Four months ago, a front-end engineer on my team looking to make upgrades to a product or feature would have filed a ticket and waited for the infrastructure group to unblock them. They might have lost a day, sometimes a week. Today, that same engineer makes changes themselves. The code is occasionally brittle, but it works, and the end result ships in a fraction of the time it used to take.

That small story is unfolding inside nearly every engineering organization right now. While some celebrate the sudden fact that one person can do the work of five, others are focused entirely on tech industry layoffs. Both perspectives skip the question I find more interesting: What happens to mastery when every engineer can suddenly do everything?

For two decades, we have described strong engineers as T-shaped. The horizontal bar represents breadth, which is a working familiarity across many areas. The vertical bar represents depth, the real command of one domain earned over years. Agent tooling has stretched that horizontal bar wider than ever before. My concern is the vertical bar, which is quietly getting shorter.

Consider what is now possible in a single quarter. With the right agent harness, one engineer can stand up a billing system, a data connector framework, regional and organizational tenancy infrastructure, or a consumption-based pricing implementation. The pull requests pass review. The tests are green. All looks good. But green tests cannot tell you if the person who shipped that work understood why the system needs redundancy in one specific place, where its failure modes are hiding, or which trade-offs the model made silently on their behalf. The pattern recognition that comes from watching systems fail over many years is suddenly weighted differently than it was even 12 months ago. Our industry has not caught up to that shift.

When the interview stops measuring judgment

The first place this surfaces is hiring, a trend that should concern anyone who has built a team. Traditional coding interviews were always an imperfect proxy for engineering judgment, but agent tooling completely obliterates them. If a candidate can produce a working solution in 20 minutes that would have taken two hours a year ago, the exercise no longer measures technical competence. It just measures how well a coder can prompt an agent.

At Thread AI, we have responded by widening what we look at when we interview job candidates. Our process moves across coding exercises, problem decomposition, system architecture, and behavioral components, with the weighting shifting by role. We allow AI assistance only in specific sections because our engineers still need to be able to operate without it. Some of our work happens in secure environments where you cannot lean on an agent to debug for you. What we’re really testing for now is judgment under ambiguity — the ability to notice when an agent’s output is confidently wrong — and the depth to predict where a system will break before it breaks.

Hiring teams that fail to make this shift will fill their rosters with false positives. They will hire people who interview like experts but struggle the first time a system behaves in a way the model did not anticipate. Ultimately, these companies will miss out on top-tier talent, and they won’t discover the misstep until it’s too late.

Confusing velocity with understanding

That brings me to a larger risk: the rise of false expertise as a category of its own. Historically, the reasoning has gone, “I built a proof of concept, therefore I am an expert.” I have watched versions of this appear in technical leadership, in investment decisions, and in policy conversations about AI. It travels well because the artifact looks real. A working demo is highly persuasive, even when the person behind it only half-understands how it functions.

The problem is bigger than one false expert shipping one bad product; an organization can absorb that. The real risk is a generation of consequential decisions being made by people who have confused velocity with understanding. You can already see the cultural scaffolding being built around this with the celebration of the “idea guy,” and the sudden fashion for invoking “taste” as a substitute for knowing how a system actually works. Those of us shaping tooling, hiring norms, and regulations have a narrow window to set better defaults before this pattern hardens into the way the industry operates.

Depth and breadth, held together

This is the path we’ve been walking at Thread AI since before the latest wave of tooling arrived.

To ground this in a specific example: I have spent 15 years building complex systems. I worked at Goldman Sachs through the financial crisis and the early Dodd-Frank infrastructure, moved critical payment systems into the cloud at The New York Times when that ground was still new, and built the system of record for model training and evaluation at Palantir across highly regulated environments in defense, health, and finance. This experience is the superpower that lets me course-correct an agent when it produces confident-but-wrong output.

I felt this sharply not long ago while scoping consumption-based pricing in a single quarter. The agents did an enormous amount of the heavy lifting, and at some point, I realized that my largest contributions to the effort were knowing where the system would fail and steering around it before we got there. I have also seen how organizations have built large teams around efforts like these in the past. Someone earlier in their career or relying purely on AI guidance would not have had that instinct to draw on. That is the part the public conversation keeps missing.

Every engineer at Thread AI, regardless of seniority, is expected to be a builder at heart. Our people own outcomes across compute, data, and the organizational and identity primitives that hold the product together, all without the traditional product-manager and project-manager scaffolding around them. Our model works only because the people in those seats have the depth to know what they do not know, and the breadth to fill the gaps with agents. They use the tooling instead of being used by it.

AI doesn’t replace deep understanding

The core issue facing organizations today is not whether AI will replace engineers. That question has been answered dozens of times this year with varying degrees of nuance, and it has stopped being interesting. The more useful question for anyone running a company is whether we are protecting the people who understand our systems deeply enough to recognize when the machines are wrong.

In our company, the answers have been to move toward explicit end-to-end ownership, and to hire for depth and breadth together rather than treating them as a trade-off. Layoffs dominate the headlines because they are an easy narrative, but they describe a symptom rather than the actual choice in front of us. The real choice is whether we let breadth quietly stand in for mastery, or whether we build organizations that keep human judgment in the loop on purpose.

In an era when software can be generated faster than it can be understood, the companies that hold onto what is human, verifiable, and deeply understood will be the ones still standing when the brittle parts give way.

—

New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.

Demis Hassabis, the driving force behind Google DeepMind, is ascending to the role of chief scientist at Alphabet, Google’s parent company, replacing Jeff Dean who is leaving to work at a start-up.

The role will enable Hassabis to “put his full attention on actively shaping the future of AGI,” or artificial general intelligence, Alphabet CEO Sundar Pichai wrote on the company’s Inside Google blog.

Hassabis’ attention will still be divided, however: He will continue to lead research at Google spin-off Isomorphic Labs, which works on drug discovery, and although he will no longer be CEO of DeepMind, he will be its chair. Koray Kavukcuoglu will take over DeepMind, reporting directly to Pichai. He is currently its CTO.

Hassabis has been a strong promoter of AGI, defined by Google as the “hypothetical intelligence of a machine that possesses the ability to understand or learn any intellectual task that a human being can.”

He has a long career in AI, having helped found DeepMind in 2010. He has been a prominent figure in the AGI field, prophesying in May that it will be a viable technology within three years. He has been keen to tackle any barriers in the way of developing the technology; just last month, he called for greater self-regulation in the market, arguing that it would help drive the technology forward.

Hassabis welcomed the chance to focus on AGI development. “We have arrived at a pivotal moment in human history. I’ve been working towards AGI my whole life, and now, I feel it is close at hand. It’s critical that we collectively get the next steps right to ensure this all goes well for humanity and we usher in an incredible new age of discovery and wonder” he wrote in the Inside Google blog post.

This article first appeared on Computerworld.

Demis Hassabis, the driving force behind Google DeepMind, is ascending to the role of chief scientist at Alphabet, Google’s parent company, replacing Jeff Dean who is leaving to work at a start-up.

The role will enable Hassabis to “put his full attention on actively shaping the future of AGI,” or artificial general intelligence, Alphabet CEO Sundar Pichai wrote on the company’s Inside Google blog.

Hassabis’ attention will still be divided, however: He will continue to lead research at Google spin-off Isomorphic Labs, which works on drug discovery, and although he will no longer be CEO of DeepMind, he will be its chair. Koray Kavukcuoglu will take over DeepMind, reporting directly to Pichai. He is currently its CTO.

Hassabis has been a strong promoter of AGI, defined by Google as the “hypothetical intelligence of a machine that possesses the ability to understand or learn any intellectual task that a human being can.”

He has a long career in AI, having helped found DeepMind in 2010. He has been a prominent figure in the AGI field, prophesying in May that it will be a viable technology within three years. He has been keen to tackle any barriers in the way of developing the technology; just last month, he called for greater self-regulation in the market, arguing that it would help drive the technology forward.

Hassabis welcomed the chance to focus on AGI development. “We have arrived at a pivotal moment in human history. I’ve been working towards AGI my whole life, and now, I feel it is close at hand. It’s critical that we collectively get the next steps right to ensure this all goes well for humanity and we usher in an incredible new age of discovery and wonder” he wrote in the Inside Google blog post.

After more than 30 years the cybersecurity field, Keith Jones recently realized that his role had changed, from being a single contributor to manager of a fairly large team. And this team was getting a lot accomplished — tasks that used to take up a huge chunk of his workday.

No, his company hadn’t hired a group of new employees to work under him. He simply accelerated his use of artificial intelligence tools. Now, instead of grinding through a lot of basic tasks, that work is done for him while he focuses on bigger-picture work.

“It really feels like I have a team behind the scenes, but what I have is Claude [Anthropic’s AI tool],” says Jones, who currently works as a cybersecurity researcher. “I’ve been thinking for the last several months about how much differently I work now than I did a year ago, when I would sit and write all the low-level stuff before I could get to the 10% of the good stuff I really wanted to focus on. Now I can sit back and say, ‘Give me three different ways to solve this problem.’”

Most people working in the technology field, like Jones, have had to figure out how best to work with AI. The technology has come on strong, with many companies making its use mandatory and actively evaluating whether employees are faster and more efficient because of it. And while it is boosting productivity and taking over the burden of repetitive, manual tasks, it’s also creating a new level of stress and a dizzying kind of mental exhaustion.

So what can tech workers do about the heavier mental load that comes with using AI, on top of escalating worries about the safety of their own jobs? AI users and industry analysts say there are specific ways to ease some of those burdens and prepare for a changing job market.

Combating the slop factor

When it comes to working with LLM tools, a well-known issue is dealing with AI workslop and hallucinations. The slop is AI-generated output that is low-quality, buzzword-heavy, and generic. It also can refer to bloated, boilerplate code. Hallucinations are inaccurate or completely made-up results. AI routinely offers this messy or incorrect information with total confidence, giving users a false sense of security.

Using this bad data can lead to anything from minor software bugs to severe liabilities. “Don’t believe the machine is infallible,” says Craig Shue, computer science professor and department head at Worcester Polytechnic Institute (WPI). “That’s when bugs will start working in. There’s a lot of misinformation on the internet, and that could be what the LLM is grabbing and using.”

Here are ways to combat the problem:

• Make AI show its work: Ask it to cite its sources or explain its reasoning. Example prompt: Explain the logic and show the steps before writing the code.
• Give the AI a source of truth: Instead of letting the AI search the internet for information, give it the exact source material (reports, transcripts, data sheets) to base its output on, telling it to use only the information provided.
• Validate. Validate. Validate: Never let AI publish code directly to the main project without first reviewing and running it locally. Similarly, never take AI output and simply move it on to the next person in the project. Every single AI output needs review.
• Don’t be fooled by confidence: As with managing a human, question the output. When you’re busy or tired, it’s easy to just go with the results it gives you. Don’t. Always analyze and question it.

Taking on AI-driven workload creep

Let’s face it: The great promise of AI is that it will take over repetitive, manual tasks, which will save you an incredible amount of time. What isn’t talked about as much is that it also can create a new workload — one that can be exhausting in a whole new way.

“Is AI saving people time? The short answer is yes,” says J.P. Gownder, vice president and principal analyst with Forrester Research. “But people also are being overwhelmed with overproduced things. Everyone wants to look busy and they’re producing more, but not necessarily better. Managers have to push back on that or it’s not really saving you time.”

In a multi-year study by Upwork, the largest online freelance marketplace, 77% of employees reported that AI had increased their workload. The report noted that a boost in productivity comes with a “significant emotional and relational cost,” with 88% of workers who saw the highest productivity gains also feeling burned out. And IDC’s Future of Work 2026 survey reported that 24% of IT workers report increased workload as a top AI concern.

Here are ways to combat the problem:

• Keep it short: Part of the prompt — always — should be to tell any AI tool to be concise.
• Build an anti-slop culture: Don’t simply accept and pass on workslop. It’s insulting for a co-worker to have to deal with pages of largely useless information.
• Filter the noise: When everyone on a team starts using AI, the volume of Slack messages, long-form memos, and data reports skyrockets. Don’t treat it all with equal importance. Practice radical prioritization.
• Manage the transcript deluge: Stop wading through 40-page meeting transcripts that bury action items. Instead, prompt the system to produce a concise summary focused strictly on deliverables or status updates.
• Reduce the AI blast radius: When asked to fix a bug, AI tools often rewrite hundreds of lines of unrelated code, multiplying your code review time. Prevent this by instructing the tool to isolate its changes only to the specific function or file in question.

Managing the AI mental tax

Using AI often necessitates a different kind of mental processing, changing what had been the natural pacing of your day and dramatically increasing context switching. Instead of simply building and testing, someone might be jumping back and forth between auditing, fact-checking, prompting, and re-prompting. To manage strain and protect your focus, new strategies are needed.

Published this past March in the Harvard Business Review, a study by Boston Consulting Group and the University of California, Riverside, surveyed 1,500 workers and coined the term “AI brain fry.” The researchers found that juggling multiple AI tools causes decision fatigue and increases errors.

How to combat the problem:

• Work in batches: Continuously reviewing AI output as it comes in can quickly lead to mental burnout. Dedicate blocks of time throughout your day to interact with your AI tools.
• Create analog islands: Your brain needs time to decompress, and that means taking a break from digital processing… and from screen time in general. Make time in your day to step away from screens, such as taking a 15-minute walk or reading a book instead of watching a video online.
• Know when to step in: Instead of endlessly tweaking prompts to get a perfect result, it is often faster and less mentally taxing to manually write or refactor the final 20% yourself.
• Create base prompts: Writing custom prompts that include everything from guardrails to tone instructions for every new project quickly drains your mental energy. Instead, build two or three reusable system prompts, such as one for refactoring legacy code and another for drafting API docs, and use them as templates.

Proving your human value in a new job market

With companies regularly using AI-based applicant tracking systems to filter resumes, and AI actively shifting job responsibilities and skills requirements, the strategy for how you apply for roles and handle interviews is changing.

Leo Freitas, an analyst and research manager at IDC Research, says it’s critical for job applicants to show potential employers what they can do that machines cannot. “You need demonstrable achievements,” he adds. “It’s good to show highly human skills.”

How to combat the problem:

For your resume:

• Mirror their language: Use the exact language from the job description. Traditional applicant tracking systems rely heavily on structured information and keyword matching, says Teresa Hill, founder and leader of Anchor GTM, a growth marketing consultancy. That means if a posting says “product marketing manager,” don’t just write “PMM.” Write both.
• Keep it simple: Use standard section headers, like “Experience” and “Education.” Creative alternatives and formatting can confuse parsers.
• Avoid AI writing: Use AI to help structure your thinking, then edit until the copy sounds natural and authentically human.
• Swap responsibilities for metrics: To stand out, especially with AI scanners, tie as many bullet points as possible from your work to business outcomes.

For the interview:

• So, how do you use AI? Every interviewer eventually asks some version of this question. The best answers focus on judgment vs. simply name-dropping tools. Explain what you automate, what you never automate, and why.
• Show that you’re a gatekeeper: AI tools can generate code or copy instantly, but they also introduce errors. To stand out, show that you know how to audit, verify, and safeguard quality.
• Focus on learning: Don’t emphasize your expertise with a specific AI tool. Focus on being someone who is adaptable and learns quickly, Hill says. 
• What sets you apart from a machine: Show, don’t tell. Give work examples that demonstrate that you know how to be creative, collaborative, and problem solve. Show metrics whenever possible.
• Demonstrate that you know the limits: Make it clear that you know when to use AI and what not to let it touch without heavy review. 

Future-proofing your career in a shifting tech market

The anxiety echoing through the tech industry is tangible as companies reallocate corporate capital toward automation. While both Gownder and Freitas emphasize that there is far more fear than actual AI-driven layoffs, the shift in corporate spending is undeniably stoking job insecurity.

“There’s this apocalyptical view that AI will take everyone’s job in a few years,” says Freitas. “I don’t see that happening, but many things will change in the nature of how we work. I don’t think the world is going to end tomorrow. But it’s always good to do a self-assessment and look at whether AI can do what you’re doing now.”

How to combat the problem:

• Use this technology to your advantage: Approach AI as a new tool, not a replacement. Use it to make yourself better and faster at your job. “I look at AI like it’s another new tool, and I’m going to learn it like I’ve learned any other tool,” says Jones.
• Don’t bury your head in the sand: Take a look at what you do and consider if it could be done by AI.If your role is highly automatable, think about switching to a more advanced position or to a role, like security, that more clearly needs a human in the loop.
• Take ownership of your career: Expand your knowledge and skills. Find courses and certifications (many are free online) and take advantage of employers’ training programs.
• Work with the business side: Make sure you understand the business — its long-term goals, competitive market, and jargon. Be the bridge between the technical and business sides of the company, giving presentations and solving business problems with technology.
• Highlight your in-house expertise: When you have institutional knowledge, make sure you are openly using it to benefit the business. Your knowledge can be your key differentiator.
• Push the business forward: Think about the next app or customer-facing system that will propel the business forward. Be the one who is advancing the company with tech.
• Continue to adapt: Don’t get stuck in your anxiety. Keep being curious and working your learning muscles. 

More on AI in the workplace:

• Burned out by bots: The rise of prompt fatigue in the workplace
• The AI tech job slaughter gets real
• Increased AI expectations without guidance leads to employee burnout
• ‘Botsitting’: The AI time-savings killer only governance can stop
• Here are the top AI certifications that will get you hired and promoted
• How to curb hallucinations in Copilot (and other genAI tools)

After more than 30 years the cybersecurity field, Keith Jones recently realized that his role had changed, from being a single contributor to manager of a fairly large team. And this team was getting a lot accomplished — tasks that used to take up a huge chunk of his workday.

No, his company hadn’t hired a group of new employees to work under him. He simply accelerated his use of artificial intelligence tools. Now, instead of grinding through a lot of basic tasks, that work is done for him while he focuses on bigger-picture work.

“It really feels like I have a team behind the scenes, but what I have is Claude [Anthropic’s AI tool],” says Jones, who currently works as a cybersecurity researcher. “I’ve been thinking for the last several months about how much differently I work now than I did a year ago, when I would sit and write all the low-level stuff before I could get to the 10% of the good stuff I really wanted to focus on. Now I can sit back and say, ‘Give me three different ways to solve this problem.’”

Most people working in the technology field, like Jones, have had to figure out how best to work with AI. The technology has come on strong, with many companies making its use mandatory and actively evaluating whether employees are faster and more efficient because of it. And while it is boosting productivity and taking over the burden of repetitive, manual tasks, it’s also creating a new level of stress and a dizzying kind of mental exhaustion.

So what can tech workers do about the heavier mental load that comes with using AI, on top of escalating worries about the safety of their own jobs? AI users and industry analysts say there are specific ways to ease some of those burdens and prepare for a changing job market.

Combating the slop factor

When it comes to working with LLM tools, a well-known issue is dealing with AI workslop and hallucinations. The slop is AI-generated output that is low-quality, buzzword-heavy, and generic. It also can refer to bloated, boilerplate code. Hallucinations are inaccurate or completely made-up results. AI routinely offers this messy or incorrect information with total confidence, giving users a false sense of security.

Using this bad data can lead to anything from minor software bugs to severe liabilities. “Don’t believe the machine is infallible,” says Craig Shue, computer science professor and department head at Worcester Polytechnic Institute (WPI). “That’s when bugs will start working in. There’s a lot of misinformation on the internet, and that could be what the LLM is grabbing and using.”

Here are ways to combat the problem:

• Make AI show its work: Ask it to cite its sources or explain its reasoning. Example prompt: Explain the logic and show the steps before writing the code.
• Give the AI a source of truth: Instead of letting the AI search the internet for information, give it the exact source material (reports, transcripts, data sheets) to base its output on, telling it to use only the information provided.
• Validate. Validate. Validate: Never let AI publish code directly to the main project without first reviewing and running it locally. Similarly, never take AI output and simply move it on to the next person in the project. Every single AI output needs review.
• Don’t be fooled by confidence: As with managing a human, question the output. When you’re busy or tired, it’s easy to just go with the results it gives you. Don’t. Always analyze and question it.

Taking on AI-driven workload creep

Let’s face it: The great promise of AI is that it will take over repetitive, manual tasks, which will save you an incredible amount of time. What isn’t talked about as much is that it also can create a new workload — one that can be exhausting in a whole new way.

“Is AI saving people time? The short answer is yes,” says J.P. Gownder, vice president and principal analyst with Forrester Research. “But people also are being overwhelmed with overproduced things. Everyone wants to look busy and they’re producing more, but not necessarily better. Managers have to push back on that or it’s not really saving you time.”

In a multi-year study by Upwork, the largest online freelance marketplace, 77% of employees reported that AI had increased their workload. The report noted that a boost in productivity comes with a “significant emotional and relational cost,” with 88% of workers who saw the highest productivity gains also feeling burned out. And IDC’s Future of Work 2026 survey reported that 24% of IT workers report increased workload as a top AI concern.

