit Search Group has placed a lot of developers include data, analytics, and AI-enablement. “That could be directly involved with data engineering or in building tools like reporting systems and ETL [extract, transform, load] pipelines,” Erhard says.

The firm also has handled searches for developers who can build and maintain customer-facing products for banking, healthcare, and retail companies, such as mobile apps or digital platforms customers can use to interact with companies.

Randstad Digital, a provider of global technology talent, sees demand for roles including web developers, system developers, and app developers. “These professionals would work on anything from customer-facing platforms to internal tools,” says Michael Morris, global head of platform and talent at the company. “Non-tech companies are also often hiring roles like software architecture and devops to help scale existing technology. These involve being more ingrained in the business, like building a supply chain system for a retailer, rather than creating individual tech products like you would at a technology company.”

Prep for success

To increases the chances of success at landing developer jobs outside of the tech industry, development professionals would be wise to follow some good practices.

Boost AI skills

One best practice is to boost skills in using AI-powered tools and get familiar with all things AI.

“Get fluent with AI-assisted development and its limits,” Awasthi says. “This is not optional. Organizations across every sector expect developers to use AI coding tools productively. But the more durable skill is knowing when AI output is wrong, incomplete, or unsuitable for a regulated context. That critical evaluation capacity is what non-tech employers are increasingly trying to hire.”

AI does not necessarily replace the need for human developers so much as it changes the skills profile for those roles, Erhard says. “The biggest difference in recent years is that AI literacy is now a non-negotiable,” he says. “At minimum, developers today need to understand concepts like prompt engineering and how to use AI tools to improve their efficiency.”

One thing many job candidates don’t expect is that the rise of AI has also increased the importance of high-level skills such as problem framing, system design, and cross-functional communication,” Erhard says. “Essentially, if something is related to development but too complex or nuanced for an AI to handle effectively, then the demand is high for human developers who have that expertise,” he says.

Candidates who land roles consistently have experience building AI-augmented workflows along with standard coding skills, Erhard says. “Employers increasingly expect to hire developers who can leverage AI, so demonstrating this experience on your résumé can be very beneficial,” he says.

Gain domain knowledge

Summit Search Group is seeing high demand for developers with deep domain knowledge in an organization’s specific industry. “So, for instance, if someone is both an experienced developer and has expertise in healthcare compliance, or financial regulations, then those candidates tend to be very sought after,” Erhard says.

Domain fluency is an underrated skill, Awasthi says. “A developer who understands healthcare compliance, financial regulation, or manufacturing process logic is significantly harder to replace than one who only writes clean code,” she says. “AI can generate boilerplate. It cannot navigate a HIPAA audit or explain a model’s output to a compliance officer.”

Development professionals should “pick an industry and learn it seriously; not just the technology stack but the regulatory environment, the business model, and the actual problems practitioners face,” Awasthi says. “A developer who has read about HIPAA, or spent time understanding credit risk, is immediately more valuable in those hiring contexts.”

It’s also vital to demonstrate real-world, practical application of skills, not just credentials. “The strongest candidates have projects in their portfolio that directly tie to and solve real business problems,” Erhard says.

Acquire soft skills

And then there are the soft skills that are becoming more of a differentiator than they were in the past. As AI handles more routine coding, human developers are expected to make more architectural decisions and collaborate across departments, Erhard says. “Strong communication and problem-solving skills are critical for many of the developer roles that we’re filling today,” he says.

While technical skills are still relevant for developers using and managing AI tools, “they also need to develop the skill of ‘deeper thinking’ and learn how to think one step ahead,” Morris says. “This includes skills like system design mastery—understanding the macro view and learning how microservices, databases, and third-party APIs interact securely and efficiently.”

They also should become deeply fluent in the AI coding tools commonly used in their particular industry, with a strong understanding of how to prompt them for optimal output, Morris says. Product context awareness is also useful. “AI doesn’t know what the customer wants, but you do,” Morris says. “Understanding the business problem and the end-user experience is a requirement for being able to guide LLMs.”

Master debugging and incident response

Developers looking to break into non-tech sectors also should develop skills in debugging and incident response, Morris says. “Complex systems with multiple AI agents can, and will, fail, which means companies need humans to trace logic flaws to get the system back on track,” he says. “A mastery of root-cause analysis is a critical skill.”

“Security, compliance, and reliability are very important in non-tech industries like finance and healthcare,” says Rohit Agarwal, co-founder of Zenius, a remote hiring company. “So employers want developers who also know regulatory environments well.”

Network and keep learning

To successfully pivot from jobs at tech companies, “continuous learning, upskilling, and building hybrid skills that combine technical and business knowledge are essential,” Morris says. “With the right preparation, tech professionals can adapt and continue to thrive in meaningful, dynamic careers.”

It’s also a good idea to join talent communities in fields of interest and “engage with other members in conversations that increase your knowledge through the collective intelligence of the community,” Morris says. “Take advantage of AI skilling opportunities relevant for your role, or better yet, where you want to go next. Experiment with the technology either on your own or through structured programs.” Ultimately, be curious and proactive, he says.

“I’d also recommend developers not to ignore referrals, direct outreach, and industry-specific communities during job search,” Agarwal says. “There are often a lot more opportunities available than the ones posted online.”

덴마크의 다국적 제약사 노보 노디스크(Novo Nordisk)는 특허 만료 전에 신약을 최대한 빨리 시장에 출시하는 데 큰 관심을 두고 있다. 노보 노디스크의 디지털 혁신 책임자(CDTO) 스테파니 보바(Stephanie Bova)는 “대형 블록버스터 신약의 경우 출시가 일주일만 늦어져도 손실 규모가 1,000만~1억 달러(약 149억~1,494억 원)에 이를 수 있다”라며 “특허 보호 기간 동안 제품을 판매할 수 있는 시간이 그만큼 줄어들기 때문”이라고 설명했다.

생성형 AI는 신약 개발 과정의 여러 단계를 획기적으로 단축할 가능성을 제시했다. 특히 노보 노디스크는 핵심 업무 프로세스마다 소요 시간을 꾸준히 추적·관리해 왔기 때문에 다른 많은 기업보다 유리한 출발점에 있었다. 생성형 AI를 일부 업무에 적용하면 생산성이 향상되고, 곧바로 재무 성과로 이어질 것으로 기대할 수도 있었다. 하지만 현실은 그렇게 단순하지 않았다. 신약 개발은 여러 부서에서 다양한 업무가 서로 다른 시점에 진행되는 복잡한 과정이기 때문이다.

보바는 “각 담당자는 자신이 맡은 분야의 전문가이지만, 다음 단계의 업무나 전체 프로세스가 어떻게 연결되는지까지는 잘 알지 못하는 경우가 많다”라며 “시스템 자체가 워낙 크고 복잡해 전체 성과를 한눈에 파악하기 어렵다”라고 설명했다.

프로세스 문서에 기록된 내용과 실제 업무 방식이 일치하지 않는 경우도 적지 않다. 같은 업무를 담당자마다 서로 다른 방식으로 수행하기도 하며, 일부 핵심 업무는 외부에서 거의 드러나지 않는다. 예를 들어 생산팀은 완전히 다른 조직에 속해 있어 신약이 미국 식품의약국(FDA) 제출을 앞두고 있다는 사실조차 인지하지 못할 수 있다. 이 경우 필요한 문서도 아직 준비되지 않은 상태일 수 있다.

보바는 “앞 단계에서는 아무리 빠르게 업무를 진행해도 결국 다른 팀의 준비가 끝날 때까지 기다려야 하는 상황이 발생한다”라고 말했다.

이는 기업이 AI 프로젝트의 성과를 측정하는 과정에서 마주하는 여러 어려움 가운데 하나이며, AI 관련 설문조사 결과가 서로 엇갈리는 이유이기도 하다.

개별 업무 단위에서 보면 노보 노디스크는 AI 도입을 통해 생산성이 향상됐고, 분명한 효과도 확인하고 있다. 하지만 시야를 넓혀 기업 전체의 실적을 기준으로 평가하면 상황은 훨씬 복잡해진다. 중요한 단계 하나라도 누락되면 신약 출시 기간은 단축되지 않는다. 또한 신약이 실제 환자에게 공급되기까지는 수년이 걸리기 때문에 AI 도입에 따른 재무적 효과 역시 상당한 시간이 지나야 나타난다. 그리고 이는 AI 투자 수익률(ROI)을 측정하기 어렵게 만드는 문제의 시작에 불과하다.

프로세스 측정의 중요성

이 같은 프로세스의 사각지대를 해소하기 위해 노보 노디스크는 차세대 프로세스 마이닝 기술인 AI 기반 실시간 운영 디지털 트윈을 도입했다.

보바는 “프로세스 인텔리전스 기업 셀로니스(Celonis)와 협력해 프로세스 데이터를 기반으로 한 디지털 트윈을 구축했다”라며 “임상 분야에 이 기술을 적용한 것은 업계 최초였다”라고 설명했다. 이 도구는 기업 시스템에서 데이터를 수집해 직원들이 실제로 어떤 업무를 수행하는지 추적한다. 일부 직원의 기억에 의존하는 설문조사 방식과 달리 실제 업무 흐름을 객관적으로 파악할 수 있다는 것이 특징이다.

첫 번째 적용 대상은 7단계로 구성된 비교적 단순한 프로세스였다. 하지만 디지털 트윈을 구축한 결과, 실제로는 담당자에 따라 5단계로 진행되기도 하고 9단계까지 늘어나기도 한다는 사실이 드러났다.

보바는 “동일한 업무 전문가 10명을 한자리에 모아도 프로세스에 대한 해석은 제각각이며, 시간이 지나면서 업무 방식도 조금씩 달라진다”라고 말했다.

프로젝트는 기존 프로세스의 여러 문제점도 찾아냈다. 일부 업무는 직원 재교육이 필요했고, 어떤 경우에는 사용자 인터페이스(UI)를 개선해야 했다. 하지만 일단 프로세스를 표준화하면 AI 도입 이전의 기준 데이터를 확보할 수 있다. 이를 기반으로 AI를 활용한 업무 지원이나 자동화가 실제 성과를 냈는지 객관적으로 비교·평가할 수 있다.

또 하나 미리 결정해야 했던 과제는 AI로 확보한 시간을 어떻게 활용할 것인지였다.

보바는 “사람을 감원하는 것은 바람직하지 않다”라며 “이들은 고도의 전문성을 갖춘 구하기 어려운 인재인 만큼, 팀 간 인력을 재배치하는 방안을 고려하는 편이 더 적절하다”라고 밝혔다.

현재 노보 노디스크는 수백 개의 AI 에이전트를 실제 업무에 운영하고 있다. 이들 에이전트는 모두 디지털 트윈 인프라 안에서 식별할 수 있도록 관리된다.

보바는 “문제가 발생하면 어디에서 오류가 생겼는지 정확히 파악해 바로 수정할 수 있다”라며 “다음 단계는 여러 AI 에이전트가 서로 협업하는 멀티 에이전트 오케스트레이션이다. 지금은 각각의 AI 에이전트가 연결돼 있지만, AI 에이전트를 관리하는 또 다른 AI 에이전트는 아직 없는 상태”라고 설명했다.

다만 신약 개발은 수년에 걸쳐 진행되는 만큼 아직 AI 투자 수익률(ROI)을 평가하기에는 이르다는 것이 보바의 설명이다.

보바는 “전체 프로세스를 종단간(end-to-end)으로 분석하면 불필요한 과정을 제거해 개발 기간을 2년 정도 단축할 수 있을 것으로 기대한다”라며 “현재보다 2년 더 빨리 시장에 제품을 출시하는 것이 목표”라고 말했다.

이미 임상 개발 막바지에 접어든 신약은 AI 도입에 따른 시간 단축 효과가 제한적이다. 반면 개발 초기 단계의 신약은 가장 큰 혜택을 받을 것으로 예상된다. 다만 이러한 성과가 기업의 재무 실적으로 이어지기까지는 앞으로 수년이 더 걸릴 전망이다.

이처럼 여러 프로세스를 동시에 최적화해야 진정한 가치를 얻을 수 있는 산업은 제약업계만이 아니다. PwC에 따르면 단발성 AI 프로젝트는 측정 가능한 성과를 내지 못하는 경우가 많다. 반면 기업의 경영 전략과 연계된 전사적 규모의 AI 도입은 실질적인 투자 수익을 창출하는 것으로 나타났다.

실제로 AI 도입이 거의 보편화됐음에도 불구하고 지난 12개월 동안 AI를 통해 매출이 증가하거나 비용이 감소했다고 답한 기업은 많지 않았다. 그럼에도 KPMG는 올해 말 기업의 AI 투자 규모가 지난해보다 거의 두 배로 증가할 것으로 전망했다.

생산성 측정

대부분의 기업은 비교적 작은 규모에서 AI 도입을 시작한다. 대표적인 사례가 직원 생산성 향상을 위한 AI 챗봇 도입이다. AI 챗봇은 놀라울 정도로 빠른 속도로 확산됐지만, 정작 기대했던 생산성 향상을 어떻게 측정해야 하는지는 여전히 쉽지 않은 과제로 남아 있다.

카네기멜런대학교 AI 교수 아난드 라오(Anand Rao)는 무엇보다 기준선(baseline)을 확보하는 것이 중요하다고 말한다. 하지만 어떤 업무는 기준선을 측정하기가 어렵고, 어떤 경우에는 사실상 불가능하다.

예를 들어 보험 심사는 결과가 나타나기까지 수년이 걸린다. 생명보험이라면 그 기간이 수십 년에 이를 수도 있다. 일부 의사결정은 애초에 성과를 측정할 기준 자체가 존재하지 않는다.

라오는 “사람의 의사결정 과정과 그 질을 평가하겠다고 하면 사회적 거부감이 생긴다”라며 “사람은 자신의 의사결정이 평가받는 것을 좋아하지 않는다”라고 설명했다.

이어 “결과가 좋으면 누구나 자신의 공이라고 말하지만, 결과가 나쁘면 외부 요인 때문이라고 생각하는 경향이 있다”라고 말했다.

측정이 가능한 업무라도 상황은 크게 다르지 않다. 많은 기업이 AI를 도입하기 전에 기존 성과를 측정하는 작업부터 하지 않는 경우가 많기 때문이다.

패션 소매업체 룰루레몬(Lululemon)의 전 글로벌 최고정보책임자(CIO)이자 수석부사장(EVP)을 지낸 줄리 애버릴(Julie Averill)은 “처음부터 기준선을 마련하지 않았다”라고 말했다. 현재 애버릴은 디지털 혁신 컨설팅 기업 골드 스레드(Gold Thread)의 CEO를 맡고 있다.

애버릴은 “AI가 더 나은 의사결정을 도와줄 것이라는 전제를 먼저 세우고 시작했다”라며 “그렇게 되면 이후 성과를 제대로 측정하기가 어려워진다”라고 설명했다.

물론 다른 지표를 활용할 수도 있다. 예를 들어 AI 사용률이나 사용자 만족도 같은 수치다.

애버릴은 “AI는 실제로 활용되고 있고 다양한 이점을 만들어내고 있다”라며 “눈에 보이는 효과도 있지만 그렇지 않은 효과도 있다. 결국 프로세스를 믿어야 한다”라고 말했다.

이어 “이는 클라우드 도입과 비슷하다. 모두가 미래의 방향이라는 사실은 알고 있고 장점도 이해하지만, 실제로 전환하기는 쉽지 않으며 조직 전반에 많은 변화가 필요하다”라며 “하지만 전환을 빨리 시작할수록 새로운 운영 방식에 더 빨리 적응하고 AI의 가치를 제대로 활용할 수 있다”라고 설명했다.

반면 고객 서비스처럼 성과를 수치로 측정하기 쉬운 영역도 있다.

애버릴은 “고객 서비스는 반복적인 업무가 많아 기업이 AI 자동화를 가장 먼저 적용하는 분야”라며 “측정 가능한 결과가 분명하고 기준선도 비교적 쉽게 설정할 수 있다”라고 말했다.

룰루레몬은 개인화 추천 시스템에도 수년간 AI를 활용해 왔다. 이 역시 성과를 정량적으로 측정할 수 있는 분야다. 또한 AI는 수작업 데이터 입력을 자동화해 오류율을 낮출 수 있으며, 규정 준수 모니터링과 사기 탐지, 설비 예지보전(Predictive Maintenance) 등에서도 활용되고 있다. 이러한 분야는 모두 AI 효과를 수치로 평가할 수 있다.

하지만 직원 생산성 전반을 측정하는 일은 룰루레몬뿐 아니라 대부분의 기업에 여전히 어려운 과제다.

가장 직관적인 방법은 AI의 영향을 많이 받는 직종에서 실제 해고가 늘어났는지를 살펴보는 것이다. AI 때문에 일자리가 줄어든다는 보도는 이미 넘쳐난다.

그러나 올해 3월 공개된 앤트로픽 보고서는 다른 결과를 제시했다. AI의 영향을 가장 크게 받는 직종, 즉 AI로 인해 해고 가능성이 가장 높은 직군에서도 실업 증가를 보여주는 증거는 발견되지 않았다.

2025년 초에는 연구기관 METR이 숙련된 소프트웨어 개발자를 대상으로 AI 사용 여부에 따른 업무 수행 속도를 비교하는 실험을 진행했다.

결과는 예상과 달랐다. 개발자들은 AI를 사용하면 생산성이 24% 정도 향상될 것으로 기대했고, 실제 체감 효과도 약 20%라고 평가했다. 하지만 실측 데이터는 정반대였다. AI를 사용한 경우 오히려 작업 속도가 평균 19% 느려진 것으로 나타났다.

물론 AI 도구는 빠르게 발전하고 있다. METR은 AI 사용 여부를 다시 비교하는 후속 연구를 추진했지만 충분한 참가자를 모집하지 못했다. 연구 참여 비용을 지급했음에도 AI 없이 작업하는 방식으로 돌아가려는 개발자가 거의 없었기 때문이다.

물론 AI 덕분에 한 명의 엔지니어가 수백 명의 업무를 수행했다는 사례도 심심치 않게 들린다. 클로드 코드의 50만 줄 규모 코드베이스가 실수로 유출됐을 당시 한국인 개발자 시그리드 진(Sigrid Jin)이 클린룸 방식(원본 코드를 직접 복사하거나 참고하지 않고, 동일한 기능을 새롭게 구현하는 개발 방식)으로 이를 2시간 만에 재구현한 뒤 깃허브에 공개했고, 해당 프로젝트가 역대 가장 빠르게 별 10만 개를 달성했다는 사례도 있다.

하지만 AI와 관련된 대부분의 이야기처럼 실제 상황은 훨씬 복잡하다. 특히 소프트웨어 개발에서는 코드를 작성하는 일 자체가 전체 개발 과정에서 차지하는 비중은 일부에 불과하다.

리서치 기관 DX가 400개 기업의 핵심 엔지니어링 지표를 분석한 보고서에 따르면 AI 활용률은 2024년 11월 이후 65% 증가했다. 그러나 AI로 인한 생산성 향상은 10%에도 미치지 못한 것으로 나타났다.

AI의 숨은 비용

AI의 생산성 향상을 측정하기 어려운 것처럼 AI 도입 비용을 정확하게 산정하는 일도 쉽지 않다. 기업이 AI를 처음 도입할 때는 비용을 비교적 간단하게 계산할 수 있다. 직원들이 사용하는 AI 챗봇의 월 구독료는 얼마인지, 맞춤형 모델을 학습하거나 파인튜닝하는 데 얼마나 드는지만 계산하면 되기 때문이다. 하지만 활용 사례가 복잡해질수록 비용 산정도 훨씬 어려워진다고 애버릴은 설명했다.

애버릴은 “이제는 AI 자체뿐 아니라 AI를 둘러싼 다양한 시스템까지 고려해야 한다”라며 “이런 비용은 측정하기는 더 어렵지만 기업에 미치는 영향은 훨씬 크다”라고 말했다.

예를 들어 RAG을 활용해 AI를 업무 프로세스에 통합하면 LLM API 호출 비용이 지속적으로 발생한다. 여기에 기존 시스템을 연동하거나 수정하는 비용까지 추가된다. 이러한 비용 구조는 시간이 갈수록 더욱 복잡해지고 있다.

KPMG의 글로벌 AI·데이터 랩 총괄인 스와미나탄 찬드라세카란(Swaminathan Chandrasekaran)은 “기업들은 지금까지 AI 사용 현황을 체계적으로 수집·분석할 수 있는 텔레메트리와 계측 체계를 구축하는 데 충분한 노력을 기울이지 않았다”라고 말했다. 기업 전체의 AI 비용을 정확히 파악하는 일은 마치 날씨를 예측하는 것과 비슷하다는 설명이다.

그는 “오늘날 정확한 기상 예보가 가능한 이유는 수만 개의 기상관측소가 데이터를 수집하고 이를 종합하기 때문”이라며 “그런 데이터가 없다면 날씨를 예측할 수 없을 것”이라고 설명했다.

기업도 AI 활용 전반을 측정할 수 있는 계측 체계를 구축해야 한다는 것이 그의 주장이다. 얼마나 많은 토큰을 사용했는지, 누가 사용했는지, 그리고 그 사용량이 실제 업무 성과와 어떤 관계가 있는지까지 추적해야 한다는 것이다.

찬드라세카란은 “현재는 이러한 측정 체계가 근본적으로 부족한 상황”이라고 지적했다.

직원이 AI 챗봇을 사용하는 경우에는 그나마 비용을 예측하기 쉽다. 사람이 하루에 입력할 수 있는 질문 수에는 물리적인 한계가 있고 구독료도 비교적 일정하기 때문이다. 또한 RAG를 적용한 업무 시스템에서는 기존의 규칙 기반 시스템이 예측 가능한 방식으로 LLM API를 호출한다.

하지만 에이전틱 AI가 등장하면서 상황은 훨씬 복잡해졌다. AI 에이전트는 예측하기 어려운 방식으로 자율적으로 행동하기 때문에 API 호출 횟수가 급격히 늘어날 수 있다. 보스턴컨설팅그룹(BCG) 보고서에 따르면 기업의 약 3분의 2는 AI 확장에 따른 비용이 통제하기 어려운 수준으로 증가하고 있다고 답했다.

기업이 간과하기 쉬운 또 다른 비용은 데이터 관련 비용이다. 다른 예산 항목에 포함돼 있다는 이유로 제대로 추적하지 않는 경우도 많다. AI 학습이나 파인튜닝을 위한 데이터 준비, RAG 임베딩 구축, AI 에이전트를 통한 MCP 직접 연동 등은 모두 상당한 비용을 수반하며, AI 도입이 확대될수록 이러한 비용은 빠르게 증가할 수 있다.

컨설팅 업체 코글린 어소시에이츠(Coughlin Associates)의 대표이자 IEEE 펠로인 톰 코글린(Tom Coughlin)은 “대표적인 비용 가운데 하나가 데이터 반출(egress) 비용”이라며 “클라우드에서 데이터를 꺼내와야 하는 경우 데이터 반출 수수료가 상당한 수준까지 늘어날 수 있다”라고 설명했다.

AI 도입에는 사람에 대한 투자 비용도 적지 않다.

코글린은 “장기적으로 AI는 큰 가치를 제공하겠지만, 이를 제대로 활용하려면 직원들이 올바르게 사용하는 방법을 익혀야 한다”라며 “그러한 역량이 부족하면 결국 경쟁에서 뒤처질 수밖에 없다”라고 말했다.

해결책과 상반된 현실

AI 프로젝트에서는 문제를 해결하는 데도 적지 않은 비용이 든다. 지난 18개월 동안 대다수 기업이 최소 한 차례 이상의 AI 관련 사고를 경험했으며, 그중 상당수는 금전적 손실로 이어졌다. 일부 기업은 피해 규모가 50만 달러(약 7억 4,700만 원)를 넘기도 했다. 여기에 AI 기능이 거의 모든 소프트웨어와 서비스에 기본 탑재되면서 ROI를 계산하는 일은 더욱 복잡해지고 있다.

미국 로펌 브라운스타인 하얏트 패버 슈렉(Brownstein Hyatt Farber Schreck)의 최고정보책임자(CIO) 앤드루 존슨(Andrew Johnson)은 “직접적인 비용은 정확히 파악할 수 있다”라면서도 “기존에 사용하던 플랫폼이나 원래 AI 기능이 없던 SaaS 애플리케이션에 AI가 추가되는 경우에는 비용을 측정하기가 훨씬 어렵다”라고 말했다.

이어 “공급업체들은 AI 기능이 추가됐다며 라이선스 비용을 큰 폭으로 인상하고 있다”라며 “그 인상분 가운데 실제로 얼마나 AI 때문인지를 따져보면 명확하지 않은 경우가 많다”라고 설명했다.

AI가 비용 절감 효과를 가져오더라도 그에 따른 추가 비용이 발생하는 경우도 적지 않다. 예를 들어 브라운스타인은 계약 관리 플랫폼에 연간 약 7만 달러(약 1억 462만 원)를 지출하고 있었다. 이를 AI를 활용해 자체 구축하면서 약 4만 달러(약 5,980만 원)의 개발 인건비와 연간 3,000달러(약 448만 원)의 호스팅 비용이 들었다. 이후 유지보수 비용도 연간 수천 달러 수준으로 발생할 예정이다.

여기에 자체 애플리케이션을 운영하면 보안 감사와 취약점 평가, 침투 테스트, 코드 리뷰 등 간접 비용도 함께 고려해야 한다.

존슨은 “플랫폼이 복잡하고 위험도가 높을수록 자체 솔루션을 개발하려는 의지는 그만큼 줄어든다”라고 말했다.

그럼에도 AI 덕분에 소프트웨어 개발 조직의 생산성은 크게 향상됐다. 현재 개발자 4~5명이 과거 20~30명이 수행하던 업무를 처리할 수 있게 됐다.

하지만 생산성 향상이 곧바로 인건비 절감으로 이어지는 것은 아니다. 해결해야 할 새로운 프로젝트가 계속 생겨나기 때문이다.

존슨은 “개발해야 할 솔루션 아이디어가 엄청나게 많이 쌓여 있다”라고 말했다.

카네기멜런대학교의 라오 교수는 업무는 가용한 시간을 모두 채우는 방향으로 늘어나는 경향이 있다고 설명했다.

예를 들어 AI 덕분에 생산성이 20% 향상됐다고 가정해 보자. 라오는 “100명이 하던 일을 이제는 80명이 할 수 있게 됐다고 생각할 수 있다”라며 “하지만 연말이 돼도 실제 인원은 그대로인 경우가 많다”라고 말했다.

이어 “기존 업무는 분명 더 효율적으로 처리된다”라며 “하지만 사람은 확보한 20%의 여유 시간을 활용해 새로운 업무를 추가하거나 기존 업무를 보완한다. 한 시간 일찍 퇴근하는 것이 아니라 새로운 가치를 만드는 일에 시간을 쓰게 된다”라고 설명했다.

오히려 일부 업종에서는 생산성 향상이 단기적으로 수익성을 악화시킬 수도 있다. 대표적인 사례가 시간당 수임료를 청구하는 법률 서비스다.

존슨은 “효율성 향상은 지금까지 법률업계가 수익을 창출해 온 방식과 상충하는 측면이 있다”라며 “하지만 장기적인 관점에서 생각해야 한다. 단기적으로는 어려움이 있지만 장기적으로는 결코 불리한 일이 아니다. 오히려 AI를 도입하지 않으면 중장기적으로 경쟁력을 잃을 가능성이 크다”라고 말했다.

예를 들어 AI가 변호사의 실사(due diligence) 업무를 지원한다고 해서 해당 AI 도구에 투자한 비용이 곧바로 매출 증가로 이어진다고 단정하기는 어렵다.

존슨은 “AI 도입이 장기적으로 올바른 방향이라는 점은 분명하다”라며 “다만 그것이 구체적으로 어느 정도의 투자 수익으로 이어질지는 아직 단정하기 어렵다”라고 말했다.
dl-ciokorea@foundryco.com

It’s the end of the road for yet another facet of Exchange Server, Microsoft’s on-premises email and calendar system. The stripped-down version of its web client, Outlook Web App (OWA) Light, is being retired, forcing those Exchange Server users still using it to adopt the standard Outlook Web App instead.

“OWA Light was created for a much earlier era of the web, when browser support, bandwidth, and accessibility technologies were very different from today. Going forward, we want to invest in a modern Outlook on the web experience that provides the cross-browser, accessible, and security-focused experience,” said Microsoft.

Those enterprises still operating in a resource-constrained environment are out of luck, then.

The change will be effected in an upcoming Exchange Server update expected in August. The move should come as no surprise: Microsoft had already deprecated the light version of Outlook in August 2024. Microsoft said that sysadmins should spend the next couple of months preparing for the change by identifying any staff still using OWA Light.

This is just the latest alteration that Microsoft has made to its Exchange ecosystem, which some holdouts still use instead of the SaaS-based Microsoft 365 service. However, even on-premises customers must now pay a subscription fee to use Exchange Server.

One of the advantages of SaaS offerings is that customers don’t have to deal with patching, an advantage brought home to on-premises customers in May when a zero-day exploit struck Exchange Server.

데이터독 코리아는 9일 서울에서 기자간담회를 열고 이 같은 사업 현황과 연례 컨퍼런스 ‘대시(Dash) 2026’에서 공개한 신제품 전략을 소개했다.

엄수창 데이터독 코리아 지사장은 이를 시장 변화의 신호로 해석했다.

엄 지사장은 “연초만 해도 ‘SaaS 아포칼립스’라는 말이 나올 정도로 SaaS 기업들의 미래를 부정적으로 보는 시각이 많았다”며 “하지만 데이터독은 AI와 함께 성장하면서 오히려 큰 미래 비전을 갖게 됐다”고 말했다. 이어 “글로벌 상위 AI 기업 10곳 모두 데이터독을 사용하고 있다는 사실 자체가 시장이 우리의 성장 가능성을 높게 평가하고 있다는 방증”이라고 강조했다.

이 같은 자신감의 배경에는 AI 시대 급증하는 운영 관리 수요가 있다. 과거에는 데브옵스(DevOps)와 SRE(Site Reliability Engineering) 조직이 장애 분석과 인프라 모니터링을 위해 주로 활용했다면, 이제는 AI를 활용해 운영을 자동화하는 기능과 AI 애플리케이션 자체를 관리하는 기능까지 제공하며 AI 시대에 맞춰 사업 영역을 확대하고 있다.

정영석 데이터독 기술총괄은 올해 대시에서 공개한 100여 개의 신기능을 ‘자율 IT 운영(Autonomous Operations)’과 ‘AI 거버넌스’라는 두 가지 축으로 설명했다.

자율 IT 운영 분야에서는 ‘비츠 AI(Bits AI)’가 장애 탐지부터 원인 분석, 해결까지 자동으로 수행한다. 정 총괄은 “장애가 발생하면 비츠 AI가 8가지 안팎의 가설을 세운 뒤 하나씩 검증해 근본 원인을 찾아내고, 코드 수정안까지 PR(Pull Request) 형태로 제안한다”며 “기존에는 엔지니어가 1~2시간 걸리던 분석 및 보고서 작성 작업을 빠르면 5분 이내로 단축할 수 있다”고 설명했다.

또 인프라 자원이 부족하면 슬랙 등을 통해 운영자 승인만 받아 메모리와 CPU를 자동으로 증설하고, 사전에 정의한 가드레일 안에서는 무인 복구도 수행한다. 코드 변경부터 스테이징 배포, 프로덕션 환경에 이르기까지 애플리케이션이 의도대로 동작하는지도 AI가 지속적으로 검증한다.

AI 거버넌스 분야에서는 ▲에이전트 옵저버빌리티(Agent Observability) ▲AI 게이트웨이(AI Gateway) ▲AI 가드(AI Guard) ▲LLM 비용 관리 콘솔 등의 기능 공개했다.

에이전트 옵저버빌리티는 AI 에이전트 내부에서 어떤 LLM과 도구를 사용했고, 토큰과 비용이 얼마나 발생했는지 시각화한다. AI 게이트웨이는 여러 LLM을 통합 관리하고 감사(Audit)를 수행하며, AI 가드는 프롬프트 인젝션과 민감정보 유출을 차단한다.

정 총괄은 “코파일럿, 커서(Cursor), 클로드 등 여러 AI 모델을 함께 사용하는 기업이 늘면서 비용과 보안, 신뢰성을 통제하는 것이 C레벨 경영진의 공통 과제가 됐다”며 “개발자별, 모델별 사용량과 비용을 세분화해 보여주기 때문에 임원들도 최적화 지점을 쉽게 찾을 수 있다”고 말했다.

최근 많은 기업이 멀티 LLM 전략을 채택하는 만큼 이러한 통합 관리 플랫폼의 필요성도 커질 것이라는 설명이다.

CIO 코리아가 AI 기능 추가로 관련 비용이 늘어나는 것 아니냐고 묻자 정 총괄 “데이터독이 제공하는 수백 개의 외부 서비스 연동 기능은 모두 기본 호스트 사용료에 포함돼 있어 AI 기능이 추가됐다고 모니터링 비용이 늘어나는 것은 아니다”며 “다만 로그는 저장량이 늘어나면 비용이 증가하는 구조인데 이는 어느 벤더나 비슷하다”고 답했다.

이어 “AI가 추가됐다고 인프라 모니터링 비용이 올라가는 것은 아니지만 AI SRE처럼 자동 분석 기능을 사용할 경우 토큰(크레딧)이 소모돼 비용이 추가될 수 있다”며 “반면 엔지니어의 업무 시간을 크게 줄일 수 있기 때문에 ROI 측면에서는 충분히 상쇄할 수 있고, UI 대신 MCP(Model Context Protocol)를 활용하면 비용을 낮출 수 있어 국내 여러 대형 고객도 MCP 기반 AI옵스를 구축하고 있다”고 덧붙였다.

AI가 문제 해결책까지 제시하는 것에 대한 고객사의 거부감은 없는지 묻는 질문에는 “잘못 분석할 가능성이 있는 것은 사실이지만 지금까지 고객 반응은 매우 긍정적”이라며 “AI가 잘못 탐지하더라도 사용자가 대화를 통해 추가 분석을 요청하면 계속 수정하면서 근본 원인에 더 가까운 결과를 제시한다”고 설명했다.

이어 “이 경험은 ‘비츠 메모리(Bits Memory)’ 기능에 축적돼 이후 유사한 장애가 발생하면 더욱 정확하게 분석하도록 학습된다”고 말했다.

내부 AI는 자체 모델과 업계 최신 모델을 함께 사용하는 하이브리드 구조다.

정 총괄은 “프론티어 모델과 자체 모델인 ‘토토(Toto)’를 함께 운영하고 있으며 작업 특성에 따라 가장 적합한 모델을 선택해 사용한다”고 밝혔다. 클로드, GPT, 제미나이 등 다양한 외부 최신 모델을 활용하며, AI SRE는 내부적으로 최적 모델이 자동 선택되지만 에이전트 빌더에서는 고객이 MCP와 사용할 모델을 직접 선택할 수 있다. 또한 LLM 옵저버빌리티에서는 환각을 탐지하기 위해 교차 검증용 모델을 별도로 지정하는 기능도 제공한다.

데이터독은 앞으로 옵저버빌리티(Observability), 보안, 핀옵스(FinOps), 비즈니스 인텔리전스(BI)를 하나의 플랫폼에서 통합 제공하는 차별성을 앞세워 국내 시장 공략을 확대하겠다고 밝혔다.
jihyun.lee@foundryco.com

The hardest thing to manage is change. I wrote that line more than a decade ago in an article about the “XPocalypse,” Microsoft’s end-of-life deadline for Windows XP. My argument then was that the real crisis was not obsolete software. It was the shortage of technically literate professionals capable of guiding organizations through inevitable transitions.

More than a decade later, the names have changed. The lesson has not.

Y2K defined the pattern. The risk was real, but disaster was avoided because skilled people did the work. When nothing happened at midnight (1999-2000), many assumed the threat had been exaggerated instead of recognizing that it had been managed. Windows XP became the next version of the same problem. The operating system stayed embedded in retail, banking, healthcare, energy, law enforcement and defense systems long after it should have been retired. The vulnerability was real, but the larger lesson was mostly missed: organizations let technical debt pile up until a deadline turns it into a crisis.

Is agentic AI actually breaking the enterprise SaaS business model?