Here are ways to combat the problem:

• Keep it short: Part of the prompt — always — should be to tell any AI tool to be concise.
• Build an anti-slop culture: Don’t simply accept and pass on workslop. It’s insulting for a co-worker to have to deal with pages of largely useless information.
• Filter the noise: When everyone on a team starts using AI, the volume of Slack messages, long-form memos, and data reports skyrockets. Don’t treat it all with equal importance. Practice radical prioritization.
• Manage the transcript deluge: Stop wading through 40-page meeting transcripts that bury action items. Instead, prompt the system to produce a concise summary focused strictly on deliverables or status updates.
• Reduce the AI blast radius: When asked to fix a bug, AI tools often rewrite hundreds of lines of unrelated code, multiplying your code review time. Prevent this by instructing the tool to isolate its changes only to the specific function or file in question.

Managing the AI mental tax

Using AI often necessitates a different kind of mental processing, changing what had been the natural pacing of your day and dramatically increasing context switching. Instead of simply building and testing, someone might be jumping back and forth between auditing, fact-checking, prompting, and re-prompting. To manage strain and protect your focus, new strategies are needed.

Published this past March in the Harvard Business Review, a study by Boston Consulting Group and the University of California, Riverside, surveyed 1,500 workers and coined the term “AI brain fry.” The researchers found that juggling multiple AI tools causes decision fatigue and increases errors.

How to combat the problem:

• Work in batches: Continuously reviewing AI output as it comes in can quickly lead to mental burnout. Dedicate blocks of time throughout your day to interact with your AI tools.
• Create analog islands: Your brain needs time to decompress, and that means taking a break from digital processing… and from screen time in general. Make time in your day to step away from screens, such as taking a 15-minute walk or reading a book instead of watching a video online.
• Know when to step in: Instead of endlessly tweaking prompts to get a perfect result, it is often faster and less mentally taxing to manually write or refactor the final 20% yourself.
• Create base prompts: Writing custom prompts that include everything from guardrails to tone instructions for every new project quickly drains your mental energy. Instead, build two or three reusable system prompts, such as one for refactoring legacy code and another for drafting API docs, and use them as templates.

Proving your human value in a new job market

With companies regularly using AI-based applicant tracking systems to filter resumes, and AI actively shifting job responsibilities and skills requirements, the strategy for how you apply for roles and handle interviews is changing.

Leo Freitas, an analyst and research manager at IDC Research, says it’s critical for job applicants to show potential employers what they can do that machines cannot. “You need demonstrable achievements,” he adds. “It’s good to show highly human skills.”

How to combat the problem:

For your resume:

• Mirror their language: Use the exact language from the job description. Traditional applicant tracking systems rely heavily on structured information and keyword matching, says Teresa Hill, founder and leader of Anchor GTM, a growth marketing consultancy. That means if a posting says “product marketing manager,” don’t just write “PMM.” Write both.
• Keep it simple: Use standard section headers, like “Experience” and “Education.” Creative alternatives and formatting can confuse parsers.
• Avoid AI writing: Use AI to help structure your thinking, then edit until the copy sounds natural and authentically human.
• Swap responsibilities for metrics: To stand out, especially with AI scanners, tie as many bullet points as possible from your work to business outcomes.

For the interview:

• So, how do you use AI? Every interviewer eventually asks some version of this question. The best answers focus on judgment vs. simply name-dropping tools. Explain what you automate, what you never automate, and why.
• Show that you’re a gatekeeper: AI tools can generate code or copy instantly, but they also introduce errors. To stand out, show that you know how to audit, verify, and safeguard quality.
• Focus on learning: Don’t emphasize your expertise with a specific AI tool. Focus on being someone who is adaptable and learns quickly, Hill says. 
• What sets you apart from a machine: Show, don’t tell. Give work examples that demonstrate that you know how to be creative, collaborative, and problem solve. Show metrics whenever possible.
• Demonstrate that you know the limits: Make it clear that you know when to use AI and what not to let it touch without heavy review. 

Future-proofing your career in a shifting tech market

The anxiety echoing through the tech industry is tangible as companies reallocate corporate capital toward automation. While both Gownder and Freitas emphasize that there is far more fear than actual AI-driven layoffs, the shift in corporate spending is undeniably stoking job insecurity.

“There’s this apocalyptical view that AI will take everyone’s job in a few years,” says Freitas. “I don’t see that happening, but many things will change in the nature of how we work. I don’t think the world is going to end tomorrow. But it’s always good to do a self-assessment and look at whether AI can do what you’re doing now.”

How to combat the problem:

• Use this technology to your advantage: Approach AI as a new tool, not a replacement. Use it to make yourself better and faster at your job. “I look at AI like it’s another new tool, and I’m going to learn it like I’ve learned any other tool,” says Jones.
• Don’t bury your head in the sand: Take a look at what you do and consider if it could be done by AI.If your role is highly automatable, think about switching to a more advanced position or to a role, like security, that more clearly needs a human in the loop.
• Take ownership of your career: Expand your knowledge and skills. Find courses and certifications (many are free online) and take advantage of employers’ training programs.
• Work with the business side: Make sure you understand the business — its long-term goals, competitive market, and jargon. Be the bridge between the technical and business sides of the company, giving presentations and solving business problems with technology.
• Highlight your in-house expertise: When you have institutional knowledge, make sure you are openly using it to benefit the business. Your knowledge can be your key differentiator.
• Push the business forward: Think about the next app or customer-facing system that will propel the business forward. Be the one who is advancing the company with tech.
• Continue to adapt: Don’t get stuck in your anxiety. Keep being curious and working your learning muscles. 

More on AI in the workplace:

• Burned out by bots: The rise of prompt fatigue in the workplace
• The AI tech job slaughter gets real
• Increased AI expectations without guidance leads to employee burnout
• ‘Botsitting’: The AI time-savings killer only governance can stop
• Here are the top AI certifications that will get you hired and promoted
• How to curb hallucinations in Copilot (and other genAI tools)

Most folks seem happy to let AI write their LinkedIn posts for them. Others, myself included, have AI draft their work memos or slide decks. And some, according to recent survey data highlighted by AI Secret, are happy to let AI do their grocery shopping for them (28%), but not handle luxury goods or banking (6%). In trying to uncover a guiding principle for when mere mortals are willing to cede control to robots, AI Secret’s authors offered a cutting interpretation of our willingness to buy food but not financial products through AI: “That ranking isn’t trust, it’s a map of what people have stopped caring about.”

While this feels true-ish, the “ish” is important. For example, based on the garbage we regularly wade through on LinkedIn, AI slop feels like an attempt to care about something we’re told we should care about, but don’t. If we did, we’d take the time to write it. Or maybe it’s simply an acknowledgment that many people don’t have the skill to write well, so they entrust AI to do it better than they could. (It doesn’t.)

Maybe it’s both. As for the willingness to shop for groceries, it’s not that we don’t care about the milk in our fridge—we clearly do—but perhaps we don’t care about how it gets there. We care about the outcome, in other words, but not the process.

That feels like the right way to think about AI, and maybe, just maybe, it offers a clue as to when and how you and I should use AI.

LinkedIn discovers slop

Last week, LinkedIn introduced a button that lets users flag a post as “seems like AI slop.” It also pulled its own “enhance your post” feature, which contributed to the AI slop deluge by using AI to help compose posts, and replaced it with a proofreader designed not to change the author’s voice.

It’s a welcome change. I’ve been happily “seems like AI slopping” ever since.

Still, you have to ask, why are people producing these posts in the first place? My guess is that many don’t value posting but feel obliged to do it because “thought leadership” and “career.” Or maybe, as I did this past week, they used AI to ask, “What are my top-performing posts over the past 10 years and what’s the best strategy for replicating that success?” In addition to telling me to post three times a week (LinkedIn’s algorithms like that), it also told me something I already knew: “Your best posts were personal and opinionated.” In other words, exactly the sort of thing that AI can’t write for me.

Yes, AI can produce 500 words on how coaching your daughter’s soccer team taught you seven lessons about enterprise procurement. (“Let that sink in.”) The post will be polished and may even be popular. It will also sound like everything else in others’ feeds because you and every other person outsourced the one thing readers want most: a personal point of view. Something that makes us human.

This doesn’t make all AI-assisted writing bad. Far from it. AI can help a non-native English speaker express an original idea or turn dictated thoughts into a coherent draft. It can also challenge an argument, find missing evidence, or suggest a better structure. I use it for all those things.

But if you have nothing to say, AI isn’t going to give you a voice. Not a real one.

Just because you can…

A couple of years ago, a friend who ran product marketing at a very large technology company told me he was going to start generating sales collateral with AI. First-call decks, email templates, etc. His logic was sound and, honestly, kind of brutal. The collateral his team produced by hand was pulling a few dozen downloads from a sales force numbering in the thousands. If almost nobody wanted it, why pay a junior product marketer to make it? Let the machine publish into the void.

Sure, I said. That seems smart. Except it wasn’t. He hadn’t solved the foundational issue.

I didn’t know what that issue was, but then neither did he. After all, those low download numbers could suggest any number of things. Maybe the sellers couldn’t find it. Maybe the material wasn’t useful at scale, but perhaps a few dozen people used it to close enormous deals. Perhaps it was simply the wrong collateral for a pressing need, which the sellers resolved on their own. Or maybe, just maybe, that thing that every product marketing team does… doesn’t need to be done.

AI makes it easier not to wrestle with the problem. The deck costs almost nothing, so we keep making the deck, rather than addressing whether it needs to be created at all. Similarly, because the weekly report takes only minutes, we opt to keep publishing it. The knowledge base fills with pages no one reads because stopping a process requires a decision. Automating it merely requires a prompt.

We’re letting AI kick the can down the road for us, rather than making the hard, human decisions we’re ostensibly paid to make.

I’ve made a version of this argument about software. App creation is way up, but app adoption isn’t. Building was never the only constraint. Getting anyone to care is the constraint, and AI doesn’t solve that. It just removes our last excuse for not noticing.

Two kinds of low-value work

This isn’t a case against automating boring things. We should totally do that, and immediately. But “low-value work” hides two very different things, and they deserve opposite treatment.

The first is a low-value process attached to a valuable outcome, like my milk example. Take expense reports, backups, etc. These aren’t exciting things to do, but they must get done. AI gives us the chance to hand off as much of the process as we safely can, check the result, and move on.

The second is a low-value process attached to no discernible outcome, like the sales collateral or a LinkedIn post with no personality or real point of view. Automating this feels like a win because the cost drops, but cost is not the core problem. The real problem is that the output has no audience. It doesn’t need to exist.

If you can’t name a useful outcome that would be lost if the output stopped existing, you don’t have an automation opportunity. You have a cancellation opportunity.

I use AI where I care most

Now for the part that complicates my own argument, because the inverse is also true. The work where I use AI most aggressively is often the work I care about most.

I wrote last week about asking Claude to read four 18th-century probate wills as part of a 20-year hunt for the parents of a fourth-great-grandfather. It fabricated an entire emigrant ancestor. It was clean, plausible, and completely invented. I only caught it by clicking through to the high-resolution images and reading the documents myself, line by line.

I’ve been thinking about that experience differently this week. The model excused its behavior as “hopeful reading.” OK. But the reason I caught it is duller and more important than anything about the model: I caught Claude’s error because I cared. Twenty years of caring made me open the originals. It really, really, really mattered to me that it be right.

Nobody wants to proofread the deck they never wanted to make in the first place.

The same pattern holds at work. I use AI constantly for executive memos, compressing a sprawling pile of data and argument into context, recommendation, and ask. This is high-stakes work with a real reader, a real decision, and my name on it. So I read every line. I challenge the output. I edit (a lot). The AI doesn’t replace my investment in the work, but it does do 90% of the early legwork for me so that I can focus on the critically important last 10%.

I’ve called this AI’s trust tax: You pay the verification cost up-front, or someone else pays it later when the answer causes damage. The tax gets paid most reliably when somebody cares about the outcome. When nobody cares, AI can make bad work look finished enough to ship and presentable enough to glance at without reviewing carefully.

AI slop, then, really isn’t a model problem; it’s a question of caring, which manifests in how we choose to use it.

Maybe just stop

I wish I had a clear, guiding principle to offer here, but I don’t. Here are two questions that help, though.

1. What useful outcome disappears if this work stops?
2. If that outcome matters, where is human judgment still needed?

If there’s no meaningful outcome, stop doing the work, whether AI-powered or human-powered. If the outcome matters but much of the process doesn’t, hand the process to AI. Let AI buy the groceries, search the archive, assemble the first draft, or build the sales deck that sellers have said they actually need. Then keep a person accountable for the result.

AI is extremely good at making more things. We don’t need more things, and making them cheaper won’t make them useful. Humans, by contrast, are extremely good (or need to be) at determining which things need to be made. That’s your job, and mine, and no prompt can take it away from us.

The first phase of the AI race was largely about access. Companies rushed to adopt tools, launch pilots, and demonstrate that they were moving quickly enough to keep pace with the market. In many organizations, simply showing momentum became the strategy.

Leadership teams wanted to signal innovation, employees were encouraged to experiment, and new technologies were layered into existing workflows with the assumption that adoption itself would create advantage over time.

It has become clear: access was never going to be the differentiator for very long. The next phase of this shift will favor companies that are able to operate differently because of AI, not simply companies that use AI more often. 

That distinction matters because it moves the conversation away from tools and toward operating models, leadership discipline, decision-making structures, and organizational adaptability, which is where the real competitive separation is beginning to happen.

Speed becomes structural

One of the most significant changes AI creates within organizations is the compression of time across nearly every part of the business. It is easy to frame this conversation around productivity gains alone, but the more meaningful shift is happening around how quickly organizations are expected to respond, execute, prioritize, and make decisions while customers, competitors, and markets all begin moving faster simultaneously. What once felt like manageable friction inside a company can quickly become a competitive liability when the surrounding market is operating at a different speed.

That reality is creating pressure on operating structures that were originally designed for a slower business environment. Approval chains, heavily layered decision-making models, fragmented ownership structures, and manual dependencies become harder to sustain when speed itself starts shaping competitiveness.

AI is reducing the cost of execution at the same time that it is increasing the competitive cost of operating slowly, and many organizations are still underestimating how meaningful that shift will become over the next several years.

What makes this different from prior technology shifts is that speed is starting to become structural. Organizations that can absorb information, make decisions, and execute quickly without creating internal chaos are going to operate very differently from companies still built around slower, heavily layered processes.

AI exposes operational inefficiency

What complicates this further is that AI often exposes operational weaknesses faster than it resolves them. There is still a tendency to think about AI primarily as a technology deployment exercise when, in practice, many companies discover that it quickly becomes a broader execution and organizational discipline challenge instead. As companies attempt to accelerate, disconnected systems, inconsistent data, siloed teams, and outdated processes become more visible because they begin interfering directly with execution speed, customer responsiveness, and organizational adaptability. In many ways, AI amplifies the operational maturity a company already has.

Organizations with strong systems, disciplined information management, clear accountability structures, and healthy decision-making processes can often accelerate effectively because the underlying foundation already supports speed and adaptability. Organizations operating with fragmented workflows and unclear ownership structures tend to experience the opposite effect, where acceleration exposes friction that previously existed quietly in the background but becomes much harder to ignore once the pace of the business changes.

Many leadership teams still assume AI will compensate for inefficiency when, in reality, it often exposes those weaknesses faster. AI does not eliminate friction inside the business – it exposes where that friction already exists.

Judgment becomes more valuable

The conversation around talent is evolving in a similar way, and many organizations are still framing this transition too narrowly. Much of the public discussion continues to focus on workforce reduction, but the more important shift is actually about how organizations direct human attention, judgment, and expertise toward the areas where those capabilities create the most value. As routine work becomes easier to automate, qualities like judgment, adaptability, prioritization, and the ability to operate effectively in ambiguity become increasingly important rather than less.

The organizations gaining the greatest advantage in this environment are not simply becoming faster or more efficient. They are becoming better at creating leverage from the expertise they already have by reducing the amount of time capable people spend navigating processes, chasing information, or managing friction that no longer needs to exist. That changes the role of leadership as well. Managers become increasingly important not as controllers of process, but as providers of context, prioritization, direction, and decision clarity in environments where speed and ambiguity increasingly coexist.

The companies winning in this next phase of the market will not necessarily have fewer people. They will deploy talent differently, make decisions faster, and create organizations where capable teams are able to focus more energy on solving meaningful problems instead of managing complexity.

Customer expectations are changing faster than companies are

At the same time, customer expectations are evolving faster than many organizations are adapting internally. AI is reshaping how customers think about responsiveness, personalization, consistency, and speed, and experiences that once felt differentiated are quickly becoming baseline expectations. That creates a growing tension for companies still operating through slower internal systems while customers continue recalibrating what “good” looks like in real time based on the experiences they are having elsewhere.

This shift also has important implications for trust and visibility. As AI increasingly influences how companies are discovered, compared, evaluated, and discussed, reputation becomes much more deeply connected to how organizations are surfaced and interpreted at scale. In an AI-driven environment, reputation is no longer simply a brand asset that exists adjacent to the business. It increasingly becomes part of the infrastructure through which trust is established in the first place, particularly as AI increasingly shapes how customers discover and evaluate companies.

Companies that continue operating through slower internal systems will increasingly struggle to meet the expectations AI is teaching customers to have.

Leadership teams must redesign before they feel ready

One of the biggest leadership challenges in this environment is that many executive teams are still waiting for a level of certainty that no longer really exists. Most organizations naturally want stable playbooks, lower-risk transitions, and more complete information before making significant structural changes, but markets moving at this pace rarely provide that level of clarity in advance.

The companies moving first are not waiting for perfect certainty before redesigning how they operate. They understand that adaptability itself is becoming a competitive advantage. That does not mean acting recklessly or abandoning discipline; it means recognizing that operating models originally designed for stability and predictability can struggle in environments defined by acceleration, constant iteration, and rapidly changing customer expectations.

The leadership challenge is no longer simply deciding whether AI matters. The more difficult question is how quickly organizations are willing and able to evolve around what AI makes possible.

Most companies are measuring the wrong signals

Many companies are still measuring the wrong signals when evaluating whether their AI strategy is working. Leadership teams focus on adoption metrics such as the number of tools deployed, pilot programs launched, employee usage statistics, or isolated productivity gains. But those measurements often signal experimentation rather than transformation.

The more meaningful indicators are behavioral and organizational.

• Is the organization making decisions faster without creating confusion?
• Has unnecessary complexity been removed from critical workflows?
• Are customers experiencing less friction and greater responsiveness?
• Is information moving more effectively across the business?
• Are capable employees spending more time solving meaningful problems instead of managing process and coordination overhead?
• Can the organization adapt quickly when conditions change without becoming unstable internally?

Over time, the separation between companies experimenting with AI and companies truly built to operate in an AI-first environment will become difficult to ignore. The organizations leading in the next phase of the market will not simply adopt new technologies faster. They will build companies designed to adapt, decide, and operate differently because of them, while competitors still operating through legacy structures will struggle to keep pace.

About the author

Joe Burton is an accomplished executive who has led public and private billion-dollar organizations in driving new product portfolios, go-to-market strategies, and innovative business models. Having spent the earlier parts of his career in information technology, Joe is passionate about fostering more transparency and trust in the digital world, while championing high performing cultures aligned to mission, vision and social responsibility.

A recognized global transformational change executive, Joe has held the CEO role at Telesign and Poly, as well as serving as the Chief Technology Officer of Unified Communications at Cisco. Having started his career as an engineer, Joe brings both product and development expertise as well as a wealth of knowledge on big data, analytics, machine learning, SaaS, networking, unified communications, consumer electronics, and IoT.

The first phase of the AI race was largely about access. Companies rushed to adopt tools, launch pilots, and demonstrate that they were moving quickly enough to keep pace with the market. In many organizations, simply showing momentum became the strategy.

Leadership teams wanted to signal innovation, employees were encouraged to experiment, and new technologies were layered into existing workflows with the assumption that adoption itself would create advantage over time.

It has become clear: access was never going to be the differentiator for very long. The next phase of this shift will favor companies that are able to operate differently because of AI, not simply companies that use AI more often. 

That distinction matters because it moves the conversation away from tools and toward operating models, leadership discipline, decision-making structures, and organizational adaptability, which is where the real competitive separation is beginning to happen.

Speed becomes structural

One of the most significant changes AI creates within organizations is the compression of time across nearly every part of the business. It is easy to frame this conversation around productivity gains alone, but the more meaningful shift is happening around how quickly organizations are expected to respond, execute, prioritize, and make decisions while customers, competitors, and markets all begin moving faster simultaneously. What once felt like manageable friction inside a company can quickly become a competitive liability when the surrounding market is operating at a different speed.

That reality is creating pressure on operating structures that were originally designed for a slower business environment. Approval chains, heavily layered decision-making models, fragmented ownership structures, and manual dependencies become harder to sustain when speed itself starts shaping competitiveness.

AI is reducing the cost of execution at the same time that it is increasing the competitive cost of operating slowly, and many organizations are still underestimating how meaningful that shift will become over the next several years.

What makes this different from prior technology shifts is that speed is starting to become structural. Organizations that can absorb information, make decisions, and execute quickly without creating internal chaos are going to operate very differently from companies still built around slower, heavily layered processes.

AI exposes operational inefficiency

What complicates this further is that AI often exposes operational weaknesses faster than it resolves them. There is still a tendency to think about AI primarily as a technology deployment exercise when, in practice, many companies discover that it quickly becomes a broader execution and organizational discipline challenge instead. As companies attempt to accelerate, disconnected systems, inconsistent data, siloed teams, and outdated processes become more visible because they begin interfering directly with execution speed, customer responsiveness, and organizational adaptability. In many ways, AI amplifies the operational maturity a company already has.

Organizations with strong systems, disciplined information management, clear accountability structures, and healthy decision-making processes can often accelerate effectively because the underlying foundation already supports speed and adaptability. Organizations operating with fragmented workflows and unclear ownership structures tend to experience the opposite effect, where acceleration exposes friction that previously existed quietly in the background but becomes much harder to ignore once the pace of the business changes.

Many leadership teams still assume AI will compensate for inefficiency when, in reality, it often exposes those weaknesses faster. AI does not eliminate friction inside the business – it exposes where that friction already exists.

Judgment becomes more valuable

The conversation around talent is evolving in a similar way, and many organizations are still framing this transition too narrowly. Much of the public discussion continues to focus on workforce reduction, but the more important shift is actually about how organizations direct human attention, judgment, and expertise toward the areas where those capabilities create the most value. As routine work becomes easier to automate, qualities like judgment, adaptability, prioritization, and the ability to operate effectively in ambiguity become increasingly important rather than less.

The organizations gaining the greatest advantage in this environment are not simply becoming faster or more efficient. They are becoming better at creating leverage from the expertise they already have by reducing the amount of time capable people spend navigating processes, chasing information, or managing friction that no longer needs to exist. That changes the role of leadership as well. Managers become increasingly important not as controllers of process, but as providers of context, prioritization, direction, and decision clarity in environments where speed and ambiguity increasingly coexist.

The companies winning in this next phase of the market will not necessarily have fewer people. They will deploy talent differently, make decisions faster, and create organizations where capable teams are able to focus more energy on solving meaningful problems instead of managing complexity.

Customer expectations are changing faster than companies are

At the same time, customer expectations are evolving faster than many organizations are adapting internally. AI is reshaping how customers think about responsiveness, personalization, consistency, and speed, and experiences that once felt differentiated are quickly becoming baseline expectations. That creates a growing tension for companies still operating through slower internal systems while customers continue recalibrating what “good” looks like in real time based on the experiences they are having elsewhere.

This shift also has important implications for trust and visibility. As AI increasingly influences how companies are discovered, compared, evaluated, and discussed, reputation becomes much more deeply connected to how organizations are surfaced and interpreted at scale. In an AI-driven environment, reputation is no longer simply a brand asset that exists adjacent to the business. It increasingly becomes part of the infrastructure through which trust is established in the first place, particularly as AI increasingly shapes how customers discover and evaluate companies.

Companies that continue operating through slower internal systems will increasingly struggle to meet the expectations AI is teaching customers to have.

Leadership teams must redesign before they feel ready

One of the biggest leadership challenges in this environment is that many executive teams are still waiting for a level of certainty that no longer really exists. Most organizations naturally want stable playbooks, lower-risk transitions, and more complete information before making significant structural changes, but markets moving at this pace rarely provide that level of clarity in advance.

The companies moving first are not waiting for perfect certainty before redesigning how they operate. They understand that adaptability itself is becoming a competitive advantage. That does not mean acting recklessly or abandoning discipline; it means recognizing that operating models originally designed for stability and predictability can struggle in environments defined by acceleration, constant iteration, and rapidly changing customer expectations.

The leadership challenge is no longer simply deciding whether AI matters. The more difficult question is how quickly organizations are willing and able to evolve around what AI makes possible.

Most companies are measuring the wrong signals

Many companies are still measuring the wrong signals when evaluating whether their AI strategy is working. Leadership teams focus on adoption metrics such as the number of tools deployed, pilot programs launched, employee usage statistics, or isolated productivity gains. But those measurements often signal experimentation rather than transformation.

The more meaningful indicators are behavioral and organizational.

• Is the organization making decisions faster without creating confusion?
• Has unnecessary complexity been removed from critical workflows?
• Are customers experiencing less friction and greater responsiveness?
• Is information moving more effectively across the business?
• Are capable employees spending more time solving meaningful problems instead of managing process and coordination overhead?
• Can the organization adapt quickly when conditions change without becoming unstable internally?

Over time, the separation between companies experimenting with AI and companies truly built to operate in an AI-first environment will become difficult to ignore. The organizations leading in the next phase of the market will not simply adopt new technologies faster. They will build companies designed to adapt, decide, and operate differently because of them, while competitors still operating through legacy structures will struggle to keep pace.

About the author

Joe Burton is an accomplished executive who has led public and private billion-dollar organizations in driving new product portfolios, go-to-market strategies, and innovative business models. Having spent the earlier parts of his career in information technology, Joe is passionate about fostering more transparency and trust in the digital world, while championing high performing cultures aligned to mission, vision and social responsibility.

A recognized global transformational change executive, Joe has held the CEO role at Telesign and Poly, as well as serving as the Chief Technology Officer of Unified Communications at Cisco. Having started his career as an engineer, Joe brings both product and development expertise as well as a wealth of knowledge on big data, analytics, machine learning, SaaS, networking, unified communications, consumer electronics, and IoT.

In cybersecurity, third-party risk management normally looks simple on paper: evaluate your vendor, learn the risk, report out on the gaps and weaknesses, transfer to the contract, and continue. Unfortunately, it seldom works that way in practice.

In my roles as a CISO, I find my teams in an intermediary position as the compliance and cybersecurity expert between the end-user purchaser and the vendors they want to work with: A typically high-pressure position when you’re perceived as a roadblock to a business goal.

As a consultant, we are helping clients establish a formal third-party risk management program often for the very first time. Alternatively, you are providing vCISO or trusted adviser services to perhaps evaluate a specific product or service that lies fairly deep down in the purchasing timeline. That distinction is important, because how quickly security gets involved often determines how much friction everyone experiences.

The number one problem I see? Security is always last to know.

When security enters too late

A business team determines what kind of tool it needs. Operations want efficiency. Finance is ready to fund it. Momentum builds. Then someone says, “Wait a minute… What about cybersecurity and compliance? At that point, our role is to ask the questions that should have been asked earlier: What data will this vendor touch? Where will it reside? What controls exist and are needed? Does the vendor’s security posture (and its product) match the client’s obligations and risk tolerance?

Being the one applying the brakes at the 11th hour is not a role anyone relishes. But that often becomes what third-party cyber risk management turns into when there is no formal intake and review process.

This is something that I have witnessed time and again with clients. The team is excited about a new platform and reasonably anticipates a quick go/no-go. Instead, the review process turns into weeks of ping-ponging with the vendor: Responses to questionnaires, security documentation, clarifying calls, proof or non-provision of compliance, legalese and data flow discussions. That delay can feel painful to all involved if the end user organization does not have a mature process already in place. The business sees friction. The vendor sees hurdles. Security sees unresolved risk.

The key to getting in early is working with your legal and finance, or procurement teams to bring you in as early as possible. These will be your partners in making sure the assessment is done before anything is signed. In my experience, once the ink is dry on the contract, you have lost all leverage in being able to get action from the third-party. A mature assessment will build in contract language to address gaps or weaknesses. This is the only thing that works in getting the outcomes you are looking for.

Building a repeatable review process

At root, we’re trying to help end-user organizations build structures around vendor evaluations to ensure a repeatable process; something that is defensible and aligned to their business operations. This is not a simple product review. We are helping them translate security, compliance and operational requirements into a workable framework for making a deployment decision.

A lot of end-user organizations lack the internal time, expertise or leverage to push solution providers on technical controls, audit evidence, shared responsibility or gaps in documentation. As the intermediary between them and the vendor, we do that legwork for them. Because we can ask the questions that need to be asked and how those answers should be interpreted. When one listens to a polished sales narrative, it is not the same thing as sustainable assurance for compliance.

The most important part here is making sure the assessment timelines are clear and consistent, and the purchaser is aware of them. It is also critical that the end user is aware of where the assessment is and if it is sitting with the internal team or the customer. The internal budget holder is always the key to getting action from the vendor, as they typically see the security team as an impediment to the sale.

Done well, third-party cyber risk management is not about blocking business. It’s really about getting clients onto their projects faster and with fewer surprises and less business risk.

Expanding beyond security to add business value

Today, any employee with a budget expects to bring in new technology on a very tight timeline. But I’ve seen this lead to many problems: the biggest of which is failing to solve the business problem. Purchasers fall in love with the interface, one specific feature, the price, the salesperson — you name it, I’ve seen it. Often not even defining what they are trying to solve prior to a purchase.

The business problem and success criteria should be defined before any purchase is made, and security can be one of the criteria for scoring, provided the vendor meets a qualifying security score.

AI makes the challenge more urgent

AI is shaking up the world of third-party risk in two ways at once. One is that vendors have been speed-dialing AI into their respective solutions. Secondly, AI tools are being brought into the workplace without IT authorization [shadow AI], often happening before security or compliance teams are made aware. Essentially, the age-old third-party risk problem of security teams learning last is moving more quickly and on a larger scale.

It’s not only because AI tools are new that causes organizations to worry. It is that people can start using them at once, usually entering sensitive business data into systems that have not been vetted for privacy, retention period and whether models trained on this data will be available for other users to access. Proactive vendor governance is therefore all the more crucial. With no front-end process for intake and assessment, the organization will always be reacting after the fact.

This is where a lot of companies need to reset their expectations. Third-party cyber risk management is an ongoing process that does not work as a side task of procurement, nor can it live entirely in security. It needs to be operationalized across the business. The organizations that do this best set up workflows for bringing in new vendors, identify data exposure early, assign review responsibilities and earmark exceptions before signing a contract.

Companies that fall behind depend on heroics. Somebody sees a risk late, hustles to gather documentation from two parties in different time zones and then fights the vendor for answers while trying to make a sound judgment on limited information. It can work once or twice, but it’s not a program.

What you can do is simple: build up the process before urgency hits. Know who owns intake. Know when security gets involved. Know what evidence is required. Understand how the AI tools will be assessed before they start entering the workspace.

Balancing the needs for compliance, operational realities and the pace of technology adoption enables the business to make decisions about the vendors they depend on with confidence.

The reality is that there are vendors that are good at securing your data, and there are vendors that haven’t even thought about it and all kinds in between. The goal of a good process is to identify which kind of vendor you are dealing with and hold them accountable for any risk.

One of the most important features of a mature third-party risk program that is most often ignored is using the contract to hold vendors accountable. A third-party program without this step rarely produces the expected outcomes because there are no financial teeth to the requirements.

Third-party risk management is not about eliminating friction but shifting it to the right place where it can make an actual difference and organizing it in a way where one can manage it.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Much of the conversation around AI and work has centered on a single question: Will AI take my job?

It’s an understandable concern. Every week AI becomes increasingly more capable. We see AI summarizing meetings, generating content, analyzing data, writing software and automating workflows that once required significant human effort. Agentic AI is also becoming more established in the workplace, with virtual agents that can reason, plan and act across workflows. As those capabilities continue to improve, many employees are looking at the tasks they perform every day and wondering how much longer they will belong to them.

I believe that question reveals a bigger issue that has little to do with the technology itself.

Too many people have become defined by the tasks they perform rather than the value they create. Over time, the administrative work surrounding a role can overshadow the purpose behind it. According to Asana’s Anatomy of Work Index, knowledge workers spend 60% of their time on “work about work” — coordinating, tracking and managing tasks rather than driving meaningful outcomes. As AI automates more of this work, it can feel less like a productivity breakthrough and more like a threat because many employees equate their value with the activities that consume most of their day.

But most people were not hired to perform a task. They were hired to fulfill a purpose.

Tasks are not the job

A customer service representative isn’t successful because they spend their day summarizing conversations, looking up account information or navigating multiple systems to find answers. Those activities may have become part of the job, but they aren’t the reason the role exists. Great service professionals build trust, solve problems and create moments that strengthen customer relationships. AI can, and should, take on this administrative work, but the human value has never been in completing those tasks. It has always been in helping customers through moments that matter.

The industry increasingly recognizes this distinction. In fact, 91% of CX leaders believe human agents will remain a critical part of delivering customer experience, according to my company’s State of Customer Experience 2026 report. As AI takes on more routine work, the role of the employee doesn’t disappear. It becomes even more focused on the judgment, empathy and relationship-building that customers value most.

The same principle applies across every profession. A marketer isn’t measured by the number of presentations they build or approvals they coordinate; they’re hired to shape customer perception and drive growth; an HR professional isn’t successful because they schedule interviews or process paperwork; they’re there to identify, develop and retain talent. The examples go on, but the principle remains the same: Organizations create roles because outcomes need to be achieved, not because tasks need to be completed.

I’ve helped lead four major AI transformations, spanning everything from machine learning and big data to conversational AI, generative AI and now agentic AI. While the technology has evolved dramatically, one pattern has remained remarkably consistent.

The employees who embrace AI tend to focus on outcomes, while those who fear it often focus on tasks. The more someone defines their contribution through a list of activities, the easier it becomes to imagine AI replacing them. The more someone understands the purpose they serve, the easier it becomes to see AI as a tool that helps them deliver greater value.

As part of AI transformations, CIO organizations are often responsible for mapping jobs and core workflows. Inevitably, employees think we’re mapping their jobs to figure out what AI can replace. But once we start identifying repetitive work they’d gladly hand off, perspectives change. Someone says, “If AI handled that, I’d finally have time to work directly with customers.” Another realizes they could spend more time creating. People start thinking less about what AI might replace and more about what they’d finally have time to do. They’re reconnecting with the reason they wanted the role in the first place.

I’ve seen this play out as AI adoption expands. Our team responsible for responding to customer RFPs began using AI to analyze requirements, surface relevant information and accelerate response development. Their purpose is to help the organization communicate our value to customers and win new business. By reducing the time spent on low-value activities, AI created more capacity for strategic thinking, collaboration and customer-focused work, which directly influences the revenue and growth of our company.

I’ve even had to confront this myself. I used to spend hours coaching leaders before operational reviews: reviewing KPIs, challenging assumptions and helping them prepare for difficult questions. I used to think this was part of what made me valuable as a CIO, but I realized that I didn’t need to spend my time repeating the same coaching session. That’s why I built a virtual coach that helps my team prepare for operational reviews using many of the frameworks and lessons I’ve accumulated throughout my career. Now I have more time to spend strategizing on how to lead through the breakneck speed of AI evolution and helping the business think differently.

Rediscovering purpose

What employees are really confronting is a different question: What was my purpose in being hired in the first place?

As organizations move from AI experimentation to AI-first operating models, this question becomes harder to avoid. The tension is already visible across the workforce. A recent EY survey found that 84% of employees are eager to embrace agentic AI because they expect it to improve productivity, efficiency and the overall work experience. Yet 56% also worry about their job security working alongside AI systems. Employees aren’t rejecting AI; they’re trying to understand which parts of their contributions remain uniquely theirs as technology takes on more of the tasks they perform today.

Success will depend greatly on helping employees reconnect with the value they were hired to create. For leaders looking for practical guidance on how organizations are actually approaching AI-first transformation, the World Economic Forum’s AI-First Operating System offers a useful framework. Rather than treating AI as another technological tool, this approach encourages organizations to redesign work around value creation. As AI increasingly takes on routine tasks, employees must become clearer about where human judgment, creativity and relationships can create the greatest impact. You cannot redesign work around value if people no longer understand the purpose behind the work that they do.

In my experience, the organizations seeing the strongest results are helping employees reconnect with the outcomes they were hired to create. The conversation shifts from “What tasks can AI do?” to “What is the purpose of this role?” Once people answer that question, it becomes much easier to decide what should remain human, what can be delegated to AI and where the combination creates the most value.

None of this means change won’t happen. Some responsibilities will disappear. Some jobs will evolve significantly. New roles will emerge that we cannot fully predict today. Every major technology shift creates that kind of change.

But I believe many people are looking at this transformation through the wrong lens.

The question is not whether AI can do your tasks. The question is whether you understand the purpose behind them. Because while AI may increasingly perform the work, humans will continue to provide the judgment, creativity, accountability and value that give that work meaning.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Business analysts help organizations make the most of the data they collect by finding trends, patterns, and errors that might otherwise go unnoticed. Successful business analysts have the skills to work with data, the acumen to understand the business side of the organization, and the ability to communicate that information to people outside of IT. Certifications provide a great way to prove your business analyst bona fides or get started in the field.

Business analytics is a lucrative role in IT, with an average entry-level salary of $80,692 per year. Throughout their careers, business analysts report average salaries ranging from $58,000 to $114,000 per year, according to PayScale. If you want to advance your business analyst career, or change career paths, here are 12 certifications that will help prove your mettle. Not finding what you’re looking for? Check out our list of big data and data analytics certifications.

Top 12 business analyst certifications

• Certified Analytics Professional (CAP)
• IIBA Entry Certificate in Business Analysis (ECBA)
• IIBA Certification of Competency in Business Analysis (CCBA)
• IIBA Certified Business Analysis Professional (CBAP)
• IIBA Agile Analysis Certification (AAC)
• IIBA Certification in Business Data Analytics (CBDA)
• IQBBA Certified Foundation Level Business Analyst (CFLBA)
• IQBBA Certified Advanced Level Business Analyst (CALBA)
• IQBBA Certified Agile Business Analyst (CABA)
• IREB Certified Professional for Requirements Engineering (CPRE)
• PMI Professional in Business Analysis (PBA)
• Salesforce Certified Business Analyst

Certified Analytics Professional (CAP)

The Certified Analytics Professional (CAP) is a vendor-neutral certification that certifies your skills and ability to draw valuable insights from complex data sets to help guide strategic businesses decisions. There are three levels of the exam — the essentials, pro, and expert certifications. Essentials is for entry-level analytics professionals, Pro is for mid-career analytics practitioners, and Expert is aimed at senior analytics leaders and directors. Depending on the level of certification, each has different requirements ranging from no-prerequisites at the Essentials level to advanced degrees to qualify for the Expert certification.

• Essentials exam fee: $195 for INFORMS members, $275 for non-members
• Professional exam fee: $325 for INFORMS members, $460 for non-members
• Expert exam fee: $440 for INFORMS members, $640 for non-members

IIBA Entry Certificate in Business Analysis (ECBA)

The Entry Certificate in Business Analysis (ECBA) is the first level of certification with the International Institute of Business Analysis (IIBA), it’s designed for less experienced and entry-level business analysts. You will need to complete at least 21 hours of professional training credits, within the past four years, before you will be eligible for the exam. You don’t have to renew your ECBA certification, but it’s assumed you’ll move on to the second or third levels of certification.

• Exam fee: $395

For more, see our guide on the ECBA.

IIBA Certification of Competency in Business Analysis (CCBA)

Level 2 of the IIBA certification, the Certification of Competency in Business Analysis (CCBA) requires a minimum 3,750 hours of business analytics work aligned with the IIBA’s BABOK guide in the past 7 years, 900 hours in two of six BABOK knowledge areas, or 500 hours in four of six BABOK knowledge areas. The certification also requires a minimum of 21 hours of professional development training in the past four years and two professional references. The CCBA exam consists of 130 multiple-choice questions that are scenario-based and require some analysis. It covers fundamentals, underlying competencies, key concepts, techniques, and all six knowledge areas covered in the BABOK.

• Application fee: $145
• Exam fee: $240 for members, $405 for non-members

IIBA Certified Business Analysis Professional (CBAP)

The Certified Business Analysis Professional (CBAP) certification is the third level of certification with IIBA and is designed for “individuals with extensive business analysis experience.” To qualify for this certification, you’ll need a minimum of 7,500 hours of business analyst work experience in the past 10 years, 900 hours of work experience hours within four of the six BABOK knowledge areas, at least 35 hours of professional development in the past four years and professional references. The exam is 3.5 hours long and includes 120 multiple-choice questions based on case studies. After you pass, you’ll need to report at least 60 hours of continuing development units every three years.

• Application fee: $145
• Exam fee: $350 for members, $505 for non-members

For more, see our guide on the CBAP.