Now we have the “SaaSpocalypse.” Headlines warn that agentic AI is breaking the SaaS business model, lowering software valuations and making entire categories of enterprise tools obsolete. Investors are reacting; analysts are talking about “FOBO,” Fear of Becoming Obsolete, and organizations are again asking whether they are ready for what comes next.

The disruption is real. AI agents can now automate workflows that once required dedicated software tools and teams of human operators. The per-seat pricing model that powered two decades of SaaS economics is under pressure. But the apocalyptic framing misdiagnoses the problem. SaaS is not dying. It is bifurcating.

Platforms requiring precision, auditability, complex state management and regulatory accountability, such as financial systems, healthcare records and compliance infrastructure, will remain essential. What is collapsing is the undifferentiated middle: horizontal tools that AI agents can replicate cheaply and at scale.

The organizations most exposed are not simply those using the wrong software. They are those who outsourced technical judgment along with technical execution. They bought SaaS as a substitute for internal capability, accumulated organizational debt and now lack the human capital to navigate a transition that is fundamentally about people and process.

The old taxonomy still applies: people, process and technology. Technology serves business functions. Processes create efficiency. Qualified people sustain both. But the pace of technological change continues to outrun the education system’s ability to produce experienced professionals with current skills.

AI has widened that gap. Data engineers now design orchestration infrastructure that determines whether AI produces value or liability. Security practitioners must govern autonomous agents acting on behalf of enterprises. Business leaders need enough technical fluency to make build-versus-buy decisions in a market changing in real time.

These are not narrow technical tasks. They are the applied outputs of serious STEM education grounded in a business context, professional standards and sustained practice. We are still not producing enough people who have those skills.

How is the growing STEM education gap threatening AI leadership?

The numbers are sobering. The United States now produces fewer than 820,000 STEM graduates annually, representing about 20% of all degrees awarded. China produces approximately 3.57 million STEM graduates each year, about 40% of its university degrees. At the doctoral level, the gap is sharper. In 2000, the United States awarded 17,830 STEM PhDs, compared with China’s 7,520. By 2022, China awarded more than 50,970 STEM doctorates, over 50% more than the 33,820 awarded in the United States.

This matters directly to AI leadership. Countries building the strongest STEM pipelines today are positioning themselves to define the architecture, governance and standards of AI systems tomorrow.

How can we solve the AI talent shortage and rebuild the IT profession?

More than a decade ago, I argued that IT must be treated as a profession, not merely a resource. Finance, medicine, law, engineering and accounting all have formal professional pathways, standards and institutional support. Information technology underpins nearly every critical function of modern society, yet still lacks equivalent professional frameworks.

The AI transition makes this more urgent. As AI absorbs routine execution, the humans left in the loop must be more capable, not fewer. Their role is shifting from implementation to governance, from configuration to architecture, from maintenance to judgment. That requires better preparation, stronger incentives and professional recognition.

The United States still leads in private AI investment, but it has not matched that commitment with investment in the human capital needed to sustain it. China has embedded AI degree programs across more than 500 universities and integrated corporations directly into research and workforce pipelines. India’s AI upskilling surge is driven heavily by corporate sponsorship, with employers treating workforce education as strategic investment. The European Union has committed significant public funding to AI talent development and cross-border STEM mobility.

The United States has examples worth scaling. North Carolina’s AI Academy at NC State, built with more than 100 corporate partners, combines university credentialing with applied workplace training. North Carolina A&T, the nation’s leading producer of Black engineers, is partnering with NVIDIA and the Office of Naval Research to expand AI and cybersecurity talent. Texas has committed heavily to doctoral research infrastructure through the Texas Institute for Electronics, linking universities, government and industry around semiconductor and defense technology priorities.

These models show what a national strategy should look like: public investment, corporate sponsorship, university research capacity and continuous pathways from undergraduate study through doctoral work. But they remain exceptions. Corporate PhD fellowships from leading technology companies are valuable, but they are filters, not pipelines.

The technology sector has long harvested talent from a pipeline it does not adequately fund, then wondered why the pipeline runs short. That model is no longer sustainable. Federal and state governments must create the policy environment, including tax incentives, credentialing reform, research funding and visa frameworks, that makes corporate STEM investment structurally attractive rather than reputationally optional.

The SaaSpocalypse will pass, as Y2K and the XPocalypse passed, because capable people will do the work. The headlines will move on. The underlying shortage will remain.

What I called for in 2014 still stands: STEM education, paired with business, information management and finance, must become a sustained national infrastructure. Not as a reaction to this disruption, but as preparation for the next one.

The hardest thing to manage is change. The next is learning from it.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Infoblox announced today that it has entered into a definitive agreement to acquire Kentik, combining Infoblox’s authoritative DNS, DHCP, and IP address management (IPAM) data with Kentik’s network observability platform. Financial terms were not disclosed.

Kentik was founded in 2014, originally as CloudHelix before rebranding the following year, and has raised more than $100 million in venture funding to date. The platform provides real-time visibility into network traffic and ingests flow data, routing intelligence, and device telemetry across data centers, cloud environments, WANs, and the public internet. In recent years, the company has enhanced its platform with an AI advisor that helps to accelerate investigations.

Infoblox has spent more than two decades managing the DNS, DHCP, and IPAM services enterprises rely on to stay connected. In 2024, it first launched its Universal DDI SaaS platform for managing DNS, DHCP, and IP addresses from a single place, expanding in 2025 to more providers. DDI refers to the trio of core network services in IP networks: DNS, which turns domain names into IP addresses; DHCP, which assigns IP addresses to resources; and IPAM, which manages the network’s IP address infrastructure.

Infoblox and Kentik each had something the other one was missing.

“We know every device, every application across the hybrid multi cloud state, we know because we handed out the IPs, or we have acquired those assets,” Mukesh Gupta, chief product officer at Infoblox, told Network World. “We know what is on the network. We don’t know who is talking to who.”

The path to acquisition

“We’ve been talking for a few years,” Avi Freedman, co-founder and CEO of Kentik, told Network World.

Both Gupta and Freedman said the companies have discussed working together for several years, driven largely by customers who use both platforms and asked the two vendors to integrate them directly.

“We’ve gone from very internet-centric companies to some of the largest enterprises in the world, and guess who they use for all of their core sources of truth,” Freedman said. “So, our customers have been saying, hey, you have this great platform that can take all this enrichment, and we need you to be doing this kind of integration.”

For Infoblox, the situation was similar. Gupta noted that some of the problems his company was trying to solve require network flow information, which Kentik provides.

“We have a lot of common customers, and they were like, ‘Can you bring these platforms together?’” Gupta said.

What the integration will enable

The combination of the two companies’ technologies will bring more capabilities to users.

One specific example cited by Gupta has to do with the company’s Infoblox IQ, an agentic operations layer that was announced in June 2026, One of its existing capabilities, called IQ Actions, is designed to detect problems and begin investigating them automatically, before a customer notices an issue.

The system monitors DNS and DHCP metrics for anomalies, then automatically collects related data and analyzes it using large language models before an operator opens the ticket.

“We throw that data into LLMs and see if they can figure out what the root cause is, and come up with a recommendation, so all of that happens completely automatically,” Gupta said.

What Kentik would add to that workflow is flow data. Combining Infoblox’s DNS-based threat intelligence with Kentik’s flow data could extend the same kind of automatic investigation into security incidents. DNS data can identify devices communicating with a command and control server. Flow data can then show where those devices connected next inside the network.

“With flow data, we can draw that blast radius and tell customers proactively what the issue is and what the exposure is,” Gupta said.

Kentik’s own AI Advisor is moving in a similar direction, from answering direct questions to carrying out tasks on its own. The combination with DDI information will help to support that vision.

“What we’ve been working on is making it proactive, so basically operating Kentik for you, doing your networking tasks, all your planning, capacity optimization, troubleshooting,” Freedman said. 

Freedman traced that same logic back to why the deal made sense in the first place.

“We can actually build an amazing platform together, which customers are actually asking for, which is always the best way to build a business,” he said.

The strangest thing about cloud strategy is how confident it looks in PowerPoint and how nervous it feels in real life.

I’ve sat in rooms where the cloud slide looked clean enough to frame. Public cloud here. Private cloud there. Hybrid for the awkward middle child. Multi-cloud for resilience, bargaining power and the faint hope that no single vendor would ever own our sleep.

Then AI arrived.

At first, it looked like another conversation about workload. Bigger compute. More storage. Faster experiments. Some awkward cost questions. Nothing we couldn’t absorb with a thicker roadmap.

Then the bills landed. The data moved in odd ways. Teams built things before governance could find its shoes. Vendors became more central than anyone had admitted.

The old cloud strategy didn’t collapse. It blushed. AI exposed the assumptions beneath it.

Now, quantum changes something deeper. It asks whether the decisions behind the workload can survive time, secrecy, suppliers, weak evidence and uncertainty.

That’s a much less comfortable meeting.

Cloud strategy was built for workloads we thought we understood

For years, cloud strategy was a sensible debate about location, cost, control and speed. Public cloud for scale. Private cloud for sensitive workloads. Hybrid cloud for compromise. Multi-cloud for resilience, negotiation or, if we’re being honest, organizational politics with a nice diagram.

The logic was sound. Move faster. Cut heavy infrastructure spend. Improve recovery. Give developers what they need before they grow old waiting for a server. It worked because the work behaved in familiar ways. Systems had owners. Costs had patterns. Data had borders, or at least we pretended it did.

The question was simple: Where should this workload live? That question still matters. But it no longer carries enough weight.

AI changed that. AI changed the pattern, not just the platform AI didn’t politely join the cloud strategy. It wandered through the house, opened every cupboard and asked why the plumbing sounded tired.

The first shock was demand.

Traditional systems consume resources in ways you can usually model. AI workloads behave differently. Training, testing, inference and data processing can spike, pause, restart and spread before anyone has agreed on who owns the meter.

Cloud cost control used to ask a billing question, “How much will we use?” AI asks an operating question: “Who is allowed to create demand, at what scale, for what purpose and with whose approval?”

The second shock was data.

AI does more than store data. It chews it, reshapes it, remembers parts of it, produces new versions of it and leaves traces in places people forget to check. Prompts, logs, embeddings, model outputs, copied files and forgotten notebooks can become quiet risk pockets.

A cloud strategy that only asks where data sits misses how data behaves.

The third shock was supplier dependency.

Many firms thought they had a cloud strategy. AI revealed they had a supplier dependency strategy wearing a cloud badge. GPUs, model platforms, managed services, specialist APIs and third-party tools became central to delivery.

AI compressed the distance between idea and exposure. A team could test, connect and release faster than governance could form a working group. I say that with affection. I’ve seen working groups age in dog years.

Cloud strategy had become a test of decision speed, risk appetite, financial discipline and data control. It now goes beyond architecture.

Then quantum changed the clock.

Quantum changes the time horizon

Quantum risk often gets dumped into the cryptography drawer. That is understandable. It is also dangerous.

The leadership issue adds time to the future of quantum computers.

Some data stolen today may still matter years from now. Some secrets age badly. Trade secrets, legal records, health data, source code, identity data and sensitive contracts don’t all expire at the same speed. Some decay like fruit. Some sit like plutonium.

That is why “harvest now, decrypt later” matters. An attacker may collect encrypted data today and wait for better tools tomorrow. You don’t need to panic. You do need to ask which data has a long secrecy life.

If your most sensitive long-lived data spans cloud platforms, SaaS services, backups, archives, collaboration tools and supplier systems, where exactly is your quantum exposure? Which encryption protects it? Who manages the keys? Which supplier has a plan? Which one has a brochure?

A brochure is a scented candle for anxious executives.

Migration also takes time. Cryptography hides everywhere. In applications. In identity systems. In network devices. In APIs. In firmware. In backup tools. In old systems, nobody wants to touch.

Quantum readiness goes beyond a weekend patch. It is discovery, classification, design, testing, contracts, funding, sequencing and proof.

The risky sentence is, “We’ll revisit this when things become clearer.”

By then, the cheap decisions may have left the building.

The real issue is decision infrastructure

AI exposed assumptions about speed, cost, data and suppliers. Quantum exposes timing, ownership, evidence and memory. Together, they point to a quieter weakness: decision infrastructure.

By decision infrastructure, I mean the system by which leaders frame risk, assign ownership, make trade-offs, record choices, track evidence and revisit assumptions when facts change. That sounds dull. Good. Dull is where serious governance lives. The glamorous stuff gets applause. The dull stuff prevents regret.

Many organizations saw the risk and still failed because too many people saw different pieces of it, and nobody owned the decision. The cloud team sees architecture. Security sees exposure. Legal sees liability. Procurement sees contract gaps. Finance sees cost drift.

The board sees amber. Amber is often where hard decisions go to nap.

This is why AI and quantum belong in the same leadership conversation. AI asks whether your cloud strategy can keep pace. Quantum asks whether it can cope with time. Both punish vague ownership.

Who owns long-term cryptographic exposure? Who can force a supplier conversation? Who accepts residual risk if migration cannot happen fast enough? Who records why a decision was made and when it must be reviewed?

Suppose those questions feel awkward, good. Awkward questions earn their rent.

The questions leaders should ask now

The board needs better questions.

Start with exposure. What protects your most sensitive systems and data? Where do you rely on supplier-managed encryption? Which systems are old, critical, poorly documented and painful to change?

Exposure is a map of assets, data, dependencies and time.

Then ask about ownership. Who owns quantum readiness across cloud, cyber, legal, procurement, privacy, resilience and the business? Who can make trade-off decisions when risk reduction competes with cost and delivery? Which risks are stuck because everyone is involved and nobody is accountable?

Awareness without ownership is just anxiety with better stationery.

Then ask about evidence. Can you show progress by system, supplier, business service and data class? Would your evidence survive a board review, a regulator’s questioning or a post-incident investigation?

Evidence built under pressure is expensive. It is also sweaty. Build the proof trail before the room gets hot.

Finally, ask about timing. Which choices must be made now because migration will take years? What event would trigger faster action? When will the board revisit the risk?

Which delay would you regret if the timeline moves faster than expected?

That last question matters. Regret is often the most honest risk metric in the room.

What a quantum-aware cloud strategy looks like

A quantum-aware cloud strategy is not a glossy side document owned by three cryptographers and a nervous intern.

It is a cloud strategy with better questions built into it:

1. Build cryptographic visibility. Start with the services that matter most. Find the encryption, certificates, protocols, keys, libraries and suppliers that protect them. Perfection can wait. Blindness cannot.
2. Classify data by secrecy life. Not just sensitivity. Time. How long must this information stay protected? A short-lived report and a long-life trade secret do not belong in the same queue.
3. Press suppliers for evidence. Ask what they are doing, what you must do and how they will prove progress. Confidence is lovely. Evidence pays the rent.
4. Rank migration by risk. Start where business value, long-life data, weak visibility and migration pain meet. Treating everything as equal is how serious work becomes theatre.
5. Change board reporting. Don’t report quantum as a foggy science project. Report decisions required, risks accepted, blockers, supplier gaps and review dates. Boards govern choices. Give them choices.
6. Build a review rhythm. Standards, tools, suppliers, threats and regulations will continue to evolve. A stale roadmap is just a risk register wearing a lab coat.

No panic. Panic burns energy and produces bad slides. The aim is readiness with owners, evidence and judgment.

The cloud question grew up

Cloud strategy began as an architecture question.

AI turned it into an operating question. Quantum turns it into a leadership question.

That is the shift.

To handle this well, organizations will need to build decision muscle early. They will know what matters, who owns it, what evidence exists, which suppliers are ready and when the next decision must be made.

But beneath cloud, AI and quantum sits the discipline leaders often avoid until pressure arrives, wearing a suit: decision quality.

AI changed the cloud bill. Quantum changes the clock.

And the clock is where risk hides.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

La multinacional farmacéutica danesa Novo Nordisk está muy interesada en acelerar el tiempo que se tarda en lanzar medicamentos al mercado a medida que expiran las patentes. “Si tienes un medicamento superventas, un retraso de una semana puede suponer entre 10 y 100 millones de dólares”, afirma Stephanie Bova, responsable de transformación digital de la empresa. “Es una cantidad enorme, porque dispones de menos tiempo de protección mediante patente”.

La IA generativa ofrecía la posibilidad de acelerar drásticamente múltiples etapas del proceso de desarrollo de medicamentos. Y, dado que Novo Nordisk ya llevaba un seguimiento minucioso de la duración de sus procesos clave, contaba con una ventaja de la que carecían muchas otras empresas. Por lo tanto, debería haber sido relativamente sencillo incorporar un poco de IA generativa, ver cómo mejoraba la productividad y observar cómo llegaban los beneficios. Pero no fue tan fácil. El proceso de desarrollo de un fármaco consta de muchas partes, que tienen lugar en distintos momentos y en distintos departamentos. “Las personas son expertas en sus propios ámbitos, pero no necesariamente conocen el siguiente ámbito ni cómo encaja todo. El sistema es tan grande y complejo que no se puede ver todo el rendimiento de una sola vez”, afirma Bova.

Es posible que la documentación de los procesos no se corresponda con lo que la gente hace realmente en la práctica, y que diferentes personas realicen la misma tarea de formas distintas. Además, algunas tareas cruciales pueden pasar prácticamente desapercibidas desde fuera. El equipo de fabricación, por ejemplo, puede formar parte de un grupo completamente diferente y no ser consciente de que el medicamento se está preparando para su presentación ante la FDA (la agencia gubernamental estadounidense del medicamento), y que aún no tiene toda la documentación lista. “Así que has avanzado muy rápido solo para tener que esperar a que ellos te alcancen”, añade Bova.

Este es solo uno de los muchos retos a los que se enfrentan las empresas al intentar medir los resultados de los proyectos de IA, y la razón por la que las encuestas son tan contradictorias.

Si nos fijamos en las tareas individuales, Novo Nordisk puede demostrar mejoras en la productividad y claros beneficios positivos derivados del uso de la IA. Pero si damos un paso atrás y analizamos los resultados financieros de la empresa, el panorama se vuelve más confuso. En primer lugar, si se omiten pasos críticos, el tiempo de comercialización no mejorará. Además, un nuevo medicamento tarda años en llegar a los clientes, por lo que los efectos positivos en los resultados no se notarán hasta pasado un tiempo. Y eso es solo el principio del problema que plantea la medición del retorno de la inversión.

Medición de procesos

Para abordar los puntos ciegos de sus procesos, Novo Nordisk recurrió a la nueva generación de minería de procesos: gemelos digitales de las operaciones en tiempo real impulsados por IA. “Nos asociamos con la empresa de inteligencia de procesos Celonis para obtener un gemelo digital de nuestros datos de procesos. Fuimos los primeros del sector en aplicarlo al ámbito clínico”, explica Bova. La herramienta recopila información de los sistemas de la empresa para hacer un seguimiento de lo que los empleados hacen realmente, en lugar de utilizar encuestas para recabar información sobre lo que una parte de los empleados recordaba haber hecho en algún momento.

El primer proyecto consistió en un proceso sencillo de siete pasos y, al crear un gemelo digital del mismo, Novo Nordisk descubrió que, dependiendo de quién lo llevara a cabo, podía tratarse de un proceso de cinco o de nueve pasos. “Si reúnes a diez expertos en la materia en una sala, obtienes todo tipo de interpretaciones y, con el tiempo, se producen desviaciones”, cuenta.

El proyecto puso de manifiesto múltiples fallos en los procesos existentes. En algunos casos, fue necesario volver a formar a los empleados. En uno de ellos, hubo que actualizar la interfaz de usuario. Sin embargo, una vez que se estandariza un proceso, surge la oportunidad de tomar una “fotografía” de la situación anterior, de modo que haya algo con lo que comparar posteriormente y comprobar si la mejora mediante IA o la automatización arrojan algún resultado.

Otra cuestión que tuvieron que resolver de antemano fue decidir qué hacer con el tiempo ahorrado que se generara. “No quieres despedir a nadie”, afirma Bova. “Se trata de personal altamente cualificado y difícil de encontrar. Quizá deberíamos plantearnos redistribuir un poco los equipos”.

En la actualidad, la empresa cuenta con varios cientos de agentes de IA en funcionamiento, etiquetados dentro de la infraestructura del gemelo digital para poder identificarlos. “Si algo falla, sabemos exactamente dónde solucionarlo”, dice, y añade que la siguiente fase es la coordinación entre múltiples agentes. “Hoy en día, los tenemos conectados, pero no contamos con ‘agentes de agentes”.

Aún es demasiado pronto para saber si hay retorno de la inversión, ya que, en el desarrollo de fármacos, el proceso lleva años. “Pero, al analizar el proceso de principio a fin, espero que podamos recortar dos años del ciclo de desarrollo. Dos años menos hasta la comercialización, en comparación con la situación actual”»”, indica.

Los medicamentos que ya se encuentran en la fase final de desarrollo no experimentarán una aceleración tan notable, pero los que acaban de iniciarse serán los que más se beneficien. Sin embargo, los resultados finales no se verán hasta dentro de varios años.

La industria farmacéutica no es la única en la que el verdadero valor proviene de la optimización simultánea de múltiples procesos interconectados. Según PwC, los proyectos tácticos de IA a menudo no aportan un valor cuantificable, y los beneficios tangibles provienen de implementaciones a escala empresarial coherentes con la estrategia de negocio.

De hecho, muchas empresas no han experimentado ni un aumento de los ingresos ni una reducción de los costes gracias a la IA en los últimos 12 meses, a pesar de su adopción casi universal. Aun así, el gasto empresarial en IA se prevé que casi se duplique a finales de año en comparación con el año pasado, según KPMG.

Medición de la productividad

La mayoría de las empresas empiezan a pequeña escala, implantando chatbots de IA para los empleados con el fin de ayudar a mejorar la productividad. Y el ritmo de adopción en este ámbito ha sido asombrosamente alto, solo equiparado por la incapacidad de medir las ganancias de productividad que se supone que se deben alcanzar.

Disponer de una referencia es clave, afirma Anand Rao, profesor de IA en la Universidad Carnegie Mellon, de Estados Unidos, pero en algunos casos resulta difícil de medir y, en otros, es prácticamente imposible. Tomemos, por ejemplo, las decisiones relacionadas con los seguros, en las que los resultados pueden tardar años en hacerse evidentes. En el caso de los seguros de vida, podrían ser décadas, afirma. Y para algunos tipos de decisiones, las empresas no disponen de ningún tipo de indicador.

“Existe un estigma social a la hora de decir que estoy tratando de analizar tu proceso de toma de decisiones y lo bien que las estás tomando. Como seres humanos, no nos gusta que se evalúen nuestras decisiones”, señala. Luego, cuando una decisión sale bien al final, la gente se atribuye encantada el mérito. “Si la decisión sale mal, se achaca a factores externos”.

Pero incluso en el caso de tareas específicas en las que es posible realizar mediciones, las empresas a menudo no se esfuerzan por llevarlas a cabo antes de implementar herramientas de IA. “No partimos de una referencia”, apunta Julie Averill, antigua vicepresidenta ejecutiva y directora de sistemas de información global de la cadena de moda Lululemon. Averill es ahora directora general de Gold Thread, una consultora de transformación digital. “Partimos de la suposición de que la IA iba a ayudar a la gente a tomar mejores decisiones. Y eso te lleva a no poder medir bien los resultados”, explica.

Existen métricas alternativas que una empresa puede tener en cuenta en su lugar, añade, como las tasas de uso o la satisfacción de los usuarios. “Esto está ocurriendo y está aportando beneficios, algunos de los cuales se pueden ver y otros no. Hay que confiar en el proceso. Es igual que con la nube. Sabes que es el camino del futuro y puedes ver las ventajas, pero es difícil llegar hasta allí, y se requieren muchos cambios. Pero cuanto antes lo hagas, antes te habrás adaptado a la nueva forma de operar y podrás sacarle realmente partido”.

Hay otras áreas en las que es más fácil disponer de métricas concretas, como el servicio de atención al cliente. “Se trata de tareas repetitivas y suele ser el primer ámbito que las empresas automatizan con IA. Hay resultados muy tangibles que se pueden medir y se puede establecer una referencia muy sólida”, explica Averill.

Lululemon también lleva años utilizando la IA para mejorar la personalización y las recomendaciones, y esa es otra área que se puede cuantificar. Además, la automatización puede reducir la introducción manual de datos, lo que disminuye las tasas de error. La IA también se puede utilizar para ayudar en la supervisión del cumplimiento normativo, la detección de fraudes y el mantenimiento predictivo de los equipos, todos ellos casos de uso que se pueden cuantificar.

¿Pero la productividad de los empleados en general? Eso es difícil de medir, y no solo para Lululemon. Una forma obvia podría ser analizar los despidos en profesiones expuestas a la IA. Al fin y al cabo, los titulares están por todas partes. Pero en un informe publicado en marzo, Anthropic no encontró indicios de un aumento del desempleo en las profesiones altamente expuestas, aquellas en las que las personas tienen más probabilidades de ser despedidas debido a la IA.

A principios de 2025, la empresa de investigación METR intentó cuantificar la productividad de los desarrolladores comparando la rapidez con la que los desarrolladores experimentados eran capaces de realizar tareas con IA y sin ella. ¿El resultado? Los desarrolladores afirmaron que esperaban que la IA les permitiera trabajar un 24% más rápido y estimaron que, en realidad, la IA les había permitido hacerlo un 20 % más rápido. Pero los datos revelaron una realidad totalmente diferente. El uso de la IA, en realidad, les ralentizó un 19%.

Por supuesto, las herramientas de IA están mejorando. METR intentó realizar un estudio de seguimiento, comparando de nuevo las tareas realizadas con y sin IA, pero no pudo encontrar suficientes desarrolladores dispuestos a volver al enfoque sin IA, a pesar de que los investigadores les pagaban por participar en el estudio.

Existen casos anecdóticos de empresas en las que un solo ingeniero realiza el trabajo de cien gracias al uso de la IA. O aquella vez en que se filtró accidentalmente todo el código fuente de Claude Code, de medio millón de líneas, y el desarrollador coreano Sigrid Jin creó una reconstrucción desde cero en dos horas, que luego subió a GitHub, donde se convirtió en el proyecto más rápido de la historia en alcanzar las 100.000 estrellas.

Pero, como ocurre con cualquier otro tema relacionado con la IA, la realidad es más compleja. En el caso concreto del desarrollo de software, escribir el código es, en realidad, solo una pequeña parte de lo que implica desarrollar software.

La consultora DX analizó recientemente métricas clave de ingeniería de 400 empresas y, en un informe reciente, constató que el uso de la IA había aumentado un 65% desde noviembre de 2024, pero que la productividad relacionada con la IA se situaba justo por debajo del 10%.

Costes ocultos

Al igual que resulta difícil medir los beneficios de la IA en términos de productividad, también puede resultar complicado cuantificar los costes. Cuando una empresa empieza a utilizar la IA, los costes pueden ser relativamente fáciles de estimar. ¿A cuánto ascienden las cuotas mensuales totales de suscripción a los chatbots de IA que utilizan los empleados? ¿Cuál es el coste de entrenar o ajustar un modelo personalizado? Pero cuando se pasa a casos de uso más complejos, los cálculos se vuelven más difíciles, afirma Averill. “Ahora existen todos los sistemas relacionados con la IA. Esos son más difíciles de cuantificar, pero su impacto es mayor”, dice.

Por ejemplo, si la IA se integra en los procesos empresariales mediante RAG, existe el gasto continuo de las llamadas a la API, pero también los cambios que hay que realizar en otros sistemas, explica. Y la cosa se complica cada día más. “No hemos realizado un esfuerzo muy concertado para implantar la telemetría y la instrumentación”, afirma Swaminathan Chandrasekaran, director global de IA y laboratorios de datos en KPMG. Según él, obtener una visión global de los costes totales de la IA en una empresa es como predecir el tiempo.

“La razón por la que contamos con un sistema de predicción meteorológica tan impresionante en este país es que disponemos de decenas de miles de estaciones meteorológicas que recopilan datos”, explica. “Sin eso, no sabríamos qué tiempo va a hacer”.

Las empresas deben implantar sistemas de medición para evaluar todos los aspectos del consumo relacionado con la IA, señala, empezando por el número de tokens utilizados, quién los utiliza y cómo se correlaciona esto con el rendimiento laboral. “Esa medición brilla por su ausencia”, afirma.

Al menos cuando los humanos utilizan chatbots de IA, hay un límite en el número de preguntas que son físicamente capaces de formular, además de unos costes de suscripción predecibles. Y cuando los procesos empresariales se habilitan con IA a través de RAG, las llamadas a la API de los modelos de lenguaje grandes (LLM) las realizan sistemas empresariales predecibles y programados de forma tradicional.

Pero ahora, la IA agentiva está empeorando aún más las cosas, ya que los agentes pueden actuar de forma impredecible y el número de llamadas a la API puede dispararse rápidamente fuera de control. En un informe del Boston Consulting Group, dos tercios de las empresas señalan gastos de escalado de la IA incontrolables.

Otro coste que algunas empresas quizá no prevean bien, o que no controlen porque forma parte de un presupuesto diferente, es el relacionado con los datos. Ya sea preparando datos para el entrenamiento o el ajuste fino, utilizando incrustaciones de RAG o configurando el acceso directo a MCP a través de agentes, estos costes pueden acumularse rápidamente cuando entra en escena la IA.

“Las tarifas de salida son uno de los gastos más importantes”, afirma Tom Coughlin, miembro del IEEE y presidente de la consultora Coughlin Associates. “Si tienes que sacar datos de la nube, esas tarifas de salida podrían ser considerables”. Además, están todos los costes de personal que conlleva la implementación de la IA, añade.

“A largo plazo, la IA aportará un gran valor a las personas, pero estas deben saber cómo utilizarla correctamente. Si no cuentan con esas habilidades, se encontrarán en desventaja”, expone.

Soluciones y mensajes contradictorios

Luego está la cuestión de resolver los problemas. La mayoría de las empresas han sufrido al menos un incidente relacionado con la IA en los últimos 18 meses, y la mayoría de ellos han supuesto pérdidas económicas, algunas de más de 500.000 dólares. Además, está la IA que se está integrando en todo.

“Conocemos nuestros costes directos”, afirma Andrew Johnson, director de sistemas de información (CIO) de Brownstein Hyatt Farber Schreck, un bufete de abogados estadounidense. “Pero donde resulta más difícil de cuantificar es con las plataformas que ya tenemos implantadas y las aplicaciones SaaS que no contaban con capacidades de IA. Nos piden aumentos extraordinarios y los atribuyen a las nuevas capacidades que aporta la IA. ¿Cuánto se le debe atribuir a la IA? Eso es un poco difuso”, relata.

Incluso cuando la IA permite ahorrar dinero, a menudo hay costes adicionales asociados a ello. Por ejemplo, el bufete gastaba unos 70.000 dólares al año en una plataforma de gestión de contratos. Desarrollar su propia versión con IA supuso unos 40.000 dólares en costes de mano de obra y otros 3.000 dólares al año en alojamiento. El mantenimiento continuo será mínimo para esa aplicación en concreto, añade, lo que supondrá un total de otros dos mil dólares al año.

Pero también hay otros costes indirectos asociados al funcionamiento de las aplicaciones propias, como las auditorías de seguridad, las evaluaciones de vulnerabilidad, las pruebas de penetración y la revisión del código. “Cuanto más compleja y arriesgada es la plataforma, menor es el interés por intentar crear una solución interna”, indica.

Aun así, el equipo de desarrollo de software es ahora mucho más productivo gracias a la IA, ya que cuatro o cinco desarrolladores son capaces de hacer el trabajo de 20 o 30. Pero las mejoras en la productividad no se traducen en un ahorro de mano de obra, ya que los desarrolladores tienen mucho trabajo nuevo que hacer. “Tenemos una enorme lista de oportunidades pendientes para desarrollar soluciones”, afirma.

La tendencia del trabajo a expandirse para ocupar todo el tiempo disponible no se da solo en el desarrollo de software, señala Rao, de Carnegie Mellon. Supongamos, por ejemplo, que se espera que la IA suponga una mejora del 20% en la productividad, explica. “Antes había cien personas haciendo ese trabajo, y ahora solo necesitamos 80. Pero, al final del año, la plantilla no ha cambiado. «En las tareas que realizaban, hay una mejora, añade, “pero las personas añadirán tareas para suplir o complementar ese 20%. No es que se vayan a casa una hora antes, sino que están encontrando otras actividades que generan valor”.

De hecho, en algunos casos, el aumento de la productividad en una empresa puede llegar a perjudicar los resultados. Los abogados, por ejemplo, cobran por horas. “La eficiencia va en contra de nuestras formas tradicionales de ganar dinero”, afirma Johnson, de Brownstein. “Tenemos que pensar más allá de eso. No es perjudicial para nuestros intereses a largo plazo, pero supone un reto a corto plazo. Sin embargo, si no lo hacemos, es probable que no seamos competitivos a medio y largo plazo”.

Así pues, si una nueva herramienta de IA ayuda a un abogado en la diligencia debida, no existe una relación directa entre la inversión en esa herramienta y el aumento de los ingresos. “Es un hecho que la dirección es la correcta”, afirma Johnson. “Pero no podemos afirmar que vaya a generar un rendimiento concreto”.

Danish multinational pharmaceutical Novo Nordisk is very interested in speeding up the time it takes to get drugs to market as patents expire. “If you have a blockbuster drug, a one-week delay can be $10 to $100 million,” says Stephanie Bova, the company’s digital transformation officer. “It’s massive money because you have less time on patent.”

Gen AI offered the possibility of dramatically speeding up multiple steps in the drug development process. And since Novo Nordisk was already carefully tracking how long its key processes took, it had an advantage that many companies didn’t. So it should’ve been relatively simple to sprinkle in some gen AI, see productivity improve, and watch the money roll in. But it wasn’t that easy. A drug development process has many parts, happening at different times in different departments.

“People are experts in their own domains but don’t necessarily know the next domain and how it all fits together,” Bova says. “The system is so big and complex that you’re not able to see all the performance at once.”

Process documentation might not match what people actually do in practice, and different people might do the same task in different ways. And some crucial tasks might be nearly invisible from the outside. The manufacturing team, for example, might sit in a completely different group and not be aware the drug is getting ready for FDA submission, and don’t have all their documents ready yet.

“So you’ve run very fast only to have to wait for them to catch up,” Bova adds.

This is just one of many challenges companies face when trying to measure the results of AI projects, and why surveys are so contradictory.

Looking at individual tasks, Novo Nordisk can show productivity improvements and clear positive benefits to its use of AI. But stepping back and looking at the company’s bottom line, the picture gets murkier. First, if critical steps are missed, then time to market won’t improve. It also takes years for a new drug to get to customers, so any positive bottom-line effects won’t be felt for a while. And that’s just the start of the ROI measurement problem.

Process measurement

To address its process blind spots, Novo Nordisk turned to the new generation of process mining: AI-powered real-time digital twins of operations.

“We partnered with process intelligence company Celonis to get a digital twin of our process data,” Bova says. “We were the first in the industry to apply it to the clinical setting.” The tool collects information from enterprise systems to track what employees actually do, rather than using surveys to collect information on what a fraction of employees remembered doing at some point.

The first project was a simple, seven-step process, and in creating a digital twin of it, Novo Nordisk discovered that, depending on who was doing it, it could be a five- or nine-step process. “If you get 10 different subject matter experts in a room, you get all kinds of interpretations, and you have drift over time,” she says.

The project exposed multiple flaws in existing processes. In some cases, employees needed to be retrained. In one, the user interface had to be updated. Once a process is standardized, though, there’s an opportunity to take the before picture, so there’s something to compare to afterward, to see if the AI augmentation or automation show any results.

Another thing they had to figure out ahead of time was decide what to do with any time savings that showed up.

“You don’t want to lay people off,” Bova says. “These are highly technical, hard-to-find talent. Maybe we want to think about redistributing teams a bit.”

Today, the company has several hundred AI agents in active deployment, tagged inside the digital twin infrastructure so they can be identified.

“If something screws up, we know exactly where to fix it,” she says, adding that the next phase is multi-agent orchestration. “Today, we have them connected, but we don’t have agents of agents.”

It’s too early to say if there’s ROI yet because, for drug development, the process takes years. “But by looking at the end-to-end process, my hope is we’ll find two years of cycle time to engineer out,” she says. “Two years quicker to market, compared to where we are now.”

Drugs that are already in the final phase of development won’t see as much acceleration, but those just starting out will benefit the most. The bottom line results, however, won’t show up for several years.

The pharmaceutical industry isn’t the only one where true value comes from optimizing multiple interconnected processes at once. According to PwC, tactical AI projects often don’t deliver measurable value, with tangible returns coming from enterprise-scale deployments consistent with business strategy.

In fact, many companies have seen neither increased revenue nor decreased costs from AI in the last 12 months despite nearly universal adoption of AI. Still, enterprise spending on AI is set to nearly double by the end of the year compared to last year, according to KPMG.

Productivity measurement

Most companies start on a smaller scale, rolling out AI chatbots to employees to help improve productivity. And the pace of adoption here has been staggeringly high, matched only by a lack of ability to measure the productivity gains that are supposed to be achieved.

Having a baseline is key, says Anand Rao, professor of AI at Carnegie Mellon University, but it’s difficult to measure in some cases, and all but impossible in others. Take for example insurance decisions where results can take years to show up. With life insurance, it could be decades, he says. And for some types of decisions, companies don’t have any measurements at all.

“There’s a social stigma to saying that I’m trying to look at your decision-making and how well you’re making the decisions,” he says. “As humans, we don’t like to be measured for our decisions.”

Then, when a decision turns out well in the end, people are happy to take credit. “If the decision goes badly, it’s something outside,” he says.

But even for specific tasks where measurement is possible, companies often don’t put in the work to make the measurements prior to rolling out AI tools. “We didn’t start with a baseline,” says Julie Averill, former EVP and global CIO of fashion retailer Lululemon. Averill is now CEO at Gold Thread, a digital transformation consultancy.

“We started with the assumption that AI was going to help people make better decisions,” she says. “And that sets you up to not being able to measure well.”

There are alternative metrics that a company can look at instead, she adds, like usage rates or user satisfaction. “This is happening, and it’s bringing benefits,” she says, “some of which you can see, and some you can’t. You have to trust the process. It’s just like the cloud. You know it’s the way of the future and you can see the benefits, but it’s hard to get there, and there’s a lot of change required. But the sooner you do that, the sooner you’re in the new way of operating and can really take advantage of it.”

There are other areas where hard metrics are more readily available, like customer service. “These are repeatable tasks, and it’s usually the first place companies automate with AI,” Averill says. “There are very tangible results you can measure, and you can have a very good baseline.”

Lululemon has also been using AI for years for better personalization and recommendations, and that’s also an area that can be quantified. And automation can reduce manual data entry, reducing error rates. AI can also be used to help with compliance monitoring, fraud detection, and predictive maintenance for equipment, which are all use cases that can be quantified.

But employee productivity in general? That’s a tough one to measure, and not just for Lululemon. One obvious way might be to look at layoffs in professions exposed to AI. After all, the headlines are everywhere. But in a report released in March, Anthropic found no signs of an increase in unemployment in highly exposed professions, those in which people are most likely to be laid off due to AI.

In early 2025, research firm METR attempted to quantify developer productivity by comparing how fast experienced developers were able to achieve tasks with AI and without. The result? Developers said they were expecting AI to speed them up by 24%, and estimated that AI had actually sped them up by 20%. But the data showed an altogether different story. Their use of AI actually slowed them down by 19%.

Of course, AI tools are getting better. METR attempted to do a follow-up study, again tracking tasks done with and without AI, but they couldn’t find enough developers willing to go back to the no-AI approach, even though the researchers were paying them to participate in the study.

There are anecdotal reports of companies where one engineer does the work of a hundred by using AI. Or that time the entire half-million-line Claude Code codebase was accidentally leaked and Korean developer Sigrid Jin created a clean-room rebuild in two hours, which he then pushed to GitHub, where it became the fastest project in history to hit 100,000 stars.

But as with anything else having to do with AI, the real picture is more complicated. With software development in particular, typing the code is actually just a fraction of what’s involved in developing software.

Research firm DX recently analyzed key engineering metrics from 400 companies, and in a recent report found that AI usage increased by 65% since November 2024, but AI-related productivity was just under 10%.

Hidden costs

Just as it’s difficult to measure the productivity benefits of AI, it can also be tricky to measure the costs. When a company first starts using AI, costs might be relatively simple to estimate. What’s the total monthly subscription charges for the AI chatbots that employees are using? What’s the cost of training or fine-tuning a custom model? But when you move on to more complex use cases, the calculations get more difficult, says Averill.

“Now there are all the systems around the AI,” she says. “Those are harder to measure, but the impact is bigger.”

For example, if AI is embedded into business processes using RAG, there’s the ongoing expense of the API calls, but also the changes that need to be made to other systems, she says. And it just keeps getting more complicated every day.

“We haven’t taken a very concerted effort to putting telemetry and instrumentation in place,” says Swaminathan Chandrasekaran, global head of AI and data labs at KPMG. He says that getting a comprehensive picture of the total costs of AI in an enterprise is like predicting the weather.

“The reason we have a pretty awesome weather prediction system in this country is because we have tens of thousands of weather stations that aggregate data,” he says. “Without that, we wouldn’t know the weather.”

Companies need to set up instrumentation to measure all the aspects of AI-related consumption, he says, starting with the number of tokens used, who’s using them, and how it correlates to work output.

“That measurement is fundamentally lacking,” he says.

At least when humans are using AI chatbots, there’s a limit to how many questions they’re physically able to ask, combined with predictable subscription costs. And when business processes are AI-enabled via RAG, the API calls to LLMs are being made by predictable, traditionally-scripted business systems.

But now, agentic AI is making everything worse because the agents can act unpredictably, and the number of API calls can quickly spiral out of control. In a report by the Boston Consulting Group, two-thirds of companies are reporting uncontrollable AI scaling expenses.

Another cost some companies might not anticipate well, or not track because it’s part of a different budget, is data-related cost. Whether preparing data for training or fine-tuning, using RAG embeddings, or setting up direct MCP access via agents, these costs can quickly add up when AI comes into the picture.

“Egress fees are one of the big ones,” says Tom Coughlin, IEEE fellow and president of consulting firm Coughlin Associates. “If you have to bring data out of the cloud, those egress fees could be considerable.”

Then there are all the human costs of deploying AI, he adds.

“There’ll be a lot of value that people get out of AI in the long run, but they need to know how to use it properly,” he says. “If they don’t have those skills, you’ll be at a disadvantage.”

Solutions and mixed messages

Then there’s fixing problems. A majority of companies have had at least one AI-related incident in the last 18 months, with most resulting in financial loss, some over $500,000. Then there’s the AI that’s being embedded in everything.

“We know our direct costs,” says Andrew Johnson, CIO at Brownstein Hyatt Farber Schreck, a leading national law firm. “But where it becomes more difficult to measure is with platforms we already have in place, and SaaS applications that didn’t have AI capabilities,” he says. “They’re asking for extraordinary increases and attribute them to new capabilities due to AI. How much should be ascribed to AI? That’s a little wishy-washy.”

Even when AI saves money, there are often extra costs associated with that. For example, the firm was spending about $70,000 a year on a contract management platform. Building their own version with AI took about $40,000 in labor costs and another $3,000 a year for hosting. Ongoing maintenance will be minor for that particular application, he adds, totaling another couple of thousand a year.

But there are also other indirect costs that come with running your own applications, including security audits, vulnerability assessments, penetration tests, and code review.

“The more complex and riskier the platform, the less appetite there is for trying to create an in-house solution,” he says.

Still, the software development team is now dramatically more productive as a result of AI, with four or five developers able to do the work of 20 or 30.

But the productivity improvements don’t translate to labor savings, since there’s plenty of new work for the developers to do. “We have an enormous backlog of opportunities to develop solutions,” he says.

The tendency of work to expand to fill the time available isn’t just true for software development, says Carnegie Mellon’s Rao.

Say for example, AI is expected to lead to a 20% improvement in productivity, he says. “There were a hundred people doing it, and now we only need 80.” But at the end of the year, headcount hasn’t changed. “The tasks they were doing, there’s improvement,” he adds “But humans will add tasks to supplement or complement that 20%. It’s not that they’re going home an hour early, but they’re finding other value-generating activities.”

In fact, in some cases, increased productivity at a company can actually hurt the bottom line. Lawyers, for example, bill by the hour.

“Efficiency runs counter to our traditional ways of making money,” says Brownstein’s Johnson. “We have to think past that. It’s not detrimental to our long-term interest, but it’s a challenge in the short term. If we don’t do this, though, it’s likely we won’t be competitive in the mid- to long-term.”

So if a new AI tool helps an attorney with due diligence, there’s no straight line between the investment in that tool and increased revenues.

“It’s a given that it’s directionally right,” Johnson says. “But we can’t say it’s going to lead to a particular return.”

As a medical equipment rental company that rents, sells, and manages movable medical devices, including infusion pumps, monitors, ventilators, and incubators, USME’s mission is simple in definition, but highly sophisticated in practice.

“Our job is to deliver the right equipment to the right place at the right time,” says CIO Antonio Marin. “When you look at the community we serve, the last part of the supply chain is a patient in need. So we need to make sure all our technology, processes, and everything we do has a patient in mind. After all, they call us because they need lifesaving equipment, not because it’s a beautiful day.”

A particularly vital application of technology for Marin and his team has been directed to revamping the company’s inventory and equipment management, and field services.

“We did a lot of automation behind the scenes,” he says. “Knowing your inventory, knowing what parts you need to fix, and tracking the lifecycles of inventory is all now very automated, well managed, and fully visible across the organization. It’s about humans making critical decisions, not doing paperwork.”

But with that added efficiency comes some risk. And when lives are on the line in a highly regulated sector, vulnerabilities can surface with more tech that’s introduced. So some innovations can be more detrimental to the operations of a company or a hospital.

“We use encryption and different systems to overlay protection when it comes to personal identification data,” Marin says. “When you look at the cybersecurity chain, humans are still the weakest link.”

When talking about security, particular care needs to be taken in terms of knowing exactly where the team and equipment are at all times, and tracking performance across company and hospital staff, and hospital partners.

“As a person in IT and as an employee of the company, it’s very rewarding when we’re able to deliver lifesaving equipment so hospitals can succeed in helping patients,” he says.

Marin also discusses the importance tech and human synergy, prioritizing education in regard to cybersecurity, and the power of automating processes. Watch the full video below for more insights, and be sure to subscribe to the monthly Center Stage newsletter by clicking here.

On setting the right foundations: We’re in the middle of a major transformation. The company started with a homegrown system with phenomenal software, but as we’ve grown, it becomes more complicated to keep up with the rate of progress. So we decided to move to a SaaS platform and we have the first part of the project already complete. It’s been very successful and now we’re finishing the second part.

We can look not only at our business processes and refine them, but we think about embedding AI for faster and more accurate results. You have to have sound data and processes with AI. In one of my previous companies we used AI at the beginning when it was a buzzword and not really there. I learned a very important lesson then. You can fit the model, train it, and ask a specific question, but an unexpected answer might come back. So we went back to the old ways to analyze data and realized that the answer was right but the question was wrong.

I learned you have to be open to evaluate answers and understand where the real data is coming from, and the real sentiment on the data — the context of the information you’re working with.

On human involvement: There always has to be a human in the loop. That doesn’t mean we can’t speed the process for that human. There’s incredible things we’re doing today where an AI doesn’t have to be just gen AI. There are so many variances of AI and versions of what you can do with it. For instance, we’ve been able to automate the ordering process from a single click at a hospital nurse station to our branch operations where we get all the information we need to deliver lifesaving equipment.

In one hospital in particular, we delivered a full bed and mattress in less than 15 minutes. To put that in context, industry standards are normally between 12 and 24 hours. So in certain cases when we’re in proximity, we can be extremely fast because there’s no human interaction.

On AI and model training: We created a system called GoUSME Connect. It’s a combination of RPA, AI, and machine learning that can read a request generated by an electronic medical record system. So we’re agnostic of any EMR, and it reads information. And through machine learning, it reads the pattern of the request that transfers into an order, which ends up in one of our delivery locations.

That’s one part of how we can deliver equipment. We’re working hard to continue on predictive analytics and teaching the models because as a rental company, we have so much information about the true performance of medical equipment. Our goal in the next few months is to be able to predict equipment failures based on historical data.That’s the thing about medical equipment. It’s just a new computer. They have to go through preventive maintenance once a year, and every time they come back from a hospital, they go through review process.

So we always make sure equipment is patient ready. As we all know, though, equipment can fail. But if we can gather all the equipment we’ve rented in the last 23 years and start feeding those models with all that data, then we can be more predictive.

On logistics: One of the first things is to know your inventory, what equipment you have. And in the medical equipment rental business, it could be very seasonal. You have times where you have respiratory issues, then you get neonatal seasons. So what it allows us to do is look at our past rentals, and our inventory, and then start helping the equipment management team plan their production for the next month, week, or the next day. That’s a huge change in how we used to do things to what we can do now.

From the time of getting equipment prepared to being patient ready in the old days could be like getting a call, having a technician look for the piece of equipment, and then do all the necessary paperwork and testing. Every interaction was very manual. Now we know where it’s coming from and we prepare it. If parts for a piece of equipment are needed, the parts requisition is already requested. We know where those parts are in the country, and we know we need to ship them somewhere else. So the days of doing all those things that waste time are gone.

Revised transaction structure enables immediate closing, accelerating the Company’s strategic pivot toward AI data centers, enterprise GPU compute, and digital power infrastructure.

Envirotech Vehicles, Inc. (NASDAQ: EVTV) (“EVTV” or the “Company”) today announced the successful completion of its merger with Azio AI Corporation (“Azio AI”) on July 2, 2026, paving the way for the Company to transform to an AI Datacenter Provider and meeting the growing market demand for artificial intelligence (“AI”) infrastructure, enterprise GPU compute, digital power solutions, data center development, and digital asset infrastructure; a market that the International Data Corporation (IDC) projects will reach $487 billion in global spending in 2026 and exceed $1 trillion by 2029.[1] The transaction marks a defining milestone in the Company’s strategic transformation and establishes the foundation for its next phase of commercial execution and long-term growth.

The parties amended the proposed transaction structure to expedite the closing timeline, allowing the combined company to begin operating as a fully integrated public company significantly sooner than originally anticipated. The accelerated closing enables management to immediately focus on commercialization across its expanding AI Datacenter strategy.

With the merger complete and the combined company operating as one organization, management is now fully focused on commercial execution, infrastructure deployment, strategic growth initiatives, and creating long-term shareholder value.

Over the past several months, the Company advanced development activities at its South Texas site and deployed six megawatts of off-grid power for its modular data centers. The Company further secured rights to a 548-acre site with the capacity to scale up to 500 MW, supporting the future development of AI hyperscale data centers.

Management believes these achievements demonstrate that the combined company is entering its next phase with meaningful operational momentum already in place rather than beginning from a standing start. Infrastructure deployment is underway, customer commitments have already been established, commercial execution is actively progressing, and the Company’s corporate structure is now aligned with an operating platform built to support long-term expansion.

The completion of the merger comes at a time when investment in AI infrastructure continues to accelerate globally as enterprises increasingly require access to high-performance computing resources, GPU infrastructure, and scalable digital power solutions. Management believes the combined company is well positioned to capitalize on these long-term industry trends through a diversified infrastructure strategy designed to monetize power assets across multiple complementary revenue streams, including AI data centers, enterprise compute infrastructure, power hosting, and digital asset mining operations.

Following the closing of the transaction, the Company intends to continue expanding its AI Infrastructure strategy through AI data center development, enterprise GPU compute solutions, power hosting services, digital asset mining operations, strategic infrastructure investments, and additional commercial partnerships designed to maximize utilization of its power resources while creating multiple long-term revenue opportunities.

In connection with the closing of the merger, Phillip Oldridge has stepped down as Chief Executive Officer. Jason Maddox vacates the President position and is now the Chief Financial Officer. The Company’s Board of Directors appointed Simon Yu as President and Chris Young as Chief Executive Officer, effective immediately.

Mr. Yu is a serial entrepreneur and public markets operator with almost a decade of experience taking companies public, executing capital raises, and scaling businesses. He has previously served in founder, C-suite, and board roles at three publicly traded companies, two of which reached market capitalizations in excess of $1 billion. Mr. Yu has led legal, accounting, and advisory teams through Regulation A+ Tier 2 offerings, PCAOB audits, and public company reporting, alongside leading M&A transactions. As an active early-stage venture investor, he has evaluated investment opportunities across artificial intelligence, SaaS, and B2B technology.

Mr. Young brings extensive experience in launching and leading public companies and investing in and advising emerging technology companies, with a particular focus on artificial intelligence, software innovation, and strategic growth initiatives. Prior to joining EVTV, he served as Chief Executive Officer of Clubhouse Media Group, a publicly traded social media company and an Entrepreneur in Residence at Amplify, where he worked alongside founders and venture-backed technology companies to accelerate commercialization and support the development of high-growth technology businesses.

“Today’s announcement represents far more than the completion of a merger—it marks the beginning of our next chapter,” said Chris Young, Chief Executive Officer of EVTV. “Over the past several months, our teams have been building the operational foundation of this business while simultaneously working toward completing this transaction. With the merger now finalized, we move forward as one company with one leadership team and one strategy, focused on executing against the opportunities in front of us. We believe demand for AI infrastructure, enterprise compute, and digital infrastructure will continue expanding for years to come. Our objective is to build a scalable platform capable of serving that demand while creating long-term value for our shareholders.”

Jason Maddox, Chief Financial Officer of EVTV, added, “Completing this transaction under the amended merger structure allows us to immediately focus on execution. We have already established meaningful operational momentum, and we believe operating as a unified public company enhances our ability to deploy infrastructure, serve customers, pursue strategic growth opportunities, and continue building long-term shareholder value.”

The transaction establishes a unified operating platform designed to support the Company’s long-term growth strategy through continued investment in AI infrastructure, enterprise computing, digital power assets, and digital infrastructure development. Management believes the completion of the merger provides the operational and organizational foundation necessary to pursue the next phase of commercialization while expanding its presence across some of the fastest-growing sectors of the global technology market.

Transaction and Operational Highlights

• Successfully completed the merger with Azio AI pursuant to an amended and restated merger agreement.
• Approximately six megawatts of off-grid digital infrastructure deployed at the Company’s South Texas development site.
• Development footprint exceeding 548 acres with the potential to support up to 500 MW of AI infrastructure capacity.
• Combined company positioned to accelerate commercialization across AI infrastructure, enterprise GPU compute, digital power solutions, and digital asset mining operations.
• Merger consideration consisted of 2,655,157 shares of common stock and 973,450 shares of non-voting convertible preferred stock in exchange for 100% of outstanding capital stock of Azio AI, of which 194,807 shares of common stock were reserved for convertible notes of Azio AI assumed by the Company upon closing.
• Each share of preferred stock convertible into 100 shares of Company common stock subject to stockholder approval.
• Chris Young appointed Chief Executive Officer and Chairman of the Board.
• Simon Yu appointed President.
• Jason Maddox appointed Chief Financial Officer.
• Phillip Oldridge stepped down as Chief Executive Officer.

About Envirotech Vehicles, Inc.

Envirotech Vehicles, Inc. (NASDAQ: EVTV) is a technology infrastructure company focused on developing, owning, and operating artificial intelligence data centers, enterprise GPU compute infrastructure, digital power solutions, and digital asset mining operations. Following its acquisition of Azio AI, the Company operates an integrated AI infrastructure business encompassing AI data center development, the sale and distribution of enterprise GPU systems and server infrastructure, high-performance computing solutions, power hosting, and strategic technology investments, serving enterprise and institutional customers across domestic and international markets. Through this diversified AI infrastructure strategy, the Company is positioned to capitalize on the rapidly expanding global demand for AI infrastructure, compute capacity, digital power, and next-generation AI technologies.

For more information please visit: www.azioai.ai and for potential partnerships contact: AI@PhoenixMGMTconsulting.com

Forward-Looking Statements

This press release contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. In some cases, you can identify forward-looking statements by words such as “may,” “will,” “could,” “expect,” “anticipate,” “believe,” “estimate,” “project,” “intend,” “continue,” “potential,” “ongoing,” or the negative of these terms or other comparable terminology, although not all forward-looking statements contain these words. Forward-looking statements include statements regarding the Company’s ability to capitalize on accelerating demand for AI infrastructure, enterprise GPU compute, digital power solutions, data center development, and digital asset infrastructure; the Company’s plans to continue expanding its digital infrastructure platform through AI data center development, enterprise GPU compute solutions, power hosting services, digital asset mining operations, strategic infrastructure investments, and additional commercial partnerships; the Company’s ability to maximize utilization of its power resources while creating multiple long-term revenue opportunities; the ability to continue deploying modular digital infrastructure at the Company’s South Texas site; the anticipated deployment and scaling of NVIDIA B200 and B300 GPU systems; the ability to advance and execute against the Company’s commercial infrastructure pipeline; the anticipated development of the Company’s footprint; the ability to monetize power assets across multiple complementary revenue streams, including AI data centers, enterprise compute infrastructure, power hosting, and digital asset mining operations; customer demand for AI infrastructure, enterprise compute, and digital infrastructure; the Company’s ability to build a scalable platform designed to serve that demand and create long-term shareholder value; and the Company’s broader business strategy and long-term growth objectives.

These statements are based on current expectations and assumptions that involve risks and uncertainties that could cause actual results to differ materially. Most of these factors are outside the Company’s control and are difficult to predict. Factors that may affect actual results include, but are not limited to, the Company’s limited operating history within AI infrastructure and compute operations, project scope, engineering challenges, supply chain constraints, installation timelines, energy availability, finalization of site usage rights, regulatory considerations, equipment performance, ability to raise capital required for expansion activities, changes in digital asset markets, evolving compute demand, market conditions, the Company’s ability to successfully integrate the combined business following the completion of the merger, the risk that the anticipated benefits and synergies of the merger are not realized, the risk of unexpected costs, charges, or expenses resulting from or relating to the merger, potential adverse reactions or changes to business relationships resulting from the completion of the merger, risks related to the diversion of management’s attention from ongoing business operations during the post-closing integration period, the risk that required stockholder approval for the conversion of preferred stock issued in the merger as required by rules of The Nasdaq Stock Market LLC (the “Conversion Proposal”) is not obtained, and additional risks and uncertainties described in the Company’s most recent Annual Report on Form 10-K and subsequent Quarterly Reports on Form 10-Q filed with the SEC, which are available at www.sec.gov. The Company undertakes no obligation to update forward-looking statements except as required by law.

Important Information About the Merger and Where to Find it

The Company expects to file a proxy statement with the SEC relating to the Conversion Proposal. The definitive proxy statement will be sent to all Company stockholders. Before making any voting decision, investors and security-holders of the Company are urged to read the proxy statement and all other relevant documents filed or that will be filed with the SEC in connection with the Conversion Proposal as they become available because they will contain important information about the amended and restated merger agreement between the parties and the related transactions and the Conversion Proposal to be voted upon by the Company’s stockholders. Investors and security-holders will be able to obtain free copies of the proxy statement and all other relevant documents filed or that will be filed with the SEC by the Company through the website maintained by the SEC at www.sec.gov.

Participants in the Solicitation

The Company and its directors and executive officers may be considered participants in the solicitation of proxies from EVTV’s stockholders with respect to the Conversion Proposal under the rules of the SEC. Information about the directors and executive officers of EVTV is set forth in its Annual Report on Form 10-K for the year ended December 31, 2025, which was filed with the SEC on April 13, 2026, and in subsequent Quarterly Reports on Form 10-Q and other documents filed by the Company from time to time with the SEC. Additional information regarding the persons who may be deemed participants in the proxy solicitation and a description of their direct and indirect interests, by security holdings or otherwise, will also be included in the proxy statement, and other relevant materials to be filed with the SEC when they become available. You may obtain free copies of these documents as described above.

¹ Source: International Data Corporation (IDC), “AI Infrastructure Spending Caps Historic Year at ~$90 Billion in Q4 2025; 2029 Spending to Eclipse $1 Trillion,” April 16, 2026. The Company has not independently verified the data or projections contained in this report, and there can be no assurance that the projections will be realized.

Contact

Phoenix MGMT & Consulting

Press@PhoenixMGMTConsulting.com

Revised transaction structure enables immediate closing, accelerating the Company’s strategic pivot toward AI data centers, enterprise GPU compute, and digital power infrastructure.

Envirotech Vehicles, Inc. (NASDAQ: EVTV) (“EVTV” or the “Company”) today announced the successful completion of its merger with Azio AI Corporation (“Azio AI”) on July 2, 2026, paving the way for the Company to transform to an AI Datacenter Provider and meeting the growing market demand for artificial intelligence (“AI”) infrastructure, enterprise GPU compute, digital power solutions, data center development, and digital asset infrastructure; a market that the International Data Corporation (IDC) projects will reach $487 billion in global spending in 2026 and exceed $1 trillion by 2029.[1] The transaction marks a defining milestone in the Company’s strategic transformation and establishes the foundation for its next phase of commercial execution and long-term growth.

The parties amended the proposed transaction structure to expedite the closing timeline, allowing the combined company to begin operating as a fully integrated public company significantly sooner than originally anticipated. The accelerated closing enables management to immediately focus on commercialization across its expanding AI Datacenter strategy.

With the merger complete and the combined company operating as one organization, management is now fully focused on commercial execution, infrastructure deployment, strategic growth initiatives, and creating long-term shareholder value.

Over the past several months, the Company advanced development activities at its South Texas site and deployed six megawatts of off-grid power for its modular data centers. The Company further secured rights to a 548-acre site with the capacity to scale up to 500 MW, supporting the future development of AI hyperscale data centers.

Management believes these achievements demonstrate that the combined company is entering its next phase with meaningful operational momentum already in place rather than beginning from a standing start. Infrastructure deployment is underway, customer commitments have already been established, commercial execution is actively progressing, and the Company’s corporate structure is now aligned with an operating platform built to support long-term expansion.

The completion of the merger comes at a time when investment in AI infrastructure continues to accelerate globally as enterprises increasingly require access to high-performance computing resources, GPU infrastructure, and scalable digital power solutions. Management believes the combined company is well positioned to capitalize on these long-term industry trends through a diversified infrastructure strategy designed to monetize power assets across multiple complementary revenue streams, including AI data centers, enterprise compute infrastructure, power hosting, and digital asset mining operations.

Following the closing of the transaction, the Company intends to continue expanding its AI Infrastructure strategy through AI data center development, enterprise GPU compute solutions, power hosting services, digital asset mining operations, strategic infrastructure investments, and additional commercial partnerships designed to maximize utilization of its power resources while creating multiple long-term revenue opportunities.

In connection with the closing of the merger, Phillip Oldridge has stepped down as Chief Executive Officer. Jason Maddox vacates the President position and is now the Chief Financial Officer. The Company’s Board of Directors appointed Simon Yu as President and Chris Young as Chief Executive Officer, effective immediately.

Mr. Yu is a serial entrepreneur and public markets operator with almost a decade of experience taking companies public, executing capital raises, and scaling businesses. He has previously served in founder, C-suite, and board roles at three publicly traded companies, two of which reached market capitalizations in excess of $1 billion. Mr. Yu has led legal, accounting, and advisory teams through Regulation A+ Tier 2 offerings, PCAOB audits, and public company reporting, alongside leading M&A transactions. As an active early-stage venture investor, he has evaluated investment opportunities across artificial intelligence, SaaS, and B2B technology.

Mr. Young brings extensive experience in launching and leading public companies and investing in and advising emerging technology companies, with a particular focus on artificial intelligence, software innovation, and strategic growth initiatives. Prior to joining EVTV, he served as Chief Executive Officer of Clubhouse Media Group, a publicly traded social media company and an Entrepreneur in Residence at Amplify, where he worked alongside founders and venture-backed technology companies to accelerate commercialization and support the development of high-growth technology businesses.

“Today’s announcement represents far more than the completion of a merger—it marks the beginning of our next chapter,” said Chris Young, Chief Executive Officer of EVTV. “Over the past several months, our teams have been building the operational foundation of this business while simultaneously working toward completing this transaction. With the merger now finalized, we move forward as one company with one leadership team and one strategy, focused on executing against the opportunities in front of us. We believe demand for AI infrastructure, enterprise compute, and digital infrastructure will continue expanding for years to come. Our objective is to build a scalable platform capable of serving that demand while creating long-term value for our shareholders.”

Jason Maddox, Chief Financial Officer of EVTV, added, “Completing this transaction under the amended merger structure allows us to immediately focus on execution. We have already established meaningful operational momentum, and we believe operating as a unified public company enhances our ability to deploy infrastructure, serve customers, pursue strategic growth opportunities, and continue building long-term shareholder value.”

The transaction establishes a unified operating platform designed to support the Company’s long-term growth strategy through continued investment in AI infrastructure, enterprise computing, digital power assets, and digital infrastructure development. Management believes the completion of the merger provides the operational and organizational foundation necessary to pursue the next phase of commercialization while expanding its presence across some of the fastest-growing sectors of the global technology market.

Transaction and Operational Highlights

• Successfully completed the merger with Azio AI pursuant to an amended and restated merger agreement.
• Approximately six megawatts of off-grid digital infrastructure deployed at the Company’s South Texas development site.
• Development footprint exceeding 548 acres with the potential to support up to 500 MW of AI infrastructure capacity.
• Combined company positioned to accelerate commercialization across AI infrastructure, enterprise GPU compute, digital power solutions, and digital asset mining operations.
• Merger consideration consisted of 2,655,157 shares of common stock and 973,450 shares of non-voting convertible preferred stock in exchange for 100% of outstanding capital stock of Azio AI, of which 194,807 shares of common stock were reserved for convertible notes of Azio AI assumed by the Company upon closing.
• Each share of preferred stock convertible into 100 shares of Company common stock subject to stockholder approval.
• Chris Young appointed Chief Executive Officer and Chairman of the Board.
• Simon Yu appointed President.
• Jason Maddox appointed Chief Financial Officer.
• Phillip Oldridge stepped down as Chief Executive Officer.

About Envirotech Vehicles, Inc.

Envirotech Vehicles, Inc. (NASDAQ: EVTV) is a technology infrastructure company focused on developing, owning, and operating artificial intelligence data centers, enterprise GPU compute infrastructure, digital power solutions, and digital asset mining operations. Following its acquisition of Azio AI, the Company operates an integrated AI infrastructure business encompassing AI data center development, the sale and distribution of enterprise GPU systems and server infrastructure, high-performance computing solutions, power hosting, and strategic technology investments, serving enterprise and institutional customers across domestic and international markets. Through this diversified AI infrastructure strategy, the Company is positioned to capitalize on the rapidly expanding global demand for AI infrastructure, compute capacity, digital power, and next-generation AI technologies.

For more information please visit: www.azioai.ai and for potential partnerships contact: AI@PhoenixMGMTconsulting.com

Forward-Looking Statements

This press release contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. In some cases, you can identify forward-looking statements by words such as “may,” “will,” “could,” “expect,” “anticipate,” “believe,” “estimate,” “project,” “intend,” “continue,” “potential,” “ongoing,” or the negative of these terms or other comparable terminology, although not all forward-looking statements contain these words. Forward-looking statements include statements regarding the Company’s ability to capitalize on accelerating demand for AI infrastructure, enterprise GPU compute, digital power solutions, data center development, and digital asset infrastructure; the Company’s plans to continue expanding its digital infrastructure platform through AI data center development, enterprise GPU compute solutions, power hosting services, digital asset mining operations, strategic infrastructure investments, and additional commercial partnerships; the Company’s ability to maximize utilization of its power resources while creating multiple long-term revenue opportunities; the ability to continue deploying modular digital infrastructure at the Company’s South Texas site; the anticipated deployment and scaling of NVIDIA B200 and B300 GPU systems; the ability to advance and execute against the Company’s commercial infrastructure pipeline; the anticipated development of the Company’s footprint; the ability to monetize power assets across multiple complementary revenue streams, including AI data centers, enterprise compute infrastructure, power hosting, and digital asset mining operations; customer demand for AI infrastructure, enterprise compute, and digital infrastructure; the Company’s ability to build a scalable platform designed to serve that demand and create long-term shareholder value; and the Company’s broader business strategy and long-term growth objectives.

These statements are based on current expectations and assumptions that involve risks and uncertainties that could cause actual results to differ materially. Most of these factors are outside the Company’s control and are difficult to predict. Factors that may affect actual results include, but are not limited to, the Company’s limited operating history within AI infrastructure and compute operations, project scope, engineering challenges, supply chain constraints, installation timelines, energy availability, finalization of site usage rights, regulatory considerations, equipment performance, ability to raise capital required for expansion activities, changes in digital asset markets, evolving compute demand, market conditions, the Company’s ability to successfully integrate the combined business following the completion of the merger, the risk that the anticipated benefits and synergies of the merger are not realized, the risk of unexpected costs, charges, or expenses resulting from or relating to the merger, potential adverse reactions or changes to business relationships resulting from the completion of the merger, risks related to the diversion of management’s attention from ongoing business operations during the post-closing integration period, the risk that required stockholder approval for the conversion of preferred stock issued in the merger as required by rules of The Nasdaq Stock Market LLC (the “Conversion Proposal”) is not obtained, and additional risks and uncertainties described in the Company’s most recent Annual Report on Form 10-K and subsequent Quarterly Reports on Form 10-Q filed with the SEC, which are available at www.sec.gov. The Company undertakes no obligation to update forward-looking statements except as required by law.

Important Information About the Merger and Where to Find it

The Company expects to file a proxy statement with the SEC relating to the Conversion Proposal. The definitive proxy statement will be sent to all Company stockholders. Before making any voting decision, investors and security-holders of the Company are urged to read the proxy statement and all other relevant documents filed or that will be filed with the SEC in connection with the Conversion Proposal as they become available because they will contain important information about the amended and restated merger agreement between the parties and the related transactions and the Conversion Proposal to be voted upon by the Company’s stockholders. Investors and security-holders will be able to obtain free copies of the proxy statement and all other relevant documents filed or that will be filed with the SEC by the Company through the website maintained by the SEC at www.sec.gov.

Participants in the Solicitation

The Company and its directors and executive officers may be considered participants in the solicitation of proxies from EVTV’s stockholders with respect to the Conversion Proposal under the rules of the SEC. Information about the directors and executive officers of EVTV is set forth in its Annual Report on Form 10-K for the year ended December 31, 2025, which was filed with the SEC on April 13, 2026, and in subsequent Quarterly Reports on Form 10-Q and other documents filed by the Company from time to time with the SEC. Additional information regarding the persons who may be deemed participants in the proxy solicitation and a description of their direct and indirect interests, by security holdings or otherwise, will also be included in the proxy statement, and other relevant materials to be filed with the SEC when they become available. You may obtain free copies of these documents as described above.

¹ Source: International Data Corporation (IDC), “AI Infrastructure Spending Caps Historic Year at ~$90 Billion in Q4 2025; 2029 Spending to Eclipse $1 Trillion,” April 16, 2026. The Company has not independently verified the data or projections contained in this report, and there can be no assurance that the projections will be realized.

Contact

Phoenix MGMT & Consulting

Press@PhoenixMGMTConsulting.com

Revised transaction structure enables immediate closing, accelerating the Company’s strategic pivot toward AI data centers, enterprise GPU compute, and digital power infrastructure.

Envirotech Vehicles, Inc. (NASDAQ: EVTV) (“EVTV” or the “Company”) today announced the successful completion of its merger with Azio AI Corporation (“Azio AI”) on July 2, 2026, paving the way for the Company to transform to an AI Datacenter Provider and meeting the growing market demand for artificial intelligence (“AI”) infrastructure, enterprise GPU compute, digital power solutions, data center development, and digital asset infrastructure; a market that the International Data Corporation (IDC) projects will reach $487 billion in global spending in 2026 and exceed $1 trillion by 2029.[1] The transaction marks a defining milestone in the Company’s strategic transformation and establishes the foundation for its next phase of commercial execution and long-term growth.

The parties amended the proposed transaction structure to expedite the closing timeline, allowing the combined company to begin operating as a fully integrated public company significantly sooner than originally anticipated. The accelerated closing enables management to immediately focus on commercialization across its expanding AI Datacenter strategy.

With the merger complete and the combined company operating as one organization, management is now fully focused on commercial execution, infrastructure deployment, strategic growth initiatives, and creating long-term shareholder value.