IIBA Agile Analysis Certification (AAC)

The agile methodology has been rising in importance for business analysts over the past several years, according to the IIBA. The association’s competency-based Agile Analysis Certification (AAC) exam was designed to address this skillset and to certify business analyst professionals working in agile environments, which require fast adaption and rapid change. The exam was developed using the Agile Extension to the Business Analysis Book of Knowledge (BABOK) guide and released in May 2018 as a standalone certification and is separate from the other IIBA business analyst certifications, which stack on top of one another. The exam’s four main topics include agile mindset (30%), strategy horizon (10%), initiative horizon (25%) and delivery horizon (35%). There aren’t any eligibility requirements to take the exam, but the IIBA recommends at least two to five years of agile-related experience.

• Exam fee: $250 for members, $405 for non-members

IIBA Certification in Business Data Analytics (CBDA)

The Certification Business Data Analytics (IIBA-CBDA) from the IIBA is a certification that “recognizes your ability to effectively execute analysis-related work in support of business analytics initiatives.” To pass the exam, you will need to examine a real-world business problem, identify the data sources and how to obtain data, analyze the data, interpret and report results from the data. You’ll then need demonstrate how those results can influence business decision-making and guide company-level strategies for business analytics.

• Exam fee: $250 for members, $405 for non-members

IQBBA Certified Foundation Level Business Analyst (CFLBA)

The International Qualifications Board for Business Analysts (IQBBA) offers the Certified Foundation Level Business Analysis (CFLBA) as an entry-level certification, which will qualify you to earn higher levels of certification. It’s a globally recognized certification with accredited exam and training centers across the world. It’s designed for “people involved in analyzing business processes within an organization, modeling businesses and process improvement.” The foundation level covers enterprise analysis, business analysis process planning, requirements elicitation, requirements analysis, solution validation, tools and techniques, innovation, and design.

• Exam fee: $215

IQBBA Certified Advanced Level Business Analyst (CALBA)

The IQBBA Certified Advanced Level Business Analysis certification offers an advanced-level qualification for those who have passed the entry-level CFLBA exam. At this level, you’ll gain skills in business analysis process management, strategic analysis and optimization, and requirements management. Learning modules focus on enhancing the skills gained at the foundational level, deepening your knowledge of more advanced skills that will be necessary in your career.

• Exam fee: $215

IQBBA Certified Agile Business Analysis (CABA)

The IQBBA Certified Agile Business Analyst certification is another foundational-level qualification designed for anyone who wants to strengthen their business analysis skills with a focus on the Agile framework. The course covers how to recognize the role of a BA in agile software development projects, contribute to agile software teams, understand the principles of agile business analysis, and employ BA techniques in an enterprise setting. In addition to BA principles, the course and certification cover agile skills as well, including the 12 principles of the Agile Manifesto and how they intertwine with BA methods.

• Exam fee: $215

IREB Certified Professional for Requirements Engineering (CPRE)

The International Requirements Engineering Board (IREB) offers the Certified Professional for Requirements Engineering (CPRE) certification is designed for those working in requirements engineering (RE), and it’s offered at three levels. The Foundation Level is first, where you’ll be certified in the basics of RE. The Practitioner Level is next, where you can choose between four paths, including management, modeling, elicitation, and RE@Agile followed by Specialist level in the same four pathways. Finally, the Expert Level certifies you at the “highest level of expert knowledge,” which includes both your hands-on experience as well as your knowledge and skills gained through previous certifications.

Your certification will not expire, and you will not need to renew it. The IREB states that the CPRE is “based on the fundamental methods and approaches of Requirements Engineering, and these alter only slowly,” so at this time, they don’t see a need for renewal.

• Exam fee: Varies by testing center

PMI Professional in Business Analysis (PBA) Certification

The PMI Professional in Business Analysis (PBA) certification is designed for business analysts who work with projects or programs, or project and program managers who work with analytics. It’s offered through the Project Management Institute, which specializes in widely recognized project management certifications, such as the PMP. The certification focuses on business analysis training through hands-on projects and testing on business analysis principles, tools and fundamentals.

If you’ve already earned a bachelor’s degree, you’ll need at least three years’ experience, or 4,500 hours, in business analysis consecutively within the past eight years to earn this certification. Without a bachelor’s degree, you’ll need five years or 7,500 hours experience.

You’ll be required to earn 60 professional development units within three years after completing the certification to maintain your renewal status. If you let your renewal lapse, your credentials will be suspended for one year until you fulfill the requirements — after that, it will be terminated and you’ll need to reapply.

• Exam fee: $405 for PMI members, $555 for non-members

Salesforce Certified Business Analyst

The Salesforce Certified Business Analyst certification is a vendor-specific certification for business analysts — or similar roles — who work directly with Salesforce technology. The exam covers customer discovery, collaboration with stakeholders, business process mapping, requirements, user stories, and development support and user acceptance. You will need to pass a 60-question multiple choice question test and up to five additional unscored questions. While it’s not required, candidates should have around 2 years of business analyst experience and Salesforce Platform experience.

• Exam fee: $200

Much of the conversation around AI and work has centered on a single question: Will AI take my job?

It’s an understandable concern. Every week AI becomes increasingly more capable. We see AI summarizing meetings, generating content, analyzing data, writing software and automating workflows that once required significant human effort. Agentic AI is also becoming more established in the workplace, with virtual agents that can reason, plan and act across workflows. As those capabilities continue to improve, many employees are looking at the tasks they perform every day and wondering how much longer they will belong to them.

I believe that question reveals a bigger issue that has little to do with the technology itself.

Too many people have become defined by the tasks they perform rather than the value they create. Over time, the administrative work surrounding a role can overshadow the purpose behind it. According to Asana’s Anatomy of Work Index, knowledge workers spend 60% of their time on “work about work” — coordinating, tracking and managing tasks rather than driving meaningful outcomes. As AI automates more of this work, it can feel less like a productivity breakthrough and more like a threat because many employees equate their value with the activities that consume most of their day.

But most people were not hired to perform a task. They were hired to fulfill a purpose.

Tasks are not the job

A customer service representative isn’t successful because they spend their day summarizing conversations, looking up account information or navigating multiple systems to find answers. Those activities may have become part of the job, but they aren’t the reason the role exists. Great service professionals build trust, solve problems and create moments that strengthen customer relationships. AI can, and should, take on this administrative work, but the human value has never been in completing those tasks. It has always been in helping customers through moments that matter.

The industry increasingly recognizes this distinction. In fact, 91% of CX leaders believe human agents will remain a critical part of delivering customer experience, according to my company’s State of Customer Experience 2026 report. As AI takes on more routine work, the role of the employee doesn’t disappear. It becomes even more focused on the judgment, empathy and relationship-building that customers value most.

The same principle applies across every profession. A marketer isn’t measured by the number of presentations they build or approvals they coordinate; they’re hired to shape customer perception and drive growth; an HR professional isn’t successful because they schedule interviews or process paperwork; they’re there to identify, develop and retain talent. The examples go on, but the principle remains the same: Organizations create roles because outcomes need to be achieved, not because tasks need to be completed.

I’ve helped lead four major AI transformations, spanning everything from machine learning and big data to conversational AI, generative AI and now agentic AI. While the technology has evolved dramatically, one pattern has remained remarkably consistent.

The employees who embrace AI tend to focus on outcomes, while those who fear it often focus on tasks. The more someone defines their contribution through a list of activities, the easier it becomes to imagine AI replacing them. The more someone understands the purpose they serve, the easier it becomes to see AI as a tool that helps them deliver greater value.

As part of AI transformations, CIO organizations are often responsible for mapping jobs and core workflows. Inevitably, employees think we’re mapping their jobs to figure out what AI can replace. But once we start identifying repetitive work they’d gladly hand off, perspectives change. Someone says, “If AI handled that, I’d finally have time to work directly with customers.” Another realizes they could spend more time creating. People start thinking less about what AI might replace and more about what they’d finally have time to do. They’re reconnecting with the reason they wanted the role in the first place.

I’ve seen this play out as AI adoption expands. Our team responsible for responding to customer RFPs began using AI to analyze requirements, surface relevant information and accelerate response development. Their purpose is to help the organization communicate our value to customers and win new business. By reducing the time spent on low-value activities, AI created more capacity for strategic thinking, collaboration and customer-focused work, which directly influences the revenue and growth of our company.

I’ve even had to confront this myself. I used to spend hours coaching leaders before operational reviews: reviewing KPIs, challenging assumptions and helping them prepare for difficult questions. I used to think this was part of what made me valuable as a CIO, but I realized that I didn’t need to spend my time repeating the same coaching session. That’s why I built a virtual coach that helps my team prepare for operational reviews using many of the frameworks and lessons I’ve accumulated throughout my career. Now I have more time to spend strategizing on how to lead through the breakneck speed of AI evolution and helping the business think differently.

Rediscovering purpose

What employees are really confronting is a different question: What was my purpose in being hired in the first place?

As organizations move from AI experimentation to AI-first operating models, this question becomes harder to avoid. The tension is already visible across the workforce. A recent EY survey found that 84% of employees are eager to embrace agentic AI because they expect it to improve productivity, efficiency and the overall work experience. Yet 56% also worry about their job security working alongside AI systems. Employees aren’t rejecting AI; they’re trying to understand which parts of their contributions remain uniquely theirs as technology takes on more of the tasks they perform today.

Success will depend greatly on helping employees reconnect with the value they were hired to create. For leaders looking for practical guidance on how organizations are actually approaching AI-first transformation, the World Economic Forum’s AI-First Operating System offers a useful framework. Rather than treating AI as another technological tool, this approach encourages organizations to redesign work around value creation. As AI increasingly takes on routine tasks, employees must become clearer about where human judgment, creativity and relationships can create the greatest impact. You cannot redesign work around value if people no longer understand the purpose behind the work that they do.

In my experience, the organizations seeing the strongest results are helping employees reconnect with the outcomes they were hired to create. The conversation shifts from “What tasks can AI do?” to “What is the purpose of this role?” Once people answer that question, it becomes much easier to decide what should remain human, what can be delegated to AI and where the combination creates the most value.

None of this means change won’t happen. Some responsibilities will disappear. Some jobs will evolve significantly. New roles will emerge that we cannot fully predict today. Every major technology shift creates that kind of change.

But I believe many people are looking at this transformation through the wrong lens.

The question is not whether AI can do your tasks. The question is whether you understand the purpose behind them. Because while AI may increasingly perform the work, humans will continue to provide the judgment, creativity, accountability and value that give that work meaning.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Too often, brands treat compliance as a downstream exercise. Teams build products, launch new capabilities and then tack on controls afterward.

The pace of technology evolution and adoption has never been faster, and regulatory bodies are doing their best to keep up. For brands, that means they’re standing on shifting ground. They need  to modernize legacy infrastructure, adopt AI responsibly, deliver better customer experiences, maintain trust and navigate increasingly complex regulatory requirements – all at once.

I’ve witnessed this shift firsthand in payments. Fraudsters adapt faster than regulatory cycles, and customer expectations continue to rise regardless of where legislation stands. In one of the most highly regulated sectors, waiting for new mandates to arrive is a losing strategy.

The brands that lead have embraced regulatory readiness as an advantage to better inform technology architecture, operating models and partner strategy.

If I had one piece of advice for CIOs, it would be to treat compliance as part of the blueprint instead of the punch list at the end of a build. With a controls-by-design approach, a collaborative culture, and the right partnerships, any brand can embrace change with confidence and resilience.

3 ways regulatory readiness is a competitive advantage

1. Build a solid foundation

One of the most impactful strategies I’ve seen is the shift from compliance-after-the-fact to controls-by-design.

Forward-thinking financial institutions increasingly treat regulatory frameworks like DORA and the EU AI Act as design principles rather than external requirements. Instead of asking how to retrofit compliance into modern systems, they are asking how thoughtful governance can shape modernization from day one.

For example, the EU AI Act mandates transparency for high-risk AI systems like automated credit scoring. Instead of burying disclosures in the fine print, a smart bank builds an interactive feature directly into its digital banking app, which allows customers to simulate how adjustments will improve their approval odds. By doing so, they transform a regulatory obligation into innovation that builds trust.

After all, when an AI-driven decision fails, customers do not blame the algorithm. They blame the brand. The controls-by-design approach helps ensure those risks are anticipated and managed before they reach the customer.

This feels particularly urgent in the payments industry, where FedNow and stablecoins allow funds to move instantly – and irrevocably. As settlement windows shrink from days to seconds, brands need to embed capabilities like behavioral monitoring, AI-driven fraud detection, account verification and orchestration functionality directly into the transaction architecture itself – as part of the initial design – to identify and mitigate fraudulent activity as it evolves. Regulation, like Nacha’s new rules around ACH fraud, reinforces that direction, but for trust-focused brands, the work begins long before the rules change.

Each of these examples points to the same trend. Brands that embrace a controls-by-design philosophy are constructing technology architectures that are ready to adapt long before the inspectors arrive on site.

2. Align your crew

Technology architecture is only half of the story. The other half is how well your crew works together to bring that architecture to life.

For years, compliance lived in its own lane. Governance acted like a checkpoint. When technology evolved in predictable cycles, that made sense. But today, the brands making the greatest progress build shared accountability into their operating models so they can adapt to regulation in a more coordinated, consistent way.

After all, a construction project is only successful when electricians, plumbers, framers and masons coordinate every step and trust the work happening around them.

The same is true in the enterprise. Instead of focusing on separate priorities, product, engineering, operations, risk and compliance must align around shared outcomes, with greater transparency into how decisions are made, ongoing oversight and continuous feedback loops between teams. As a result, regulatory readiness becomes part of how the business works every day, change becomes easier and the broader benefits across the organization become clear.

In many organizations, I’ve observed how harmony between teams not only increases compliance but also fosters greater customer-centric innovation. When teams operate from a shared, real-time view of the customer, every interaction becomes more connected. Customers experience one brand, not a collection of disconnected teams.

That spirit of collaboration becomes even more important as AI moves deeper into customer-facing and operational workflows. AI innovation has outpaced AI regulation, which makes it even more important for brands to take the initiative to ensure proper controls are in place.

We are already seeing this play out with SR 26-2, the Federal Reserve’s latest guidance on AI for banks. While it establishes important expectations around model risk management, it leaves room for institutions to determine how agentic AI and generative AI should be governed. Instead of treating this as carte blanche, banking leaders should see this as an opportunity to build trust. By leading the way with governed, responsible GenAI and agentic AI operating models, banks can win customers’ trust long before regulation requires it.

No single department should shoulder that responsibility alone. Product teams understand how AI shapes the customer experience. Engineering teams understand how models are built, deployed and monitored. Risk and compliance teams understand governance expectations, while operations teams see how those decisions play out every day. Effective AI governance and innovation emerge when those perspectives come together around a shared view of accountability.

3. Expand your toolkit

Innovation in today’s regulatory environment requires more tools than you may have in your own toolkit.

Technology is more complex, fraud threats evolve faster and AI capabilities require significant investment and ongoing tuning. At the same time, brands have to stay ahead of customer expectations, market dynamics and evolving risk requirements.

It just doesn’t make sense to build every capability yourself when trust, resilience, compliance and speed-to-value are such integral parts of the equation. 

Throughout my career, I’ve seen success with a build-buy-partner approach that brings together the right tools for the right project.

This is particularly important in highly regulated environments, where implementation risk can be as significant as technical risk. That’s where proven results – especially through partnership – might take precedence over experimentation.

I went through this consideration just recently. CSG Forte partnered with IBM to launch PaymentsProtection.ai.

We set out to provide customers with AI-powered fraud detection and financial risk management without spending years recreating capabilities that already existed. By partnering with IBM, we were able to access additional specialty tools: AI capabilities, real-time monitoring, financial risk management expertise and external validation in one of the most sensitive areas of payments. The collaboration reduced fraud losses by 50-70%, lowered false positives and offered customers a smoother, safer experience.

In a market that never stands still, the right tools give brands the freedom to build with greater precision, adaptability and purpose.

Raise the standard

Successful brands are changing how they think about regulation. Instead of looking at it as a burden or a constraint on innovation, they are treating it like a key factor in architectural decisions, crew alignment and partner strategy.

That approach increasingly separates the brands raising the standard from those struggling to keep up. It changes the role regulation plays within the business. It infuses trust, governance and adaptability into a brand’s foundation.

Those capabilities make it easier to scale new builds, navigate future change and innovate with confidence as markets, customer expectations and regulatory requirements continue to charge ahead.

The brands shaping the future won’t be scrambling to reinforce the structure after the cracks appear. They’ll be the ones that construct resilience from the very beginning.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The meeting that changed my perspective

I remember sitting there and realizing I wasn’t thinking about the model at all. I was thinking about the data feeding it.

One discussion stands out in particular. We were evaluating how predictive analytics could improve sales forecasting for a national portfolio of opportunities. Leadership wanted greater confidence in projected outcomes so resources could be prioritized earlier in the sales cycle. As conversations turned toward model accuracy, we discovered something more important. Different teams weren’t consistently recording opportunity stages, probability scores and client attributes. The model wasn’t struggling because it lacked sophistication. It was learning from business processes that had never been standardized in the first place. That meeting changed how I approached every AI initiative that followed.

Throughout my career leading enterprise business intelligence initiatives, I’ve repeatedly watched organizations blame the algorithm when the real issue was inconsistent data, fragmented ownership across departments and business definitions that meant different things to different teams. AI doesn’t distinguish between disciplined and inconsistent business processes. It learns from both with equal confidence.

I’d built and defended executive dashboards for years before that meeting, and dashboards had trained me to believe imperfect data was a manageable, even routine problem. Experienced leaders read a dashboard with context. They know which numbers to trust, which ones need a caveat and which gaps to mentally fill in based on what they already know about the business. Predictive AI doesn’t have that judgment. Machine learning assumes the historical data it’s trained on represents reality as it actually is. If two departments define “active customer” differently, or if a critical field has been silently incomplete for two fiscal years, the model doesn’t notice or compensate. It learns the inconsistency as ground truth, and it repeats that mistake at scale, with confidence, every single time it runs.

That moment fundamentally changed how I approach every AI initiative. I stopped starting with technology and started with data integrity instead.

5 questions I ask before any AI platform conversation

Today, I rarely begin AI discussions by talking about technology. Before any conversation about platforms or vendors, I ask five questions of the leadership team. Can we explain, in plain language, where this data actually comes from? Do the business leaders in the room agree on what our core definitions mean, or does “revenue” or “active account” shift depending on who’s presenting? Would we rely on this data to make a multimillion-dollar decision without a human manually double-checking it first? Is there a specific, named person accountable for every critical dataset, or does ownership dissolve the moment something goes wrong? And underneath all of it, are we actually solving a business problem, or are we chasing a technology because it’s the thing everyone else is talking about this quarter?

I remember one initiative where these questions prevented us from moving too quickly. During an early assessment, we discovered that two operational systems treated the same customer differently because each had evolved around separate business processes. Executive reports appeared consistent because manual reconciliation had become part of the monthly reporting routine. Once we identified the inconsistency, the project paused while business stakeholders agreed on common definitions and ownership. That decision delayed the AI initiative by only a few weeks, but it likely prevented months of troubleshooting after deployment. More importantly, it strengthened confidence in every analytics initiative that followed.

These conversations reveal far more about whether an organization is genuinely ready for AI than any vendor demonstration ever will. A polished proof-of-concept can make almost any dataset look production-ready for the ten minutes it’s on screen. These five questions don’t have that luxury. They tend to surface, quickly and uncomfortably, where an organization’s data confidence actually breaks down, and that’s the information leadership needs before committing budget and reputation to a rollout.

This lines up with what the NIST AI Risk Management Framework has argued for a while now: governance and accountability belong at the foundation of an AI initiative, not layered in after a model is already in production. Governance built in retroactively tends to be theater, built to explain a failure that’s already happened rather than to prevent one.

Leadership before technology

The organizations I’ve seen actually succeed with AI invest first in governance, ownership and shared business definitions, and only then in the platform itself. They clean up master data before they scale a model against it. They remove duplication in customer and product records. They assign accountability for datasets the same way they’d assign accountability for a budget line, with a name attached and consequences if it slips. This work rarely shows up in a demo, which is probably why it gets skipped so often in the rush toward deployment.

One lesson I’ve seen repeatedly is that assigning ownership changes behavior almost immediately. Once business leaders understood they were accountable for the quality of specific datasets, not just the reports generated from them, conversations shifted. Instead of asking why dashboards looked different, teams began discussing why the underlying business process produced inconsistent information. Governance stopped being viewed as documentation and became part of everyday decision-making. The improvements weren’t dramatic overnight, but they were sustainable, and that consistency ultimately mattered more than any individual technology upgrade.

I saw this firsthand during an executive reporting initiative where multiple leadership teams relied on the same performance dashboard but interpreted one KPI differently, because ownership had never been clearly assigned. Once the business designated a single owner for the metric and standardized its definition across reporting systems, disagreements disappeared almost overnight. More importantly, that same governance work later allowed predictive analytics to be introduced with confidence, because everyone was working from the same version of the truth.