Over the past several months, the Company advanced development activities at its South Texas site and deployed six megawatts of off-grid power for its modular data centers. The Company further secured rights to a 548-acre site with the capacity to scale up to 500 MW, supporting the future development of AI hyperscale data centers.

Management believes these achievements demonstrate that the combined company is entering its next phase with meaningful operational momentum already in place rather than beginning from a standing start. Infrastructure deployment is underway, customer commitments have already been established, commercial execution is actively progressing, and the Company’s corporate structure is now aligned with an operating platform built to support long-term expansion.

The completion of the merger comes at a time when investment in AI infrastructure continues to accelerate globally as enterprises increasingly require access to high-performance computing resources, GPU infrastructure, and scalable digital power solutions. Management believes the combined company is well positioned to capitalize on these long-term industry trends through a diversified infrastructure strategy designed to monetize power assets across multiple complementary revenue streams, including AI data centers, enterprise compute infrastructure, power hosting, and digital asset mining operations.

Following the closing of the transaction, the Company intends to continue expanding its AI Infrastructure strategy through AI data center development, enterprise GPU compute solutions, power hosting services, digital asset mining operations, strategic infrastructure investments, and additional commercial partnerships designed to maximize utilization of its power resources while creating multiple long-term revenue opportunities.

In connection with the closing of the merger, Phillip Oldridge has stepped down as Chief Executive Officer. Jason Maddox vacates the President position and is now the Chief Financial Officer. The Company’s Board of Directors appointed Simon Yu as President and Chris Young as Chief Executive Officer, effective immediately.

Mr. Yu is a serial entrepreneur and public markets operator with almost a decade of experience taking companies public, executing capital raises, and scaling businesses. He has previously served in founder, C-suite, and board roles at three publicly traded companies, two of which reached market capitalizations in excess of $1 billion. Mr. Yu has led legal, accounting, and advisory teams through Regulation A+ Tier 2 offerings, PCAOB audits, and public company reporting, alongside leading M&A transactions. As an active early-stage venture investor, he has evaluated investment opportunities across artificial intelligence, SaaS, and B2B technology.

Mr. Young brings extensive experience in launching and leading public companies and investing in and advising emerging technology companies, with a particular focus on artificial intelligence, software innovation, and strategic growth initiatives. Prior to joining EVTV, he served as Chief Executive Officer of Clubhouse Media Group, a publicly traded social media company and an Entrepreneur in Residence at Amplify, where he worked alongside founders and venture-backed technology companies to accelerate commercialization and support the development of high-growth technology businesses.

“Today’s announcement represents far more than the completion of a merger—it marks the beginning of our next chapter,” said Chris Young, Chief Executive Officer of EVTV. “Over the past several months, our teams have been building the operational foundation of this business while simultaneously working toward completing this transaction. With the merger now finalized, we move forward as one company with one leadership team and one strategy, focused on executing against the opportunities in front of us. We believe demand for AI infrastructure, enterprise compute, and digital infrastructure will continue expanding for years to come. Our objective is to build a scalable platform capable of serving that demand while creating long-term value for our shareholders.”

Jason Maddox, Chief Financial Officer of EVTV, added, “Completing this transaction under the amended merger structure allows us to immediately focus on execution. We have already established meaningful operational momentum, and we believe operating as a unified public company enhances our ability to deploy infrastructure, serve customers, pursue strategic growth opportunities, and continue building long-term shareholder value.”

The transaction establishes a unified operating platform designed to support the Company’s long-term growth strategy through continued investment in AI infrastructure, enterprise computing, digital power assets, and digital infrastructure development. Management believes the completion of the merger provides the operational and organizational foundation necessary to pursue the next phase of commercialization while expanding its presence across some of the fastest-growing sectors of the global technology market.

Transaction and Operational Highlights

• Successfully completed the merger with Azio AI pursuant to an amended and restated merger agreement.
• Approximately six megawatts of off-grid digital infrastructure deployed at the Company’s South Texas development site.
• Development footprint exceeding 548 acres with the potential to support up to 500 MW of AI infrastructure capacity.
• Combined company positioned to accelerate commercialization across AI infrastructure, enterprise GPU compute, digital power solutions, and digital asset mining operations.
• Merger consideration consisted of 2,655,157 shares of common stock and 973,450 shares of non-voting convertible preferred stock in exchange for 100% of outstanding capital stock of Azio AI, of which 194,807 shares of common stock were reserved for convertible notes of Azio AI assumed by the Company upon closing.
• Each share of preferred stock convertible into 100 shares of Company common stock subject to stockholder approval.
• Chris Young appointed Chief Executive Officer and Chairman of the Board.
• Simon Yu appointed President.
• Jason Maddox appointed Chief Financial Officer.
• Phillip Oldridge stepped down as Chief Executive Officer.

About Envirotech Vehicles, Inc.

Envirotech Vehicles, Inc. (NASDAQ: EVTV) is a technology infrastructure company focused on developing, owning, and operating artificial intelligence data centers, enterprise GPU compute infrastructure, digital power solutions, and digital asset mining operations. Following its acquisition of Azio AI, the Company operates an integrated AI infrastructure business encompassing AI data center development, the sale and distribution of enterprise GPU systems and server infrastructure, high-performance computing solutions, power hosting, and strategic technology investments, serving enterprise and institutional customers across domestic and international markets. Through this diversified AI infrastructure strategy, the Company is positioned to capitalize on the rapidly expanding global demand for AI infrastructure, compute capacity, digital power, and next-generation AI technologies.

For more information please visit: www.azioai.ai and for potential partnerships contact: AI@PhoenixMGMTconsulting.com

Forward-Looking Statements

This press release contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. In some cases, you can identify forward-looking statements by words such as “may,” “will,” “could,” “expect,” “anticipate,” “believe,” “estimate,” “project,” “intend,” “continue,” “potential,” “ongoing,” or the negative of these terms or other comparable terminology, although not all forward-looking statements contain these words. Forward-looking statements include statements regarding the Company’s ability to capitalize on accelerating demand for AI infrastructure, enterprise GPU compute, digital power solutions, data center development, and digital asset infrastructure; the Company’s plans to continue expanding its digital infrastructure platform through AI data center development, enterprise GPU compute solutions, power hosting services, digital asset mining operations, strategic infrastructure investments, and additional commercial partnerships; the Company’s ability to maximize utilization of its power resources while creating multiple long-term revenue opportunities; the ability to continue deploying modular digital infrastructure at the Company’s South Texas site; the anticipated deployment and scaling of NVIDIA B200 and B300 GPU systems; the ability to advance and execute against the Company’s commercial infrastructure pipeline; the anticipated development of the Company’s footprint; the ability to monetize power assets across multiple complementary revenue streams, including AI data centers, enterprise compute infrastructure, power hosting, and digital asset mining operations; customer demand for AI infrastructure, enterprise compute, and digital infrastructure; the Company’s ability to build a scalable platform designed to serve that demand and create long-term shareholder value; and the Company’s broader business strategy and long-term growth objectives.

These statements are based on current expectations and assumptions that involve risks and uncertainties that could cause actual results to differ materially. Most of these factors are outside the Company’s control and are difficult to predict. Factors that may affect actual results include, but are not limited to, the Company’s limited operating history within AI infrastructure and compute operations, project scope, engineering challenges, supply chain constraints, installation timelines, energy availability, finalization of site usage rights, regulatory considerations, equipment performance, ability to raise capital required for expansion activities, changes in digital asset markets, evolving compute demand, market conditions, the Company’s ability to successfully integrate the combined business following the completion of the merger, the risk that the anticipated benefits and synergies of the merger are not realized, the risk of unexpected costs, charges, or expenses resulting from or relating to the merger, potential adverse reactions or changes to business relationships resulting from the completion of the merger, risks related to the diversion of management’s attention from ongoing business operations during the post-closing integration period, the risk that required stockholder approval for the conversion of preferred stock issued in the merger as required by rules of The Nasdaq Stock Market LLC (the “Conversion Proposal”) is not obtained, and additional risks and uncertainties described in the Company’s most recent Annual Report on Form 10-K and subsequent Quarterly Reports on Form 10-Q filed with the SEC, which are available at www.sec.gov. The Company undertakes no obligation to update forward-looking statements except as required by law.

Important Information About the Merger and Where to Find it

The Company expects to file a proxy statement with the SEC relating to the Conversion Proposal. The definitive proxy statement will be sent to all Company stockholders. Before making any voting decision, investors and security-holders of the Company are urged to read the proxy statement and all other relevant documents filed or that will be filed with the SEC in connection with the Conversion Proposal as they become available because they will contain important information about the amended and restated merger agreement between the parties and the related transactions and the Conversion Proposal to be voted upon by the Company’s stockholders. Investors and security-holders will be able to obtain free copies of the proxy statement and all other relevant documents filed or that will be filed with the SEC by the Company through the website maintained by the SEC at www.sec.gov.

Participants in the Solicitation

The Company and its directors and executive officers may be considered participants in the solicitation of proxies from EVTV’s stockholders with respect to the Conversion Proposal under the rules of the SEC. Information about the directors and executive officers of EVTV is set forth in its Annual Report on Form 10-K for the year ended December 31, 2025, which was filed with the SEC on April 13, 2026, and in subsequent Quarterly Reports on Form 10-Q and other documents filed by the Company from time to time with the SEC. Additional information regarding the persons who may be deemed participants in the proxy solicitation and a description of their direct and indirect interests, by security holdings or otherwise, will also be included in the proxy statement, and other relevant materials to be filed with the SEC when they become available. You may obtain free copies of these documents as described above.

¹ Source: International Data Corporation (IDC), “AI Infrastructure Spending Caps Historic Year at ~$90 Billion in Q4 2025; 2029 Spending to Eclipse $1 Trillion,” April 16, 2026. The Company has not independently verified the data or projections contained in this report, and there can be no assurance that the projections will be realized.

Contact

Phoenix MGMT & Consulting

Press@PhoenixMGMTConsulting.com

Revised transaction structure enables immediate closing, accelerating the Company’s strategic pivot toward AI data centers, enterprise GPU compute, and digital power infrastructure.

Envirotech Vehicles, Inc. (NASDAQ: EVTV) (“EVTV” or the “Company”) today announced the successful completion of its merger with Azio AI Corporation (“Azio AI”) on July 2, 2026, paving the way for the Company to transform to an AI Datacenter Provider and meeting the growing market demand for artificial intelligence (“AI”) infrastructure, enterprise GPU compute, digital power solutions, data center development, and digital asset infrastructure; a market that the International Data Corporation (IDC) projects will reach $487 billion in global spending in 2026 and exceed $1 trillion by 2029.[1] The transaction marks a defining milestone in the Company’s strategic transformation and establishes the foundation for its next phase of commercial execution and long-term growth.

The parties amended the proposed transaction structure to expedite the closing timeline, allowing the combined company to begin operating as a fully integrated public company significantly sooner than originally anticipated. The accelerated closing enables management to immediately focus on commercialization across its expanding AI Datacenter strategy.

With the merger complete and the combined company operating as one organization, management is now fully focused on commercial execution, infrastructure deployment, strategic growth initiatives, and creating long-term shareholder value.

Over the past several months, the Company advanced development activities at its South Texas site and deployed six megawatts of off-grid power for its modular data centers. The Company further secured rights to a 548-acre site with the capacity to scale up to 500 MW, supporting the future development of AI hyperscale data centers.

Management believes these achievements demonstrate that the combined company is entering its next phase with meaningful operational momentum already in place rather than beginning from a standing start. Infrastructure deployment is underway, customer commitments have already been established, commercial execution is actively progressing, and the Company’s corporate structure is now aligned with an operating platform built to support long-term expansion.

The completion of the merger comes at a time when investment in AI infrastructure continues to accelerate globally as enterprises increasingly require access to high-performance computing resources, GPU infrastructure, and scalable digital power solutions. Management believes the combined company is well positioned to capitalize on these long-term industry trends through a diversified infrastructure strategy designed to monetize power assets across multiple complementary revenue streams, including AI data centers, enterprise compute infrastructure, power hosting, and digital asset mining operations.

Following the closing of the transaction, the Company intends to continue expanding its AI Infrastructure strategy through AI data center development, enterprise GPU compute solutions, power hosting services, digital asset mining operations, strategic infrastructure investments, and additional commercial partnerships designed to maximize utilization of its power resources while creating multiple long-term revenue opportunities.

In connection with the closing of the merger, Phillip Oldridge has stepped down as Chief Executive Officer. Jason Maddox vacates the President position and is now the Chief Financial Officer. The Company’s Board of Directors appointed Simon Yu as President and Chris Young as Chief Executive Officer, effective immediately.

Mr. Yu is a serial entrepreneur and public markets operator with almost a decade of experience taking companies public, executing capital raises, and scaling businesses. He has previously served in founder, C-suite, and board roles at three publicly traded companies, two of which reached market capitalizations in excess of $1 billion. Mr. Yu has led legal, accounting, and advisory teams through Regulation A+ Tier 2 offerings, PCAOB audits, and public company reporting, alongside leading M&A transactions. As an active early-stage venture investor, he has evaluated investment opportunities across artificial intelligence, SaaS, and B2B technology.

Mr. Young brings extensive experience in launching and leading public companies and investing in and advising emerging technology companies, with a particular focus on artificial intelligence, software innovation, and strategic growth initiatives. Prior to joining EVTV, he served as Chief Executive Officer of Clubhouse Media Group, a publicly traded social media company and an Entrepreneur in Residence at Amplify, where he worked alongside founders and venture-backed technology companies to accelerate commercialization and support the development of high-growth technology businesses.

“Today’s announcement represents far more than the completion of a merger—it marks the beginning of our next chapter,” said Chris Young, Chief Executive Officer of EVTV. “Over the past several months, our teams have been building the operational foundation of this business while simultaneously working toward completing this transaction. With the merger now finalized, we move forward as one company with one leadership team and one strategy, focused on executing against the opportunities in front of us. We believe demand for AI infrastructure, enterprise compute, and digital infrastructure will continue expanding for years to come. Our objective is to build a scalable platform capable of serving that demand while creating long-term value for our shareholders.”

Jason Maddox, Chief Financial Officer of EVTV, added, “Completing this transaction under the amended merger structure allows us to immediately focus on execution. We have already established meaningful operational momentum, and we believe operating as a unified public company enhances our ability to deploy infrastructure, serve customers, pursue strategic growth opportunities, and continue building long-term shareholder value.”

The transaction establishes a unified operating platform designed to support the Company’s long-term growth strategy through continued investment in AI infrastructure, enterprise computing, digital power assets, and digital infrastructure development. Management believes the completion of the merger provides the operational and organizational foundation necessary to pursue the next phase of commercialization while expanding its presence across some of the fastest-growing sectors of the global technology market.

Transaction and Operational Highlights

• Successfully completed the merger with Azio AI pursuant to an amended and restated merger agreement.
• Approximately six megawatts of off-grid digital infrastructure deployed at the Company’s South Texas development site.
• Development footprint exceeding 548 acres with the potential to support up to 500 MW of AI infrastructure capacity.
• Combined company positioned to accelerate commercialization across AI infrastructure, enterprise GPU compute, digital power solutions, and digital asset mining operations.
• Merger consideration consisted of 2,655,157 shares of common stock and 973,450 shares of non-voting convertible preferred stock in exchange for 100% of outstanding capital stock of Azio AI, of which 194,807 shares of common stock were reserved for convertible notes of Azio AI assumed by the Company upon closing.
• Each share of preferred stock convertible into 100 shares of Company common stock subject to stockholder approval.
• Chris Young appointed Chief Executive Officer and Chairman of the Board.
• Simon Yu appointed President.
• Jason Maddox appointed Chief Financial Officer.
• Phillip Oldridge stepped down as Chief Executive Officer.

About Envirotech Vehicles, Inc.

Envirotech Vehicles, Inc. (NASDAQ: EVTV) is a technology infrastructure company focused on developing, owning, and operating artificial intelligence data centers, enterprise GPU compute infrastructure, digital power solutions, and digital asset mining operations. Following its acquisition of Azio AI, the Company operates an integrated AI infrastructure business encompassing AI data center development, the sale and distribution of enterprise GPU systems and server infrastructure, high-performance computing solutions, power hosting, and strategic technology investments, serving enterprise and institutional customers across domestic and international markets. Through this diversified AI infrastructure strategy, the Company is positioned to capitalize on the rapidly expanding global demand for AI infrastructure, compute capacity, digital power, and next-generation AI technologies.

For more information please visit: www.azioai.ai and for potential partnerships contact: AI@PhoenixMGMTconsulting.com

Forward-Looking Statements

This press release contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. In some cases, you can identify forward-looking statements by words such as “may,” “will,” “could,” “expect,” “anticipate,” “believe,” “estimate,” “project,” “intend,” “continue,” “potential,” “ongoing,” or the negative of these terms or other comparable terminology, although not all forward-looking statements contain these words. Forward-looking statements include statements regarding the Company’s ability to capitalize on accelerating demand for AI infrastructure, enterprise GPU compute, digital power solutions, data center development, and digital asset infrastructure; the Company’s plans to continue expanding its digital infrastructure platform through AI data center development, enterprise GPU compute solutions, power hosting services, digital asset mining operations, strategic infrastructure investments, and additional commercial partnerships; the Company’s ability to maximize utilization of its power resources while creating multiple long-term revenue opportunities; the ability to continue deploying modular digital infrastructure at the Company’s South Texas site; the anticipated deployment and scaling of NVIDIA B200 and B300 GPU systems; the ability to advance and execute against the Company’s commercial infrastructure pipeline; the anticipated development of the Company’s footprint; the ability to monetize power assets across multiple complementary revenue streams, including AI data centers, enterprise compute infrastructure, power hosting, and digital asset mining operations; customer demand for AI infrastructure, enterprise compute, and digital infrastructure; the Company’s ability to build a scalable platform designed to serve that demand and create long-term shareholder value; and the Company’s broader business strategy and long-term growth objectives.

These statements are based on current expectations and assumptions that involve risks and uncertainties that could cause actual results to differ materially. Most of these factors are outside the Company’s control and are difficult to predict. Factors that may affect actual results include, but are not limited to, the Company’s limited operating history within AI infrastructure and compute operations, project scope, engineering challenges, supply chain constraints, installation timelines, energy availability, finalization of site usage rights, regulatory considerations, equipment performance, ability to raise capital required for expansion activities, changes in digital asset markets, evolving compute demand, market conditions, the Company’s ability to successfully integrate the combined business following the completion of the merger, the risk that the anticipated benefits and synergies of the merger are not realized, the risk of unexpected costs, charges, or expenses resulting from or relating to the merger, potential adverse reactions or changes to business relationships resulting from the completion of the merger, risks related to the diversion of management’s attention from ongoing business operations during the post-closing integration period, the risk that required stockholder approval for the conversion of preferred stock issued in the merger as required by rules of The Nasdaq Stock Market LLC (the “Conversion Proposal”) is not obtained, and additional risks and uncertainties described in the Company’s most recent Annual Report on Form 10-K and subsequent Quarterly Reports on Form 10-Q filed with the SEC, which are available at www.sec.gov. The Company undertakes no obligation to update forward-looking statements except as required by law.

Important Information About the Merger and Where to Find it

The Company expects to file a proxy statement with the SEC relating to the Conversion Proposal. The definitive proxy statement will be sent to all Company stockholders. Before making any voting decision, investors and security-holders of the Company are urged to read the proxy statement and all other relevant documents filed or that will be filed with the SEC in connection with the Conversion Proposal as they become available because they will contain important information about the amended and restated merger agreement between the parties and the related transactions and the Conversion Proposal to be voted upon by the Company’s stockholders. Investors and security-holders will be able to obtain free copies of the proxy statement and all other relevant documents filed or that will be filed with the SEC by the Company through the website maintained by the SEC at www.sec.gov.

Participants in the Solicitation

The Company and its directors and executive officers may be considered participants in the solicitation of proxies from EVTV’s stockholders with respect to the Conversion Proposal under the rules of the SEC. Information about the directors and executive officers of EVTV is set forth in its Annual Report on Form 10-K for the year ended December 31, 2025, which was filed with the SEC on April 13, 2026, and in subsequent Quarterly Reports on Form 10-Q and other documents filed by the Company from time to time with the SEC. Additional information regarding the persons who may be deemed participants in the proxy solicitation and a description of their direct and indirect interests, by security holdings or otherwise, will also be included in the proxy statement, and other relevant materials to be filed with the SEC when they become available. You may obtain free copies of these documents as described above.

¹ Source: International Data Corporation (IDC), “AI Infrastructure Spending Caps Historic Year at ~$90 Billion in Q4 2025; 2029 Spending to Eclipse $1 Trillion,” April 16, 2026. The Company has not independently verified the data or projections contained in this report, and there can be no assurance that the projections will be realized.

Contact

Phoenix MGMT & Consulting

Press@PhoenixMGMTConsulting.com

Large Languae Models (LLMs) sind die KI-„Arbeitspferde“: Sie ermöglichen zunehmend ausgefeiltere Funktionen und Workflows und nähern sich in Sachen Performance dem menschlichen Niveau. Allerdings ist „mehr“ nicht immer besser – für manche Workloads sind spezifische Daten und limitierte Fähigkeiten völlig ausreichend.

Diese Erkenntnis treibt die Entwicklung von Small Languae Models (SLMs) voran. Diese sind – in Form von domänenspezifischen Modellen, statistischen sowie neuronalen Sprachmodellen – Experten zufolge schneller, kostengünstiger, ressourcenschonender und datenschutzfreundlicher als herkömmliche LLMs. Es handelt sich jedoch nicht einfach nur um ein Substitut, wie Thomas Randall, Research Director bei der Info-Tech Research Group, erklärt: „Das Muster ähnelt eher einer optimierten Arbeitsteilung. Eine Routing-Architektur leitet dabei simple oder klar abgegrenzte Queries an ein spezialisiertes SLM weiter. Komplexe Abfragen fließen hingegen weiterhin in ein LLM.“

So werden Small Language Models „kleingehalten“

Während die Parameteranzahl bei LLMs im Bereich von Hunderten von Milliarden – oder sogar Billionen – liegen kann, beschränken sich SLMs in der Regel auf eine bis sieben Milliarden Parameter. Ganz allgemein gilt dabei jeder Wert unter zehn Milliarden als „klein“. Das zieht auch Unterschiede bei den Trainingsdaten nach sich: Bei LLMs liegen diese im Regelfall in Form von mehreren Petabytes vor. SLMs werden hingegen auf kompakten Transformer-Architekturen (neuronalen Netzwerken) unter Verwendung kleinerer, spezialisierter und hochwertiger Datensätze trainiert, die auf ihre jeweilige Funktion zugeschnitten sind.

Um die Modellgröße zu begrenzen, ohne dabei die Performance einzuschränken, kommen bei Small Language Models verschiedene Techniken zum Einsatz. Dazu gehören:

• Wissensdestillation: Bei diesem Ansatz wird ein kleineres „Student“-Modell von einem größeren „Teacher“-Modell trainiert. Auf dieser Basis lernt das kleine Modell vom großen, robuste Reasoning-Ketten nachzuahmen – allerdings in deutlich kleinerem Maßstab.
• Pruning: Hierbei werden redundante oder irrelevante Parameter aus den Architekturen neuronaler Netze entfernt.
• Quantisierung: Mit dieser Technik werden Werte von einer hohen auf eine niedrigere Präzision reduziert (Gleitkommazahlen werden in Ganzzahlen umgewandelt). So wird die Datengröße reduziert, die Verarbeitung beschleunigt und der Energieverbrauch optimiert.

Größere Modelle lassen sich zudem auch durch Techniken wie Retrieval Augmented Generation (RAG) modifizieren und zu kleineren, spezialisierteren Modellen destillieren.

„Letztendlich werden Enterprise-Daten mit SLMs zu einem essenziellen Unterscheidungsmerkmal, das Datenaufbereitung, Qualitätsprüfungen, Versionierung und Management erforderlich macht. Nur so lässt sich sicherstellen, dass relevante Daten so strukturiert sind, dass sie den Anforderungen für das Feintuning entsprechen“, hält Sumit Agarwal, VP Analyst bei Gartner, fest.

SLMs – die Vorteile

SLMs werden nach Meinung von Randall vor allem eingesetzt, um wirtschaftliche Vorteile zu erschließen: „Bei repetitiven High-Volume-Tasks, die klar abgegrenzt sind – etwa die Triage im Kundenservice –, lassen sich die Kosten für den Einsatz eines generalistischen LLMs mit einer Billion Parametern nicht rechtfertigen.“

Selbst moderate Workflows für GPT-5 im großen Maßstab verursachen dem Experten zufolge Cloud-Kosten, die nicht tragbar sind. Der Einsatz eines begrenzten, zweckgebundenen SLM sei für solche Workflows weitaus besser und effizienter, so Randall. Er fügt hinzu: „SLMs performen besonders gut, wenn eine Aufgabe die schnelle, konsistente und wiederholte Anwendung eines klar definierten Musters erfordert. Die Leistung ist in diesem Bereich oft besser als bei einem LLM. Denn ein SLM wurde darauf trainiert, eine Sache besonders gut zu erledigen – anstatt alles nur passabel.“

Zudem durchforste ein SLM nicht das komplette Internet nach irrelevanten Informationen, was auch die Wahrscheinlichkeit von Halluzination senke. Darüber hinaus realisiert der Einsatz von Small Language Models weitere Benefits:

• Geringere Rechenanforderungen: SLMs lassen sich direkt „on-device“ ausführen – auf Laptops, Smartphones, in Edge-Fällen und sogar offline.
• Robuste Privacy- und Security-Standards: Weil SLMs klein genug sind, um direkt auf Endgeräten oder On-Premises ausgeführt zu werden, wird auch das Risiko von Datenlecks und Sicherheitsvorfällen reduziert. Dadurch sind SLMs besonders attraktiv für stark regulierte Branchen oder Organisationen, die sensible Daten verarbeiten.
• Effizientere Inferenz: Kleinere Modelle liefern schnelle Antworten, was ideal für Echtzeitanwendungen ist.
• Günstigeres Deployment: Die Hardware- und Cloud-Kosten, die für SLMs anfallen, sind geringer.
• Bessere Anpassbarkeit: Small Language Models werden auf der Grundlage spezifischer Daten der jeweiligen Organisation trainiert und zeichnen sich daher durch eine bessere „Customizability“ aus.

Für Forscher bei Nvidia sind Small Language Models „die Zukunft von Agentic AI“, wie sie in einem Whitepaper (PDF) ausführlich darlegen. Darin betonen die Experten insbesondere die Flexibilität und den modularen Aufbau von SLMs – und ihr Potenzial zur Demokratisierung von KI. Ob die Auguren von Gartner das so unterschreiben würden, ist unklar – zumindest prognostizieren diese aber, dass im Unternehmensumfeld bis zum Jahr 2027 dreimal so viele SLMs wie LLMs im Einsatz sein werden. „Die Vielfalt der Aufgaben in Geschäftsabläufen und der Bedarf an höherer Genauigkeit treiben den Shift auf KI-Modelle voran, die auf bestimmte Funktionen oder Domänendaten feinabgestimmt sind“, kommentiert Gartner-Analyst Agarwal.

Anwendungsfälle für Small Language Models

SLMs eignen sich hervorragend für eine Vielzahl von Use Cases. Zum Beispiel die folgenden:

• Boilerplate-Tasks: Routineaufgaben sowie simple Command-Parsing- und -Routing-Aufgaben, die auf vordefinierten Templates basieren.
• Content-Generierung: SLMs können detaillierte Reports, benutzerspezifische Texte, Web- und Social-Media-Beiträge sowie Marketingmaterialien erstellen.
• Chatbots und Assistenten: Kleinere KI-Modelle ermöglichen Echtzeitinteraktionen, bearbeiten Routineanfragen von Kunden und internen Benutzern – oder transkribieren und übersetzen live.
• Inhaltsanalysen: SLMs sind auch in der Lage, Daten- und Sentiment-Analysen durchzuführen – beispielsweise, um Branchentrends zu identifizieren oder bei der Strategieoptimierung zu unterstützen.
• Code-Generierung: Auch Small Language Models können Entwickler dabei zur Hand gehen, Code zu schreiben oder zu debuggen.
• IoT, Edge-Computing- und Low-Resource-Szenarien: SLMs können lokal „on-device“ ausgeführt werden, ganz ohne Cloud-Hosting oder eine Internetverbindung.
• Spezialdomänen: In Bereichen wie dem Finanz- und Rechtswesen oder der Medizin genießen Datenschutz und Compliance oberste Priorität – auch hier können SLMs entsprechend glänzen.

Hier stoßen SLMs an ihre Grenzen

Kompromisse müssen Anwender bei SLMs insbesondere in Sachen Wissensbreite und Reasoning-Fähigkeiten eingehen, wie InfoTech-Research-Manager Randall erklärt: „SLMs tendieren zum Leistungsabfall bei Aufgaben, die Kontextbewusstsein oder mehrstufiges Schlussfolgern über unbekannte Domänen hinweg erfordern – oder auch, wenn ein großes Kontextfenster benötigt wird.“

Darüber hinaus bescheinigt Randall SLMs auch Schwierigkeiten mit Randfällen oder tangentialen Tasks – etwa einem Helpdesk-Ticket, das eine neue Kategorie erfordert. Dazu gesellen sich weitere Nachteile, beziehungsweise Einschränkungen:

• Enger Scope: SLMs werden auf ein spezifisches Fachgebiet trainiert und sind in ihrer Größe und Rechenleistung begrenzt. Deshalb kann ihre Generalisierungsfähigkeit eingeschränkt sein – etwa, wenn es um nuanciertere Aufgaben geht.
• Geringere Robustheit: Außerhalb ihrer Spezialdomäne (oder bei komplexeren Adversarial Inputs) sind SLMs möglicherweise fehleranfällig.
• Bias-Risiken: Datensätze, die nicht sorgfältig kuratiert werden, können Verzerrungen potenziell verstärken.

Unternehmen ist deshalb zu empfehlen, bei der Implementierung Task-spezifischer Modelle pragmatisch vorzugehen. Das meint auch Gartner – und empfiehlt, kleine, kontextbezogene Modelle in Bereichen zu testen, in denen LLMs die Erwartungen hinsichtlich Geschwindigkeit oder Antwortqualität nicht erfüllt haben. Die Marktforscher raten außerdem zu „Composite“-Ansätzen mit mehreren Modellen und Workflow-Schritten bei Use Cases, in denen die Orchestrierung eines einzelnen Modells nicht geklappt hat. (fm)

Dieser Artikel ist im Original bei unserer Schwesterpublikation Infoworld.com erschienen.

Existing security controls weren’t designed for AI agents.

Static credentials and standing privileges aren’t sufficient for an emerging model where organizations need to rapidly authorize, limit, and revoke permissions from autonomous agents, sometimes more than once within a single workflow.

Agentic AI requires organizations to carefully consider how to govern agentic identity, agent-to-agent communication, secrets management, privileged access, and workforce identity.

Agentic identity

The first challenge is to establish a reliable identity for agents themselves.

The “how” here is still being hotly debated. Some organizations treat AI agents as another form of non-human identity, similar to service accounts or machine identities. Others argue that agents should be their own category, distinct from both human users and machine accounts.

In any case, agents need something like a “certificate” to give them an identity that can be recognized and governed across environments. This is especially important because, in most enterprises, agents will operate across multiple environments, including cloud platforms, on-premises systems, and SaaS applications. 

Agent-to-agent communication

Securing agentic AI requires organizations to limit not only which resources AI agents can access, but also which other access-enabled agents they can communicate with. This is often currently handled with Model Context Protocol (MCP) gateways, although this approach is largely giving way to the use of agentic mesh.

An agentic mesh is a distributed architecture where multiple specialized AI agents can discover one another, coordinate, and collaborate on tasks without a central controller. This approach lets organizations overlay intent-based communication rules via certificates, but also allows permissions to be revoked on demand.

Agentic secrets

Traditionally, secrets like passwords and API keys are managed via requests through IT service management platforms. But this mechanism doesn’t work for AI agents, which operate too quickly and across too many systems to rely on static credentials.

Instead, secrets should be generated dynamically, used for a specific purpose, and then retired when the task is complete. This approach can be compared to modern hotel key cards. Unlike the physical room keys of the past, a key card is issued for a specific stay, but after that, it becomes worthless to both legitimate users and malicious actors.

Privileged access

AI agents may start with the same permissions as a given human user, drawing on relevant business systems and data for context. However, as workflows get handed off from agent to agent, this privilege should not be passed along throughout the process. Rather, privileges should be whittled down at each stage until only a thin layer remains to authorize a specific execution step.

Workforce identity

Organizations already manage the identities of human workers, of course, but often these identities are handled differently across separate management platforms and sign-on tools. To support agentic AI, organizations must find ways to break through this fragmentation, ensure that worker identities are current, and translate workforce permissions correctly into agentic workflows.

A lifecycle approach to identity

These five areas should not be addressed in isolation. Rather, organizations should apply governance and observability across the identity lifecycle, ensuring that every agentic action can ultimately be traced back to approved access and permission levels.

The outcomes of this effort—including dynamic access, the principle of least privilege, strong identity, and clear auditability—are goals that many organizations have long been pursuing. The rise of agentic AI makes them more urgent than ever.

To learn more, visit us here.

Higher education has consolidated its entire academic operation into a handful of massive SaaS platforms. The LMS manages instruction, grading and communication. The SIS owns enrollment, records and financial aid. Identity and productivity live in a small number of cloud providers. These are not peripheral tools — they are the operational infrastructure of the institution. As IT stewards, we manage platforms we do not own, cannot restore ourselves and cannot directly control — which makes contingency planning not optional, but fundamental to the role.

The contracts are in place. The SLAs are signed. The compliance certifications are current. None of that matters to a student who cannot reach her instructor three days before finals. None of it matters to a faculty member who has no roster, no grade book and no way to document the work his students submitted before the platform went dark. SLAs govern vendor response timelines. Keeping academic operations running during that response window is IT’s responsibility.

The disruption hit during finals week 2026, and I was doing what every CIO in higher education was doing — monitoring. A major learning management system had been breached. The disruption spread fast. Finals were canceled. Exams were postponed. Students and staff were stranded without access to coursework, rosters or grade books. The costs — in academic disruption, extended contracts, emergency response — were substantial and widely reported. My institution was not directly impacted. But watching peer institutions in my own state go dark during the highest-stakes moment of the academic calendar was not reassuring. It was a confirmation of something I had been thinking about for a long time.

The disruption proved something IT professionals have relearned in every decade of their careers. Mark Twain observed that history does not repeat itself, but it does rhyme. This is a verse we have heard before: Dependence on a single point of failure, without a tested contingency plan, is not a strategy — it is a risk that has simply not yet been called. Whether the failure comes from a cyberattack, a vendor outage, an infrastructure collapse or a cloud provider’s bad deployment, the result is the same. The institution stops. And no SLA, contract or compliance certification prevents that moment from arriving.

Vigilance is not optional. Technologies are evolving faster than any IT team can fully anticipate. New platforms, new integrations, new dependencies emerge constantly — and with each one comes a new potential failure point. That is not an argument against adopting new technology. It is an argument for the one principle that never becomes obsolete: Reliance on any single critical system, whether it is a connectivity provider, an identity platform or a SaaS solution, is a proven strategy for failure. The question is never whether that system will fail. The question is whether the institution is prepared when it does.

Single points of failure fail — inevitably, and at the worst possible time. IT professionals have known this for thirty years. The SaaS layer is not exempt.

This is not a new lesson. Azure has gone down. AWS has failed. Google Workspace has had outages that took organizations dark globally. No campus runs a single ISP connection — we provision redundant circuits, preferably from independent providers, because we learned long ago that the connection will sometimes fail and the institution cannot afford to stop when it does. Financial services, government and multinational enterprises applied that same logic to every dependency in their stack. Their response to platform risk was not to demand better SLAs. It was to architect around the dependency. Redundancy. Failover. Independent continuity capability. The massive disruptions from Canvas demonstrate that effective contingency solutions for these critical platforms have not kept pace with our dependence on them. We cannot get fooled again.