I’ve learned that AI projects rarely fail in the data science team. They fail months earlier, when leadership assumes the organization already understands its own data.

McKinsey’s research on scaling AI reinforces this pattern at scale: the organizations that generate lasting value from AI are consistently the ones that pair the technology with real changes to their operating model and governance, rather than simply layering AI on top of how things already worked. That finding matches what I’ve observed leading enterprise analytics initiatives directly. The technology was rarely the constraint. The organization’s relationship with its own data was.

It’s tempting to frame AI adoption as an engineering problem with a leadership footnote, when in practice it’s closer to the reverse. CIOs reporting on rebuilding an AI-ready data strategy make a related point: treating data ownership as a purely IT issue stops working once business units, product teams and AI platforms are all generating and transforming data continuously, which is exactly why accountability has to sit with named business leaders, not a technical team working in isolation. A related piece on building an AI-ready data culture puts it more bluntly: an organization can’t scale AI without first scaling trust in its own data, and that trust starts with culture and ownership, not tooling.

I no longer ask whether an organization is AI-ready. I ask whether its leaders would bet on their own data without a human checking behind the model first. If the honest answer is no, the next investment shouldn’t be another AI platform or a more sophisticated model. It should be a stronger data foundation, built deliberately, with clear ownership, before a single additional AI use case gets greenlit.

If another executive asked me for one piece of advice before approving a major AI investment, I’d tell them this: spend one day interrogating your data before spending another dollar on your model. What that conversation reveals will tell you more about your organization’s readiness than any vendor demonstration ever could.

Organizations rarely fail because their AI isn’t intelligent enough. They struggle because they ask AI to learn from data that was never prepared to support intelligent decisions in the first place. The organizations that lead in this next era won’t be the ones with the most advanced models. They’ll be the ones that got their own house in order first, and knew it.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The meeting that changed my perspective

I remember sitting there and realizing I wasn’t thinking about the model at all. I was thinking about the data feeding it.

One discussion stands out in particular. We were evaluating how predictive analytics could improve sales forecasting for a national portfolio of opportunities. Leadership wanted greater confidence in projected outcomes so resources could be prioritized earlier in the sales cycle. As conversations turned toward model accuracy, we discovered something more important. Different teams weren’t consistently recording opportunity stages, probability scores and client attributes. The model wasn’t struggling because it lacked sophistication. It was learning from business processes that had never been standardized in the first place. That meeting changed how I approached every AI initiative that followed.

Throughout my career leading enterprise business intelligence initiatives, I’ve repeatedly watched organizations blame the algorithm when the real issue was inconsistent data, fragmented ownership across departments and business definitions that meant different things to different teams. AI doesn’t distinguish between disciplined and inconsistent business processes. It learns from both with equal confidence.

I’d built and defended executive dashboards for years before that meeting, and dashboards had trained me to believe imperfect data was a manageable, even routine problem. Experienced leaders read a dashboard with context. They know which numbers to trust, which ones need a caveat and which gaps to mentally fill in based on what they already know about the business. Predictive AI doesn’t have that judgment. Machine learning assumes the historical data it’s trained on represents reality as it actually is. If two departments define “active customer” differently, or if a critical field has been silently incomplete for two fiscal years, the model doesn’t notice or compensate. It learns the inconsistency as ground truth, and it repeats that mistake at scale, with confidence, every single time it runs.

That moment fundamentally changed how I approach every AI initiative. I stopped starting with technology and started with data integrity instead.

5 questions I ask before any AI platform conversation

Today, I rarely begin AI discussions by talking about technology. Before any conversation about platforms or vendors, I ask five questions of the leadership team. Can we explain, in plain language, where this data actually comes from? Do the business leaders in the room agree on what our core definitions mean, or does “revenue” or “active account” shift depending on who’s presenting? Would we rely on this data to make a multimillion-dollar decision without a human manually double-checking it first? Is there a specific, named person accountable for every critical dataset, or does ownership dissolve the moment something goes wrong? And underneath all of it, are we actually solving a business problem, or are we chasing a technology because it’s the thing everyone else is talking about this quarter?

I remember one initiative where these questions prevented us from moving too quickly. During an early assessment, we discovered that two operational systems treated the same customer differently because each had evolved around separate business processes. Executive reports appeared consistent because manual reconciliation had become part of the monthly reporting routine. Once we identified the inconsistency, the project paused while business stakeholders agreed on common definitions and ownership. That decision delayed the AI initiative by only a few weeks, but it likely prevented months of troubleshooting after deployment. More importantly, it strengthened confidence in every analytics initiative that followed.

These conversations reveal far more about whether an organization is genuinely ready for AI than any vendor demonstration ever will. A polished proof-of-concept can make almost any dataset look production-ready for the ten minutes it’s on screen. These five questions don’t have that luxury. They tend to surface, quickly and uncomfortably, where an organization’s data confidence actually breaks down, and that’s the information leadership needs before committing budget and reputation to a rollout.

This lines up with what the NIST AI Risk Management Framework has argued for a while now: governance and accountability belong at the foundation of an AI initiative, not layered in after a model is already in production. Governance built in retroactively tends to be theater, built to explain a failure that’s already happened rather than to prevent one.

Leadership before technology

The organizations I’ve seen actually succeed with AI invest first in governance, ownership and shared business definitions, and only then in the platform itself. They clean up master data before they scale a model against it. They remove duplication in customer and product records. They assign accountability for datasets the same way they’d assign accountability for a budget line, with a name attached and consequences if it slips. This work rarely shows up in a demo, which is probably why it gets skipped so often in the rush toward deployment.

One lesson I’ve seen repeatedly is that assigning ownership changes behavior almost immediately. Once business leaders understood they were accountable for the quality of specific datasets, not just the reports generated from them, conversations shifted. Instead of asking why dashboards looked different, teams began discussing why the underlying business process produced inconsistent information. Governance stopped being viewed as documentation and became part of everyday decision-making. The improvements weren’t dramatic overnight, but they were sustainable, and that consistency ultimately mattered more than any individual technology upgrade.

I saw this firsthand during an executive reporting initiative where multiple leadership teams relied on the same performance dashboard but interpreted one KPI differently, because ownership had never been clearly assigned. Once the business designated a single owner for the metric and standardized its definition across reporting systems, disagreements disappeared almost overnight. More importantly, that same governance work later allowed predictive analytics to be introduced with confidence, because everyone was working from the same version of the truth.

I’ve learned that AI projects rarely fail in the data science team. They fail months earlier, when leadership assumes the organization already understands its own data.

McKinsey’s research on scaling AI reinforces this pattern at scale: the organizations that generate lasting value from AI are consistently the ones that pair the technology with real changes to their operating model and governance, rather than simply layering AI on top of how things already worked. That finding matches what I’ve observed leading enterprise analytics initiatives directly. The technology was rarely the constraint. The organization’s relationship with its own data was.

It’s tempting to frame AI adoption as an engineering problem with a leadership footnote, when in practice it’s closer to the reverse. CIOs reporting on rebuilding an AI-ready data strategy make a related point: treating data ownership as a purely IT issue stops working once business units, product teams and AI platforms are all generating and transforming data continuously, which is exactly why accountability has to sit with named business leaders, not a technical team working in isolation. A related piece on building an AI-ready data culture puts it more bluntly: an organization can’t scale AI without first scaling trust in its own data, and that trust starts with culture and ownership, not tooling.

I no longer ask whether an organization is AI-ready. I ask whether its leaders would bet on their own data without a human checking behind the model first. If the honest answer is no, the next investment shouldn’t be another AI platform or a more sophisticated model. It should be a stronger data foundation, built deliberately, with clear ownership, before a single additional AI use case gets greenlit.

If another executive asked me for one piece of advice before approving a major AI investment, I’d tell them this: spend one day interrogating your data before spending another dollar on your model. What that conversation reveals will tell you more about your organization’s readiness than any vendor demonstration ever could.

Organizations rarely fail because their AI isn’t intelligent enough. They struggle because they ask AI to learn from data that was never prepared to support intelligent decisions in the first place. The organizations that lead in this next era won’t be the ones with the most advanced models. They’ll be the ones that got their own house in order first, and knew it.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Too often, brands treat compliance as a downstream exercise. Teams build products, launch new capabilities and then tack on controls afterward.

The pace of technology evolution and adoption has never been faster, and regulatory bodies are doing their best to keep up. For brands, that means they’re standing on shifting ground. They need  to modernize legacy infrastructure, adopt AI responsibly, deliver better customer experiences, maintain trust and navigate increasingly complex regulatory requirements – all at once.

I’ve witnessed this shift firsthand in payments. Fraudsters adapt faster than regulatory cycles, and customer expectations continue to rise regardless of where legislation stands. In one of the most highly regulated sectors, waiting for new mandates to arrive is a losing strategy.

The brands that lead have embraced regulatory readiness as an advantage to better inform technology architecture, operating models and partner strategy.

If I had one piece of advice for CIOs, it would be to treat compliance as part of the blueprint instead of the punch list at the end of a build. With a controls-by-design approach, a collaborative culture, and the right partnerships, any brand can embrace change with confidence and resilience.

3 ways regulatory readiness is a competitive advantage

1. Build a solid foundation

One of the most impactful strategies I’ve seen is the shift from compliance-after-the-fact to controls-by-design.

Forward-thinking financial institutions increasingly treat regulatory frameworks like DORA and the EU AI Act as design principles rather than external requirements. Instead of asking how to retrofit compliance into modern systems, they are asking how thoughtful governance can shape modernization from day one.

For example, the EU AI Act mandates transparency for high-risk AI systems like automated credit scoring. Instead of burying disclosures in the fine print, a smart bank builds an interactive feature directly into its digital banking app, which allows customers to simulate how adjustments will improve their approval odds. By doing so, they transform a regulatory obligation into innovation that builds trust.

After all, when an AI-driven decision fails, customers do not blame the algorithm. They blame the brand. The controls-by-design approach helps ensure those risks are anticipated and managed before they reach the customer.

This feels particularly urgent in the payments industry, where FedNow and stablecoins allow funds to move instantly – and irrevocably. As settlement windows shrink from days to seconds, brands need to embed capabilities like behavioral monitoring, AI-driven fraud detection, account verification and orchestration functionality directly into the transaction architecture itself – as part of the initial design – to identify and mitigate fraudulent activity as it evolves. Regulation, like Nacha’s new rules around ACH fraud, reinforces that direction, but for trust-focused brands, the work begins long before the rules change.

Each of these examples points to the same trend. Brands that embrace a controls-by-design philosophy are constructing technology architectures that are ready to adapt long before the inspectors arrive on site.

2. Align your crew

Technology architecture is only half of the story. The other half is how well your crew works together to bring that architecture to life.

For years, compliance lived in its own lane. Governance acted like a checkpoint. When technology evolved in predictable cycles, that made sense. But today, the brands making the greatest progress build shared accountability into their operating models so they can adapt to regulation in a more coordinated, consistent way.

After all, a construction project is only successful when electricians, plumbers, framers and masons coordinate every step and trust the work happening around them.

The same is true in the enterprise. Instead of focusing on separate priorities, product, engineering, operations, risk and compliance must align around shared outcomes, with greater transparency into how decisions are made, ongoing oversight and continuous feedback loops between teams. As a result, regulatory readiness becomes part of how the business works every day, change becomes easier and the broader benefits across the organization become clear.

In many organizations, I’ve observed how harmony between teams not only increases compliance but also fosters greater customer-centric innovation. When teams operate from a shared, real-time view of the customer, every interaction becomes more connected. Customers experience one brand, not a collection of disconnected teams.

That spirit of collaboration becomes even more important as AI moves deeper into customer-facing and operational workflows. AI innovation has outpaced AI regulation, which makes it even more important for brands to take the initiative to ensure proper controls are in place.

We are already seeing this play out with SR 26-2, the Federal Reserve’s latest guidance on AI for banks. While it establishes important expectations around model risk management, it leaves room for institutions to determine how agentic AI and generative AI should be governed. Instead of treating this as carte blanche, banking leaders should see this as an opportunity to build trust. By leading the way with governed, responsible GenAI and agentic AI operating models, banks can win customers’ trust long before regulation requires it.

No single department should shoulder that responsibility alone. Product teams understand how AI shapes the customer experience. Engineering teams understand how models are built, deployed and monitored. Risk and compliance teams understand governance expectations, while operations teams see how those decisions play out every day. Effective AI governance and innovation emerge when those perspectives come together around a shared view of accountability.

3. Expand your toolkit

Innovation in today’s regulatory environment requires more tools than you may have in your own toolkit.

Technology is more complex, fraud threats evolve faster and AI capabilities require significant investment and ongoing tuning. At the same time, brands have to stay ahead of customer expectations, market dynamics and evolving risk requirements.

It just doesn’t make sense to build every capability yourself when trust, resilience, compliance and speed-to-value are such integral parts of the equation. 

Throughout my career, I’ve seen success with a build-buy-partner approach that brings together the right tools for the right project.

This is particularly important in highly regulated environments, where implementation risk can be as significant as technical risk. That’s where proven results – especially through partnership – might take precedence over experimentation.

I went through this consideration just recently. CSG Forte partnered with IBM to launch PaymentsProtection.ai.

We set out to provide customers with AI-powered fraud detection and financial risk management without spending years recreating capabilities that already existed. By partnering with IBM, we were able to access additional specialty tools: AI capabilities, real-time monitoring, financial risk management expertise and external validation in one of the most sensitive areas of payments. The collaboration reduced fraud losses by 50-70%, lowered false positives and offered customers a smoother, safer experience.

In a market that never stands still, the right tools give brands the freedom to build with greater precision, adaptability and purpose.

Raise the standard

Successful brands are changing how they think about regulation. Instead of looking at it as a burden or a constraint on innovation, they are treating it like a key factor in architectural decisions, crew alignment and partner strategy.

That approach increasingly separates the brands raising the standard from those struggling to keep up. It changes the role regulation plays within the business. It infuses trust, governance and adaptability into a brand’s foundation.

Those capabilities make it easier to scale new builds, navigate future change and innovate with confidence as markets, customer expectations and regulatory requirements continue to charge ahead.

The brands shaping the future won’t be scrambling to reinforce the structure after the cracks appear. They’ll be the ones that construct resilience from the very beginning.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Every CIO I speak with today is wrestling with some version of the same question: How do we move faster with AI and deliver on our commitments?

It’s an understandable concern. Boards and CEOs are asking about AI. Business leaders are experimenting with use cases. Employees are discovering tools daily, while technology vendors promise unprecedented gains in productivity, innovation, and competitive advantage.

After hundreds of conversations with technology executives over the past year, I’ve become convinced that speed isn’t the real issue. The organizations pulling away from the pack aren’t necessarily adopting AI faster than everyone else. They’re executing more effectively — a subtle distinction that represents one of the defining leadership challenges of the AI era.

Technology has never been the hardest part of transformation. People, priorities, culture, and operating models are the biggest challenges. The ability to translate bold boardroom aspirations into thousands of thoughtful decisions made every day by architects, engineers, product managers, analysts, and business leaders is where competitive advantage is created. AI may be accelerating the pace of change, but it hasn’t changed that fundamental truth.

I’ve met plenty of executives who are exceptional in the boardroom. They know how to frame a vision, influence a board, and build confidence among investors and business leaders. I’ve also met remarkable technologists who instinctively understand the architectural decisions, engineering tradeoffs, and implementation details that determine how great ideas become reality. Modern CIOs, however, must move comfortably between both worlds. Afshean Talasaz is one who stands out among this rare breed.

Long before becoming CIO of Colonial Pipeline, Talasaz built his career from the ground up as a business professional, data scientist, and technologist. He has designed enterprise platforms, built AI capabilities, led technology organizations, and partnered closely with executive leadership teams on business transformation. Today, as an executive in residence with our Practitioners for Practitioners (P4P) community, he helps CIOs and business leaders navigate one of the most significant technology shifts of our generation.

While Talasaz brings deep knowledge of data and AI to the table, his greatest strength is his ability to create strategy and connect it with execution. He can spend the morning discussing enterprise reinvention with the board and the afternoon debating architectural principles with the teams responsible for bringing that vision to life.

That versatility gives Talasaz a unique lens on how CIOs can deliver value with AI.

Software companies have a term for engineers who understand every layer of the technology stack: full-stack developers. Listen to Talasaz and it becomes evident that the AI era requires something similar from technology leaders: a full-stack CIO.

The full-stack CIO: Leading with clarity

A full-stack CIO understands how every layer of the enterprise influences the next. They recognize that every strategic priority becomes a portfolio investment, every investment shapes an operating model, every operating model influences architecture, every architecture choice informs product decisions, every product decision shapes engineering priorities.

The best CIOs understand both ends of that journey. The extraordinary ones understand everything in between.

And those who execute best lead with clarity, Talasaz says.

“Everyone, from executives to middle managers to the people writing code, should be able to explain what we’re trying to achieve,” he emphasizes. “Clarity isn’t that we’ve handed out the PowerPoint. It’s that people genuinely understand where we’re going and can articulate it in their own language.”

One of the unintended consequences of the AI boom is that organizations are beginning to confuse activity with alignment. They have AI councils, AI governance committees, AI innovation labs, AI centers of excellence, AI pilots, and AI roadmaps. Yet if you stop ten people in the hallway and ask a deceptively simple question, What business problem are we actually trying to solve? you’ll often hear ten different answers.

As a result, architects optimize for one objective while product teams optimize for another. Business units pursue opportunities that seem perfectly reasonable from their perspective. Engineers make thoughtful technical decisions based on the information available to them. Individually, none of those decisions are necessarily wrong. Collectively, however, they create organizational drift. AI doesn’t create that problem. It simply accelerates the consequences.

And while AI can be a force multiplier for the positive when every decision is guided by a shared understanding of where the organization is headed, it can also be a force multiplier for the negative, resulting in an organization simply moving faster in different directions.

“When we have the fundamentals right, the tech infrastructure, the operating models, the nuances of how our business actually runs, we get the impacts of AI in a positive way,” Talasaz says. “When we don’t have those in place, AI can amplify the gaps or mute the benefits.”

At a time when so much of the conversation surrounding AI is focused on algorithms, agents, and automation, it’s an important reminder that organizations don’t execute strategy; people do.

Reducing organizational friction

Most executives are familiar with the concept of VUCA that characterizes today’s business environment. But Talasaz stresses the importance of turning this concern inward: “If the world outside our organizations is becoming more volatile, uncertain, complex, and ambiguous, what are we, as leaders, doing to the inside of our organizations?”

Leaders spend enormous amounts of time helping their organizations respond to external disruption but comparatively little time asking whether they are inadvertently re-creating those same conditions internally in response to those external needs. Are we reducing uncertainty or introducing more of it? Are we simplifying work or adding unnecessary complexity? Are we helping people focus on what matters most, or asking them to navigate competing priorities and shifting expectations?

Talasaz refers to this phenomenon as double VUCA — something I’ve witnessed repeatedly while working with CIOs over the past decade. Organizations often assume they’re struggling because of technology limitations when the real constraint is organizational friction. Teams wait for decisions. Priorities shift faster than roadmaps. Governance grows heavier. New committees are formed to solve problems created by existing committees. Everyone is working harder, yet the organization somehow feels slower.

AI amplifies both outcomes. Organizations with clarity become dramatically more effective because AI accelerates good decisions. Organizations without clarity simply accelerate confusion.

Operating model as strategy enabler

AI governance is one way to achieve greater clarity, but as Talasaz says, governance shouldn’t primarily exist inside policy manuals that few people read.

Instead, AI governance should be embedded in the daily rhythms of the organization, shaping how teams collaborate, how decisions are made, how products move from ideas into production, and how innovation happens safely without requiring constant escalation. In other words, it’s all about your operating model.

“If you had to pick one thing that isn’t technology, your operating model is the most important element for executing data and AI at scale,” he says.

The best operating models create enough clarity that capable people can make thousands of decisions independently and confidently, without having to wait for permission. By embedding good governance into the way it works, the organization becomes faster.

This advice echoes something I’ve heard repeatedly from some of the world’s most respected CIOs: High-performing organizations aren’t built on tighter control; they’re built on greater trust, supported by clear principles, shared expectations, and operating models that enable responsible decision-making at every level of the enterprise.

Talasaz points out that technology leaders tend to speak in terms of transformation. He suggests CIOs consider a different word: reinvention.

As he explains, transformation implies replacing what exists today with something new. Reinvention starts with a more clear-eyed and practical premise: Some things absolutely must change; others represent years, sometimes decades, of accumulated expertise, customer trust, operational discipline, and competitive advantage.

Reinvention is about building on those strengths while also creating new ways to deliver value. The leaders making the greatest progress in their AI journeys seem to recognize that it’s less about abandoning the past than thoughtfully preparing the organization for the future.

Closing the gap between strategy and execution

Full-stack CIOs must be able to map out the various layers of execution and planning that need to be done at every level of the organization to be successful. To help with this, Talasaz has developed a data and AI framework that draws on his own experiences “from the keyboard to the boardroom.”

As Talasaz sees it, too many organizations have been doing good work in isolation. “They’re doing a lot of the right things,” he says. “They’re just not connected.”

Boards may be discussing growth while business leaders redesign customer experiences. Product teams may be prioritizing new capabilities while architects modernize platforms. Data teams may be improving quality while engineers focus on delivery. Every group makes meaningful progress within its own domain, yet somewhere between strategy and execution, the connective tissue begins to disappear. Talasaz’s framework brings those connecting points to the forefront.

Crucially, the framework doesn’t begin with technology or AI or even with data. It begins with the experiences the organization hopes to create for its customers, employees, or partners. Many AI initiatives start with the question, “What can this technology do?” And indeed, we need to be inspired by the possibilities and challenged to think differently by what the technology can do. But, Talasaz emphasizes, we also need to ask what experiences we need to deliver for our business and how the technology can make that a reality.

The framework challenges CIOs to answer that question first. Only after the experiences are clearly defined does the conversation move to the capabilities required to deliver it, the business activities that support those capabilities, the AI and data products that enable them, and finally the data foundation that makes everything possible.

This shift in perspective ensures that, rather than allowing technology investments to search for business value, the business experience defines the technology required to deliver it. For CIOs, that’s more than a planning exercise. It’s a fundamentally different way of leading.

Over the coming months, the P4P community will be convening a series of small CxO roundtables to explore these issues and work more deeply with Afshean Talasaz’s 6×6 Data and AI Framework. CIOs and other enterprise leaders interested in participating are welcome to reach out to me directly.

For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.

Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organizations continue to suffer major cyber incidents with alarming regularity. Every week seems to bring news of another ransomware attack, supply chain compromise or data breach affecting organizations that many would have assumed were well protected.

The obvious conclusion is that we are asking the wrong questions.

Too many executive teams remain preoccupied with the latest threat actor, the newest security product the CISO wants to buy or the latest vulnerability making headlines. Those issues matter, but they are not what should be keeping CEOs awake at night.

In my view, there are three far more fundamental issues that deserve the attention of every chief executive.

1. Corporate complexity, and the widening gap between business leadership and cybersecurity reality

Perhaps the biggest cybersecurity risk facing large organizations today is not technical at all.

It is the growing disconnect between executive perception and operational reality.

Many boards genuinely believe their organizations are reasonably well protected. They receive regular dashboards showing improving maturity scores, increasing compliance levels, falling vulnerability counts and reassuring traffic-light reports.

Unfortunately, cyber attackers do not read dashboards.

Behind those executive reports often lies an increasingly complex technology landscape, thousands of unmanaged digital assets, ageing infrastructure, rampant shadow IT, fragmented ownership, inconsistent governance and security teams struggling to keep pace with relentless business change.

The problem is rarely a lack of effort.

It is that corporate complexity has reached a level where traditional governance mechanisms are no longer capable of providing an accurate picture of organizational resilience.

Executives believe they understand the level of cyber risk they face because they receive regular reports. Those reports often measure activity rather than resilience.

Governance committees end up debating around another percentage point of phishing awareness or vulnerability remediation, while fundamental issues remain unaddressed in the background.

2. Organizational inertia, and the need for executive structure to evolve faster

Cyber criminals continue to evolve rapidly. Large organizations generally do not.

This is the second issue that should concern every CEO.

Throughout my career, I have observed organizations repeatedly responding to new cyber threats by adding another technology platform, another monitoring capability, another compliance framework or another governance committee.

Very rarely do they stop to redesign how cybersecurity operates.

The result is what I described several years ago as the “Cybersecurity Spiral of Failure”.

• As complexity and regulation increase, organizations invest in more security products.
• More products create more complexity.
• More products and greater complexity generate more alerts.
• More alerts require more analysts.
• More analysts produce more reports.
• More reports continue to build up executive confidence.
• Meanwhile, the underlying structural weaknesses remain largely unchanged, technical debt piles up and costs escalate.

And when the inevitable breach eventually happens, reality reveals itself, but distrust also sets in between senior executives and security teams.

This is not a funding problem. Nor is it a skills problem. It is fundamentally an operating model problem.

Many organizations continue trying to solve twenty-first century challenges using governance, accountability, organizational and reporting structures designed twenty-five years ago.

The cybersecurity function itself has evolved dramatically. Many executive structures have not.

This organizational inertia extends beyond technology: It affects budgeting cycles, investment priorities, procurement processes, accountability models and decision-making speed.

Cyber attackers innovate every day. Organizational change often takes years.

That imbalance should worry every CEO.

3. Accelerating technological disruption, and how it challenges organizations in areas where they are intrinsically weak

The third issue is potentially the most significant over the coming decade.

• Artificial intelligence, autonomous agents and machine identities
• Software supply chain complexity.
• Quantum computing, and post-quantum cryptography

Each of these developments represents far more than another technical trend.

Together, they fundamentally change the dynamics of cybersecurity.

Artificial intelligence is transforming countless business processes. At the same time, it is also increasing both the speed and sophistication of cyber-attacks while simultaneously transforming defensive capabilities.

Organizations have become increasingly dependent on software ecosystems that extend far beyond their own direct control. Engaging with the supply chain in ways that lead to a genuine appreciation of the risks involved has become a key challenge for most cybersecurity practices.

Quantum computing may eventually invalidate much of today’s cryptographic algorithms, forcing organizations into one of the largest technology efforts since Y2K — but without the benefit of a fixed deadline and faced by a problem that is considerably more complex and hyperconnected IT estates that have little to do with those of the late 90s.

None of these challenges can be solved overnight: They require clear governance, sustained investment over a few years and cross-functional organizational coordination.

Most large organizations are weak on those three fronts: This is precisely why CEOs should be focusing on them now.

Waiting until some of those risks become obvious will almost certainly be too late.

Businesses naturally prioritise immediate commercial pressures. Cybersecurity often involves preparing for risks whose timing remains uncertain.

But one of the greatest leadership failures I keep seeing remains the inability of organizations to act decisively on known unknowns.

That tension explains why many organizations delay action until external events force them to respond. Unfortunately, cybersecurity rarely rewards late action.

Leadership will determine who succeeds

Cybersecurity discussions still frequently focus on technology. I believe they should focus far more on leadership.

Technology will continue evolving. Threat actors will continue adapting. Regulations will continue expanding. Those developments are inevitable.

What remains within the control of every CEO is how their organization responds.

Does cybersecurity remain an IT issue? Or is it recognised as an integral part of business resilience?

How is cybersecurity accountability assigned at executive level? Or does it still rest largely with a CISO hidden in the organization?

Does the board spend sufficient time discussing resilience? Or does cybersecurity appear only when approving budgets or reviewing incidents?

These questions will increasingly determine organizational success.

The companies that navigate the next decade successfully will not necessarily be those spending the most on cybersecurity. Nor will they be those deploying the latest security technologies first.

They will be the organizations whose leadership recognises that cybersecurity has become a permanent business capability — embedded into governance, strategy, operational decision-making and organizational culture.

That transformation cannot be delegated. It begins with the CEO.

And perhaps that is the single biggest issue that should keep every chief executive awake at night: Not when the next cyber-attack will happen, but whether their organization is evolving quickly enough on those matters to meet a threat landscape that is changing much faster than the business itself.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

What is a business analyst?

Business analysts (BAs) are responsible for bridging the gap between IT and the business using data analytics to assess processes, determine requirements, and deliver data-driven recommendations and reports to executives and stakeholders.

BAs engage with business leaders and users to understand how data-driven changes to process, products, services, software, and hardware can improve efficiencies and add value. They must articulate those ideas but also balance them against what’s technologically feasible and financially and functionally reasonable. Depending on the role, a business analyst might work with data sets to improve products, hardware, tools, software, services, or process.

The International Institute of Business Analysis (IIBA), a nonprofit professional association, considers the business analyst an agent of change, and says that business analysis is a disciplined approach to introduce and manage change to organizations, whether they’re for-profit businesses, governments, or nonprofits.

Impact of AI on business analyst role

As AI becomes commonplace in the tech industry, business analysts are embracing it as a tool to automate repetitive work in the role. AI tools can be used for workflow and diagramming, process mapping, data analysis, and to automate meeting minutes and transcribe meetings where requirements are established, all designed to speed up the process of analyzing data, creating visuals, and transcribing and writing user stories and acceptance criteria.

AI tools can also help identify patterns, insights, and unique data points that might go unnoticed by humans, and allow a faster time to generate insights for organizations.

Of course, as with all AI tools, they still require humans to oversee prompts, scripting, and evaluate AI outputs to ensure they’re accurate and valid. While they can’t replace the work of BAs, AI can help them spend more time on thoughtful analysis and decision making, rather than mundane tasks such as gathering and summarizing data, and querying.

Business analyst job description

BAs are responsible for creating new models that support business decisions by working closely with finance and IT teams to establish initiatives and strategies aimed at improving revenue and optimizing costs. They need a strong understanding of regulatory and reporting requirements, and have plenty of experience in forecasting, budgeting, and financial analysis combined with knowing KPIs, according to Robert Half Technology.

According to Robert Half, a BA’s job description typically includes budgeting and forecasting, planning and monitoring, variance analysis, pricing, reporting, and creating a detailed business analysis in an effort to outline problems, opportunities, and solutions for a business. It also says BAs should be able to define business requirements and report them back to stakeholders.

Since BAs are tasked with prioritizing technical and functional requirements, identifying what clients want, and determining what’s feasible to deliver, the role requires a deep understanding of systems, how they function, who’ll need to be involved, and the necessary steps to get everyone on board.  

The role is constantly evolving, especially as companies rely more on data to advise business operations. Every company has different issues that a business analyst can address, whether it’s dealing with outdated legacy systems, changing technologies, broken processes, poor client or customer satisfaction, or large, siloed organizations.

Business analyst skills

The BA position requires both hard and soft skills, as they need to know how to pull, analyze, and report data trends, share that information with others, and apply it to business goals and needs.

Not all BAs need a background in IT if they have a general understanding of how systems, products, and tools work. Alternatively, some have strong IT backgrounds and less experience in business, but are interested in shifting away from IT into this hybrid role, which often acts as a communicator between the business and IT sides of the organization. So having extensive experience in either area can be beneficial for BAs.

According to the IIBA, some of the most important skills and experience for a business analyst are:

• Oral and written communication skills
• Interpersonal, organizational, facilitation, and consultative skills
• Analytical thinking and problem solving
• Being detail-oriented and able to deliver a high level of accuracy
• Knowledge of business structure
• Stakeholder and cost-benefit analysis
• Processes modeling
• Understanding networks, databases, and other technologies

For a more in-depth look at what it takes to succeed as a business analyst, click here.

Business analyst salary

The average annual salary for an IT business analyst is $80,692, according to data from PayScale. The highest paid BAs are in New York, where the average salary is 14% higher than the national average. Dallas, Texas, is second, with reported salaries 6.4% higher than the national average, closely followed by Washington, D.C., where salaries are 6.3% higher than the national average.

Some skills are in higher demand than others, with the potential to boost salary. According to Payscale, these are associated with higher BA salaries. These skills, and the amount they can boost your salary, include:

Skills	Salary Boost
ScrumMaster	44%
Microsoft Azure	30%
Supply Chain	27%
Oracle eBusiness Suite	25%
Master Data Management (SAP MDM)	24%
SAP Sales and Distribution (SAP SD)	24%
Product Support	18%
Microsoft Dynamics GP	18%
SAP Quality Management (SAP QM)	18%
Workday Software	15%

For tips on boosting your salary, click here.

Business analyst certifications

Although business analysis is a relatively new discipline in IT, a handful of organizations already offer certifications to help boost your résumé and prove your merit as an analyst. Organizations such as the IIBA, IQBBA, IREB, and PMI each offer their own tailored certifications for business analysis. These include:

• IIBA Entry Certificate in Business Analysis (ECBA)
• IIBA Certification of Competency in Business Analysis (CCBA)
• IIBA Certified Business Analysis Professional (CBAP)
• IIBA Agile Analysis Certification (AAC)
• IQBBA Certified Foundation Level Business Analyst (CFLBA)
• IREB Certified Professional for Requirements Engineering (CPRE)
• PMI Professional in Business Analysis (PBA)
• Certified Analytics Professional (CAP)

For more information about how to earn one of these certifications — and how much they cost — click here.

Business analytics tools and software

BAs typically rely on software such as Microsoft’s Excel, PowerPoint, and Access, as well as SQL, Google Analytics, and Tableau. These tools help BAs collect and sort data, create graphs, write documents, and design visualizations to explain findings. You won’t necessarily need programming or database skills for a BA position, but if you already have these skills, they won’t hurt. The type of software and tools you’ll need to use, however, will depend on your job title and what the organization requires.

What is a business analyst?

Business analysts (BAs) are responsible for bridging the gap between IT and the business using data analytics to assess processes, determine requirements, and deliver data-driven recommendations and reports to executives and stakeholders.

BAs engage with business leaders and users to understand how data-driven changes to process, products, services, software, and hardware can improve efficiencies and add value. They must articulate those ideas but also balance them against what’s technologically feasible and financially and functionally reasonable. Depending on the role, a business analyst might work with data sets to improve products, hardware, tools, software, services, or process.

The International Institute of Business Analysis (IIBA), a nonprofit professional association, considers the business analyst an agent of change, and says that business analysis is a disciplined approach to introduce and manage change to organizations, whether they’re for-profit businesses, governments, or nonprofits.

Impact of AI on business analyst role

As AI becomes commonplace in the tech industry, business analysts are embracing it as a tool to automate repetitive work in the role. AI tools can be used for workflow and diagramming, process mapping, data analysis, and to automate meeting minutes and transcribe meetings where requirements are established, all designed to speed up the process of analyzing data, creating visuals, and transcribing and writing user stories and acceptance criteria.

AI tools can also help identify patterns, insights, and unique data points that might go unnoticed by humans, and allow a faster time to generate insights for organizations.

Of course, as with all AI tools, they still require humans to oversee prompts, scripting, and evaluate AI outputs to ensure they’re accurate and valid. While they can’t replace the work of BAs, AI can help them spend more time on thoughtful analysis and decision making, rather than mundane tasks such as gathering and summarizing data, and querying.

Business analyst job description

BAs are responsible for creating new models that support business decisions by working closely with finance and IT teams to establish initiatives and strategies aimed at improving revenue and optimizing costs. They need a strong understanding of regulatory and reporting requirements, and have plenty of experience in forecasting, budgeting, and financial analysis combined with knowing KPIs, according to Robert Half Technology.

According to Robert Half, a BA’s job description typically includes budgeting and forecasting, planning and monitoring, variance analysis, pricing, reporting, and creating a detailed business analysis in an effort to outline problems, opportunities, and solutions for a business. It also says BAs should be able to define business requirements and report them back to stakeholders.

Since BAs are tasked with prioritizing technical and functional requirements, identifying what clients want, and determining what’s feasible to deliver, the role requires a deep understanding of systems, how they function, who’ll need to be involved, and the necessary steps to get everyone on board.  

The role is constantly evolving, especially as companies rely more on data to advise business operations. Every company has different issues that a business analyst can address, whether it’s dealing with outdated legacy systems, changing technologies, broken processes, poor client or customer satisfaction, or large, siloed organizations.

Business analyst skills

The BA position requires both hard and soft skills, as they need to know how to pull, analyze, and report data trends, share that information with others, and apply it to business goals and needs.

Not all BAs need a background in IT if they have a general understanding of how systems, products, and tools work. Alternatively, some have strong IT backgrounds and less experience in business, but are interested in shifting away from IT into this hybrid role, which often acts as a communicator between the business and IT sides of the organization. So having extensive experience in either area can be beneficial for BAs.

According to the IIBA, some of the most important skills and experience for a business analyst are:

• Oral and written communication skills
• Interpersonal, organizational, facilitation, and consultative skills
• Analytical thinking and problem solving
• Being detail-oriented and able to deliver a high level of accuracy
• Knowledge of business structure
• Stakeholder and cost-benefit analysis
• Processes modeling
• Understanding networks, databases, and other technologies

For a more in-depth look at what it takes to succeed as a business analyst, click here.

Business analyst salary

The average annual salary for an IT business analyst is $80,692, according to data from PayScale. The highest paid BAs are in New York, where the average salary is 14% higher than the national average. Dallas, Texas, is second, with reported salaries 6.4% higher than the national average, closely followed by Washington, D.C., where salaries are 6.3% higher than the national average.

Some skills are in higher demand than others, with the potential to boost salary. According to Payscale, these are associated with higher BA salaries. These skills, and the amount they can boost your salary, include:

Skills	Salary Boost
ScrumMaster	44%
Microsoft Azure	30%
Supply Chain	27%
Oracle eBusiness Suite	25%
Master Data Management (SAP MDM)	24%
SAP Sales and Distribution (SAP SD)	24%
Product Support	18%
Microsoft Dynamics GP	18%
SAP Quality Management (SAP QM)	18%
Workday Software	15%

For tips on boosting your salary, click here.

Business analyst certifications

Although business analysis is a relatively new discipline in IT, a handful of organizations already offer certifications to help boost your résumé and prove your merit as an analyst. Organizations such as the IIBA, IQBBA, IREB, and PMI each offer their own tailored certifications for business analysis. These include:

• IIBA Entry Certificate in Business Analysis (ECBA)
• IIBA Certification of Competency in Business Analysis (CCBA)
• IIBA Certified Business Analysis Professional (CBAP)
• IIBA Agile Analysis Certification (AAC)
• IQBBA Certified Foundation Level Business Analyst (CFLBA)
• IREB Certified Professional for Requirements Engineering (CPRE)
• PMI Professional in Business Analysis (PBA)
• Certified Analytics Professional (CAP)

For more information about how to earn one of these certifications — and how much they cost — click here.

Business analytics tools and software

BAs typically rely on software such as Microsoft’s Excel, PowerPoint, and Access, as well as SQL, Google Analytics, and Tableau. These tools help BAs collect and sort data, create graphs, write documents, and design visualizations to explain findings. You won’t necessarily need programming or database skills for a BA position, but if you already have these skills, they won’t hurt. The type of software and tools you’ll need to use, however, will depend on your job title and what the organization requires.

For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.

Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organizations continue to suffer major cyber incidents with alarming regularity. Every week seems to bring news of another ransomware attack, supply chain compromise or data breach affecting organizations that many would have assumed were well protected.

The obvious conclusion is that we are asking the wrong questions.

Too many executive teams remain preoccupied with the latest threat actor, the newest security product the CISO wants to buy or the latest vulnerability making headlines. Those issues matter, but they are not what should be keeping CEOs awake at night.

In my view, there are three far more fundamental issues that deserve the attention of every chief executive.

1. Corporate complexity, and the widening gap between business leadership and cybersecurity reality

Perhaps the biggest cybersecurity risk facing large organizations today is not technical at all.

It is the growing disconnect between executive perception and operational reality.

Many boards genuinely believe their organizations are reasonably well protected. They receive regular dashboards showing improving maturity scores, increasing compliance levels, falling vulnerability counts and reassuring traffic-light reports.

Unfortunately, cyber attackers do not read dashboards.

Behind those executive reports often lies an increasingly complex technology landscape, thousands of unmanaged digital assets, ageing infrastructure, rampant shadow IT, fragmented ownership, inconsistent governance and security teams struggling to keep pace with relentless business change.

The problem is rarely a lack of effort.

It is that corporate complexity has reached a level where traditional governance mechanisms are no longer capable of providing an accurate picture of organizational resilience.

Executives believe they understand the level of cyber risk they face because they receive regular reports. Those reports often measure activity rather than resilience.

Governance committees end up debating around another percentage point of phishing awareness or vulnerability remediation, while fundamental issues remain unaddressed in the background.

2. Organizational inertia, and the need for executive structure to evolve faster

Cyber criminals continue to evolve rapidly. Large organizations generally do not.

This is the second issue that should concern every CEO.

Throughout my career, I have observed organizations repeatedly responding to new cyber threats by adding another technology platform, another monitoring capability, another compliance framework or another governance committee.

Very rarely do they stop to redesign how cybersecurity operates.

The result is what I described several years ago as the “Cybersecurity Spiral of Failure”.

• As complexity and regulation increase, organizations invest in more security products.
• More products create more complexity.
• More products and greater complexity generate more alerts.
• More alerts require more analysts.
• More analysts produce more reports.
• More reports continue to build up executive confidence.
• Meanwhile, the underlying structural weaknesses remain largely unchanged, technical debt piles up and costs escalate.

And when the inevitable breach eventually happens, reality reveals itself, but distrust also sets in between senior executives and security teams.

This is not a funding problem. Nor is it a skills problem. It is fundamentally an operating model problem.

Many organizations continue trying to solve twenty-first century challenges using governance, accountability, organizational and reporting structures designed twenty-five years ago.