That omission is what made the 2026 attack so damaging. Not the sophistication of the breach — the entry point was a peripheral free-tier environment that wasn’t even within the vendor’s primary certification scope. The damage was catastrophic because institutions had no fallback. Faculty had no rosters. Administrators had no enrollment data. There was no continuity layer. A single point of failure, at institutional scale, with no plan for when it fails.

And now the economics have shifted in the worst possible direction. PowerSchool paid a ransom in December 2024 after attackers stole data on 60 million students — and was re-extorted anyway, with individual school districts receiving separate demands months later using the same stolen data. Instructure’s CEO publicly confirmed the extortion payment. Anyone who has paid a ransom only to be hit a second time at double the cost can tell you — paying the attackers resolves nothing and instead invites more attacks. The sector has now proven twice, publicly, and at scale, that it will pay. That changes the threat calculus entirely. Higher education stops being a target of opportunity and becomes a target of strategy. Criminal groups share that intelligence. Banner serves over 1,400 institutions. Blackboard reaches tens of millions of users across thousands of campuses. Every major higher education SaaS platform is now on active threat actor priority lists — not because they are newly vulnerable, but because the sector has proven it will pay, that academic calendar pressure creates maximum leverage, and that IT has not yet built the operational alternative that our dependence on these platforms demands — and therefore the failure is ours to own, especially if we allow it to happen a second time.

The sector has proven it will pay. Every ransomware group operating today just received the same market signal. What follows is not unpredictable — it is documented, underway and aimed directly at the platforms carrying your institution’s academic operations.

As a CIO, my approach to this is not a spreadsheet or a stack of printed reports. IT is responsible for identifying critical failure points and countering them — that is not optional; it is the job. Accepting failure as inevitable without a mitigation strategy is not viable. Redundancy and continuity solutions are standard practice everywhere else in our infrastructure. There was no reason the SaaS layer should be different.

A leader’s first job isn’t to be right — it’s to be responsible.

The solution I implemented is a secure, read-only, centralized repository — a continuity strategy that ensures students, staff and faculty can continue to function whether the issue is a power outage, a cyberattack or a SaaS platform going dark. It is not a replacement for Canvas or Banner. It is the independent fallback that allows the institution to keep operating while the primary system is restored. I have learned the hard way that accepting failure without a plan is not a posture any CIO can defend.

Watching the frustration across the industry during and after the 2026 attack — institutions paralyzed, peer CIOs improvising, faculty working from personal spreadsheets, boards asking questions no one could answer — the logic of extending this capability to other institutions became unavoidable. The solution is not complex. The architecture is straightforward. The discipline behind it is thirty years old. The discipline is established. The responsibility to apply it is our field of expertise in IT.

To be precise about scope: An ACR does not prevent vendor breaches, replace cyber insurance or remove notification obligations. When an incident hits, legal counsel, security teams and institutional leadership still manage the response. What the ACR changes is what they have to work with — a governed, auditable record of what data was accessed, what manual actions were taken and how operations continued while the vendor worked to restore service.

Redundancy, disaster recovery, continuity of operations — the discipline is not new. The SaaS platforms carrying academic operations deserve the same standard we hold everywhere else.

The solution to this problem exists. A SaaS third-party continuity of operations strategy requires an independent data layer — one the institution controls, synchronized on a regular scheduled cycle from source systems, and accessible when those systems are not. Platform-agnostic across Canvas, Banner, Blackboard and PowerSchool. Read-only by design. Auditable by requirement. Independent by architecture. That last word is the one that matters — independent of the platforms whose availability you cannot guarantee.

Every CIO in higher education knows what a single point of failure looks like. Every one of us has built around them at every other layer. Servers, networks, data centers — we do not accept the single-point risk, and we do not wait for the failure to motivate the fix. The SaaS layer is not an exception.

The question is not whether your institution will face it. The question is whether you will have a continuity strategy in place when it arrives — or be explaining to your board why you did not.

Leaders don’t rent accountability — they own it outright.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

SAP가 AI 전환에 필요한 재원을 마련하기 위해 채용과 출장 비용을 줄인다.

블룸버그에 따르면 SAP는 최근 사내 이메일을 통해 “장기적인 성공에 핵심적인 AI 직무를 중심으로 일부 직군에 한해서만 신규 채용을 진행할 것”이라고 직원들에게 공지했다.

또 AI 개발과 직접 관련된 경우를 제외한 내부 출장을 중단하고, 협력업체 관련 비용을 포함한 다른 지출을 줄이는 방안도 검토하고 있다고 밝혔다.

SAP 대변인은 CIO.com에 이 같은 내용을 확인하며 “SAP는 고객에게 장기적인 가치와 혁신을 제공할 수 있는 분야에 자원을 집중하기 위해 투자 현황을 지속적으로 점검하고 있다”라며 “이러한 방침에 따라 AI 관련 역량과 인재, 기술에 대한 투자를 우선하는 한편, 채용과 외부 지출, 내부 출장은 더욱 엄격하게 관리하고 있다. 고객 대상 활동과 핵심 AI 프로젝트는 기존과 동일하게 전폭적으로 지원할 것”이라고 설명했다.

이번 조치는 AI 전략을 한층 강화하려는 SAP의 행보를 보여주는 사례로 볼 수 있다. 여기에는 SAP의 AI 디지털 비서 ‘쥴(Joule)’에 대한 투자 확대도 포함된다. 앞서 지난 주 SAP CEO 크리스티안 클라인은 대부분의 AI 개발 조직을 직접 총괄하는 역할을 맡았다. 지난 3월에는 영업, 구축, 서비스, 지원 조직의 관리 권한을 현재 최고고객책임자(CCO)를 맡고 있는 토마스 자우어에시히 이사회 멤버가 이끄는 고객가치그룹(Customer Value Group)으로 이관한 바 있다.

고객이 체감할 수 있는 가치가 중요

컨설팅 기업 인포테크리서치 그룹(Info-Tech Research Group)의 수석 리서치 디렉터 테라 히긴슨은 SAP가 AI 도입을 확대해 회사의 전략을 뒷받침하고 투자 효과를 입증해야 하는 상황이지만, “고객은 추가 예산을 투입하거나 운영 우선순위를 높이기 전에 AI가 어떤 가치를 제공하는지 보다 명확한 근거를 확인하기를 원한다”라고 말했다.

히긴슨은 SAP 역시 다른 소프트웨어 기업들과 마찬가지로 여러 압박에 직면해 있다고 분석했다. SaaS 기업의 시장 가치는 이전 호황기보다 여전히 크게 낮은 수준이며, AI는 구축과 운영, 확장에 많은 비용이 들어간다. 반면 AI가 얼마나 실질적인 수익을 가져다줄지는 아직 불확실하다.

히긴슨은 “지금은 비용을 공격적으로 늘릴 시기가 아니다”라며 “SAP는 경쟁 우위를 분명히 확보할 수 있는 분야에 집중적으로 투자해야 한다. AI 디지털 비서 쥴은 지금까지 기대에 미치지 못했지만, SAP는 사용자들에게 이를 적극 활성화하도록 독려하고 있는 것으로 알고 있다. 이런 점이 현실적인 긴장을 만들어내고 있다”라고 평가했다.

AI가 바꾸는 인력 구조

AI는 SAP가 2024년 구조조정 당시와 같은 대규모 감원을 피하려는 전략에도 영향을 미치고 있다. 뉴욕타임스에 따르면 SAP는 새로운 AI 기술을 활용해 직원들이 보다 높은 가치를 창출하는 새로운 역할을 만들어내도록 장려하고 있다.

또한 클라인 CEO는 머지않은 미래에 인력이 줄어드는 것이 아니라 지금과는 전혀 다른 형태의 인력 구성이 될 것으로 내다봤다. 그는 2~3년 뒤에도 사람이 직접 소프트웨어 코드를 작성하는 일이 남아 있을지 확신할 수 없다고 밝혔다.

또 다른 컨설팅 기업 무어인사이트앤드스트래티지(Moor Insights & Strategy)의 부사장이자 수석 애널리스트인 제이슨 앤더슨은 직원들이 AI를 적극 활용하면 일상적인 업무 방식 자체가 달라진다고 설명했다. 예를 들어 소프트웨어 엔지니어는 코딩에 쓰던 시간이 줄어들면서 보안 점검이나 테스트 업무에 더 많은 시간을 투입하고 있다는 것이다.

앤더슨은 “하지만 이러한 업무 재배분은 아직 해결되지 않은 가장 큰 과제”라며 “미래의 업무 환경에 대한 논의와 그것이 현재 근로자에게 어떤 의미를 갖는지를 연결하는 핵심 고리가 아직 부족하다. 여기에 적어도 세 가지 요인이 당분간 이러한 변화의 정착을 어렵게 만들 것”이라고 말했다.

구체적으로 앤더슨은 AI가 업무 방식을 바꾸는 과정에서 해결해야 할 과제로 세 가지를 제시했다.

첫째, 현재 AI는 개인의 생산성을 높이는 데는 효과적이지만 팀 단위 협업을 지원하는 수준에는 아직 이르지 못했다.

둘째, AI 덕분에 과거에는 할 수 없었던 업무까지 수행할 수 있게 되면서 생산성이 크게 향상될 것이라는 기대가 있지만, 그런 업무 자체가 충분한 사업적 필요성을 갖추지 못한 경우도 적지 않다고 지적했다. 결국 AI로 확보한 생산성을 새로운 업무에 활용할 것인지, 아니면 단순히 비용과 예산을 줄이는 데 사용할 것인지가 기업의 과제로 남아 있다고 설명했다.

셋째, AI가 가져올 변화는 몇 달이나 몇 분기가 아니라 수년, 나아가 수십 년에 걸쳐 나타날 것이라고 전망했다. 자동화가 장기적으로는 오히려 일자리를 늘린다는 연구 결과를 고려하면, AI가 일자리를 변화시키더라도 결국 노동시장은 새로운 균형을 찾아갈 것이라고 내다봤다.

앤더슨은 SAP를 비롯한 기업들이 장기적인 경쟁력을 유지하기 위해 이러한 변화에 대응하는 것은 불가피하다고 평가했다. 다만 “단기적으로는 앞으로 나아가기 위해 많은 기업이 조직과 비용을 줄여야 할 것이며, 이는 영향을 받는 직원들에게는 결코 위로가 되지 않을 것”이라고 말했다.
dl-ciokorea@foundryco.com

Microsoft-CEO Satya Nadella sorgte kürzlich für Aufsehen, als er prognostizierte, dass traditionelle Enterprise-Anwendungen im Zeitalter der agentischen KI „kollabieren” würden. Die Befürchtungen vieler Anleger, dass AI-Agenten den Markt für Unternehmenssoftware erschüttern werden, spitzten sich Anfang Februar zu, als die Veröffentlichung von Anthropic Cowork einen massiven Ausverkauf von Software-Aktien auslöste.

Ist die „SaaS-pocalypse“ lediglich ein Phänomen der Wall Street, oder hat sie auch Auswirkungen auf CIOs? Ist die Rhetorik „SaaS ist tot“ realistisch, oder ist sie maßlos übertrieben? Wir haben Branchenbeobachter befragt, womit sie rechnen.

Etablierte Lieferanten sind im Vorteil

Branchenausblick: Die aktuellen Marktführer werden ihre Dominanz auf absehbare Zeit ausüben, indem sie KI-Agenten in ihre Plattformen integrieren.

Forrester-Analystin Kate Leggett hat eine klare Meinung zur Zukunft des Softwaremarktes: „Es gibt einmal die Bewertungen von Investoren und dann gibt es die Realität, was in großen Unternehmen tatsächlich geschieht und in welchem Zeitrahmen Veränderungen stattfinden werden.“ Kernanwendungen würden so schnell nicht verschwinden, erklärt sie gegenüber unserer US-Schwesterpublikation CIO.com, auch wenn es an den Rändern zur Erosion komme. In welchem Zeitrahmen? „Es könnte Jahrzehnte dauern, bis alle Ausgaben vollständig von KI-Agenten übernommen werden.“

Abonnieren Sie unserer CIO-Newsletter für mehr Analysen, Hintergründe und Deep Dives für die CIO-Community.

IT-Experte William Flaiz fügt hinzu: „Auf Führungsebene werden keine Entscheidungen getroffen, CRM-Systeme komplett abzuschaffen.“ Allerdings hätten CIOs in Unternehmen einen starken Anreiz, agentische KI in bestehende Plattformen zu integrieren, um mehr Wert aus ihren Investitionen herauszuholen. „Sie suchen nach Möglichkeiten, mit den ihnen zur Verfügung stehenden Tools bessere Ergebnisse zu erzielen“, sagt Flaiz.

„Hinsichtlich des Ausmaßes der Umwälzungen gibt es viel Schwarz-Weiß-Denken“, berichtet Alex Demeule, Senior Analyst bei Technology Business Review Inc. (TBRI). „Natürlich wird KI einen großen Einfluss auf Softwareanbieter haben. Aber in den kommenden fünf bis zehn Jahren sind sie viel besser positioniert für den Sprung ins KI-Zeitalter, als es der Aktienkurs vermuten lässt.“ Seine Prognose lautet, dass Agentic AI nur langsam eingeführt wird und Menschen noch viele Jahre lang eine Rolle spielen werden.

Agentic AI wird Preismodelle revolutionieren

Branchenausblick: Agentische KI wird einen grundlegenden Wandel von Abo-basierenden hin zu verbrauchs- oder ergebnisorientierten Preismodellen auslösen.

Dana Gardner, Präsident und Chefanalyst bei Interarbor Solutions, ist der Ansicht, dass es kurz- bis mittelfristig weniger darum geht, bestehende Software-Systeme komplett zu ersetzen. Vielmehr stehe das Ende der Preismacht ihrer Lieferanten bevor. „Versierte CIOs werden KI nutzen, um die Gesamtkosten der IT zu senken.” Schließlich seien KI-Agenten in der Lage, Verbrauchs- und Nutzungsmuster von Business-Applikationen zu verstehen. CIOs können diese Erkenntnisse in günstigere Verträge umsetzen.

In einem Bericht über die Auswirkungen von KI auf den SaaS-Markt schreibt die Unternehmensberatung Bain & Co.: „Wenn ein AI Agent eine menschliche Aufgabe ersetzt, erwarten Kunden, dass sie auf Basis der Ergebnisse bezahlen und nicht nach der Anzahl der Anmeldungen. Marktführer wie Intercom und Salesforce bewegen sich bereits in diese Richtung. Der grundlegende Wandel besteht darin, nicht mehr für den Zugriff, sondern für die geleistete Arbeit zu berechnen.“

Auch die Marktbeobachter von IDC stellen im Report „FutureScape: Worldwide Agentic AI 2026 Predictions“ fest, dass eine rein auf Nutzerlizenzen basierende Preisgestaltung bis 2028 überholt sein wird. So würden 70 Prozent der Softwareanbieter demnach ihre Preisstrategien auf neue Wertkennzahlen wie Verbrauch, Ergebnisse oder organisatorische Fähigkeiten umstellen.

Laut Forrester-Analystin Leggett werde sich die Abkehr von Abo-Preisen auf verschiedene Weise vollziehen. So könnte ein CIO, der ein Abonnement für 100 Lizenzen hat, beispielsweise 10 oder 20 dieser Lizenzen gegen eine nutzungs- oder ergebnisbasierte Abrechnung umtauschen. Lieferanten würden voraussichtlich Lizenzstufen oder flexible Optionen mit einer Art agentenbasierter Preisgestaltung anbieten.

Softwareplattformen werden fusionieren und neue Rivalitäten schaffen

Branchenausblick: Da KI-Agenten nicht unterscheiden, woher die Daten stammen, werden die Grenzen zwischen traditionellen Kategorien der Unternehmenssoftware wie CRM und ERP verschwimmen.

Um effektiv zu arbeiten, benötigen KI-Agenten Zugriff auf Daten, unabhängig davon, wo diese gespeichert sind. SaaS-Anbieter haben das erkannt und heben die Grenzen zwischen CRM, ERP, IT-Service-Management und anderen Kategorien auf. Leggett weist beispielsweise darauf hin, dass Lieferanten wie Oracle und Microsoft einheitliche Datenplattformen aufbauen. Diese lassen sich via Model Context Protocol (MCP) integrieren, um komplexe KI-basierte Workflows zu unterstützen.

• Oracle bietet eine integrierte Suite aus cloudbasierten ERP- und CRM-Anwendungen sowie eine vollständig verwaltete agentenbasierte Plattform an.
• Microsoft offeriert unter dem Dach von Dynamics 365 sowohl ERP- als auch CRM-Funktionalitäten, ebenso wie branchenspezifische Lösungen auf Basis kleiner Sprachmodelle (SLMs), die schlanker und kostengünstiger sind als LLMs.
• SAP integriert seine Signavio-Suite für Geschäftsprozess-Management, sein LeanIX-SaaS-Tool für Unternehmensarchitektur-Management sowie seinen Joule-AI-Agenten zu einem einheitlichen System.
• Salesforce führt sein Mulesoft-Angebot für Integration und Automatisierung als Platform-as-a-Service mit seiner Data360-Kundendatenplattform und seiner Agentforce-AI-Plattform zusammen.
• Das IT-Service-Management-Schwergewicht ServiceNow hat die Übernahme des Anbieters der agentischen KI-Plattform Moveworks abgeschlossen und Salesforce im CRM-Bereich herausgefordert.

Gewinner und Verlierer im Software-Sektor

Branchenausblick: Agentic AI wird erhebliche Auswirkungen auf Anbieter von Einzelprodukten haben. Anbieter mit generischen Apps müssen kämpfen, während Lieferanten beispielsweise branchenspezifischer Tools besser aufgestellt sind.

Laut Analystin Leggett von Forrester werden Einzelprodukte wie Workflow-, Tabellenkalkulations- oder einfache Projektmanagement-Apps „in relativ kurzer Zeit verschwinden“, da sie leicht nachzubilden sind. Stark vertikalisierte Apps seien besser vor Disruption geschützt, da sie tiefgreifendes Fachwissen und Integrationen mit angrenzenden Systemen, beispielsweise aus den Bereichen CAD oder medizinische Bildgebung, bieten. Beispiele hierfür sind Epic und Cerner für das Management elektronischer Patientenakten (EHR), IQVIA für Pharmazie und Biowissenschaften oder Procore im Bauwesen.

Laut Leggett verfügen die großen Anbieter von CRM-Plattformen über eingebaute Vorteile: einen Schutzwall um ihre Daten, branchenspezifisches Wissen und Workflows, tiefe Partnernetzwerke, bewährte Branchen-Practices sowie Fachwissen in regulatorischen Feldern. Demeule von TBRI weist zudem darauf hin, dass etablierte Anbieter gerade deshalb langfristig Bestand haben, weil sie sich bei jeder Disruptionswelle erfolgreich neu ausrichten konnten – sei es beim Übergang von On-Premises-Lösungen zur Cloud oder bei der Umstellung von unbefristeten Lizenzen auf Abonnements.

Vibe-Coding als Disruptor spezifischer Segmente

Branchenausblick: Vibe-Coding könnte die Vormachtstellung der SaaS-Anbieter ins Wanken bringen und Endnutzern die Möglichkeit geben, ihre eigenen Agenten zu erstellen.

Vibe-Coding, also KI-Agenten zu verwenden, um Software auf Basis einfacher Eingaben in natürlicher Sprache zu erstellen, hebt die Low-Code- und No-Code-Bewegung auf eine neue Stufe. Mithilfe von Vibe-Coding können Software-Anwender KI-Dienste nutzen, um eine Produktivitäts-App zu erstellen, die über die Grenzen einer traditionellen CRM- oder ERP-Plattform hinausgeht.

Laut Leggett stellt Vibe-Coding eine echte Bedrohung dar, da es Arbeitnehmern potenziell ermöglicht, produktiver zu sein. So ließen sich traditionelle Plattformen für Enterprise-Software umgehen, auch weil sie von vielen Nutzern als aufgebläht und kompliziert angesehen werden.

Unternehmen, die technologisch rückständig sind, verfügen möglicherweise nicht über die Fähigkeiten oder das Selbstvertrauen, eigene Agenten zu entwickeln und einzusetzen, die geschäftskritische Arbeitsabläufe beeinflussen. „Vibe-Coding als punktuelle Lösung betrachten wir als disruptiv”, sagt Demeule. „Geschäftsmodelle für kleine, isolierte Lösungen geraten durch AI-Agenten in große Gefahr. Wer aber komplexe, unternehmenskritische Infrastrukturen managt, der ist aktuell sicher, weil KI diese Komplexität noch nicht beherrscht.“

Eine agentische Orchestrierungsschicht entsteht

Branchenausblick: Es wird weiterhin herkömmliche SaaS-Anwendungen geben, doch diese werden voraussichtlich hinter einer agentischen Orchestrierungsschicht verborgen sein.

Analysten sind sich einig, dass die Benutzeroberfläche der Zukunft nicht die herkömmliche SaaS-Lösung, sondern agentisch sein wird, während das CRM- oder ERP-System in den Hintergrund tritt. IDC-Analyst Bo Lykkegaard erläutert den Trend: „Komplexität ist die Achillesferse des SaaS-Modells. Jede SaaS-Anwendung erfordert eine eigene Lernkurve und Benutzeroberfläche, was bei sporadischer Nutzung schnell zu Ineffizienzen führt.“

KI biete hier eine überzeugende Lösung: Anstatt durch mehrere Dashboards zu navigieren, könnten Nutzer mit agentengesteuerten, dialogorientierten Schnittstellen interagieren, die systemübergreifend Aufgaben ausführen. Das Ergebnis? „KI als eine neue Schnittstellenschicht, die Komplexität abstrahiert, repetitive Prozesse automatisiert und neu definiert, wie Menschen Software nutzen.“ Die entscheidende Frage für die kommenden Jahre: Werden CIOs diese Funktionalität von ihren aktuellen Software-Lieferanten oder von Disruptoren wie OpenAI, Anthropic und Palantir beziehen? (ajf/jd)

Only 35% of CIOs have full visibility into their AI operating costs, according to a recent KPMG survey. That makes it difficult for them to control spend on software-as-a-service offerings from vendors who, like Workday, have incorporated pay-as-you-go agentic AI into their offerings. Workday is one of several vendors that have shifted to a hybrid subscription/consumption pricing model.

“Fundamentally, with AI we are shifting the value of what enterprise software as a service is delivering in the industry,” Workday CTO Gabe Monroy explained in a recent interview. “The key, though, is that the value is no longer derived by a fixed factor, like how many employees you have working for you. It’s now going to be derived by how much use are you getting out of the system, hence the consumption.”

However, “It’s going to be in some cases disruptive to our customers, and it’s incumbent on us to provide them with tools to forecast and navigate that transition effectively,” he said.

That will be welcome news for the 40% of organizations that KPMG found have usage or token budgets in place.

The changes Monroy described are part of an industry trend, according to Terra Higginson, principal research director at Info-Tech Research Group. “What we are seeing in the market is that basic seat pricing and seat counts are not going away. Customers are still paying for the core subscription footprint. AI is being layered on top as an incremental cost,” she said. “The practical message is simple: expect to pay more. The pricing model may shift from seats to credits or consumption, but the direction of spend is still up.”

And because each vendor’s program has its own twists and its own ways of measuring and charging for usage, every new model adds a layer of complexity to the budgeting headaches CIOs already face thanks to the ongoing move to consumption-based services, which began with the cloud.

Two parts to the model

Workday’s AI pricing model is in two parts. First, customers subscribe to the services they want, as they always have. With that subscription, they receive a pool of Flex Credits that can be used to enable AI agents and other “applicable platform capabilities” including Agent-Ready Tools, Workday Data Cloud, and high-volume use of Sana through its conversational AI interface. The number of credits included varies by company size. But on top of that, they also purchase a subscription for additional Flex Credits that can be applied to any product they subscribe to.

Flex Credit usage is monitored through the Platform Consumption Console, which generates alerts when consumption hits 80%, 90% and 100% of subscribed credits. Use is metered when a task is completed.

However, one Flex Credit doesn’t necessarily equal one action. Workday’s rate card lists the number of credits per activity; for example, as of May 21, in the Recruiting Agent, it currently costs six credits to screen and grade each candidate’s resumé against a job opening, and 750 credits per requisition to identify relevant leads in existing talent pools and rediscover candidates for recruiters, recommending jobs for those candidates to apply for. In the Contract Negotiation Agent, the review and redlining of a contract, based on a playbook, costs 500 credits.

The company also provides a reference guide listing the credits used by actions performed by the Sana platform and by self-service agents.

The good news is that, though Workday’s console counts credits used in both production and pre-production environments, only those used in production are charged for, offering an early budgeting reality check and a chance to tweak processes before they land in production. Pre-production usage count is only in aggregate, however, so if a customer wants to size a specific agent, the best approach is to run it in a defined window or dedicated test tenant and compare usage before and after the test.

Use them or lose them

The bad news is that Flex Credits expire after one year, and any left in a subscription do not roll over to the next; it’s a use them or lose them situation.

If, on the other hand, a customer exceeds their Flex Credit balance during the year, Workday said it does not just turn off their agents or other access to services. Instead, Workday’s account teams “partner with them to reconcile usage and help them purchase additional credits.”

Analysts agree that there are pros and cons to this new market reality.

“Workday’s Flex Credits are part of a broader shift we’re seeing across SaaS,” said Melody Brue, principal analyst at Moor Insights & Strategy. “Vendors are defining their own proprietary units for AI consumption so they can meter usage on top of existing subscriptions.”

Workday’s model, she said, is more flexible than a static AI add-on because customers can use Flex Credits for whichever agents drive the most value at a given time and get access to new AI capabilities as they launch.

The trade-off, however, is predictability. “Credit burn rates vary widely by task,” she said. A pilot can quietly consume a year’s worth of Flex Credits within weeks without strong telemetry and governance. And that, she said is what worries technology and finance leaders: apparently successful AI adoption that shows up as a budget surprise.

But, said Scott Bickley, advisory fellow at Info-Tech Research Group, “The Workday Flex Credits Rate Card seeks to quantify consumption of Flex Credits to specific value-added actions that are AI agent-driven. Many other vendors in the ERP space have created incredibly complex, multi-layered consumption models, leaving their customers’ heads spinning as they seek to decipher how capacity will be consumed, much less if it can add value.”

Brue, too, approved of Workday’s model, although she said that a core issue with AI pricing today is that vendors are each defining their own units, with no common measurement across platforms. This gives vendors pricing flexibility, but makes customers do extra work to create meaningful metrics like cost per resolution or cost per process run, just to keep budgets and ROI under control.

“Workday’s Flex Credits are a smart move for Workday because they align revenue with AI usage, but from the buyer’s side, they raise the bar on FinOps and governance,” she said. “You need clear dashboards, guardrails, and forecasting, or that flexibility can quickly turn into a budget black hole.”

KI-Agenten könnten die Geschäftsmodelle klassischer Enterprise-Softwareanbieter grundlegend verändern. Bis 2030 stehen dadurch laut Gartner weltweit bis zu 234 Milliarden Dollar an Ausgaben für Unternehmenslösungen auf dem Spiel. Denn autonome Systeme interagieren zunehmend direkt mit Business-Anwendungen und umgehen dabei menschliche Nutzer.

„Unternehmen kaufen Software künftig nicht mehr in erster Linie für Menschen, sondern zunehmend für KI-Agenten“, erklärt George Brocklehurst, Managing Vice President bei Gartner, im Gespräch mit CIO.com. „Seit Jahrzehnten wird Software nach ihrer Benutzeroberfläche, der User Experience, der Bedienbarkeit, den Workflows und dem Schulungsaufwand bewertet. Wenn KI-Agenten jedoch zu den primären Nutzern werden, verlieren diese Faktoren erheblich an Bedeutung.“

Nach Schätzungen von Gartner werden die gefährdeten Umsätze bis zum Ende des Jahrzehnts rund 20 Prozent der weltweiten Enterprise-SaaS-Ausgaben ausmachen.

“Agentic Arbitrage” verändert den Softwaremarkt

Als Ursache nennt Gartner den Trend zur sogenannten „Agentic Arbitrage“. Gemeint ist der Einsatz von KI-Agenten, die Geschäftsprozesse eigenständig über mehrere Unternehmensanwendungen hinweg ausführen. Dadurch müssen Beschäftigte immer seltener direkt mit den Benutzeroberflächen einzelner Anwendungen arbeiten.

„Agentische KI verändert die Ökonomie von Software“, erklärt Brocklehurst. Diese Systeme übersprängen häufig die klassische Softwareoberfläche und lieferten direkt die gewünschten Ergebnisse. Dadurch werde die bislang enge Verbindung zwischen der Zahl der Anwender und dem Umsatz vieler Softwarehersteller aufgebrochen.

CIOs müssen Software neu bewerten

Für CIOs bedeutet diese Entwicklung laut Brocklehurst ein Umdenken bei der Auswahl und Beschaffung von Unternehmenssoftware.

Statt vor allem auf Benutzerfreundlichkeit und Oberflächendesign zu achten, sollten Unternehmen künftig prüfen, ob KI-Agenten über APIs sämtliche Geschäftsprozesse ausführen können, die bislang über die Benutzeroberfläche von Menschen erledigt werden.

„Entscheidend ist zunächst, ob ein Agent über die API alles – und idealerweise mehr – erledigen kann als ein Mensch über den Bildschirm und ob die Lizenzbedingungen des Herstellers dies überhaupt zulassen“, so Brocklehurst.

Dies verändert auch die Art und Weise, wie Softwareverträge bewertet werden sollten.

„Prüfen Sie die Vertragsbedingungen genauso sorgfältig wie die Technologie selbst“, rät der Gartner-Mann. „Die Lizenzbedingungen vieler Anbieter können die Nutzung durch autonome Systeme Dritter technisch oder finanziell einschränken oder sogar untersagen. CIOs könnten feststellen, dass ihre KI-Strategie nicht an fehlender Technologie scheitert, sondern an Klauseln, die sie bereits unterschrieben haben.“

Sein Rat: Unternehmen sollten bereits heute vertraglich festschreiben, welche Rechte KI-Agenten bei der Nutzung von Unternehmenssoftware erhalten. Viele der heute abgeschlossenen Verträge werden noch gültig sein, wenn Agentic AI im Unternehmensalltag zum Standard geworden ist.

Die Wissenshoheit wird zum nächsten Streitpunkt

Neben APIs und Lizenzbedingungen sollten Unternehmen genau darauf achten, wo das durch KI entstehende operative Wissen gespeichert und genutzt wird, betont Brocklehurst.

Jede Korrektur, jede Ausnahme und jeder Workflow, den ein KI-Agent verarbeitet, erzeuge neues organisatorisches Wissen.

Gartner bezeichnet die Fähigkeit eines Unternehmens, dieses Wissen zu bewahren, als Knowledge Retention Rate (KRR).

„Wenn dieses Wissen in die gemeinsamen Modelle des Softwareanbieters einfließt, verbessert Ihre operative Erfahrung ein Produkt, das auch Ihre Wettbewerber nutzen“, so Brocklehurst. „Die wichtigste Klausel der nächsten Generation von Softwareverträgen lautet daher: Wem gehört das, was das System von Ihnen lernt?“

Nach Einschätzung von Gartner droht Unternehmen eine neue Form des Vendor Lock-in, wenn das im Betrieb gewonnene Wissen beim Softwareanbieter verbleibt statt beim Kunden.

Klassische SaaS-Ökonomie gerät unter Druck

Laut Gartner könnten KI-Agenten, die Aufgaben über mehrere Unternehmensanwendungen hinweg ausführen, die direkte Interaktion der Nutzer mit traditionellen Softwareoberflächen reduzieren. Dadurch würde die seit langem etablierte Verbindung zwischen tatsächlicher Softwarenutzung und nutzerbasierter Lizenzierung (Seat-based Licensing) zunehmend an Bedeutung verlieren.

Gartner empfiehlt etablierten Softwareanbietern deshalb, ihren Mehrwert künftig weniger über Benutzeroberflächen als vielmehr über geschäftliche Ergebnisse (Outcomes) zu definieren. Gleichzeitig sollten sie agentengestützte Funktionen direkt in Geschäftsprozesse integrieren und sicherstellen, dass kundenspezifisches Wissen erhalten bleibt.

Davon könnten KI-native Start-ups und Serviceanbieter gleichermaßen profitieren. Sie haben die Chance, sich als Orchestrierungsebene zu etablieren, die Arbeitsabläufe über mehrere Unternehmensanwendungen hinweg koordiniert.

„Während dieser Wandel eine existenzielle Bedrohung für Anbieter darstellt, die an veralteten Dashboards und nutzerbasierten Modellen festhalten, eröffnet er gleichzeitig erhebliche Umsatzchancen für Unternehmen, die Services und Plattformen für agentengestützte, bereichsübergreifende Workflows entwickeln“, so Brocklehurst.

Governance muss mit autonomen Systemen Schritt halten

Gartner rät CIOs außerdem, Governance-Strukturen aufzubauen, bevor autonome KI-Agenten zum Standard werden.

„Autonomie sollte niemals stillschweigend oder uneinheitlich vergeben werden“, betont Brocklehurst. Unternehmen sollten die Autonomie von Agenten als explizite Governance-Entscheidung behandeln und dabei festlegen, wo Agenten unabhängig agieren dürfen, wer diese Entscheidungen genehmigt und wie häufig diese Berechtigungen überprüft werden sollten.

„Unternehmen, die diese Fähigkeiten bereits heute entwickeln, werden schneller und zugleich sicherer handeln können, wenn die Technologie den nächsten Reifegrad erreicht“, so der Gartner-Analyst.

Obwohl Gartner den Wandel als eine Neudefinition der seit Jahren diskutierten „Saaspocalypse“ beschreibt, erwartet Brocklehurst keineswegs das Ende von Software-as-a-Service.

„Das ist weniger eine Apokalypse als vielmehr eine Metamorphose“, erklärt er. „SaaS wird nicht verschwinden – nur in einer anderen Form weiterbestehen.“ (mb)

Dieser Artikel basiert auf einem Beitrag von CIO.com.

SAP is limiting hiring and travel spending to help pay for its AI transformation.

The tech giant will “exclusively focus new hiring on selected profiles only, mainly core Al roles, that are critical for our long-term success,” staff were reportedly told in an internal email.

The email also said that internal travel, unless it is related to AI development, will be suspended, and that the company is looking at ways to cut other spending with suppliers, Bloomberg reported.

An SAP spokesperson confirmed the report, telling CIO, “SAP continually reviews its investments to ensure resources are focused on the areas that will drive long-term customer value and innovation. As part of this approach, we are prioritizing investments in AI-related capabilities, talent, and technologies while applying greater discipline to hiring, external spending, and internal travel. Customer-facing activities and critical AI initiatives remain fully supported.”

This is yet another part of the SAP’s efforts to accelerate its focus on AI, including its digital assistant, Joule. Earlier this week, CEO Christian Klein took on direct responsibility for most of its AI development teams. In March, Klein had passed oversight of sales, delivery, service, and support to the new Customer Value Group under executive board member Thomas Saueressig, now chief customer officer.

Customers need to see value

Terra Higginson, principal research director at Info-Tech Research Group, said that while SAP needs AI adoption to support its strategy and justify its investments, “customers still need to see a clearer value proposition before they commit more budget or operational attention.”

Like many software companies, SAP is facing multiple pressures, she said: SaaS valuations remain significantly below prior-cycle highs, AI is expensive to build, operate, and scale, and the commercial payoff from AI remains uncertain.

“This is not a time for lavish spending,” she said. “SAP needs to be disciplined about where it invests, focusing on areas that create clear competitive differentiation. Joule has been underwhelming so far, yet I hear that SAP is pushing users hard to turn it on. That creates a real tension.”

Reshaping the workforce

AI is also behind SAP’s attempt to avoid layoffs like those that occurred during its 2024 restructuring. The company is encouraging employees to invent “more valuable jobs,” assisted by the new technologies, The New York Times reported. The report said that in the not too distant future, CEO Klein is expecting to see not a smaller workforce, but a very different one; he is not sure whether there will be any people coding software in two or three years.

Jason Andersen, VP and principal analyst at Moor Insights & Strategy, said that when workers use AI a lot, it changes how they interact with their daily tasks. For example, software engineers are now doing more security and testing tasks as their time is freed up from coding.

“But, this rebalancing of work is the big challenge that hasn’t been worked out yet,” he said. “That is the missing link in this whole future-of-work story and how that translates to today’s worker. And that has three major mitigating factors that at least temporarily disrupt good intentions.”