The cybersecurity function itself has evolved dramatically. Many executive structures have not.

This organizational inertia extends beyond technology: It affects budgeting cycles, investment priorities, procurement processes, accountability models and decision-making speed.

Cyber attackers innovate every day. Organizational change often takes years.

That imbalance should worry every CEO.

3. Accelerating technological disruption, and how it challenges organizations in areas where they are intrinsically weak

The third issue is potentially the most significant over the coming decade.

• Artificial intelligence, autonomous agents and machine identities
• Software supply chain complexity.
• Quantum computing, and post-quantum cryptography

Each of these developments represents far more than another technical trend.

Together, they fundamentally change the dynamics of cybersecurity.

Artificial intelligence is transforming countless business processes. At the same time, it is also increasing both the speed and sophistication of cyber-attacks while simultaneously transforming defensive capabilities.

Organizations have become increasingly dependent on software ecosystems that extend far beyond their own direct control. Engaging with the supply chain in ways that lead to a genuine appreciation of the risks involved has become a key challenge for most cybersecurity practices.

Quantum computing may eventually invalidate much of today’s cryptographic algorithms, forcing organizations into one of the largest technology efforts since Y2K — but without the benefit of a fixed deadline and faced by a problem that is considerably more complex and hyperconnected IT estates that have little to do with those of the late 90s.

None of these challenges can be solved overnight: They require clear governance, sustained investment over a few years and cross-functional organizational coordination.

Most large organizations are weak on those three fronts: This is precisely why CEOs should be focusing on them now.

Waiting until some of those risks become obvious will almost certainly be too late.

Businesses naturally prioritise immediate commercial pressures. Cybersecurity often involves preparing for risks whose timing remains uncertain.

But one of the greatest leadership failures I keep seeing remains the inability of organizations to act decisively on known unknowns.

That tension explains why many organizations delay action until external events force them to respond. Unfortunately, cybersecurity rarely rewards late action.

Leadership will determine who succeeds

Cybersecurity discussions still frequently focus on technology. I believe they should focus far more on leadership.

Technology will continue evolving. Threat actors will continue adapting. Regulations will continue expanding. Those developments are inevitable.

What remains within the control of every CEO is how their organization responds.

Does cybersecurity remain an IT issue? Or is it recognised as an integral part of business resilience?

How is cybersecurity accountability assigned at executive level? Or does it still rest largely with a CISO hidden in the organization?

Does the board spend sufficient time discussing resilience? Or does cybersecurity appear only when approving budgets or reviewing incidents?

These questions will increasingly determine organizational success.

The companies that navigate the next decade successfully will not necessarily be those spending the most on cybersecurity. Nor will they be those deploying the latest security technologies first.

They will be the organizations whose leadership recognises that cybersecurity has become a permanent business capability — embedded into governance, strategy, operational decision-making and organizational culture.

That transformation cannot be delegated. It begins with the CEO.

And perhaps that is the single biggest issue that should keep every chief executive awake at night: Not when the next cyber-attack will happen, but whether their organization is evolving quickly enough on those matters to meet a threat landscape that is changing much faster than the business itself.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Every CIO I speak with today is wrestling with some version of the same question: How do we move faster with AI and deliver on our commitments?

It’s an understandable concern. Boards and CEOs are asking about AI. Business leaders are experimenting with use cases. Employees are discovering tools daily, while technology vendors promise unprecedented gains in productivity, innovation, and competitive advantage.

After hundreds of conversations with technology executives over the past year, I’ve become convinced that speed isn’t the real issue. The organizations pulling away from the pack aren’t necessarily adopting AI faster than everyone else. They’re executing more effectively — a subtle distinction that represents one of the defining leadership challenges of the AI era.

Technology has never been the hardest part of transformation. People, priorities, culture, and operating models are the biggest challenges. The ability to translate bold boardroom aspirations into thousands of thoughtful decisions made every day by architects, engineers, product managers, analysts, and business leaders is where competitive advantage is created. AI may be accelerating the pace of change, but it hasn’t changed that fundamental truth.

I’ve met plenty of executives who are exceptional in the boardroom. They know how to frame a vision, influence a board, and build confidence among investors and business leaders. I’ve also met remarkable technologists who instinctively understand the architectural decisions, engineering tradeoffs, and implementation details that determine how great ideas become reality. Modern CIOs, however, must move comfortably between both worlds. Afshean Talasaz is one who stands out among this rare breed.

Long before becoming CIO of Colonial Pipeline, Talasaz built his career from the ground up as a business professional, data scientist, and technologist. He has designed enterprise platforms, built AI capabilities, led technology organizations, and partnered closely with executive leadership teams on business transformation. Today, as an executive in residence with our Practitioners for Practitioners (P4P) community, he helps CIOs and business leaders navigate one of the most significant technology shifts of our generation.

While Talasaz brings deep knowledge of data and AI to the table, his greatest strength is his ability to create strategy and connect it with execution. He can spend the morning discussing enterprise reinvention with the board and the afternoon debating architectural principles with the teams responsible for bringing that vision to life.

That versatility gives Talasaz a unique lens on how CIOs can deliver value with AI.

Software companies have a term for engineers who understand every layer of the technology stack: full-stack developers. Listen to Talasaz and it becomes evident that the AI era requires something similar from technology leaders: a full-stack CIO.

The full-stack CIO: Leading with clarity

A full-stack CIO understands how every layer of the enterprise influences the next. They recognize that every strategic priority becomes a portfolio investment, every investment shapes an operating model, every operating model influences architecture, every architecture choice informs product decisions, every product decision shapes engineering priorities.

The best CIOs understand both ends of that journey. The extraordinary ones understand everything in between.

And those who execute best lead with clarity, Talasaz says.

“Everyone, from executives to middle managers to the people writing code, should be able to explain what we’re trying to achieve,” he emphasizes. “Clarity isn’t that we’ve handed out the PowerPoint. It’s that people genuinely understand where we’re going and can articulate it in their own language.”

One of the unintended consequences of the AI boom is that organizations are beginning to confuse activity with alignment. They have AI councils, AI governance committees, AI innovation labs, AI centers of excellence, AI pilots, and AI roadmaps. Yet if you stop ten people in the hallway and ask a deceptively simple question, What business problem are we actually trying to solve? you’ll often hear ten different answers.

As a result, architects optimize for one objective while product teams optimize for another. Business units pursue opportunities that seem perfectly reasonable from their perspective. Engineers make thoughtful technical decisions based on the information available to them. Individually, none of those decisions are necessarily wrong. Collectively, however, they create organizational drift. AI doesn’t create that problem. It simply accelerates the consequences.

And while AI can be a force multiplier for the positive when every decision is guided by a shared understanding of where the organization is headed, it can also be a force multiplier for the negative, resulting in an organization simply moving faster in different directions.

“When we have the fundamentals right, the tech infrastructure, the operating models, the nuances of how our business actually runs, we get the impacts of AI in a positive way,” Talasaz says. “When we don’t have those in place, AI can amplify the gaps or mute the benefits.”

At a time when so much of the conversation surrounding AI is focused on algorithms, agents, and automation, it’s an important reminder that organizations don’t execute strategy; people do.

Reducing organizational friction

Most executives are familiar with the concept of VUCA that characterizes today’s business environment. But Talasaz stresses the importance of turning this concern inward: “If the world outside our organizations is becoming more volatile, uncertain, complex, and ambiguous, what are we, as leaders, doing to the inside of our organizations?”

Leaders spend enormous amounts of time helping their organizations respond to external disruption but comparatively little time asking whether they are inadvertently re-creating those same conditions internally in response to those external needs. Are we reducing uncertainty or introducing more of it? Are we simplifying work or adding unnecessary complexity? Are we helping people focus on what matters most, or asking them to navigate competing priorities and shifting expectations?

Talasaz refers to this phenomenon as double VUCA — something I’ve witnessed repeatedly while working with CIOs over the past decade. Organizations often assume they’re struggling because of technology limitations when the real constraint is organizational friction. Teams wait for decisions. Priorities shift faster than roadmaps. Governance grows heavier. New committees are formed to solve problems created by existing committees. Everyone is working harder, yet the organization somehow feels slower.

AI amplifies both outcomes. Organizations with clarity become dramatically more effective because AI accelerates good decisions. Organizations without clarity simply accelerate confusion.

Operating model as strategy enabler

AI governance is one way to achieve greater clarity, but as Talasaz says, governance shouldn’t primarily exist inside policy manuals that few people read.

Instead, AI governance should be embedded in the daily rhythms of the organization, shaping how teams collaborate, how decisions are made, how products move from ideas into production, and how innovation happens safely without requiring constant escalation. In other words, it’s all about your operating model.

“If you had to pick one thing that isn’t technology, your operating model is the most important element for executing data and AI at scale,” he says.

The best operating models create enough clarity that capable people can make thousands of decisions independently and confidently, without having to wait for permission. By embedding good governance into the way it works, the organization becomes faster.

This advice echoes something I’ve heard repeatedly from some of the world’s most respected CIOs: High-performing organizations aren’t built on tighter control; they’re built on greater trust, supported by clear principles, shared expectations, and operating models that enable responsible decision-making at every level of the enterprise.

Talasaz points out that technology leaders tend to speak in terms of transformation. He suggests CIOs consider a different word: reinvention.

As he explains, transformation implies replacing what exists today with something new. Reinvention starts with a more clear-eyed and practical premise: Some things absolutely must change; others represent years, sometimes decades, of accumulated expertise, customer trust, operational discipline, and competitive advantage.

Reinvention is about building on those strengths while also creating new ways to deliver value. The leaders making the greatest progress in their AI journeys seem to recognize that it’s less about abandoning the past than thoughtfully preparing the organization for the future.

Closing the gap between strategy and execution

Full-stack CIOs must be able to map out the various layers of execution and planning that need to be done at every level of the organization to be successful. To help with this, Talasaz has developed a data and AI framework that draws on his own experiences “from the keyboard to the boardroom.”

As Talasaz sees it, too many organizations have been doing good work in isolation. “They’re doing a lot of the right things,” he says. “They’re just not connected.”

Boards may be discussing growth while business leaders redesign customer experiences. Product teams may be prioritizing new capabilities while architects modernize platforms. Data teams may be improving quality while engineers focus on delivery. Every group makes meaningful progress within its own domain, yet somewhere between strategy and execution, the connective tissue begins to disappear. Talasaz’s framework brings those connecting points to the forefront.

Crucially, the framework doesn’t begin with technology or AI or even with data. It begins with the experiences the organization hopes to create for its customers, employees, or partners. Many AI initiatives start with the question, “What can this technology do?” And indeed, we need to be inspired by the possibilities and challenged to think differently by what the technology can do. But, Talasaz emphasizes, we also need to ask what experiences we need to deliver for our business and how the technology can make that a reality.

The framework challenges CIOs to answer that question first. Only after the experiences are clearly defined does the conversation move to the capabilities required to deliver it, the business activities that support those capabilities, the AI and data products that enable them, and finally the data foundation that makes everything possible.

This shift in perspective ensures that, rather than allowing technology investments to search for business value, the business experience defines the technology required to deliver it. For CIOs, that’s more than a planning exercise. It’s a fundamentally different way of leading.

Over the coming months, the P4P community will be convening a series of small CxO roundtables to explore these issues and work more deeply with Afshean Talasaz’s 6×6 Data and AI Framework. CIOs and other enterprise leaders interested in participating are welcome to reach out to me directly.

HireQuotient, an AI-native recruiting platform, today announced its integration with Paylocity (Nasdaq: PCTY), bringing AI-powered candidate sourcing and screening capabilities to Paylocity customers in manufacturing, building services, construction, healthcare and insurance, which are industries where deskless and frontline hiring has historically been underserved by AI recruiting tools.

Employers in these sectors who already use HireQuotient are seeing the impact firsthand.

“By simply putting in vetting criteria, I was able to get a very specific talent pool within a day,” said Niki Simoneaux, COO of Arc Health. “With EasySource, we can reach a huge database or filter for specific licenses and areas.”

“With technology and the ability to work remotely, we’re able to recruit nationwide outside of our footprint. This expands the pool of prospective candidates and gives us access to candidates who might not have ever applied for a position on our website’s career page,” said Jeff McGee, vice president at W3 Insurance.

“HireQuotient’s AI-native product helped my team at Alliance Building Services to cut down time to close position by more than 60%, and their team works very closely with the client to ensure adoption at scale,” said Willow Marcon, senior vice president at Alliance Building Services.

Recruiters in manufacturing, building services, construction, healthcare and insurance often spend more than two-thirds of their time on manual work and using over 10 platforms to just close a hire: sourcing a wide range of profiles, skimming resumes, finding contact information, reaching out and doing hundreds of calls and constant follow-ups. That fragmented process leads to recruiter burnout and leaves gaps in candidate data. Because most HR platforms don’t offer built-in AI native agents that work in tandem to do all it takes to close the hire, employers in these industries have faced hiring delays and platform churn.

The partnership addresses this gap by integrating HireQuotient’s EasySource platform directly into the Paylocity ecosystem. Instead of relying on rigid keyword searches, EasySource identifies strong talent pools, screens for role-specific credentials and licenses and personalizes outreach by phone and email. For mid-market companies with 500 to 1,000 employees, that translates to a 70% faster time-to-hire and an estimated $100,000 in annual savings.

The integration also closes the feedback loop for employers. By feeding post-hire data back into the recruiting system, EasySource learns from successful hires to build smarter talent pools over time, while keeping recruiters engaged longer by freeing them to focus on the human side of hiring.

Gokul Rajaram, board member at Coinbase and former board member of The Trade Desk (Nasdaq: TTD), and also known as the godfather of Google AdSense, said, “Smarthveer is one of those rare founders who picks an unglamorous, deeply underserved market and refuses to leave until it’s fixed. Frontline hiring is exactly that market. Being named to Paylocity’s elite partner network is a testament to his relentlessness and to the team he’s built. Excited for what’s ahead.”

“Paylocity maintains an elite partner network, so being named one of them is a testament to the strength of our product,” said Smarthveer Sidana, founder and CEO of HireQuotient. “By keeping that recruiting activity inside the Paylocity ecosystem, we’re helping them close a critical gap for their employers, capture revenue that previously sat outside their platform, and prevent the client churn that comes with a fragmented hiring process.”

Jim Moffatt, former global CEO of Deloitte Consulting and board partner at Greycroft VC, said, 

“This is a big milestone for Smarthveer and his team. I congratulate them on this big win. Paylocity’s large client base acts as a strong distribution, and HireQuotient’s EasySource acts as a strong product to cater to the needs of Paylocity’s clients. Paylocity is known for its highly selective approach, and I’m glad to see that after months of evaluation and extensive due diligence, they’re going live with HireQuotient’s EasySource. I feel confident in the value this partnership will create for frontline industries. I remember when Smarthveer spoke to me about it in December, and it felt very ambitious. I’m glad to see it turn to reality.”

For employers with a traditionally deskless workforce in industries where AI adoption has lagged, the integration bridges a major capability gap by allowing them to source, screen, onboard and manage payroll all in one place.

For more information, visit www.hirequotient.com.

A media kit with additional partner quotes, executive headshots and logos can be found here.

About HireQuotient

HireQuotient is an AI-native recruiting platform that automates candidate sourcing and screening for employers in manufacturing, building services, construction, healthcare, insurance and other frontline-heavy industries. Its flagship platform, EasySource, is one of a select number of recruiting technologies integrated with Paylocity’s HR and payroll ecosystem. Founded by Smarthveer Sidana, HireQuotient is headquartered in San Francisco. For more information, visit https://www.hirequotient.com/.

Media Contact

Bethany Rhodes

Uproar by Moburst for HireQuotient

bethany@moburst.com

Contact

Bethany Rhodes

bethany@moburst.com

Site reliability engineers (SREs) have the tough assignment of resolving thorny performance and reliability issues. But their primary mission is to provide devops teams with operational insights and to suggest implementation improvements on business system performance, security, and overall robustness.

Google introduced its SRE playbook in 2003, but it took some time for the role’s definition, tools, and techniques to become mainstream. Startups were the first to adopt observability for cloud-native applications and create dedicated SRE positions. As tools matured and SRE responsibilities became more clearly defined, larger enterprises assigned SREs to work as a bridge between devops and IT ops teams to improve resilience across a wider range of applications, APIs, and data pipelines.

SRE is a career path for multidisciplinary engineers with strong investigative instincts, sharp data analytics skills, and the temperament to perform under pressure. It has become a critical responsibility as tech became mission-critical for enterprises, and it is a growing role in the genAI era as more businesses deploy AI agents.

But the critical need for resiliency and greater technological complexity brings new challenges for SREs. According to the 2026 State of Production Reliability and AI Adoption report, 44% of respondents experienced an outage linked to ignored or suppressed alerts in the past year, and 35% report their engineers occasionally ignore or dismiss alerts due to alert fatigue. More than 70% of alerts received are not actionable, according to 57% of organizations.

So, is AI making the SRE’s role easier and helping businesses run more reliable technology operations? On the other hand, AI is also driving complexity, as companies deploy genAI tools and AI agents across more business functions and seek to automate more decision-making across operations.

AIops and agentic ops aid SREs

Over the past decade, SRE responsibilities have become somewhat easier through improvements in monitoring platforms, observability practices, tools for centralizing operational data, and AI applied in IT operations (AIops). But during the heat of resolving an outage or performance issue, it’s not easy to correctly identify what system triggered the issue versus other downstream systems impacted by it.

According to the Komodore 2025 Enterprise Kubernetes Report, 79% of production incidents originate from recent system changes, including deployments and changes to compute environments. But the other 21% of incidents stem from issues outside of the business’s control, including network failures, third-party changes, and cloud provider failures.

“SREs using AI capabilities succeed or fail in the moment an incident unfolds, when engineers are deciding what to investigate next,” says Itiel Shwartz, CTO at Komodor. “If the system streamlines root cause detection, connects signals to recent changes, and explains its reasoning in a way engineers recognize, it earns trust. If it adds uncertainty or demands extra validation, it gets sidelined, regardless of how bespoke the model behind it may be. What’s less obvious is what it takes to make AI for SREs work in production, and how different that reality is from prototypes, demos, or early internal builds.”

AIops is not a new capability, especially in using machine learning to correlate logs, metrics, and traces across monitoring and alerting systems. IT service management and SREs have been using AIops to reduce the mean time to resolve incidents and to perform accurate root cause analysis (RCA) efficiently. Agentic ops is the next wave of genAI operational capabilities, including tools for monitoring AI agents, managing their access rights, and detecting AI model accuracy drift.

 “AI is useful during major incidents because it can pull together a lot of context into a few clear sentences, which is exactly what an SRE needs in the moment,” suggests Shani Shoham, chief revenue officer at OpenObserve. “The complexity of architecture and the different tooling make it easier for AI than for a human, but autonomous resolution is still a way off.”

AI’s impact on people and burnout

The business pressure to keep systems up, secure, and performing well is a 24/7 stressful responsibility. According to The SRE Report 2025 from Catchpoint, 36% of SREs often or always experience elevated stress during an incident, and 28% said the stress persists even after the incident is resolved. AI capabilities may prove to be a game-changer in helping SREs avoid burnout and reduce stress.

“AI can improve RCA by taking in a much larger incident context than any engineer can hold at 3am, reasoning across traces, logs, metrics, deploys, config changes, alerts, ownership, and recent production behavior,” says Noam Levy, founding engineer and field CTO at Groundcover. “Beyond attempting a full RCA, its immediate value is distilling the signals that actually matter, reconstructing a clear timeline of cause and effect, and helping engineers separate correlation from likely causality. Once a fix is deployed, agents can also verify remediation by comparing pre- and post-fix behavior, but this depends on broad access to rich, correlated production signals and a cost model that does not discourage adoption or experimentation.”

Not only are incidents resolved faster and with less stress, but AI can also free up SRE time to focus on proactive work and create a career path for junior developers into SRE roles. Quais Taraki, CTO at EDB Postgres AI, adds, “AI reduces toil by automating repetitive tasks while accelerating incident resolution through copilots that correlate signals across distributed systems, allowing SREs to focus more on resilience strategies like chaos engineering and failure analysis.”

AI can have long-lasting operational impacts, especially for organizations looking to deploy more mission-critical technology and AI capabilities. Two longer-term benefits of AI for SREs are reducing the number of bridge calls needed for incident response and the number of engineers required in “war rooms” to coordinate root cause analyses.

“When something goes wrong, AI that guides SREs can do the full analysis, get to the root cause, and perform the remediation,” says Spiros Xanthos, founder and CEO of Resolve AI. “AI also helps avoid many escalations, and when escalations are needed, it targets the right people from the network, infrastructure, and the application teams. AI for SREs centralizes operational intelligence, exposes tribal knowledge, and can guide more junior developers.” 