First, he said, AI tends to be a personal productivity enhancer and is not yet team friendly. Second, “There’s an argument that AI will enable us to be so much more productive since we can now do those things that we could not before. Except that those things never really had a strong enough case to begin with. So, will we use this new capacity to do that or just cut the budget?”

And thirdly, he pointed out, “macro views get sorted out in years and decades, not months and quarters. AI will change jobs, and, if you believe the research suggesting automation actually increases the number of jobs over time (which I do), it will work itself out.”

SAP and other companies must do these things to stay competitive over the long run, he said, but, “In the short run, a lot of companies will have to scale back to move forward, which is of little consolation to those impacted.”

“Ya no se compra software principalmente para personas; cada vez se compra más para agentes”, explica George Brocklehurst, vicepresidente ejecutivo de Gartner. “Durante un par de décadas, el software se ha evaluado por su interfaz y por la experiencia de usuario: facilidad de uso, flujos de trabajo, formación. Cuando los agentes de IA se convierten en el usuario principal, todo eso pierde valor”.

Gartner estima que el gasto expuesto representará alrededor del 20% del gasto empresarial en SaaS al final de la década. La consultora atribuye este cambio al fenómeno que denomina ‘arbitraje agentivo’ (agentic arbitrage), es decir, el uso de agentes de IA para completar tareas empresariales a través de múltiples sistemas corporativos, reduciendo la necesidad de que los empleados interactúen directamente con cada aplicación.

Según Brocklehurst, la IA agentiva está cambiando la economía del software. Estos sistemas suelen omitir los flujos tradicionales de uso del software y entregar directamente los resultados, rompiendo así la relación histórica entre el crecimiento del número de usuarios y el crecimiento de los ingresos de muchos proveedores de software empresarial.

Los CIO deberán replantearse la adquisición de software

La aparición de la IA agentiva obligará a los CIO a evaluar el software empresarial de otra manera. En lugar de centrarse principalmente en la experiencia de usuario y el diseño de las interfaces, las organizaciones deberán analizar si los agentes de IA pueden realizar, mediante API, todas las funciones que hoy ejecutan los usuarios humanos a través de pantallas y aplicaciones.

“Lo realmente importante es determinar si un agente puede hacer todo —e incluso más— a través de la API de un sistema que lo que una persona puede realizar mediante una interfaz gráfica, y si las condiciones del proveedor lo permiten”, afirma Brocklehurst.

Este cambio también afecta a la forma de evaluar los contratos de software. “Examine el contrato con la misma atención con la que examina la tecnología”, recomienda. “Las condiciones de los proveedores pueden prohibir o restringir —desde el punto de vista técnico o financiero— el uso autónomo por parte de terceros. Los CIO podrían descubrir que su estrategia de IA está bloqueada no por una limitación tecnológica, sino por cláusulas que ya firmaron”.

Por ello, aconseja que las organizaciones negocien desde ahora los permisos para el uso de agentes en sus acuerdos de software, ya que muchos contratos seguirán vigentes cuando los agentes de IA se generalicen.

La propiedad del conocimiento será el próximo campo de batalla

Más allá de las API y las licencias, las empresas deberán prestar especial atención a dónde se almacena el conocimiento generado por los sistemas de IA. Cada corrección, excepción o flujo de trabajo gestionado por un agente crea conocimiento organizativo. Gartner denomina Knowledge Retention Rate (KRR) o tasa de retención del conocimiento a la capacidad de una organización para conservar ese aprendizaje.

“Si ese conocimiento acaba alimentando los modelos compartidos del proveedor, la experiencia operativa de su empresa estará mejorando un producto que también utilizan sus competidores”, señala Brocklehurst. “La cláusula más importante de la próxima generación de contratos de software será: “¿Quién es el propietario de lo que el sistema aprende de usted?””.

Según Gartner, las empresas corren el riesgo de caer en una nueva forma de dependencia tecnológica (vendor lock-in) si ese aprendizaje operativo permanece en manos de los proveedores y no de los clientes.

El modelo económico tradicional del SaaS afronta una disrupción

Gartner sostiene que los agentes de IA capaces de ejecutar procesos en múltiples aplicaciones empresariales reducirán la interacción directa de los usuarios con las interfaces tradicionales, debilitando el vínculo histórico entre el uso del software y las licencias basadas en número de usuarios.

Ante este escenario, los proveedores consolidados deberán evolucionar desde una propuesta de valor centrada en la interfaz hacia otra basada en los resultados, incorporando capacidades agentivas directamente en los procesos de negocio y preservando el conocimiento específico de cada cliente.

Al mismo tiempo, las startups nativas de IA y los proveedores de servicios podrían beneficiarse al convertirse en la capa de orquestación encargada de coordinar el trabajo entre múltiples aplicaciones empresariales. “Aunque este cambio supone una amenaza existencial para los proveedores que siguen defendiendo modelos basados en paneles de control tradicionales y licencias por usuario, también crea una importante oportunidad de ingresos para quienes desarrollen servicios y plataformas capaces de soportar flujos de trabajo transversales impulsados por agentes”, indica Brocklehurst.

La gobernanza debe evolucionar junto con los sistemas autónomos

Gartner también insta a los CIO a establecer marcos de gobernanza antes de que los agentes autónomos de IA se conviertan en algo habitual. “No conceda autonomía de forma implícita ni desigual”, advierte Brocklehurst. Las organizaciones deben tratar la autonomía de los agentes como una decisión explícita de gobierno corporativo, definiendo dónde pueden actuar de forma independiente, quién autoriza esas decisiones y con qué frecuencia deben revisarse esos permisos.

“Las empresas que desarrollen esa capacidad desde ahora podrán avanzar más rápido y con mayor seguridad cuando la tecnología esté preparada para asumir más responsabilidades”, concluye.

Aunque Gartner describe esta transición como una redefinición del concepto de ‘Saaspocalypse’, Brocklehurst subraya que el SaaS no desaparecerá. “Esto es menos un apocalipsis y más una metamorfosis. El SaaS no será destruido; simplemente emergerá bajo una forma diferente”.

Azure Linux 4.0 – ein Open-Source-Betriebssystem auf Linux-Basis – wurde auf der Entwicklerkonferenz Build 2026 von Microsoft vorgestellt. Im Gegensatz zu früheren Versionen soll Microsofts Linux-Distribution nun kostenlos verfügbar sein.

Technisch basiert Azure Linux 4.0 auf Fedora 43 und nutzt dasselbe RPM-basierte Paketverwaltungssystem. Berichten zufolge wurde das Linux-Derivat optimiert, um Workloads auf dem Azure-Cloud-Dienst auszuführen. Um Fehlerbehebungen und Sicherheits-Updates will sich Microsoft kümmern.

Azure Linux 4.0 ist nicht für Endverbraucher konzipiert und deshalb textbasiert. Deswegen beträgt die Größe auch nur knapp unter 300 Megabyte.

Es kann ab sofort über den Microsoft Marketplace heruntergeladen werden. (tf)

Dieser Artikel ist im Original bei unserer Schwesterpublikation Computersweden.se erschienen.

AI agents are poised to challenge traditional enterprise software business models, placing up to $234 billion in application software spending at risk by 2030 as they increasingly bypass human users and interact directly with business systems, according to Gartner.

“You are no longer buying software primarily for people; you are increasingly buying it for agents,” George Brocklehurst, managing vice president at Gartner, told CIO. “For a couple of decades, software has been evaluated on the interface, the user experience: usability, workflow, training. When AI agents become the primary user, all that depreciates.”

Gartner estimates that the exposed spending would account for about 20% of enterprise software-as-a-service (SaaS) spending by the end of the decade.

Gartner attributes the shift to what it calls “agentic arbitrage,” or the use of AI agents to complete business tasks across multiple enterprise systems, reducing the need for employees to interact directly with individual software interfaces.

Agentic AI changes the economics of software, Brocklehurst said, adding that these systems often bypass traditional software and deliver outcomes directly, breaking the link between user growth and revenue growth for many enterprise software vendors.

CIOs may need to rethink software procurement

The emergence of agentic AI will require CIOs to evaluate enterprise software differently, Brocklehurst said.

Instead of focusing primarily on user experience and interface design, organizations should assess whether AI agents can perform every business function through application programming interfaces (APIs) that human users can perform through application screens, he said.

“What really matters, as a starting point, is whether an agent can do everything—and more—through the system’s API that a human can do through a screen, and whether a vendor’s terms permit that,” he said.

That also changes how software contracts should be evaluated.

“Scrutinize the contract as much as you scrutinize the technology,” Brocklehurst said. “Vendors’ terms can prohibit or restrict — technically or financially — third-party autonomous use. CIOs may find their AI strategy blocked not by capability but by clauses they have already signed.”

He advised organizations to negotiate agent permissions into software agreements now because many existing contracts will remain in force when enterprise AI agents become mainstream.

Knowledge ownership becomes the next battleground

Beyond APIs and licensing, organizations should pay close attention to where AI systems retain operational learning, Brocklehurst said.

Every correction, exception, and workflow handled by an AI agent creates organizational knowledge, he said. Gartner refers to an organization’s ability to retain that knowledge as its Knowledge Retention Rate (KRR).

“If it accrues to the vendor’s shared models, your operational experience is improving a product your competitors also use,” Brocklehurst told CIO. “The most important clause in the next generation of software contracts is: ‘Who owns what the system learns from you?’”

According to Gartner, enterprises risk a new form of vendor lock-in if operational learning remains with software providers rather than the customer.

Traditional SaaS economics face disruption

According to Gartner, AI agents that execute work across multiple enterprise applications could reduce direct user interaction with traditional software interfaces, weakening the long-standing link between software usage and seat-based licensing.

Gartner said incumbent software providers should shift from interface-based value to outcome-based value, while embedding agentic capabilities directly into business processes and preserving customer-specific knowledge.

At the same time, AI-native startups and service providers could benefit by becoming the orchestration layer that coordinates work across multiple enterprise applications.

“While this shift is posing an existential threat for vendors who are defending legacy dashboards and seat-based models, it creates a substantial revenue opportunity for vendors who are enabling and developing services and platforms to support agentic-enabled cross-domain workflows,” Brocklehurst said.

Governance should evolve with autonomous systems

Gartner also urged CIOs to establish governance frameworks before autonomous AI agents become commonplace.

“Do not grant autonomy implicitly or unevenly,” Brocklehurst said. Organizations should treat agent autonomy as an explicit governance decision, defining where agents can operate independently, who authorizes those decisions, and how frequently those permissions should be reviewed.

“The companies that build that muscle now will move faster, and more safely, when the technology is ready for more,” he said.

Although Gartner described the transition as a redefinition of the long-discussed “Saaspocalypse,” Brocklehurst said SaaS itself would evolve rather than disappear. “This is less an apocalypse and more of a metamorphosis,” he said. “SaaS will not be destroyed; it will emerge in a different form.”

AI-powered software development tools integrate with your IDE and codebase, helping you to write, refactor, and fix code faster. These tools also make it fast and easy to create and run unit tests and integration tests — tasks that take more time when done manually.

Today, .NET developers often use GitHub Copilot, Claude Code, Cursor AI, and even AI chatbots like ChatGPT to generate code. In this article, we’ll cover some best practices you should follow when using AI to generate your C# code.

Challenges of using AI-generated code

While AI can write code for you, often the generated code does not work as intended. AI may generate code that contains logic errors, bugs, or security vulnerabilities, or code that doesn’t conform to your organization’s coding conventions or quality standards, or code that isn’t compatible with existing architecture. Further, AI may generate code that runs slowly or fails to run at all.

These are some of the key challenges organizations face when using AI-generated code in production:

• Inconsistency: The quality of AI-generated code can vary widely because the same generative AI prompt can produce different results, making it impossible to trust the code until it has been reviewed.
• Security: The potential for AI-generated code to generate insecure code is significant, because models are trained on open-source code that contains security vulnerabilities including weak/unsafe validation, injection patterns, hard-coded secrets, memory safety issues, and outdated dependencies.
• Accountability: AI-generated code often creates an accountability gap because organizations find they have limited visibility into how AI-assisted code was generated, approved, and tested.
• Contextual concerns: Because your AI-powered tool may not have access to project-specific conventions, abstractions, or business rules, the code it generates may not conform to the standards of your organization’s codebase.
• Overengineering: AI models can produce large amounts of unnecessary code and create additional layers of abstraction, making the code more complex and more difficult to understand and maintain.
• Error handling: Often, AI-generated code succeeds in creating the required logic based on the “happy path” of an application, but does not create sufficient or adequate recovery, retry, or validation logic. Additionally, AI-generated code may not incorporate proper error handling mechanisms.
• Technical debt: The sheer amount of generated code can require additional resources for reviewing, cleaning, refactoring, and debugging the code after the fact, as well as for maintaining the code in the future.

Best practices for using AI to write code

Here are some of the best practices you should follow when writing code using AI-powered tools:

Write clear and specific prompts

To get the best use of AI-assisted coding tools, you should be proficient in prompt engineering. Your prompts should be specific, concise, and contain relevant code examples to enable your AI-powered tools to generate code that is functional, meets the requirements, and conforms to the standards and guidelines. Most importantly, you should plan precisely on the architecture and design, the exact solution you need, the structure of the codebase, and the coding and design guidelines to follow.

Use AI as a peer programmer

You should always treat AI as a peer programmer and your (junior) coding assistant. You should always review code the AI generates for you, run tests, and perform audits to validate correctness, conformance to guidelines and standards, performance and scalability bottlenecks, and security vulnerabilities. Based on the outcome of the audit, you should refactor your AI-generated code accordingly. And, repeat this cycle iteratively — audit followed by refactoring (if required) — until you are satisfied with the code.

Favor quality over speed

Your application source code should be performant, scalable, secure, extendable, and easy to comprehend and maintain. One of the biggest challenges of using AI-generated code is ensuring it meets requirements and conforms to the guidelines and standards of your organization without compromising on performance, scalability, and security.

AI can generate code for you quite quickly, but the onus is on you to understand how the code works, investigate it for any flaws, test it thoroughly, and change it if and when it is needed. You must be sure to understand the code in its entirety. Unless you comprehend the code, you will never be able to improve or extend it when you need to.

And you must never compromise quality for speed. If you use AI as a shortcut, your code may fail when deployed to the production environment — and that would be a disaster.

Provide the right context

The code your AI-powered tool generates for you will be more useful to you if you’ve provided the right context. You should provide your AI coding tool with comprehensive, up-front information, such as architecture docs, coding standards, and relevant files, rather than just providing instructions using prompts. And you should add images or screenshots when specifying prompts to help your AI-powered tool better understand the context.

Your AI-generated code must be testable for best results. It is always a good practice to specify tests at the time when your AI-enabled tool generates code, as tests can help AI understand the expected behavior and produce code that better aligns with your expectations. Additionally, you should specify the exact goal, the current and/or target technology stack, the relevant code boundaries, and the definition of “done”, i.e., the desired outcome.

Creating a Data Transfer Object using GitHub Copilot

Remember, any AI-powered code generator is only as good as the input provided to it. This input is also known as the prompt. If the prompt you specify does not clearly state the objective, the generated code will not meet your requirements. Here is an example of a prompt that fails to consider performance and lacks clarity.

Generate code to create a Product DTO having fields Id, Name, and Price

When I entered this prompt into the GitHub Copilot Chat window, the following piece of code was generated.

public class Product
{
   public int Id { get; set; }
   public string Name { get; set; } = string.Empty;
   public decimal Price { get; set; }
   public Product() { }
   public Product(int id, string name, decimal price)
   {
       Id = id; Name = name; Price = price;
   }
}

Typically, a DTO (Data Transfer Object) should be created using records for improved performance instead of classes. Moreover, a DTO should be immutable by default, because its purpose is to store and pass data from the presentation layer to the business layer in an application. This not only guarantees thread safety but also prevents accidental changes to data and simplifies testability.

Now, let’s change the prompt as shown below and try again.

Create an immutable Product DTO using C# that uses the record type, having fields Id, Name, and Price.

When I entered the above prompt in GitHub Copilot Chat, a record type named ProductDto was created using a positional record as shown below.

public sealed record ProductDto(int Id, string Name, decimal Price);

Creating a logging library using GitHub Copilot

In this next example, we’ll use GitHub Copilot within the Visual Studio IDE. With GitHub Copilot up and running in our IDE, you can specify the following prompt for creating a logging library using GitHub CoPilot within the Visual Studio IDE:

Create an asynchronous logger using .NET 10 and C# 14 that:

• Stores logs asynchronously in a text file or a database
• Uses a SQLite database for storing logs in a database

The log target should be configurable, i.e., the storage target of the generated log can be a file, a database, or etc.

Create a separate class for each log target, i.e., FileLogger for storing logs in a file and DbLogger for storing logs in the databasDave Berminghame

Incorporate comprehensive error handling mechanism wherever applicable

Figure 1 shows this prompt in GitHub Copilot (running in Visual Studio) and the files that Copilot generated for the project.

Once you have provided the prompt as input to Github Copilot, it will parse the input and generate several files in your project. Figure 2 shows the two projects in the Solution Explorer window — the console application project and the AsyncLogger class library project.

The AsyncLoggerService class uses the System.Threading.Channel static class to write logs of type LogEntry in the log target, which can be a text file or a database. The System.Threading.Channel class contains two methods to create channels, the CreateBounded and the CreateUnbounded methods.

While CreateBounded is used to create a channel that holds a finite number of messages, CreateUnbounded is used to create a channel with unlimited capacity. You can learn more about working with System.Threading.Channel from my earlier article here.

Reviewing the AI-generated code

Although GitHub Copilot will generate the complete source code of the AsyncLogger library for you, you should carefully examine — and thoroughly test — the generated code before you use it in production. For example, when I submitted the above prompt to Copilot, the code generated included three issues that needed to be addressed. Let’s take a look.

Unbounded channel oops

In the AsyncLoggerService class, GitHub Copilot included the following code that uses an Unbounded channel.

_channel = Channel.CreateUnbounded(
    new UnboundedChannelOptions { SingleReader = true, SingleWriter = false });

There is a major flaw in this approach. If this code were used in production, memory consumption could surge dramatically under burst traffic (say, 10k or more requests per second). This growth in memory usage could result in GC pressure and eventually a crash of the application.

A better approach is to use a bounded channel with an explicit backpressure strategy, as shown in the code snippet given below.

_channel = Channel.CreateBounded(new BoundedChannelOptions(10_000)
{
    FullMode = BoundedChannelFullMode.DropWrite // or Wait
});

Fire-and-forget oops

In the LogAsync method, GitHub Copilot included the following statement that contains a fire-and-forget call with no retries and no information if the write operation fails (i.e., if the channel is already closed).

_channel.Writer.TryWrite(entry);

A better approach is to include a fallback path as shown in the code snippet below.

if (!await _channel.Writer.WaitToWriteAsync())
{
    TryWriteFallback("Channel closed or unavailable");
    return;
}
await _channel.Writer.WriteAsync(entry);
private void TryWriteFallback(string text)
{
    try
    {
        var path = _config.FallbackFilePath ?? "fallback-errors.log";
        var dir = Path.GetDirectoryName(path);
        if (!string.IsNullOrEmpty(dir) && !Directory.Exists(dir)) 
            Directory.CreateDirectory(dir);
        File.AppendAllText(path, $"[{DateTime.UtcNow:o}] {text}{Environment.NewLine}");
    }
    catch
    {
        // swallow - nothing else we can do
    }
}

The WaitToWriteAsync method returns true if space is available to write an item, false otherwise. Hence, if no space is available, the TryWriteFallback method will be called and the log written to the fallback-errors.log file.

Using Sync over Async in a Constructor

Finally, GitHub Copilot included the following piece of code in the constructor of the AsyncLoggerService class.

_target.InitializeAsync(_cts.Token).GetAwaiter().GetResult();

Using sync over async in a constructor in C# is considered an anti-pattern. The reason is because constructors cannot be asynchronous, i.e., you cannot mark a constructor as asynchronous using the async keyword. As a result, you will have to make blocking calls and wait for your asynchronous code to complete execution. And this could result in thread starvation and a deadlock.

A better alternative will be to move the initialization code out of the constructor as shown below.

public async Task InitializeAsync()
{
    await _target.InitializeAsync(_cts.Token);
}

AI-generated code review checklist

You should verify each item of the following checklist before you integrate AI-generated code into your application.

• Does the code address all specified requirements?
• Is the code well-documented?
• Are there any security vulnerabilities or security anti-patterns?
• Does the code follow C# coding standards and guidelines?
• Are the algorithms efficient as far as performance is concerned?
• Is the code testable, extensible, and maintainable?
• Is the code testable with proper abstractions?
• Does the code check for security vulnerabilities such as SQL injection and XSS?
• Does the code incorporate N + 1 queries or other inefficient data access approaches?
• Does the code comply with naming conventions and code organization standards?
• Does the code incorporate error handling, logging, input validation, and configuration?
• Does the code use asynchronous programming approaches?
• Does the code meet the desired code coverage expectations?

Takeaways

AI can help you create all of your boilerplate code, provide suggestions for best practices, and greatly speed up your exploration and research efforts. However, you should remember that AI is not a replacement for human intelligence, experience, and innovation. You should treat your AI-powered coding tool as your coworker or assistant and not your replacement.

You should take advantage of AI to do all of the tedious, monotonous work so that you can concentrate on the architecture, innovation, and other aspects of software architecture and development that require human involvement. You can take advantage of AI to generate your application’s architecture and design as well. However, the generated architecture and design should be for your reference only — it is entirely on you to decide how much of it you should use and what you need to replace.

Here’s the final word: AI-powered coding tools will help you when you provide them with the correct context and clear instructions. Be sure to review the generated code carefully, and test thoroughly before deploying to production. Expect your AI coding tool to make mistakes, and be prepared to make changes (perhaps over many iterations) to get the performant, reliable, secure, and maintainable code that you need.

가트너는 현재부터 2030년까지 최대 2,340억 달러(약 362조 원) 규모의 기업용 애플리케이션 지출이 ‘에이전틱 차익거래(Agentic arbitrage)’의 영향을 받을 것으로 전망했다. 이는 2030년 전체 기업용 애플리케이션 서비스형 소프트웨어(SaaS) 지출의 약 20%에 해당하는 규모다.

에이전틱 차익거래는 AI 에이전트가 여러 시스템을 넘나들며 업무를 수행하면서 사용자가 기존 소프트웨어 인터페이스를 직접 조작할 필요가 줄어드는 현상을 의미한다.

가트너 VP 애널리스트 조지 브로클허스트는 “에이전틱 AI는 소프트웨어의 경제 구조 자체를 바꾸고 있다”라며 “에이전틱 시스템은 사용자 경험(UX) 중심의 기존 애플리케이션을 우회해 원하는 결과를 직접 제공함으로써 소프트웨어를 전면에 드러나지 않는 존재로 만들고 있다”라고 설명했다. 이어 “이 같은 변화는 많은 기업용 소프트웨어 공급업체에서 사용자 증가와 매출 성장 간의 연결고리를 약화시키고 있다”라고 밝혔다.

가트너는 이러한 변화가 이미 시작됐으며, 앞으로 소프트웨어 개발 방식과 가격 정책, 소비 방식 전반을 바꿀 것으로 내다봤다.

브로클허스트는 “이 현상은 기존 SaaS 생태계의 변화를 상징하는 ‘사스포칼립스(Saaspocalypse)’를 새로운 형태로 정의하게 될 것”이라며 “이는 SaaS의 종말이 아니라 진화에 가깝다. SaaS는 사라지는 것이 아니라 새로운 형태로 발전할 것이며, 이러한 변화는 기존 공급업체와 신규 사업자 모두에게 위협이자 기회가 될 것”이라고 말했다.

기능보다 성과를 중시하는 기업 수요 확대

가트너는 기업의 소프트웨어 구매 기준도 기능 중심에서 성과 중심으로 빠르게 이동하고 있다고 분석했다.

브로클허스트는 “기업은 더 이상 새로운 도구나 대시보드를 추가하는 데 집중하지 않는다”라며 “기업이 원하는 것은 더 나은 비즈니스 성과다. 하지만 AI 기능을 추가하는 것만으로는 성과 개선보다 비용 증가로 이어지는 경우가 많다”라고 설명했다.

이어 “AI를 통해 실질적인 성과를 얻으려면 기업의 축적된 지식과 고객 맥락을 지속적으로 유지할 수 있는 시스템이 필요하다”라고 덧붙였다.

일부 공급업체는 자율적인 엔드투엔드 워크플로와 시스템 간 오케스트레이션, 고객 맥락 및 지식 축적 기능을 지원하는 에이전틱 솔루션을 제공하고 있다. 가트너는 이러한 솔루션이 비즈니스 성과와 투자수익률(ROI) 향상에 기여할 수 있지만, 실제 구축 과정에서는 상당한 수준의 서비스 지원이 필요한 경우가 많다고 설명했다.

브로클허스트는 “조직이 에이전틱 AI 시스템을 적극 활용하게 되면 사용자 인터페이스(UI)는 더 이상 차별화 요소가 되기 어렵다”라며 “기존 SaaS 공급업체의 시장 점유율은 점차 잠식되고, 업종에 관계없이 활용 가능한 에이전틱 플랫폼을 제공하는 신규 사업자가 새로운 기회를 확보하게 될 것”이라고 전망했다.

기존 SaaS 업체는 위기, 서비스 기업은 기회

가트너는 기존 소프트웨어 공급업체가 경쟁력을 유지하기 위해서는 인터페이스 중심의 가치에서 성과 중심의 가치로 전환해야 한다고 제언했다. 또한 제품 실행 단계에 에이전틱 기능을 통합하고, 단순한 데이터 확보를 넘어 고객별 지식과 맥락을 지속적으로 축적·관리해야 한다고 밝혔다.

브로클허스트는 “이러한 변화는 기존 대시보드와 사용자 수 기반 비즈니스 모델에 의존하는 공급업체에는 위협이 될 수 있다”라며 “반면 서비스와 플랫폼을 기반으로 에이전틱 기능을 제공하고 도메인 간 워크플로를 지원하는 기업에는 새로운 수익 창출 기회가 될 것”이라고 설명했다.

가트너는 AI 기반 스타트업과 서비스 제공업체가 기업 시스템 전반에서 ‘에이전틱 레이어’ 역할을 수행할 것으로 전망했다. 이들은 단순한 기능 제공을 넘어 측정 가능한 성과를 창출하고, 기업이 AI 중심으로 업무 프로세스를 재설계할 수 있도록 지원할 것으로 예상된다.

브로클허스트는 “궁극적으로 이들 기업은 기존 소프트웨어 지출뿐 아니라 ROI 개선을 통해 새롭게 확보되는 추가 예산까지 흡수할 수 있을 것”이라고 밝혔다.
dl-ciokorea@foundryco.com

AI 도입이 빠르고 광범위하게 확산되면서, 많은 CIO는 조직이 AI에 실제로 얼마나 많은 비용을 지출하고 있는지 제대로 파악하지 못하고 있다.

컨설팅 기업 프로티비티(Protiviti)의 ‘2026 AI 펄스 서베이(2026 AI Pulse Survey)’에 따르면, 기업의 약 3분의 2는 직원이 적절한 관리·감독 없이 AI를 사용한 적이 있다고 답했다. 또한 대기업의 절반 가까이는 직원들이 어떤 AI 도구를 사용하고 있는지 완전히 파악하지 못하는 것으로 나타났다. IBM의 ‘2026 테크 리더 스터디(2026 Tech Leader Study)’에서는 기술 리더의 77%가 AI 도입 속도가 이미 조직의 거버넌스 역량을 앞지르고 있다고 응답했다.

프로티비티 글로벌 기술 리스크 및 복원력(Technology Risk & Resilience) 부문 총괄인 앤드루 리트럼(Andrew Retrum)은 “기업들이 AI 도입을 서두르는 속도와 AI를 활용하기 위한 기술적 진입 장벽이 매우 낮다는 점이 맞물리면서, AI 활용 현황을 지속적으로 파악하기가 매우 어려운 환경이 됐다”라고 설명했다.

이는 과거의 ‘섀도 IT’와는 성격이 다르다. 재무적 위험의 원인이 직원들이 무단으로 챗GPT를 구독하는 데 있는 것이 아니라, 벤더 계약 갱신, 사용량 기반 과금, 사업부 예산 곳곳에서 AI 비용이 누적되고 있기 때문이다. 일부 CIO는 초기부터 이러한 비용을 아키텍처에 반영해 전체 지출을 완전히 파악하고 있지만, 대부분은 이제야 이를 따라잡는 단계에 있다. 일부 기업은 비용보다 더 중요한 문제를 제대로 들여다보지 못하고 있다는 사실을 뒤늦게 깨닫고 있다.

돈은 어디에 숨어 있나

AI 비용은 대부분의 조직이 충분히 주목하지 않는 세 곳에서 발생하고 있다.

첫 번째는 벤더 제품에 내장된 AI 기능이다. 소프트웨어 공급업체들은 기존 제품에 AI 기능을 조용히 추가하고 있으며, 그 비용은 새로운 항목으로 청구되는 대신 계약 갱신 시 인상된 비용에 반영된다. 가트너가 2025년 9월 발표한 조사에 따르면, 일부 솔루션은 벤더가 사전 고지 없이 AI 기능을 추가하면서 계약 갱신 비용이 최대 30%까지 증가한 것으로 나타났다.

두 번째는 사용량 기반 과금이다. 가트너는 “생성형 AI 비용의 대부분은 구축(Build)이 아니라 운영(Run) 단계에서 발생한다”라며 “추론(Inference), API 호출, 파인튜닝(Fine-tuning), 사용량 기반 과금은 규모가 커질수록 비용이 빠르고 예측하기 어려운 방식으로 증가한다”라고 분석했다.

컨설팅 기업 코너스톤 리서치(Cornerstone Research)의 최고기술혁신책임자(CTIO) 필 레슬리(Phil Leslie)는 이를 직접 경험했다고 말했다.

레슬리는 “제미나이는 이용료가 정액제이기 때문에 비용을 모니터링하는 것이 큰 의미가 없다”라며 “반면 클로드 코드는 사용량 기반 과금 방식이어서 도입이 확대될수록 지출도 함께 늘어난다. 비용이 증가하는 것을 확인한 뒤 이에 맞춰 대시보드를 구축해 관리하고 있다”라고 설명했다.

하지만 전체 비용을 한눈에 파악하는 일은 쉽지 않다.

레슬리는 “클로드 코드, 기본 클로드 서비스, MS 오피스에서 쓰이는 클로드 플러그인 전반에 걸친 비용을 통합적으로 파악하는 것은 결코 간단한 일이 아니다”라고 말했다.

세 번째는 사업부 주도의 AI 도입이다. 각 부서가 법인카드나 자체 예산을 활용해 AI 솔루션을 구매하면서 IT 부서의 관리 범위를 벗어나는 사례가 늘고 있다.

처음부터 가시성을 고려한 설계

통신 솔루션 기업 콕스 비즈니스(Cox Business)의 AI 총괄 에릭 페이스(Eric Pace)는 자사가 AI 지출을 100% 파악하고 있다고 밝혔다. 다만 이를 위해서는 처음부터 아키텍처와 거버넌스를 의도적으로 설계하는 과정이 필요했다.

페이스는 “일상 운영(BAU, Business as Usual) 과정에서 활성화되는 SaaS 기반 AI 모듈, 신규 AI 솔루션 구매, 전사 토큰 사용량까지 모든 AI 지출을 100% 파악하고 있다”라고 설명했다.

핵심은 중앙집중화와 명확한 책임 체계였다.

페이스는 “AI를 한 조직이 개발하고 다른 조직이 단순히 넘겨받는 방식이 아니라, 처음부터 조직 전체가 함께 책임지는 운영 모델을 구축하는 데 집중했다”라며 “AI 기능을 조기에 중앙집중화해 전사 목표와 일치시키는 한편, 각 사업부는 실제 업무 맥락을 제공해 AI 활용이 실질적인 성과로 이어지도록 했다”라고 말했다.

콕스 비즈니스는 아키텍처 자체에도 기본적으로 가시성을 내장했다.

페이스는 “모든 AI 트래픽은 AI 게이트웨이와 런타임 보안 솔루션을 거친다”라며 “온프레미스와 클라우드 기반 환경 모두 동일하게 적용된다”라고 설명했다.

이 같은 아키텍처는 네트워크 모니터링까지 확장된다.

페이스는 “네트워크를 통해 들어오고 나가는 모든 트래픽을 확인할 수 있으며, 회사 기기에서 어떤 서비스가 실행되고 있는지도 파악할 수 있다”라며 “표준 경로를 벗어난 트래픽 패턴이 발견되면 직원들과 협력해 규정을 준수할 수 있도록 지원한다”라고 말했다.

동시에 직원들이 필요한 AI 도구를 자유롭게 사용할 수 있는 환경도 마련했다.

페이스는 “‘틀 안의 자유(Freedom in a Framework)’라는 원칙 아래 다양한 AI 생태계와 기능을 제공하고 있다”라며 “대부분의 직원은 업무에 필요한 모든 AI 도구를 이용할 수 있다고 느낀다”라고 밝혔다.

비용보다 더 중요한 문제

모든 조직이 AI 비용 가시성 확보를 최우선 과제로 삼는 것은 아니다. 일부 기업은 다른 문제를 더 중요하게 보고 있다.

코너스톤 리서치의 레슬리는 “현재는 의도적으로 비용 가시성을 우선순위에서 뒤로 미뤄두고 있다”라며 “더 어려운 문제는 우리 업무의 특성 자체”라고 말했다.

코너스톤 리서치는 고도의 정확성이 요구되는 소송 지원 업무를 수행하는 기업으로, 전문가 보고서에는 오류가 허용되지 않는다.

레슬리는 “신뢰를 훼손하지 않으면서 AI의 이점을 어떻게 활용할 것인지가 가장 큰 과제”라며 “비용도 중요하지만, 지금 단계에서는 가장 큰 제약 요인은 아니다”라고 설명했다.

레슬리는 비용 최적화를 어렵게 만드는 또 다른 요인도 지적했다. AI 비용을 가장 많이 사용하는 사람이 오히려 가장 높은 성과를 내는 경우가 많다는 것이다.

그는 “전체 AI 비용의 약 80%가 사용자 10%에게서 발생하며, 이들은 대부분 중요한 업무를 수행하는 가장 숙련된 인력”이라며 “모든 사용자에게 동일한 비용 상한선을 적용하면 오히려 장려해야 할 핵심 활용 사례를 제한할 위험이 있다”라고 말했다.

현재 코너스톤은 일정 수준 이상의 비용이 발생하면 추가 승인 절차를 거치도록 하되, 필요한 경우 예외를 허용하는 방식을 운영하고 있다.

레슬리는 “AI 비용이 많이 발생하는 사용자는 낭비를 의미하는 것이 아니라 높은 가치를 창출하는 업무를 수행하고 있다는 신호인 경우가 많다”라고 말했다.

조직 규모가 달라지면 접근법도 달라진다

AI 비용 가시성 확보 방식은 조직 규모에 따라서도 달라진다.

아마존에서 10년간 근무한 뒤 코너스톤으로 자리를 옮긴 레슬리는 두 기업의 차이를 이렇게 설명했다.

레슬리는 “아마존은 단순히 규모가 큰 것이 아니라 사업 영역도 훨씬 다양하다”라며 “그 정도 규모에서는 단순한 규칙이 비효율적이라는 것을 알면서도, 복잡성을 관리하기 위해서는 획일적인 기준을 적용할 수밖에 없는 경우가 많다”라고 말했다.

반면 코너스톤에서는 보다 세밀한 관리가 가능하다.

그는 “피드백 주기가 충분히 짧기 때문에 각 조직 책임자와 직접 대화해 몇 분 만에 팀의 목표를 파악할 수 있다”라며 “덕분에 어떤 경우에는 비용을 더 투입하는 것이 합리적인지 확신을 갖고 판단할 수 있으며, 상황에 맞는 맞춤형 비용 관리가 가능하다”라고 설명했다.

콕스 비즈니스는 규모가 커지면서 또 다른 접근 방식을 선택했다.

페이스는 “AI 우수성 센터(CoE) 밖에서 엔터프라이즈 애플리케이션을 개발하는 조직에는 실행 역량을 분산시키는 대신, 자본 투자는 중앙에서 관리하는 체계를 구축했다”라고 말했다.

또한 토큰 사용 예산은 중앙에서 관리하되, AI 사용량이 많은 부서와는 지속적으로 관련 정보를 공유하고 있으며, 주요 사용 부서와 정기적으로 논의해 실제 비즈니스 가치를 평가하고 있다고 설명했다.

AI 비용 관리, 무엇이 효과적인가

아직 AI 비용 가시성을 구축하는 단계에 있는 조직이라면 기본부터 시작하는 것이 중요하다.

프로티비티의 리트럼은 “우선 AI 자산 목록을 만드는 것부터 시작해야 한다. 보이지 않는 것은 관리할 수도 없다”라며 “IT, 보안, 법무, 사업부에 명확한 책임을 부여하고, 이를 일회성 프로젝트가 아닌 지속적인 관리 체계로 운영해야 한다”라고 조언했다.

우선순위를 정하는 것도 중요하다.

리트럼은 “완벽함을 추구하다가 실행을 미루지 말아야 한다”라며 “민감한 데이터를 다루거나 고객 대상 의사결정, 규제 대상 업무와 관련된 AI 활용 사례처럼 위험도가 높은 영역부터 우선 관리해야 한다. 이러한 영역에 적절한 통제 장치를 마련한 뒤 점진적으로 범위를 확대하는 것이 바람직하다”라고 설명했다.

가트너는 조달 단계에서 AI 구매 항목을 별도로 구분해 관리하고, IT 재무관리 시스템에서도 AI 지출을 독립적으로 추적할 것을 권고했다. 또한 다음 클라우드 및 SaaS 계약 갱신 전에 AI 관련 비용 조항을 계약에 포함하도록 협상할 필요가 있다고 제안했다.

콕스 비즈니스는 거버넌스를 단순한 통제 수단이 아니라 우선순위를 명확히 하는 도구로 활용하고 있다.

페이스는 “더 빠르게 비즈니스 가치를 창출할 수 있는 일에 조직의 역량을 집중하기 위해 필요할 때는 과감하게 ‘아니오’라고 말해왔다”라고 밝혔다.

예산보다 더 큰 위험

일부 조직에서는 AI 비용이 통제 불가능한 수준으로 증가하는 것보다 AI를 잘못 사용하는 것이 더 큰 위험일 수 있다.

레슬리는 “섀도 IT의 핵심은 비용 통제가 아니라 평판 리스크”라며 “기업의 특성과 AI 활용 방식에 따라 무분별한 AI 사용은 실제로 심각한 피해를 초래할 수 있다. 바로 그 위험을 관리하는 것이 더 중요하다”라고 말했다.

AI 비용에 대한 가시성을 확보하는 것은 분명 중요하다. 그러나 일부 CIO에게는 지금 보이지 않는 더 중요한 문제가 따로 있을 수도 있다.
dl-ciokorea@foundryco.com

SAP가 AI 중심 기업으로의 전환을 가속하기 위해 올해 들어 두 번째 경영진 조직 개편에 나섰다.

첫 번째 개편은 지난 3월 이뤄졌다. SAP는 고객 성공(Customer Success) 조직과 고객 서비스 및 딜리버리(Customer Services and Delivery) 조직을 통합해 ‘고객 가치 그룹(Customer Value Group)’을 신설했다.

이를 통해 영업, 구축, 서비스, 기술지원 등 고객 관련 기능을 고객 서비스 및 딜리버리 담당 이사회 멤버였던 토마스 자우어에시히(Thomas Saueressig)에게 일원화했다. 현재 자우어에시히는 최고고객책임자(CCO)를 맡고 있다.얼마 지나지 않아 SAP는 제품 및 엔지니어링을 총괄하는 이사회 멤버 무함마드 알람(Muhammad Alam)이 2027년 3월 계약 만료 후 연임하지 않기로 결정했다고 발표했다.알람의 후임을 즉시 선임하지 않기로 한 SAP는 그의 업무를 다른 경영진에게 분산하기로 했다.

블룸버그에 따르면 산업 AI 부문을 제외한 알람의 모든 조직은 크리스티안 클라인(Christian Klein) CEO가 직접 총괄하며, 산업 AI 조직은 세바스티안 슈타인호이저(Sebastian Steinhäuser) 최고운영책임자(COO)가 맡는다.또 SAP는 새로운 제품 총괄 임원을 선임하기 위해 미국을 중심으로 외부 인재를 물색할 계획이다. 다만 해당 직책의 역할과 조직 체계는 아직 구체적으로 정해지지 않은 것으로 알려졌다.

알람은 제품 전략과 개발을 비롯해 SAP의 글로벌 제품·엔지니어링 조직과 소프트웨어 애플리케이션 전반을 총괄해왔다.

AI 전환 가속화

이번 조직 개편은 SAP의 AI 전환을 앞당기고 경쟁력을 강화하기 위한 조치라고 SAP는 설명했다.

SAP 대변인은 CIO와의 이메일 인터뷰에서 “SAP는 AI 기반 자율기업(Autonomous Enterprise)으로의 전환을 가속하기 위해 조직을 재편하고 있다”라며 “새로운 조직 구조는 AI, 데이터, 핵심 애플리케이션을 더욱 긴밀하게 연결해 SAP의 프로세스 전문성을 기반으로 한 통합 엔드투엔드 솔루션을 제공할 수 있도록 한다”라고 밝혔다.

이어 “이번 개편은 심도 있는 프로세스 전문성, 신뢰할 수 있는 데이터, 유연한 플랫폼을 결합해 대규모 환경에서도 차별화되고 신뢰할 수 있는 비즈니스 AI를 구현할 수 있도록 한다”라며 “이를 통해 차세대 엔터프라이즈 소프트웨어 시장에서 SAP의 경쟁력을 더욱 강화할 것”이라고 설명했다.

몇 달 사이 두 차례 경영진 개편이 이뤄진 점을 우려할 수도 있지만, 무어 인사이트 앤드 스트래티지(Moor Insights & Strategy)의 부사장 겸 수석 애널리스트 제이슨 앤더슨(Jason Andersen)은 고객의 소프트웨어 업그레이드 부담을 해결하기 위해 필요한 변화라고 평가했다.

앤더슨은 “AI는 기술적으로 이러한 문제를 완화할 잠재력이 있지만 기업 문화와 산업별 요구사항, 규제 환경 등 해결해야 할 과제가 여전히 많다”라며 “고객의 시스템 전환을 지원하는 업무가 새로운 혁신과 성장 기회 창출에 필요한 역량을 분산시킬 수도 있다”라고 분석했다.

이어 “올봄 토마스 자우어에시히의 역할이 확대된 것은 기존 고객 기반을 현대화해야 하는 과제가 얼마나 큰지를 보여준다”라며 “이번에 크리스티안 클라인 CEO가 제품 조직을 직접 맡게 된 것은 SAP를 ‘SaaS 우선(SaaS-first)’ 기업에서 ‘AI 우선(AI-first)’ 기업으로 전환하기 위한 또 하나의 대규모 과제를 추진하기 위한 것”이라고 말했다.

AI만으로는 가치 창출 어렵다

인포테크 리서치 그룹(Info-Tech Research Group)의 수석 리서치 디렉터 테라 히긴슨(Terra Higginson)은 “기업들이 AI 투자 대비 성과 격차(value gap)를 본격적으로 문제 삼기 시작했다”라며 “이번 리더십 개편은 SAP가 AI만으로는 충분한 가치를 창출할 수 없다는 점을 인식하고 있음을 보여준다”라고 평가했다.

이어 “SAP는 전략이 실행 과정에서 어디에서 힘을 잃고 있는지 파악하려 하고 있지만, 이는 SAP만의 문제가 아니다”라며 “같은 문제가 소프트웨어 업계 전반에서 나타나고 있다”라고 설명했다.

그레이하운드 리서치(Greyhound Research)의 수석 애널리스트 산치트 비르 고기아(Sanchit Vir Gogia)는 “이번 조직 개편은 AI 실행 문제가 이미 해결됐다는 의미가 아니라, AI 전략과 실행에 대한 책임을 강화하겠다는 신호로 보는 것이 맞다”라며 “분명한 것은 SAP가 AI와 고객 도입, 클라우드 중심 실행을 축으로 운영 모델을 다시 구축하고 있다는 점”이라고 분석했다.

고기아는 이번 개편 시점을 “엔터프라이즈 소프트웨어 산업의 경제성에 가해지는 현실적인 압박”에 대응한 것으로 해석했다.

그는 “경영진의 강한 의지만으로 AI 에이전트가 재무나 급여 업무를 안전하게 처리할 수 있는 것은 아니다”라며 “지금 필요한 것은 무조건적인 기대도 과도한 불안도 아닌, 신중하고 냉정한 접근”이라고 말했다.

또 CIO가 SAP에 가장 먼저 던져야 할 질문은 “이번 조직 개편으로 우리 IT 환경에서 실제 무엇이 달라지는가”라고 조언했다.

그는 “제품 로드맵의 책임자가 바뀌는지, 출시 일정은 어떻게 달라지는지, 계약상 책임은 어떻게 달라지는지를 확인해야 한다”라며 “계약을 갱신하거나 프로젝트를 이사회에 설명할 때 실제로 중요한 것은 바로 이 문제”라고 설명했다.

제품보다 계약서를 살펴야

고기아는 SAP가 제품에 AI 기능을 확대하는 만큼 CIO들도 제품 홍보보다 계약 내용을 더욱 면밀히 검토해야 한다고 조언했다.

특히 AI 모델 제공업체와의 책임 범위, 고객 데이터 활용 방식, 데이터 활용 거부(옵트아웃) 권리 등이 계약서에 명확하게 규정돼 있는지 확인해야 한다고 말했다.

고기아는 “SAP가 고객 데이터를 제3자 AI 모델 학습에 사용하지 않는다고 말한다면, 그 약속은 홈페이지가 아니라 계약서에 명시돼 있어야 한다”라며 “AI 기능이 기본 제공에서 사용량 기반 과금으로 전환될 경우 과금 방식도 계약서에서 명확히 규정해야 한다”라고 밝혔다.

이어 “워크플로우가 SAP와 타사 시스템을 오갈 경우 최종 책임이 누구에게 있는지가 가장 중요한 문제”라며 “책임 주체를 명확히 할 수 없는 제품 약속은 약속이 아니라 구호에 불과하다”라고 지적했다.

그러면서 “엔터프라이즈 고객은 조직 개편 자체에 주목할 것이 아니라 SAP의 운영 모델을 면밀히 검증해야 한다”라고 조언했다.
dl-ciokorea@foundryco.com

For the second time this year, SAP is shaking up its executive ranks as it continues its quest to adapt to an AI-centric world.

The first shake-up came in March, with the creation of the Customer Value Group, merging SAP’s Customer Success and Customer Services and Delivery organizations to put sales, delivery, services, and support of its products under the leadership of executive board member for customer services and delivery Thomas Saueressig, who is now chief customer officer.

Shortly thereafter, the company announced that executive board member in charge of product and engineering Muhammad Alam had decided not to renew his contract when it expires in March 2027.

The consequences of that are being felt now as, rather than immediately replacing Alam, the company has decided to split his responsibilities among other executives, with CEO Christian Klein managing all of Alam’s teams except industrial AI, which will be run by COO Sebastian Steinhäuser, Bloomberg reported. It said SAP will conduct an external search, focusing on the US, for a new executive product lead, although it is “unclear” how the role will be structured.

Alam oversaw both SAP’s global product and engineering organization and its software applications, including product strategy and development.

Accelerating transformation

The changes will hasten SAP’s AI transformation and make it more competitive, a company spokesperson told CIO. “SAP is evolving its organization to accelerate its transformation toward an AI-driven Autonomous Enterprise,” the spokesperson said via email. “The new structure brings AI, data, and core applications closer together, enabling more integrated, end-to-end solutions built on SAP’s unique process expertise. These changes sharpen SAP’s competitive edge in Business AI, combining deep process knowledge, trusted data, and flexible platforms to deliver differentiated, reliable AI outcomes at scale, and reinforcing SAP’s position at the forefront of the next generation of enterprise software.”

Although a second leadership change within a few months could be a cause for concern, Jason Andersen, VP and principal analyst at Moor Insights & Strategy, sees the changes as necessary to help the company overcome customers’ reluctance to undertake complex and expensive software upgrades. “While AI has the potential to technically reduce those challenges, significant work remains to address cultural, industry-specific, and regulatory needs,” he said, adding that the task of helping customers migrate could distract from new innovations and growth opportunities. “The change in Thomas’ role in the Spring reflects the magnitude of the install base challenge. The shift in Christian’s focus is to help drive what will be an equally big job of shifting SAP from a SaaS-first company to an AI-first company.”

AI alone will not drive value

Terra Higginson, a principal research director at Info-Tech Research Group, said, “Companies are starting to get serious about the value gap in AI. This leadership shift shows that SAP recognizes AI alone will not drive value. SAP is trying to figure out where strategy is getting lost in execution, but they are not the only ones. The same issue is showing up across the software market.”

And, said Sanchit Vir Gogia, chief analyst at Greyhound Research, “SAP’s reshuffle is best read as a signal about accountability, not as proof that the AI execution problem is already solved. The pattern, however, is unmistakable. SAP is rebuilding its operating model around AI, adoption and cloud-led execution”

He reads the timing of the change as a response to what he called “genuine pressure on the economics of enterprise software,” pointing out, “executive urgency does not, by itself, make an agent safe enough to touch finance or payroll. The right posture is disciplined curiosity, neither applause nor panic.”

CIOs should ask SAP one brutally practical question first, he said: What changes for my estate because of this reported reshuffle? In other words, what changes in roadmap ownership, release timing and contractual accountability, “because that is the only question that matters when signing renewals or defending a program to a board.”

Focus on contract language

And as the company builds more AI into its products, he recommended CIOs move their focus from the company’s product claims to its contract language, including clarity on model-provider boundaries, customer-data use and opt-out rights.

“If SAP says customer data will not train third-party models, that belief belongs in the agreement, not on a homepage. Contracts should also pin down how AI is metered as features move from included to consumption-priced,” he said. “The sharpest question is where accountability sits when a workflow crosses SAP and non-SAP systems. A product promise that cannot be traced to an accountable owner is a slogan, not a commitment.”

So, he said, “Enterprise customers should not buy the reshuffle. They should interrogate the operating model.”

Oft liefern kompromittierte Endgeräte die lediglich angelehnte Hintertür, durch die Ransomware ins Unternehmen schlüpft. Gartner-Analysten raten deshalb zu unveränderbaren Endpunkten. Igel Technology liefert dafür eine solche Architektur – und neuerdings zudem schnelle Hilfestellung für gekaperte Windows-Clients.

Das Bremer Unternehmen behauptete sich einst im Bereich Thin Clients gegen Größen wie HP und Dell, Ende 2022 verkündete Igel dann, keine TCs mehr zu produzieren, sondern Hardware von Partnern wie HP, Lenovo und LG zu nutzen.

Denn Igel hatte erkannt: Die eigentliche Stärke liegt im angriffsresistenten, weil stark abschottbaren Linux-Betriebssystem Igel OS samt zentraler Verwaltung per zugehöriger Universal Management Suite (UMS). Seither arbeitete das Unternehmen, ab 2023 unter der Führung des in den USA lebenden Dänen Oestermann, daran zum zum Anbieter einer, so Igel, „Adaptive Secure Endpoint Platform“ zu werden. Diese Plattform setzt, so eine weitere Igel-Formulierung, das „Preventative Security Model“ um, soll also Kompromittierung a priori verhindern.

Igels erweiterbare Endpunkt-Plattform

Hierfür ist das Igel OS in schönster Thin-Client-Tradition auf das Nötigste reduziert, gehärtet und somit hochgradig manipulationsresistent. In Kombination mit rein serverseitiger Datenhaltung scheint dies heute nützlicher denn je. Denn Ransomware-Angriffe haben sich, wie einst die Kaninchen in Australien, zur regelrechten Landplage entwickelt. Und Security-Fachleute warnen allerorts, dass Cyberkriminelle verstärkt KI nutzen, um ihre Angriffe weiter zu automatisieren, zu skalieren und zu beschleunigen.

Die Analysten von Gartner bestätigen die neue Strategie von Igel. „Endpunkte sind die am stärksten fragmentierte, poröse Oberfläche einer Organisation“, schreiben die Marktforscher in einem Papier vom Februar 2026, dessen Titel auch gleich einen Ausweg weist: „Nutzen Sie unveränderbare Endpunkte, um Ransomware zu besiegen, Konfigurationsabweichungen zu stoppen und schnelle Wiederherstellung zu garantieren“. Denn „veränderliche, agentenlastige Endpunkte“ – vulgo Windows-PCs – seien das Haupteinfallstor für Angriffe, so die Analysten.

Unveränderliche Endpunkte hingegen, so Gartner-Analyst Franz Hinner und seine Co-Autoren, könnten die Angriffskette durchbrechen und Persistenz der Angreifer im Netzwerk für langfristige oder wiederholte Angriffe verhindern. Indem sich die Sicherheitskontrollen vom Endgerät auf die Identität verlagerten, so die Marktforscher, ließen sich die Ausfallzeiten der Mitarbeiter um 98 Prozent senken.

Eben dieses Konzept verfolgt Igel mit der „Adaptive Secure Endpoint Platform“, die esüber offene APIs erlaubt, Drittanbieterlösungen zu integrieren. Rund 130 Partner zählt man inzwischen, so die Bremer, darunter Identity-Security-Anbieter wie Okta, Imprivata und Microsoft (mit Entra ID) sowie diverse weitere Security-Größen, mit deren Hilfe Igel Zero-Trust-Architekturen umzusetzen kann.

Doch Igel verlässt sich längst nicht nur auf seine Partner: Auch das hauseigene Entwicklungsteam unter der Leitung von General Manager und CTO Matthias Haas treibt die Softwareentwicklung eifrig voran. Hierfür unterhält Igel heute neben dem Stamm-Entwicklungsstandort Augsburg weitere in Bukarest, Bangalore und Fort Lauderdale, USA. Federführend ist jedoch weiterhin die deutsche Lokation.

Bei einer Kundenveranstaltung in Frankfurt präsentierte Igel kürzlich zahlreiche Erweiterungen seiner Plattform. Hierzu zählen unter anderem:

• kontextbezogene Zugriffskontrollen, ermöglicht durch die Kooperation mit Security-Partnern;
• ein Managed Hypervisor inklusive der Option, auf den TCs Published Apps lokal laufen zu lassen;
• Managed Container (wichtig für das Industrieumfeld);
• Unterstützung für ARM-Prozessoren.

Und natürlich darf das Thema KI nicht fehlen: Igel AI Armor soll die KI-Nutzung absichern, MCP-Support sei hierfür in Arbeit.

Eine pfiffige Lösung ist „Igel Business Continuity & Disaster Recovery“. Die Funktionsweise: Ein Windows-Endpunkt läuft virtualisiert auf Igel OS. Im Notfall, etwa bei einem Ransomware-Angriff, müssen die Anwender nur die F9-Taste drücken. Dies führt zum Neustart samt Auswahl, ob man den Windows-Rechner oder das abgesicherte Igel OS starten möchte. Neben diesem Dual Boot gibt es, etwa für Industrie-PCs, auch eine USB-Boot-Option.

Dadurch, so Igel, seien Unternehmen in Minuten wieder arbeitsfähig. Oder konkret ausgedrückt: Anwender können gehostete und SaaS-Applikationen wie Windows 365 weiter nutzen und bleiben damit zumindest im Kern handlungsfähig. Das Windows-OS liegt dabei für Forensik-Zwecke weiterhin unangetastet vor. Die Lösung erweist sich laut CEO Klaus Oestermann als „Türöffner“ für die Neukundengewinnung, ebenso beim Ausbau bestehender Installationen.

Igel-Vorteile für Kliniken und die Industrie

Wie Igel anhand mehrerer Kundenszenarien veranschaulichte, bieten unveränderliche, zentral verwaltete Endpunkte auch jenseits von Malware-Schutz und Resilienz im Angriffsfall Vorteile.

So brauchten die PCs des britischen NHS Gloustershire Hospitals früher laut Igel-Angaben 30 Minuten bis zum erfolgten Login. Mitarbeiter riefen deshalb vom Arbeitsweg aus an und baten einen Kollegen, sie mit ihrem Passwort einzuloggen, damit sie bei Ankunft schnell arbeitsfähig sind – das Gegenteil von Nutzerfreundlichkeit und ein Alptraum für jeden CISO.

Mit Igel OS und der Access-Management-Lösung Imprivata dauere der Login nun nur noch eine Minute, berichteten die Bremer, ein erneuter Login wenige Sekunden. Ein Arzt auf Visite müsse sich also nicht mehr minutenlang vom Patienten abwenden, um mit dem PC zu kämpfen, sondern könne sich schnell wieder der Behandlung widmen.

Hierzulande setzen laut Peter Goldbrunner, Vice President und General Manager Central Europe bei Igel, rund 300 Kliniken auf Igel OS. Auch sonst wachse das Geschäft in Deutschland ebenso schnell wie das internationale Business – und das vom hohen Niveau des Stammlandes aus betrachtet.

So betreibe nun etwa Aldi Nord die Steuerung der Backautomaten in seinen Filialen mittels zentral verwalteter Igel-OS-Endpunkte. In der Industrie wiederum, so Goldbrunner, nutze beispielsweise Audi inzwischen Steuerungsrechner mancher Produktionsanlagen virtualisiert auf Igel-OS-Endpunkten statt wie bislang Industrie-PCs. Damit sollen sich die Industriesteuerungen selbst dann zügig weiterbetreiben lassen, wenn wie letztes Jahr bei Jaguar Land Rover Cyberangreifer zuschlagen sollten – ohne dass ein Techniker vor Ort eingreifen muss.

Laut Emanuel Pirker, Ex-Chef des 2025 von Igel akquirierten TC-Herstellers Stratodesk und nun verantwortlich für den Contact-Center-Bereich, können Igel-OS-Endpunkte im Call- oder Contact-Center die Kosten deutlich senken. Das Onboarding neuer Mitarbeiter sei in fünf Minuten erledigt – wichtig in einer Branche mit extrem hoher Personalfluktuation. Datensicherheit und Compliance seien gewahrt, da keine Daten auf den Endpunkten gespeichert werden. Zudem sinken laut Pirker die Betriebskosten durch längere Hardware-Lebenszyklen, weniger Update-Bedarf und einfacheres Management. UMS ist hierfür auf Wunsch „as a Service“ erhältlich, auch aus einem Rechenzentrum im EU-Rechtsraum. (mb)

Um Software abzusichern, muss man wissen, was in ihrem Code steckt. Aus diesem Grund ist eine Software Bill of Material, SBOM oder Software-Stückliste heute unerlässlich. Der SolarWinds-Angriff sowie die Log4j-Schwachstelle haben verdeutlicht, wie wichtig es ist, die Sicherheit von Softwarelieferketten in den Fokus zu nehmen – insbesondere, wenn es um Open Source Software geht. Einer Umfrage (PDF) des Open-Source-Unternehmens Tidelift zufolge enthalten heute 92 Prozent aller Anwendungen Open-Source-Komponenten. Eine durchschnittliche, moderne Applikation besteht demnach sogar zu 70 Prozent aus quelloffener Software.

Die Antwort auf die potenziellen Risiken sind – wenn es nach der Linux Foundation, der Open Source Security Foundation und OpenChain geht – SBOMs: Formale und maschinenlesbare Metadaten, die ein Softwarepaket und seinen Inhalt eindeutig identifizieren. Die Software-Stücklisten können auch andere Informationen enthalten, etwa Copyright- oder Lizenzdaten. Dabei ist eine Software Bill of Material so konzipiert, dass sie organisationsübergreifend ausgetauscht werden kann. Besonders hilfreich ist eine SBOM, um die Transparenz über die von den Teilnehmern einer Softwarelieferkette gelieferten Komponenten zu gewährleisten.

SBOM – Best Practices

Eine SBOM sollte beinhalten:

• die Open-Source-Bibliotheken der Anwendung;

• Plugins, Erweiterungen und andere Zusatzmodule;

• von In-House-Entwicklern selbst geschriebenen Quellcode;

• Informationen über die Versionen dieser Komponenten, ihren Lizenzierungs- und Patch-Status;

• automatische kryptografische Signatur und Überprüfung von Komponenten;

• automatische Scans, um SBOMs als Teil der CI/CD-Pipeline zu erstellen.

Dabei sollte eine Software Bill of Material ein einheitliches Format verwenden. Zu den gängigen SBOM-Formaten gehören:

• Software Package Data Exchange (SPDX),

• Software Identification (SWID) Tagging und

• OWASP CycloneDX.

Bislang hat sich keiner der drei Standards von den anderen abgesetzt und einen De-facto-Industriestandard geschaffen. Um SBOMs praktikabel zu machen, sollte die SBOM-Erstellung nicht nur automatisiert, sondern in die CI/CD-Pipeline integriert werden. Oder wie die National Telecommunications and Information Administration (NTIA) es ausdrückt (PDF): “Das ultimative Ziel ist es, SBOMs in Maschinengeschwindigkeit zu generieren.”

Software Bill of Materials – Use Cases

Auch bei SBOMs gibt es drei verschiedene Anwendungsfälle. Im Allgemeinen sind das:

1. Softwarehersteller verwenden SBOMs, um Erstellung und Wartung der von ihnen gelieferten Software zu unterstützen.

2. Softwareeinkäufer nutzen SBOMs, um sich vor dem Kauf abzusichern, Rabatte auszuhandeln und Implementierungsstrategien aufzusetzen.

3. Softwarebetreiber nutzen SBOMs für das Vulnerability- und Asset-Management, um Lizenzen und Compliance zu managen und Abhängigkeiten und Risiken in Sachen Software und Komponenten schnell zu identifizieren.

Empfehlenswerte SBOM-Tools

Bei drei verschiedenen SBOM-Formaten und einer Vielzahl von Metadaten, die innerhalb einer Software Bill of Material verfolgt werden können, ist es nicht verwunderlich, dass es kein SBOM-Tool gibt, das sämtliche Bedürfnisse erfüllt. Gartner empfiehlt, Tools zu verwenden, die folgende Funktionen mitbringen:

• SBOMs während des Build-Prozesses erstellen;

• Quellcode und Binärdateien (wie Container-Images) analysieren;

• SBOMs bearbeiten;

• SBOMs in lesbaren Formaten anzeigen, vergleichen, importieren und validieren;

• SBOM-Inhalte von einem Format oder Dateityp in andere übersetzen, beziehungsweise die Informationen zusammenführen;

• Einbindung anderer Tools über APIs und Bibliotheken;

Keines der folgenden acht Tools erfüllt (bislang) all diese Empfehlungen. Wir empfehlen Ihnen, die Tools auszuprobieren und anschließend zu ermitteln, welches für Ihre Zwecke am besten geeignet ist. Diese acht SBOM-Tools verdienen Ihre Aufmerksamkeit:

Anchore

Das Unternehmen ist bereits seit sechs Jahren im SBOM-Business tätig. Die Grundlage des Unternehmens bilden zwei Open-Source-Projekte:

• Syft ist ein Tool mit Kommandozeilen-Interface und eine Bibliothek, um SBOMs aus Container-Images und Dateisystemen zu erzeugen.

• Grype ist ein einfach zu integrierendes Tool, um Container-Images und Dateisysteme auf Schwachstellen zu scannen.

Zusammen können diese beiden Werkzeuge Software-Stücklisten in jeder Phase des Entwicklungsprozesses erzeugen, von Quellcode-Repositories und CI/CD-Pipelines bis hin zu Container-Registries und Laufzeiten. Diese SBOMs werden in einem zentralen Repository aufbewahrt, um vollständige Transparenz und kontinuierliches Monitoring zu gewährleisten – auch nach der Bereitstellung. Die Tools von Anchore unterstützen CycloneDX, SPDX und das proprietäre SBOM-Format von Syft. Das Anbieterunternehmen bündelt seine SBOM-Funktionalität in der Plattform Anchore Enterprise 4.0 Software SCM (Supply Chain Management).

FOSSA

Die Flaggschiff-Programme von FOSSA sind ein Open Source License Compliance Manager und ein Open Source Vulnerability Scanner. Der Ansatz von FOSSA sieht vor, dass Sie das SBOM-Tool in Ihr bevorzugtes Versionskontrollsystem wie GitHub, BitBucket oder GitLab integrieren. Sie können auch die CLI von FOSSA verwenden und das Tool lokal ausführen oder es in Ihre CI/CD-Pipeline integrieren.

In jedem Fall identifiziert FOSSA im Rahmen eines Projektscans automatisch sowohl direkte als auch indirekte Abhängigkeiten in der Codebasis.

GitLab (ehemals Rezilion)

Beim DevSecOps-Anbieter ist SBOM Teil seiner ganzheitlichen Software-Sicherheits- und Schwachstellen-Systeme. Dynamic SBOM verwendet eine dynamische Laufzeitanalyse, um die Angriffsfläche Ihrer Software zu monitoren. Es sucht also ständig nach bekannten Schwachstellen in den Komponenten. Neben der Bereitstellung eines Live-Inventars aller Softwarekomponenten in Ihren CI/CD-, Staging- und Produktionsumgebungen wird Ihre SBOM ständig aktualisiert. Sie können Ihre Software Bill of Material im CycloneDX-Format und als Excel-Tabelle exportieren.

Nach der Übernahme durch GitLab wurden die SBOM-Funktionalitäten von Rezilion im Jahr 2022 in die DevSecOps-Plattform integriert.

Mend

Früher unter dem Namen WhiteSource bekannt, bietet Mend eine Vielzahl von SCA-Tools (Software Composition Analysis) an. Eine SBOM-Funktionalität ist in das SCA-Toolset integriert. Die Lösung von Mend ist weniger ein Entwicklerprogramm oder ein CI/CD-Tool – sondern vielmehr ein Open-Source-Lizenz- und Sicherheitsmechanismus für Programmierer.

Mit Hilfe von Mend lassen sich sämtliche Softwarekomponenten tracken, direkte und indirekte Abhängigkeiten identifizieren, Schwachstellen aufdecken, Remediationspfade bereitstellen und automatisch SBOM-Einträge aktualisieren.

SPDX SBOM Generator

Dieses eigenständige Open-Source-Tool tut das, was sein Name verspricht: SPDX-SBOMs aus aktuellen Paketmanagern oder Build-Systemen erstellen. Sie können seine CLI verwenden, um SBOM-Daten aus Ihrem Code zu erzeugen. Das Tool erzeugt Berichte über Komponenten, Lizenzen, Copyrights und Sicherheitsreferenzen Ihres Codes. Diese Daten werden in der SPDX v2.2-Spezifikation exportiert.

Start Left Security

Dieses SBOM-Tool wird als Software-as-a-Service (SaaS) angeboten. Auf der Grundlage einer patentierten, anwendungszentrierten Integrationsmethodik kombiniert das ehemals unter dem Namen TauruSeer bekannte Angebot seine Cognition-Engine-Sicherheitsüberprüfung mit SBOM. Das Paket hilft Ihnen, Ihren Code für Ihre Entwickler und Kunden abzusichern und zu tracken.

Tern Project

Dieses quelloffene SBOM-Projekt lässt sich gut mit SPDX SBOM Generator kombinieren. Anstatt mit Paketmanagern oder Build-Systemen zu arbeiten, erzeugt dieses SCA-Tool und die Python-Bibliothek eine SBOM für Container-Images und Docker-Dateien. Darüber hinaus lassen sich auch SBOMs im SPDX-Format erzeugen.

Vigilant Ops

Dieser Cybersicherheitsanbieter aus dem Healthcare-Bereich konzentriert sich mit seiner InSight-Plattform auf Software-Stücklisten. Seine SaaS-Plattform generiert und pflegt zertifizierte SBOMs und sorgt für deren authentifizierten Austausch. Sie bietet Sicherheit durch kontinuierliche Schwachstellenüberwachung. Die SBOM-Zertifizierung verwendet patentierte Algorithmen, um sicherzustellen, dass alle Komponenten validiert und Schwachstellen verlinkt sind.

Die Sicherheitsfunktionen können auch für SBOMs verwendet werden, die von anderen Programmen erstellt wurden. Diese werden sowohl im Ruhezustand als auch während der Übertragung verschlüsselt.

Dieser Artikel ist im Original bei unserer Schwesterpublikation CSOonline.com erschienen.

Google has removed a malicious browser extension masquerading as Perplexity AI after Microsoft researchers found it was intercepting users’ search traffic and routing queries through attacker-controlled servers before forwarding them to legitimate search engines.

Microsoft Threat Intelligence said the extension masqueraded as the AI-powered answer engine to trick users into installing it. Based on its analysis, the company said the extension’s primary objective was to intercept search traffic and collect browsing data while maintaining a normal browsing experience, making the activity difficult for users to detect.

“Microsoft Threat Intelligence has identified a malicious Chromium-based extension that spoofs the AI-powered answer engine Perplexity AI to trick unsuspecting users into installing it,” the company’s threat intelligence team said in a blog post. “Based on our observation of the extension’s behavior, we assess its primary objective to be search traffic interception and data collection, which might enable downstream use cases such as profiling, targeted advertising, or other forms of misuse depending on operator intent.”

Microsoft said it reported the extension to Google, which subsequently removed it.

The incident reflects a broader trend identified by Microsoft’s researchers, who earlier this month warned that attackers were increasingly abusing the names and branding of popular AI platforms in phishing and malware campaigns.

Extension quietly intercepted browser searches

Unlike traditional browser hijackers that alter search results or flood users with advertisements, the extension operated less conspicuously.

According to Microsoft, it abused Chromium’s Manifest V3 APIs to intercept searches entered through the browser’s address bar, forwarding those queries through intermediary infrastructure controlled by the attacker before redirecting users to legitimate search providers. Because victims ultimately received the expected search results, the activity could remain largely unnoticed, the blog post added.

“The use of intermediary infrastructure allows the operator to observe search traffic while maintaining the expected browsing experience,” Microsoft Threat Intelligence said.

The attack also relied on user trust rather than exploiting a browser vulnerability.

“What makes this interesting is that the attack doesn’t really depend on exploiting a browser vulnerability. The user becomes the initial access vector,” said Vibhum Dubey, an independent cybersecurity researcher and red teamer.

Employees routinely install browser-based productivity tools, password managers, and AI assistants, making AI-branded extensions appear legitimate, Dubey said. “Users also expect AI tools to request broad permissions to access websites and browser content, allowing malicious permission requests to blend in with legitimate functionality.”

Why AI brands make good bait

For attackers, trusted AI brands are becoming increasingly attractive social engineering lures as enterprises accelerate adoption of generative AI tools.

“Attackers are following user trust,” said Sushovan Mukhopadhyay, director analyst at Gartner. “As employees adopt AI tools quickly, trusted AI brands become high-value bait for social engineering.”

Browser extensions can quietly become “a data collection layer inside the employee’s everyday workflow,” exposing sensitive search queries, browsing activity, and business context, he said.

Mukhopadhyay said the larger issue is that enterprise AI adoption is moving faster than security governance, creating opportunities for attackers to exploit the gap between employee enthusiasm and organizational controls.

A governance blind spot

Both experts said the harder enterprise problem is visibility.

“Most organizations have a mature process for software inventory, but very few have the same level of visibility for browser extensions,” Dubey said. During security assessments, he has seen organizations maintain strict application allowlists while employees continued installing browser extensions with little or no oversight.

Rather than looking only for known malicious extensions, security teams should monitor for risky behaviors such as changes to default search providers, requests for access to all websites, communications with domains unrelated to the claimed publisher, and extensions that seek additional permissions after installation, he said.

Microsoft similarly recommended that organizations verify extension publishers, carefully review requested permissions, and monitor enterprise browsers for unauthorized or unapproved extensions.

Mukhopadhyay said CISOs should begin treating browser extensions as governed enterprise software rather than personal productivity tools.

“That means using allowlists, permission reviews, search-setting monitoring, and controls for unapproved AI tools,” he said. Citing Gartner data, he said by 2029, 30% of enterprises will use secure enterprise browser technologies to improve browser extension auditing, risk profiling, and policy enforcement.

As browsers become the primary workspace for email, SaaS applications, and AI assistants, attackers are likely to continue targeting them, Dubey said. Organizations should therefore treat browser extensions “as third-party software suppliers” that are reviewed, approved, and continuously monitored like any other enterprise application.

Across the global corporations, I advise, in financial services, healthcare, retail and the public sector, the same crisis surfaces in leadership meetings. Executives approved a bold AI roadmap. Cloud spending climbed 40, 50, even 70 percent. And yet the AI workloads that made perfect sense in the boardroom presentation now stall, overshoot their budgets or collapse under production load before they reach real users.

I am writing this just after the spring 2026 conference season, and the signal from Google Cloud Next, Microsoft Build, and a run of AWS summits only sharpens the point. Over the past several weeks the industry shipped, in production form, the infrastructure to run and govern AI at scale. What most enterprises still lack is the operating model to decide how to use it.

The problem is not the AI models. The models work. The problem is that organizations built their AI ambitions on cloud strategies designed for a world that no longer exists: strategies built for SaaS applications, predictable traffic and linear cost curves. AI workloads break all three assumptions at once.

Why AI breaks traditional cloud assumptions

For a decade, cloud-first served enterprises well. It delivered elasticity, reduced capital expenditure and democratized access to compute, because enterprise workloads were predictable: web applications, ERP systems, databases and analytics pipelines that scaled smoothly and billed in ways finance could model on a spreadsheet. GenAI and agentic AI change every one of those assumptions at once.

When organizations move AI into production, real inference, retrieval pipelines, vector search and real-time decisioning, the cloud equation breaks in at least five ways:

1. Training clusters demand power densities far above standard compute.
2. Inference needs millisecond latency that network geography can defeat.
3. Vector databases generate cost spikes invisible in standard billing.
4. Agentic workloads chain hundreds of tool calls with cascading dependencies.
5. And data-sovereignty rules constrain where any of them can run.

In short, what works at the platform level fails at the workload level.

The costs are the first thing to surprise leaders, because they hide. CloudZero’s analysis and the FinOps teams I work with put it plainly: AI spend surfaces as generic compute, storage and instance line items, rarely labeled “AI.” Three layers drive most of the waste:

1. The most visible is LLM API cost, where stateless calls re-send the full conversation history on every request, so a deployment with a couple hundred users can burn many times the token budget in the business case.
2. The biggest is idle GPU: teams’ provision for peak and then run at 10 to 20 percent utilization, and most miss their AI cost forecasts by more than a quarter.
3. The most underestimated is the vector database and retrieval layer, where storage I/O, query volume and embedding refresh appear nowhere labeled AI until the bill arrives.

The dimensions leaders underweight resilience and control

Cost and latency dominate the conversation. Two dimensions rarely get the same rigor until something breaks:

1. Resilience, whether an AI-dependent system can survive failure, degrade gracefully and recover predictably.
2. Control, who can observe, halt and audit it.

AI introduces failure modes that traditional architecture never faced: GPU single points of failure under revenue-critical inference, agentic pipelines that fail mid-execution with no rollback, and models that degrade silently from drift or throttling.

I see the pattern repeated across industries. Organizations design resilience for their traditional applications, then deploy AI on top without asking whether the same guarantees hold. In one global financial services firm I advise, a real-time credit-decisioning model running on a single cloud region took a 47-minute outage during a regional availability event. The halted loan approvals cost more than the system’s entire annual infrastructure budget, and the resilience rework that followed cost several times what designing it in from the start would have. The leaders who avoid this should ask four questions before go-live:

1. What happens when the network fails?
2. What happens when the model degrades?
3. What happens when an agent executes only halfway?
4. Who holds the authority to halt and audit?

What the cloud providers signaled this spring

The major providers are on track to spend close to $700 billion on AI infrastructure in 2026, roughly three and a half times the 2024 level. Their announcements are strategic signals, not just features. Last year they converged on one message: enterprises cannot run everything in public cloud, so all three built ways to bring their infrastructure into your data center and your sovereign environment. This year the signal advanced a step. They stopped talking about where workloads run and started shipping the layer that governs what agents are allowed to do: identity, containment, auditability and rollback.

Microsoft introduced an “Agent Computer” model with execution containers and machine identity for agents. AWS built Amazon Bedrock AgentCore around runtime, memory, identity and auditability. Google shipped an agent gateway and sovereign controls for cross-cloud traffic. As Bain observed, agentic AI is now an economics and operations problem, not just a capability problem. The through-line, captured by Microsoft’s own framing, is that AI alone will not change your business; the system running it will. McKinsey’s read is consistent: workloads are becoming more distributed, specialized and operationally demanding, which forces more deliberate infrastructure decisions.

From platform choice to placement decision

The failure I document most often is not a technology failure; it is a governance failure. Most enterprises lack a clear, repeatable way to decide what runs where, under what conditions and with what tradeoffs. Platform teams make that call informally, under deadline pressure and repeat it hundreds of times as new use cases launch. Workloads then accumulate in public cloud by default, not by design and 30 to 50 percent cost overruns follow, not because public cloud was the wrong choice but because no deliberate choice was ever made.

In one global manufacturer I advise, a predictive-maintenance model went live on public cloud and performed exactly as validated in staging. But real-time inference on the factory floor ran at 80 to 120 milliseconds across the WAN, when the machine-control system needed under ten. Moving the model to edge nodes fixed the latency, but the company lost most of a quarter of the cost, rework and delayed benefits, and the line had run for weeks on stale recommendations: a control failure that could have caused a safety event. The fix was never more AI talent. It was a structured placement decision at the start, weighing six dimensions:

• Latency: real-time (under 10 ms, edge or on-prem), interactive (50 to 500 ms, cloud) or batch.
• Cost and TCO: token spend, GPU utilization, vector-database queries, egress and unit economics per workload.
• Resilience: failover architecture, degraded-mode behavior, recovery SLA and rollback policy.
• Control: observability, audit trails, governance authority and the ability to halt or reverse.
• Data sensitivity: sovereignty requirements, privacy and compliance rules, and IP protection.
• Integration: legacy system dependencies, pipeline complexity and data-residency constraints.

Run consistently, those dimensions produce a placement pattern like this:

Workload	Latency	Cost predictability	Data sovereignty	Recommended path
Customer-facing chatbot	200-500 ms	Medium	Low risk	Public cloud, reserved instances
Real-time fraud detection	Under 10 ms	Medium	High	On-prem or sovereign private cloud
Clinical decision support	100-300 ms	Predictable	Critical	Sovereign cloud or dedicated VPC
Demand forecasting (batch)	Hours	High	Low risk	Spot instances or scheduled cloud
Factory-floor vision AI	Under 5 ms	Predictable	Medium	Edge node (Azure Local, AWS on-prem)
Internal knowledge assistant	1-3 sec	Variable tokens	High (IP risk)	Private cloud with on-prem retrieval

This is no longer optional. Cloudian’s 2026 enterprise AI infrastructure survey found that 79 percent of enterprises have already moved AI workloads out of public cloud, and 93 percent are repatriating or actively evaluating it, driven by data sovereignty, cost overruns and real-time performance. Repatriation is now the norm, not the exception.

The agentic layer makes discipline urgent. An agent chains 20 to 100 tool calls, each with its own latency, cost and failure mode, so the governance model that works for a chatbot does not work for an autonomous agent approving procurement or onboarding a customer. This spring the providers shipped production infrastructure for exactly this, yet Deloitte’s 2026 survey of more than 3,000 leaders finds only about one in five companies has a mature governance model for autonomous agents. The platforms solved the mechanism. Most enterprises have not yet written the policy.

What the leaders do differently

The organizations extracting compounding value from AI, not just running experiments, share one discipline: they treat workload placement as a repeatable process, and they build resilience and control in from the start rather than after the first production incident. In practice, they do five things:

1. Classify every use case at intake across the six dimensions, before any infrastructure is provisioned.
2. Separate AI budget lines for experiments, production inference and training, so cost is governable.
3. Treat unit economics, cost per inference, per query and per agent run, as engineering KPIs, not month-end surprises.
4. Define repatriation triggers in advance, typically 12 to 18 months of stable volume.
5. Write an explicit resilience contract, and agentic observability and rollback rules, before scaling.

The gap between strategy-ready and infrastructure-ready is the remediation backlog, and most enterprises stall moving from proof of concept to production for exactly this reason. Deloitte’s tech-trends analysis frames the same shift as the move to inference economics: the bottleneck is infrastructure governance, not model capability.

For CIOs, a 90-day agenda. Five actions separate the leaders from those managing infrastructure crises:

1. Audit every AI workload in production across latency, cost, sovereignty, volume, resilience, control and integration.
2. Separate AI infrastructure budget lines so each workload type is attributable and governable.
3. Define unit economics by workload and review them as engineering KPIs.
4. Set a quantitative repatriation evaluation trigger.
5. Define observability, cost attribution and rollback policy before scaling agents.

The strategic reframe

The organizations making real progress on AI are not distinguished by the sophistication of their models or the size of their cloud contracts. One discipline sets them apart: a clear, repeatable way to decide what runs where, under what conditions, with what tradeoffs and what happens when something fails. That discipline is not an IT problem. It is a strategic capability that requires CIO ownership, CFO alignment and executive accountability.

This spring the cloud providers handed enterprises the infrastructure to run and govern AI, and agents, at every tier of the architecture. The gap is no longer supply. It is the operating model to use deliberately. The companies building that model now build the operating foundation for AI at scale. Everyone else builds a remediation backlog. The infrastructure decisions you make in the next 12 months will decide which of those two you become.

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Rapid and widespread AI adoption has most CIOs blind to what AI is really costing their organizations.

Nearly two-thirds of companies say employees have used AI without proper oversight, and almost half of large enterprises don’t have full insight into what AI tools employees are using, according to Protiviti’s 2026 AI Pulse Survey. Meanwhile, 77% of technology leaders say AI adoption is already outpacing their governance capabilities, per IBM’s 2026 Tech Leader Study.

“Combine the breakneck pace at which companies are looking to embrace AI with the low technical barrier to entry for using AI, and you’ve got an incredibly challenging space to keep tabs on,” says Andrew Retrum, managing director and global technology risk and resilience practice lead at Protiviti.

This isn’t shadow IT in the old sense, as financial exposure isn’t rogue employees signing up for ChatGPT. It’s the AI costs mounting in vendor renewals, usage-based consumption, and business unit budgets. A few CIOs have full visibility, but only because they built it into their architecture from day one. Others are still catching up. And some are finding that cost isn’t even the most important thing they can’t see.

Where the money hides

AI costs are showing up in three places that most organizations aren’t watching closely enough.

The first is vendor-embedded AI. Software providers are quietly adding AI features to existing tools, and the costs show up as renewal increases — not new line items. Some solutions are showing a 30% cost uplift as vendors embed AI functionality without upfront disclosure, according to Gartner research from September 2025.

The second is usage-based pricing. “The bulk of GenAI cost isn’t in the build, it’s in the run: inference, API calls, fine-tuning, and usage-based consumption that scales fast and unpredictably,” Gartner notes.

Phil Leslie, chief technology and innovation officer at Cornerstone Research, has seen this firsthand. “With Gemini, monitoring cost is largely irrelevant; the fee is fixed,” he says. “With Claude Code, costs are usage-based, and as adoption grows, so does spend. We noticed costs rising and have been building our dashboards accordingly.”

Getting a complete picture isn’t easy. “Getting a truly holistic view across Claude Code, Claude.ai, and our Office plugins is not trivial,” Leslie says.

The third bucket is business unit–led adoption. Various functions are buying AI solutions via credit cards or departmental budgets, outside IT’s line of sight.

Visibility by design

At Cox Business, Head of AI Eric Pace says the company has achieved full visibility into AI spend. But it required intentional architecture and governance from the start.

“We have 100% visibility into all AI spend, including SaaS-based modules through activations in BAU [business-as-usual] operations, new purchases and solutions, and all token consumption across the enterprise,” Pace says.

The key was centralization paired with clear accountability. “We were really intentional about building a model in our organization where AI is not a handoff, with one team building and another team simply receiving it,” says Pace. “We chose to centralize the AI function early to align with company-wide objectives, while business teams provide the workflow context that makes adoption real.”

Cox Business also built visibility into its architecture by default. “All AI traffic is routed through our AI gateway and runtime security solutions,” Pace says. “This includes all on-prem and cloud-based capabilities.”

That architecture extends to network monitoring. “We can see all traffic ingress and egress on the network and can also see what is running on our company devices,” he adds. “When we identify traffic patterns outside of our desired path or standard, we work with our people to find their way into compliance.”

Employees have access to the tools they need without creating ungoverned sprawl. “We have provided flexible ecosystem and capability sets that allow our people to operate with ‘freedom in a framework,’” says Pace. “And they generally find that they have access to everything they need.”

When cost takes a back seat

Not every organization is racing to solve the cost visibility problem. For some, other concerns take priority.

“Cost visibility is deliberately secondary right now,” says Leslie of Cornerstone Research. “The harder problem is the nature of our work.”

Cornerstone operates in high-stakes litigation, where expert reports must be error-free. “Figuring out how to unlock the benefits without compromising that trust is the primary challenge,” Leslie says. “Cost matters. It is just not the binding constraint in this phase.”

Leslie also points out a nuance that complicates cost optimization: The highest spenders are often the highest performers.

“Something like 80% of our costs come from 10% of our users — and that 10% tends to be our most experienced people, using AI for legitimate, high-stakes reasons,” he says. “You cannot just set a uniform ceiling without risking exactly the use cases you want to encourage.”

For now, Cornerstone uses caps that create friction when costs get high, paired with override mechanisms. “A high-cost user is often a signal of high-value work, not waste,” Leslie says.

Scale changes the game

The visibility challenge looks different depending on organization size. Leslie spent a decade at Amazon before joining Cornerstone and sees a clear contrast. “Amazon is not just bigger — it is more diverse,” he says. “At that scale, simple rules are often inefficient, but you reach for them anyway because managing complexity requires blunt instruments.”

At Cornerstone, he can be more surgical. “The feedback loops are short enough that I can have a direct conversation with a practice lead and understand in a few minutes what a team is trying to accomplish,” Leslie says. “That means we can tailor cost management to the specific situation — confidently incurring higher costs where we know it makes sense, rather than guessing.”

At Cox Business, scale required a different approach. “We centralized our capital investments and distributed enablement where teams are building enterprise applications outside of the center of excellence,” Pace says. Token consumption budgets are centralized but communicated constantly to larger consuming departments, and top consumers are interviewed frequently to understand value.

What’s working

For organizations still building visibility, it’s helpful to begin with the basics. “Start with an inventory — you can’t defend what you can’t see,” says Protiviti’s Retrum. “Assign clear ownership across IT, security, legal, and the business. And treat it as an ongoing discipline, not a one-time effort.”

Prioritization matters, too. “Don’t let perfect be the enemy of good,” Retrum advises. “Prioritize your highest-risk use cases first — where AI is touching sensitive data, customer-facing decisions, or regulated processes. Build your guardrails around those, then expand outward.”

Gartner recommends tagging AI purchases in procurement, tracking AI spend separately in IT financial management systems, and negotiating AI-specific cost clauses into cloud and SaaS renewals before the next renewal cycle.

At Cox Business, governance isn’t just about control — it’s about focus. “We have used ‘no’ liberally to keep our people focused on the things that will get us to value quicker,” Pace says.

Beyond the budget

For some organizations, the bigger risk isn’t runaway costs: It’s what happens when AI goes wrong.

“Shadow IT is not primarily a cost control issue — it is a reputational risk issue,” Leslie notes. “Depending on your firm and how AI is used, rogue use can cause real harm. That is the risk worth managing.”

Cost visibility matters. But for some CIOs, it may not be the most important thing they’re missing.

Whether you are using an AI code generator, vibe coding, or applying spec-driven development methodologies, your job doesn’t end with AI writing the code. Whether you’re using AI to develop applications, APIs, data pipelines, AI agents, or other automations, writing the code is just one part of the job. Developers must still perform code validation, test applications, automate deployment, and configure infrastructure.

According to one survey, only 16% of a developer’s time is spent writing code. The remaining 84% is spent on other activities including defining requirements, triaging bugs, and addressing vulnerabilities.

Additionally, while AI code generation speeds up development, it can come at the cost of quality and collaboration. In Atlassian’s State of Teams 2026 survey, nearly 50% of respondents say their AI outputs aren’t reliably high quality and admit that using AI is a compromise between speed and quality. Knowledge workers say the pressure to execute is also problematic, with 87% saying they lack time to coordinate and 70% saying their processes aren’t well-optimized for AI.

So, although AI capabilities have changed drastically in the past few years, code-generation tools are not the only ways AI can improve software development. In fact, developers should seek additional AI capabilities to support the full software development life cycle (SDLC). Here are five recommendations for the AI coding stack. 

Scale up testing environments

If coding is faster, development teams should have suitably configured environments that they can use to quickly and easily test changes against real APIs and databases. Testing apps and AI agents against environments that don’t mimic production can slow down development.

“Remote + local” development environments (local execution with remote context) are one option to accelerate testing. Developers can code locally on their own physical or virtual machine, but build and deploy to remote instances. Additionally, when developing AI agents, developers need an execution environment, such as secure sandboxes or ephemeral virtual machines.

“GenAI has been a step-change for developer productivity, absorbing the repetitive work of writing boilerplate, tests, and refactors so engineers can focus on intent and design,” says Aviram Hassan, CEO and cofounder at MetalBear. “But by compressing the time it takes to produce all of this, genAI has also exposed what’s always been the real bottleneck in the SDLC: the feedback loop against the real world. Validating code and configurations against a realistic cloud environment still depends on the same slow build-and-deploy cycles teams have tolerated for years.”

The goal should be to remove the friction and delays from where developers code to a complete, real-world infrastructure they can use to validate changes. Three tools to review are mirrord, Signadot, and Telepresence.

Validate the AI-generated code

At a recent Coffee With Digital Trailblazers LinkedIn Live event that I hosted on AI coding competencies, one speaker shared how he quickly went from a short spec to more than 10,000 lines of AI-generated code. He admitted he didn’t have the time, expertise, or tools to validate the code. He’s not alone. In Sonar’s State of Code Developer Survey, 96% of developers don’t fully trust AI’s output, but only 48% always verify it before committing.

“Agentic software development is generating code faster than any team can manually review it, but speed without confidence only results in technical debt,” says Scott Sanders, corporate vice president of engineering at Sonar. “What’s needed to avoid this is an automated independent verification layer embedded directly into the development workflow—one that unifies code quality and code security into a single, deterministic platform to deliver actionable intelligence before code ever reaches the repository.”

A big concern is that AI-generated code can produce 1.4 times as many critical issues as code created by developers, according to CodeRabbit’s State of AI Versus Human Code Generation Report. Top issues include code readability, cross-site scripting, code formatting errors, and incorrect concurrency control.

Another challenge is that 82.4% of AI tools originate from third-party packages, according to Snyk’s 2026 State of Agentic AI Adoption. The implication is that development teams have much more code to validate than they develop themselves, whether by humans or AI code generators.

“When tools like Cursor are installing dependencies and running actions on a developer’s behalf, they can unintentionally pull in malicious or unvetted packages,” says Randall Degges, vice president of AI engineering and developer relations at Snyk. “That’s why techniques like intercepting tool calls, validating inputs and outputs, enforcing least-privilege access, and isolating credentials are becoming foundational to how AI-driven development systems operate. Without security embedded directly into the agent loop, teams risk shipping faster into more exposure, not less.”

According to Qodo’s report on The AI Coding Paradox, 89% of enterprise engineering teams have experienced an AI-generated code incident and have had a production outage caused by AI-generated code. Development teams building a large portfolio of AI agents or heavily relying on AI code-generation capabilities may want to look at AI code-review tools that provide more contextual analysis than basic static code review tools.

“Current AI coding assistants suffer from a severe amnesia problem, and each session starts without memory of an organization’s unique context, subjective standards, and business logic,” says Itamar Friedman, CEO and cofounder at Qodo. “To safely scale AI, it requires integrating stateful systems equipped with persistent organizational memory that continuously learn from past pull requests and automatically enforce enterprise-specific governance. Ultimately, developers need tools that ensure code is guided by continuously learning organizational experience rather than just raw machine-generated code.”

Tools to review include static application security testing (SAST), software composition analysis (SCA), software bill of materials (SBOM), and AI code review tools.

Security and end-to-end testing

Even when AI-generated code passes all the tests, how can devops teams validate whether it meets business and non-functional technical requirements? Many devops teams have invested in continuous testing, and some support continuous deployment, but the underlying assumptions behind those practices are being challenged now by who is coding and how much code is being generated. 

Some spec-driven development platforms aim to bridge the gap. Tools like Appian Composer and SAP Joule Studio 2.0 generate product requirements documents (PRDs) before coding, enabling the introduction of business acceptance criteria. These tools create knowledge graphs from the business processes implemented on their platforms and provide environments for validating AI agents before deployment.

“For most organizations, the AI code-generation methodology question matters less than the verification question,” says Gal Vered, CEO and cofounder at Checksum.ai.  “Whether your team is prompting from intent or working from specs, AI-generated code still needs to be validated against a production environment before it ships.”

Beyond functional testing, developers must look at new security concerns, especially as AI agents integrate with Model Context Protocol servers. “Most teams are stacking generation tools on top of review tools and on top of testing tools, but without security validation embedded at every stage, you’re just automating the path to your next breach,” says Harshit Agarwal, CEO at Appknox. “Mature teams treat security feedback as a non-negotiable part of the build loop, running automated checks continuously rather than catching issues after the fact.”

Add observability tools

Developers save an average of 3.6 hours per week with AI coding tools, according to one report, and the more experienced engineers achieve the largest productivity gains.

What’s one way to blow these savings? When defects get pushed to production, it’s often the site reliability engineers and senior developers who are left to triage and resolve the issue. Establishing observability practices as a devops non-negotiable is a development investment that pays off significantly to help diagnose issues, resolve errors, and improve performance.

“In data and AI systems, even small changes like model updates, tool decisions, or shifts in data flow can silently cascade into issues no one anticipated, and the AI agent has no way to know that,” says Barr Moses, cofounder and CEO at Monte Carlo. “Leading teams are addressing this by embedding observability across the entire agentic stack, particularly at precommit checkpoints, so agents can surface the true impact of changes before they go live.”

While many devops teams have mature observability practices for APIs, applications, and data integrations, observability practices for AI agents are relatively new. One technique to consider is AI tracing platforms with notation queues for human review and LLM-as-judge evals. A second option is to implement an AI gateway with observability, caching, routing, and cost-tracking capabilities.

Develop reusable agent skills

One last element of the AI stack, especially for organizations heavily investing in AI agent development, is to adopt best practices for developing reusable skills embedded in code-generating tools.

“A key emerging pattern is purpose-built AI skills: reusable, scoped instructions that give agents deep context for specific tasks, rather than relying on general-purpose prompting alongside antagonist agents that challenge other agents’ outputs,” says Phillip Goericke, CTO of NMI. “The defining shift is that developers are no longer writing code with AI assistance—they’re architecting the systems that produce and validate it.”

Development organizations that leverage code-generation tools are recognizing that coding is just one part of delivering business value from AI and resilient AI agents. Developing AI skills and establishing an AI stack are steps toward scaling to a dependable AI software development life cycle.

Es sind vor allem drei Begriffe, die die Cloud-Diskussion in deutschen Unternehmen derzeit dominieren: Sovereign Cloud, Private Cloud und Hyperscaler. Alle drei Optionen klingen nach Kontrolle, versprechen Sicherheit – und bilden jeweils ein grundlegend anderes Konzept ab.

Die daraus resultierende Entscheidungsunsicherheit war auch auf der “European Identity and Cloud Conference 2026“ in Berlin eines der meistdiskutierten Themen unter Praktikern. Das Problem: Viele Unternehmen treffen diese Entscheidung unter regulatorischem Druck und mit unvollständigen Informationen – meist einem Mix aus Marketingversprechen und technischen Halbwahrheiten.

Im Ergebnis stehen häufig überteuerte Architekturen, die regulatorisch trotzdem angreifbar bleiben – oder günstige Lösungen, die im Ernstfall nicht halten, was sie versprechen. Wer heute eine Cloud-Strategie entwickelt oder eine bestehende überprüft, muss verstehen, was hinter den einzelnen Cloud-Modellen steckt, wo die Unterschiede liegen und wann welches Modell sinnvoll ist. Dafür liefert dieser Artikel die Grundlage.

Sovereign Cloud, Private Cloud und Hyperscaler im Vergleich

Zunächst ein Blick auf die einzelnen Cloud-Modelle und ihre jeweiligen Vor- und Nachteile.

Hyperscaler Cloud

Die großen US-amerikanischen Cloud-Plattformen Amazon Web Services (AWS), Microsoft Azure und Google Cloud Platform (GCP) bieten:

• nahezu unbegrenzte Rechenkapazität,
• ein breites Serviceangebot und
• eine ausgereifte Infrastruktur, sowie
• (dank Skaleneffekten) vergleichsweise niedrige Preisen.

Der entscheidende Nachteil: Die Infrastruktur unterliegt US-amerikanischem Recht. Der CLOUD Act von 2018 gibt US-Behörden das Recht, auf Daten zuzugreifen, die von amerikanischen Unternehmen gespeichert werden – unabhängig davon, ob die Server in Frankfurt, Dublin oder anderswo stehen.

Private Cloud

Eine Private Cloud ist eine Cloud-Infrastruktur, die ausschließlich für eine Organisation betrieben wird – entweder im eigenen Rechenzentrum (On-Premises) oder bei einem Dienstleister, der die Infrastruktur dediziert bereitstellt. Der Hauptvorteil besteht dabei in der vollständigen Kontrolle über Hardware, Software und Daten.

Die wesentlichen Nachteile sind hingegen – insbesondere im Fall einer On-Premises-Lösung – hohe Investitions- und Betriebskosten, geringere Flexibilität und die Notwendigkeit, eigene Expertise aufzubauen.

Sovereign Cloud

Die Sovereign Cloud ist in erster Linie ein rechtliches und organisatorisches Konzept – kein technisches. Es gibt zwei grundlegend verschiedene Ansätze:

• Die Sovereign-Cloud-Angebote der Hyperscaler (AWS European Sovereign Cloud, Microsoft Cloud for Sovereignty, Google Sovereign Cloud) sind spezielle Angebote, bei denen europäische Tochtergesellschaften die Infrastruktur betreiben, Customer Managed Keys eingesetzt werden und vertragliche Zusicherungen gegeben werden. Das ist technisch ausgereift, aber teurer — und die rechtliche Robustheit ist noch nicht vollständig gerichtlich erprobt.
• Die Sovereign-Cloud-Lösungen europäischer Anbieter (etwa Ionos, Hetzner, OVHcloud, Deutsche Telekom oder SAP) unterliegen vollständig EU-Recht. Das sorgt für einen klaren rechtlichen Rahmen, ohne „CLOUD-Act-Problematik“. Dafür müssen sich Kunden in der Regel aber mit einem schmaleren Serviceangebot begnügen.

Die nachfolgende Tabelle zeigt die einzelnen Cloud-Modelle im direkten Vergleich:

Kriterium	Hyperscaler (Standard)	Sovereign Cloud (Hyperscaler)	Sovereign Cloud (EU-Anbieter)	Private Cloud
Datenspeicherort	EU möglich	EU, vertraglich	EU, rechtlich gesichert	eigene Kontrolle
CLOUD-Act-Risiko	vorhanden	reduziert	kein direktes US-Risiko	keines bei Eigenbetrieb
NIS2/KRITIS-Eignung	eingeschränkt	gut	gut	gut
Serviceangebot	sehr breit	breit, eingeschränkt	mittel	variiert
KI/ML-Dienste	vollumfänglich	teilweise eingeschränkt	eingeschränkt	selbst zu betreiben
Relative Kosten	günstig	15% bis 30% teurer	vergleichbar	hoch (Invest und Betrieb)
Skalierbarkeit	sehr hoch	hoch	mittel	eingeschränkt
Anbieter-Abhängigkeit	hoch	hoch	mittel	gering
Exit-Komplexität	hoch	sehr hoch	mittel	niedriger

Ein Entscheidungsbeispiel aus der Praxis

Ein mittelständischer Maschinenbauer mit 800 Mitarbeitern und Kunden in der Automobilindustrie steht vor einer typischen Entscheidung: Die bestehende IT-Infrastruktur soll modernisiert sowie KI-gestützte Predictive-Maintenance-Prozesse eingeführt werden. Als Zulieferer fällt das Unternehmen zudem in den Anwendungsbereich von NIS2. Hier sollte im Ergebnis nicht eine „Alles oder nichts“-Lösung stehen, sondern eine differenzierte Multi-Cloud-Strategie, die regulatorische Anforderungen erfüllt und gleichzeitig wirtschaftlich sinnvoll ist:

• Die Produktionsdaten und Anlagendaten – Sensordaten, Steuerungsprotokolle, OT-Verbindungen – sind NIS2-relevant und hochsensibel. Hier ist Sovereign Cloud oder Private Cloud angezeigt.
• Die KI-Entwicklungsumgebung für die Predictive-Maintenance-Plattform arbeitet mit anonymisierten Trainingsdaten. Hier wäre das Standard-Hyperscaler-Modell die wirtschaftlichste Wahl, weil das ein umfängliches KI/ML-Serviceangebot bietet und keine regulatorischen Verpflichtungen mit sich bringt.
• Die internen Collaboration-Tools haben keine besondere Schutzstufe, daher reicht hierfür ebenfalls eine Standard-Hyperscaler– oder auch eine SaaS-Lösung aus.

Die häufigsten Fehler bei der Cloud-Wahl

Unabhängig von Branche und Unternehmensgröße beobachte ich in der Praxis von Beratungsprojekten die folgenden fünf Fehler immer wieder, wenn es um die Wahl des richtigen Cloud-Modells geht.

1. Datenspeicherort mit Datenkontrolle gleichsetzen

Ein Rechenzentrum in Frankfurt bedeutet nicht, dass Sie die volle Kontrolle über Ihre Daten haben. Die entscheidende Frage ist nicht, wo der Server steht – sondern wer die Schlüssel verwaltet, die Metadaten einsehen kann und wer bei einem Rechtsstreit welche Rechte hat.

2. Sovereign Cloud als Pauschalstrategie betrachten

Die teuerste und häufigste Fehlentscheidung ist, alle Workloads in eine Sovereign-Cloud-Umgebung zu migrieren – ohne sich vorher anzusehen, welche Workloads das tatsächlich benötigen. Für Entwicklungsumgebungen, interne Tools und nicht-regulierte Daten bedeutet die Sovereign Cloud vor allem eines: Aufpreis ohne Mehrwert.

3. Identity Governance vernachlässigen

Eine technisch perfekte Sovereign-Cloud-Infrastruktur nützt wenig, wenn die Zugriffssteuerung unzureichend ist. Wer auf welche Systeme zugreifen darf, entscheidet über das tatsächliche Security-Niveau – insbesondere, wenn es um KI-Agenten und automatisierte Prozesse geht. Ein KI-Agent mit Schreibzugriff auf Produktionssysteme, der auf Sovereign-Cloud-Infrastruktur läuft, aber mit unzureichender Identity Governance operiert, ist eine Schwachstelle – egal, wo der Server steht. Identity Governance ist 2026 die kritische Lücke in den meisten Cloud-Sicherheitsarchitekturen.

4. Exit-Strategie nicht mitdenken

Wer heute in eine Sovereign Cloud der Hyperscaler migriert, muss wissen: Der Ausstieg ist komplexer und teurer als beim Standard-Angebot. Drei Kostenfallen werden dabei regelmäßig unterschätzt:

• Wechselkosten, die der EU Data Act zwar seit September 2025 deckelt und ab Januar 2027 ganz abschafft. Dabei werden allerdings nur die Kosten für den Anbieterwechsel selbst erfasst, nicht die laufenden Egress-Kosten in Multi-Cloud-Architekturen.
• Vertragliche Mindestlaufzeiten und Volumenzusagen, die Sovereign-Angebote häufig voraussetzen und die der Data Act ausdrücklich unberührt lässt.
• Die Abhängigkeit von proprietären Diensten, die sich nicht “mitnehmen” lassen, sondern beim neuen Anbieter nachgebaut werden müssen. An dieser Stelle hilft auch der Data Act nichts.

Exit-Kosten gehören deshalb von Tag eins in die Gesamtkostenrechnung – und eine dokumentierte Exit-Strategie sollte Teil jeder Cloud-Entscheidung sein.

5. Compliance mit Sicherheit verwechseln

NIS2-Konformität und ISO 27001 sagen nichts darüber aus, ob ein Unternehmen im Ernstfall handlungsfähig ist. Compliance bescheinigt, dass Prozesse dokumentiert sind. Sicherheit entsteht durch technische Kontrollen und klare Verantwortlichkeiten.

In 5 Schritten zum richtigen Cloud-Modell

Cloud-Souveränität ist – das zeigt mir jedes Projekt aufs Neue – eine Workload-Entscheidung, keine Glaubensfrage. Wer pauschal migriert, zahlt für Souveränität, wo keine nötig ist und übersieht häufig Lücken, wo sie zählt. Eine belastbare Strategie entsteht vor allem daraus, danach zu fragen, welche Regulierung greift, wie sensibel die Daten sind und wer Schlüssel und Identitäten kontrolliert. Alles andere ist Marketing.

Die folgenden fünf Schritte können Sie dabei unterstützen, das richtige Cloud-Modell für Ihre Bedürfnisse zu wählen.

• Regulatorische Pflichten prüfen: Unterliegen Ihre Cloud-Workloads DORA, NIS2, dem EU AI Act oder anderen Regulierungen? Falls ja, ist eine Standard-Hyperscaler-Lösung nur mit zusätzlichen Kontrollen, dokumentierter Risikoabwägung und belastbarer Exit-Strategie vertretbar.
• Sensitivität der Daten klassifizieren: Personenbezogene Daten mit Schrems-II-Relevanz oder Betriebsdaten kritischer Infrastrukturen sind sensible Informationen. Generell gilt: Je höher die Sensitivität der Daten, desto stärker sprechen die Argumente für Sovereign oder Private Cloud.
• Serviceabhängigkeiten prüfen: Wenn Sie Cloud-Services benötigen, die nur bei Hyperscalern verfügbar sind, etwa KI/ML-Plattformen oder spezialisierte Datenbanken, sind die Sovereign Clouds der Hyperscaler oft der bessere Kompromiss.
• Interne Ressourcen realistisch einschätzen: Private Cloud klingt nach Kontrolle — ist aber aufwendig. Um das zu bewältigen, benötigen Sie die richtigen Menschen und Expertise, um dieses Modell professionell zu betreiben.
• Kosten-Nutzen-Verhältnis berechnen: Die Sovereign Cloud kostet nach der Einschätzung von Marktexperten typischerweise 15 bis 30 Prozent mehr als ein Standard-Hyperscaler-Angebot. Rechnen Sie durch, welches Modell für Ihren Workload-Mix wirtschaftlich am sinnvollsten ist.

Wann welches Cloud-Modell sinnvoll ist, entnehmen Sie folgender Tabelle:

Situation	Empfohlenes Modell	Begründung
KRITIS-Betreiber unter NIS2	Sovereign Cloud	Nachweispflichten zu Risikomanagement und Lieferkette, persönliche Haftung der Geschäftsleitung
Finanzdienstleister unter DORA	Sovereign Cloud (Hyperscaler)	breites Serviceangebot und regulatorische Compliance
Hochrisiko-KI unter EU AI Act	Sovereign Cloud	Pflichten ab August 2026; Daten-Governance-Nachweise leichter zu führen
KI/ML-Entwicklung, anonymisierte Daten	Hyperscaler (Standard)	vollständiges Serviceangebot, kein Regulierungsdruck
Interne Tools, Dev/Test	Hyperscaler (Standard)	kein regulatorischer Bedarf, Kosten optimieren
Hochsensible Daten, Behörden	EU-Anbieter / Private Cloud	maximale rechtliche Klarheit, keine Restrisiken
Konstante Workloads, eigene Expertise	Private Cloud	langfristig wirtschaftlicher bei vorhersehbarem Bedarf

(fm)

Dieser Beitrag wurde im Rahmen des deutschsprachigen Experten-Netzwerks von Foundry veröffentlicht. Lust mitzumachen? Jetzt bewerben!