AI agent reliability

While AI capabilities have been a net positive in helping SREs improve system reliability, the growth of AI code generators, vibe coding, and spec-driven development is adding to their workloads. According to one study, 41% of all global code is now AI-generated, and Gartner predicts that 40% of new enterprise production software will be created using vibe coding techniques by 2028.

But coding velocity is creating new issues for SREs as AI pull requests have 1.4 times more critical issues and 1.7 times more major issues, according to CodeRabbit. “AI-assisted development has created an unprecedented velocity of code reaching production, expanding surface area, edge cases, and failure rates faster than traditional SRE practices can absorb,” says Vinod Jayaraman, cofounder and CTO at NeuBird AI. “The speed of shipping has far outpaced the speed of understanding what breaks in production. To close this loop, SREs need enterprise agents that can capture precise diagnostic context, including correlated traces, service dependencies, and anomaly timelines, and structure it as actionable input for the engineers and AI coding tools responsible for the fix.”

The growing number of AI agents deployed to production creates new challenges. AI agents are not just code; they have multiple failure points. They are built using language models, connect to proprietary sources for context, and integrate with Model Context Protocol servers to support more complex workflows. Changes are ongoing and not deployment events, so the SRE’s job of identifying the source of performance and accuracy drifts isn’t trivial. 

“Traditional SRE was built for systems that fail in reproducible ways, but agents fail differently and drift when a model provider pushes an update, and behavior shifts silently with no baseline for comparison,” says Mohammed Aboul-Magd, vice president of product at SandboxAQ. “Most organizations can’t even answer the basics: how many agents are running, what they have access to, and whether they’re still doing what they were built to do.”

“Every time a senior engineer leaves, they take years of learned failure patterns with them, and the next outage starts from square one,” adds Ronak Desai, cofounder and CEO at Ciroos. “Using AI for compounding operational memory changes that, and every incident your system resolves, the AI learns it.”

SREs should take a leadership role in emerging best practices, including defining their standards for AI agent non-functional acceptance criteria, observability practices, and release-readiness criteria. SREs should update their service-level objectives (SLOs) and define error budgets for AI agents in production.

Ryan Downing, vice president and CIO of enterprise business solutions at Principal Financial Group, says, “Standard SLOs and error budgets give teams the guardrails, and AI helps interpret the telemetry against those targets, reducing noise so engineers can get to the real issue faster and automate parts of remediation before customers are impacted.”

AI raises the SRE’s business impact

The more dramatic shift in site reliability engineering is an evolution of its business scope. IT leaders focus on uptime, performance, and issue resolution, as well as understanding their impacts. Business leaders will look to IT and SREs to identify, determine root cause, and remediate a broader class of issues, including rogue AI agents and the impacts of rapidly deploying new agentic capabilities. 

“AI agents are handing SREs categories of problems they’ve never had to solve before, specifically failures defined in business terms, not technical ones,” says Blake Sherwood, distinguished technologist for AI and platform strategy at Smarsh. “Traditional reliability engineering is built around latency, errors, and crashes, but agents now fail due to skipped compliance steps or outcomes that looked fine technically but were wrong contextually. Most SRE teams aren’t wired for that yet.”

The question is whether SREs with AI-augmented tools can keep up with the velocity, complexity, and business urgency of deploying new AI business capabilities.

Major AI labs are unleashing forward-deployed engineers (FDEs) to try and grab enterprise customers. Large consultancies are dishing out tokens and assembling armies of consultants — both human and agent — to do the same.

But smaller firms are in the mix now, as well. AI is helping 28Stone Consulting, a New York-based, 230-person technology consultancy for capital markets, punch above its weight against larger rivals in the rush to deliver FDEs.

In this Q&A, Thomas Dolan and Frank Erickson, founders of 28Stone, argue that agentic AI isn’t a one-size-fits-all solution in vertical markets; success takes discipline, deep domain expertise, and human involvement to mitigate risk.

Many enterprises continue to struggle with the use of AI agents, which is consultancies are stepping in to get projects off the ground. 28Stone is among those that have published blueprints and methodologies on the development and delivery of agentic AI workflows with humans in the loop.

Computerworld spoke with both founding partners about why companies are still stumbling with agentic AI rollouts, and what a disciplined delivery process actually looks like.

After 15 years of delivering software for capital markets firms, is ‘AI-first’ a real distinction or just positioning?

Dolan: “We’re not shying away from being AI-forward. What needs to shine through is AI done intelligently — not stuff you get by buying some tokens for somebody on the trading desk. We’re an AI-first firm.”

Erickson: “And it’s temporary. At some point, AI is going to be synonymous with software development.

“The whole idea of an AI SDLC (software development lifecycle) versus an SDLC is going to be one and the same, a lot like cloud computing today. To not include AI in your strategy, you’d look like a COBOL vendor.”

What does agentic AI delivery look like?

Dolan: “We’ve got several AI initiatives delivering a pure agentic approach. We’ve doubled down on the human expertise wrapper in the SDLC. That doesn’t mean sacrificing any of the benefits of the AI models — quite the opposite.

“You don’t achieve anywhere near the same level of value from applying AI without keeping that expertise — industry, functional and technical — throughout the process.”

Where do humans stay in the loop once agents are doing the work?

Dolan: “We’re believers in starting with requirements discovery. Someone who knows the analytical nuances of a good business analyst is critically important; shaping a product owner’s business information through a markup file that can be fed into a BA agent, then treating the output as if it came from a very fast junior BA. Only then is the story complete.

“The developer takes that story, transforms it into the most efficient input, then owns the output, because they’re accountable for that code. A developer should own the code on both the input and output side.

“Your product owner, who knows the business, that’s great. But expecting them to interact with an agent and output enterprise code is ridiculous. It’s not a great plan.“

Why not just put one do-everything person in charge of AI and agents?

Erickson: “Every analyst, programmer or software engineer isn’t a great requirements analyst. And a great domain analyst with some technical background won’t know if the agent’s code is garbage, maintainable, performant.

“It’s unrealistic to expect one individual to have that breadth across domain, software engineering, testing, deployment. Clients ask all the time, and we push back: ‘Great, if you can find that guy, they’re few and far between.’ To deliver at the enterprise level, you need the human expertise, at depth.“

Dolan: “There’s system speed and latency, important in parts of finance. Then there’s speed of delivery, because other areas evolve quickly and time-to-market is critical.

“Our human wrapper may at first pass come across as a little slowed down. Maybe it is. But [Erickson] has a good analogy about one of the dangers of AI: you can end up going really fast in the wrong direction. By the time you look up, you’re way off base and have to backtrack.“

What about AI in your sector do you think is overhyped?

Dolan: “The hype around the ease of use of AI and the democratization of enterprise software delivery — that ‘anybody could do it now, it’s all being done by machines’ — is another idea that could prove costly in the long run.

“This do-it-yourself reaction is dangerous for clients, and for trust in the overall AI benefit, which is real. We compare it to the beginning of offshoring 20, 30 years ago: a golden idea that was going to cure everything. A lot of firms did it thoughtlessly, thinking it’s just labor arbitrage, and it almost inevitably failed. That all-or-nothing mentality missed that offshoring is an amazing way of getting better value for your dollar, but it has to be done thoughtfully, so the delivery process — the thing that ties it all together — stays unsevered.

“We’re seeing that now. I’ve heard, ‘We’ll just push a button, the machine’s building the system.’ The machine is not building the system. It might be writing the code, the story, running the tests.

The system is built by a team of engineers you bring in and trust. My fear is that people will say, ‘We don’t need this vendor or this technology team. I’ve got a product team. They might not be able to code at all, but they know the business,’ and it fails dramatically. 

“Then people say, ‘We played with AI, it’s not ready yet,’ and throw it all away. One of the best things we can do is ensure clients know the benefit is real.“

Erickson: “The hype can be summed up in a single phrase: vibe coding. That has done AI a massive disservice, because there’s a huge difference between vibe coding and enterprise software development, and some of the loudest proponents of AI are too latched on to it. In our industry, the only way to succeed would be a stable of unicorns. It just doesn’t scale. I get perturbed when our people internally refer to AI tooling as vibe coding; if they think that’s what they’re doing, they’re misunderstood.“

When you engage clients at different levels of AI maturity, how do you get them to a understand what works?

Dolan: “95% of our take on an agentic approach is in line with everyone else’s, but that 5% matters, especially in requirements discovery, in who’s giving the requirements and how they’re thought of. It can set you up for dramatic errors, given the speed at which you’re moving.

“There’s a dangerous human tendency we’re seeing among clients to try and cut corners at the start of a project and — in lieu of having deep, expert driven discovery sessions — just summarize what they may want using AI.

“We would hope our clients are collaborative, everyone understanding it’s early days. If a client insists on doing something we feel strongly against, like a product owner completely owning everything right up to code generation, that’s an issue we have to either push back strongly on or step out of the accountability for.“

AI body shops — LLM providers and giant consultancies — are emerging to help enterprises deploy AI. Does that model work?

Dolan: “Whether you’re partnering with an LLM or with an AI-first, generic software provider — ‘Hey, we’re not industry guys, but we know AI delivery’ — you end up, if you’re a bank or a broker-dealer, saying: ‘All right, we know our business, these guys know the AI side of it. What could go wrong? Put us together and we’ll have quality engineering.’

“The problem is what you miss: the know-how of putting industry and technical expertise together and actually delivering financial services systems. The people working at the generic delivery firms, whether an AI-only firm or a body shop somewhere, don’t have that capability.“

Does AI change the economics for smaller consultancies like yours competing against the big firms, and does it cut both ways?

Dolan: “Over our 15 years pre-AI, there were two recurring reasons we’d lose a project. One: ‘We’d love to work with you guys, given your subject matter expertise, but the costs just aren’t there compared to my budgets. I’m being forced to go to a body shop or an [offshore] delivery center.’ The other side of that coin: ‘We love your capabilities, but you’re a firm of 230 people and I need 300, 400 people.’

“AI changes the options for clients. You don’t have to sacrifice the niche vendor who knows your space just because you need a larger team or a cost target. AI levels the playing field and should allow smaller firms to compete with the larger, big-box generic firms, the Accentures of the world.“

Erickson: “It redefines what scale means. You can look at velocity as a measure of your cost to deliver, not a rate card. Scale can’t be defined in terms of headcount anymore. It’s got to be defined in terms of output.

“There’s a threat in it, too. If you’re an Accenture with hundreds of thousands of low-cost software engineers, how do you train all those people? I feel for them. But for us, a couple hundred people with a specific domain focus, it’s a huge opportunity.“

How has the profile of the people you and others hire changed with this agentic process?

Erickson: “You’re still looking for people with strong engineering and design backgrounds, and communication skills, because they interact across the software development lifecycle more than in the past.

“Many take too much joy in typing out perfect code. Sorry, I don’t need you writing for-loops and classes anymore. I need you reviewing them, understanding them, operating at a higher level. That’s a different kind of person: an engineer, not a programmer or a coder. On the [business analyst] side it’s similar: people took great pride in detailed user stories covering every path. Now it’s conversations, prompts, reviewing output — less doing, more interacting.

“More than ever, they have to be interested in the domain. They can’t just be, ‘I want to learn everything there is to know about Java.’ That’s too narrow. They don’t have to be an expert; they have to be interested. In our case, capital markets is a specific niche. The biggest challenge is getting familiar with the tools — finding time, while delivering for customers, to ramp up and make the mistakes you need to without jeopardizing projects.“

What about governance? Who’s keeping AI delivery and its costs under control?

Erickson: “This is evolving rapidly. People aren’t sure how to put governance around this. The most obvious is financial governance. People are starting to get hefty bills. One of our clients spent a million dollars on tokens over the last eight weeks alone. Sticker shock. The token-maxing policies are starting to show their flaws. It’s wild west still: learn on the fly, then figure out what needs to be governed.“

Are CIOs actually opening their wallets? And when they do, what’s the smarter way to invest?

Erickson: “There’s still a lot of caution. Forecasts keep going down on how long something should take. So: ‘I could wait three months and maybe still get it delivered by the same date someone’s promising me now, but for half the price. I’m going to wait and see when equilibrium is met.’ We haven’t seen the wallets open up like crazy — it’s slow adoption.“

Dolan: “One of our clients is looking at it from a productivity-boost perspective: instead of doing the same for less, I can do much more for the same. AI lets clients pull the trigger on things they wouldn’t have in the past — projects that might not have been approved pre-AI, where the costs have come down to a point that’s palatable with the business.“

Erickson: “And that’s the story we’re hoping to hear more of. There isn’t a huge cost anymore to exploring a business opportunity. The time and money that would have gone to a return-on-investment study could be spent on a proof-of-concept with AI, and the project done a few weeks later. Maybe [there’s] a hint of things to come, where decisions start being made quicker. 

“There’s a little fear on our side, though: a lot of tiny little projects is tough for a consulting business.“

Today’s CIOs must master a complex balancing act of maintaining operational excellence while enabling AI experimentation, modernizing legacy environments while accelerating innovation, leading workforce transformation while maintaining culture, and communicating fluently across boards, business units, customers, and technical teams alike.

Few leaders understand this balancing act better than former Verizon CIO Jane Connell. Over her career, Connell has helped some of the world’s largest enterprises modernize operations, reduce complexity, and transform how technology enables business value at scale. As a 2026 CIO Hall of Fame inductee, she is widely respected not only for operational excellence and strategic vision but also for her commitment to mentoring, workforce transformation, and preparing the next generation of leaders for a rapidly changing future.

On a recent episode of the Tech Whisperers podcast, we unpacked Connell’s unconventional leadership story and the playbook that has shaped one of technology’s most impactful leaders. In this exclusive interview after the show, edited for length and clarity, Connell shares more lessons from her Hall of Fame journey and why she believes the future of technology leadership will depend less on org charts and more on curiosity, credibility, and human connection.

Dan Roberts: When you think about preparing the next generation of technology leaders, what capabilities or mindsets do you believe will matter most in this next era?

Jane Connell: One is curiosity, or what I call the “why” factor: What do we need to do and why do we need to do it? It’s having a mindset of unlocking the art of the possible. You must be comfortable with what you know, what you don’t know, and asking the question why, because in this era of AI and where technology is going, it’s not about automating things you know; it’s about what you don’t already know, and what that unlocks. AI creates patterns and opportunities and re-engineers through its own intelligence, so there has to be a lot of instinct involved, and you’re going to have to understand and learn what it’s telling you.

I’m on the board of Rutgers, and one of the conversations we’re in with future leaders in education is that you don’t have those entry-level jobs anymore. They’re going to be AI. But those were building blocks for us. We came up the ranks and did those jobs, and that created the knowledge. [Future leaders are] not going to have that, so how do you create the foundation of knowledge — which is that art of asking why or what — to question if the bots or the patterns are biased or wrong. You’re not going to have the experience to rely on and say, “That’s wrong; I know that’s wrong because I did those. I know how this operates.”

Second is having humility and being comfortable in your skin — that you don’t know everything, but you’re going to learn it. You’re going to involve yourself with people. It’s about workforce structure, not organizational structure. Who do you need to talk to, and what do you have to find out?

I also believe followership is going to be huge, because the way work gets done is not hierarchical. It’s going to be engineered based on the process and AI. You have to create followership of people working together, and they’ve got to want to work with you. This isn’t going be “you work for me, do as I say.” Followership is going to be a key skill for influencing and organically having that kind of impact, versus someone with authority.

With that is the accountability to have high integrity, be credible, and be a person someone would trust. Because all this is going to break down the hierarchy of authority, you have to bring that human side and be a really good leader, which means people want to follow you, they trust you, they want to work with you, and they know you’re going to take them to a better place.

One recurring theme throughout your career has been your ability to bridge deep technology expertise with strong business acumen. Why is that combination becoming even more critical in the age of AI and digital transformation?

You can’t impact anything tech-alone. It all resides on having business acumen and then having the technical ability to know how to use tech to solve the problem, not the other way around.

At the root of all this is every company’s Achilles’ heel: the data. Access to data has been a privilege — those who have it, those who don’t. Now you’re bringing structured and unstructured [data] together for these AI models to work, and that’s a new skill set that requires you to know the business inside and outside.

You also have to stay externally relevant and know where innovation is coming from. And you’re going to need to know how to architect that into the way your company goes to market, which requires you to know the business processes, how it runs, and how it could run.

That’s the role of leaders moving forward, immersing yourself in the problems the business needs to solve. There’s no boundaries there. It’s not what department you report in and what process you own. It’s seamless. That’s the duality people need to command and grow into.

Looking back on a career that spans multiple industries with different operating models, cultures, and regulatory environments, what were some of the most important calculated risks you took in terms of your growth?

There were two pivotal moments in my career that were the biggest risks but probably my biggest gains in growth. One was when I went into a full-time tech role and ran infrastructure. I was a fish out of water, and not the likely successor. Part of the reason I did it goes back to a something we talked about on the podcast: Well, why not me? And I want more. That’s just my tenacity.

It was during the dot-com days of the late 90s, early 2000s. It didn’t matter if you were the CEO or a board director, if you didn’t know tech and you didn’t understand how to wield it, you were never going to be successful. I knew that no matter what job I may want in the future, I had to know tech. So it was a calculated decision: I’m going to jump into tech.

Some very senior supply chain leaders who controlled my career told me, “You’re going to fail, and I’ll have a safety net for you when you come back.” Well, I didn’t fail and I never went back. That pressure was there, but I knew why I was doing it. This wasn’t just a job for ego’s sake. This was, I have to know tech. The future is tech. It’s kind of like AI now.

The other pivotal moment was changing industries. I left Johnson & Johnson at a great time. We had gone through a huge transformation, started our global services organization, and the perfect moment happened for me to retire early there. I didn’t know what I wanted to do. It was the first time I took a break in my career to let the world come to me instead of me planning it. Do I want to open a business? Do I want to consult? Do I want to stay retired? I was fortunate enough that I could, but I got bored.

The financial industry wasn’t on my radar. Coming out of healthcare, with the purpose and the connection with saving lives, helping people, it’s easy to connect to. Financial wasn’t, for me. But one of the executive search firms said to me, when you interview, the biggest question hanging over your head is going to be, could you be successful elsewhere because you grew up in J&J. You had advocates, you had influence, you knew the industry. It’s like your deck was stacked for you. Could you do all that when you’re a nobody coming off the street?

So when the CIO role opened at State Street, I interviewed — and talk about being your authentic self. I had already done all this transformation, I already knew the outcomes, I knew everything I did was always enterprise and always end-to-end transformation. And because I wasn’t really vying for the job, I was having this conversation with the CFO and saying, “Here’s what your organization is lacking, here’s the noise you’re going to hear, do you really have the appetite for it?” And “I’d like talk to the COO and see if they’re ready to hear this about the value chain. I may not know your problem yet, but I guarantee it’s one of these three things.”

I was testing their advocacy of, do you really want to transform? Are you ready? Because you have to own this. I can’t take accountabilities for your organizations. I can help you get there. I’m an enabler for you, but you have to own it. And it was a very different interview. By the end of it, I loved Ron [O’Hanley, State Street Chairman and CEO] and his whole team. I took the job on the leadership and the person more than the industry, and it was very successful.

I followed the same recipe when I went to Verizon. Those were big growing moments. They were risky, they were very uncomfortable, but it was the biggest growth that I’ve ever had.

Whether it’s a tough message to the C-suite, a difficult conversation with peers, or helping teams make sense of uncertainty and change, you tell people the truth in a way they can hear it. How can other leaders develop that ability to take people on the journey, especially when the message isn’t easy?

Skirting a problem is not the way to solve it. I’ve never been the person to say what you want to hear. I’ll tell you how you get there, and I’ll get you the results you want, but I’m going to be super honest because I want to manage the expectations of what we have to achieve.

What I’ve learned as a leader is to take accountability. Say what you’re going to do, then do it, and if you hit a roadblock, be the first to call it. That gets you access, because people see it as a calculated risk. Anybody in the C-suite has resources and budget, but the earlier you signal and don’t waste money and resources, the more access to people and resources you will have.

The greatest lesson I learned from one of the leaders in my path was: If you can’t say it in an elevator, and you can’t say it on one slide, you’re talking too much. So, think about it as one slide: What is it you need? What are you going to achieve? What are the risks? What are you taking accountability for? How will you measure it? It doesn’t matter what the message is when you can be that succinct. You’ve got them laser-focused on what it is. You gave them just enough of the periphery to know how you got there, and then it’s their belief in you that you can do it if they give you the money and resources, because that’s what you’re looking for.

It sounds so simple but putting things together succinctly is hard work. You have to take all the unnecessary noise out, and keep the conversation focused. You don’t want their mind wandering, wondering where is she going, or what are they doing? Give it to them upfront and tell them what you need.

You’ve spoken about entering corporate environments early in your career feeling intimidated by people with more traditional credentials or educational backgrounds. What advice can you give rising leaders about battling imposter syndrome?

Take the time to figure out what makes you uncomfortable, what makes you feel like an imposter, or what in that meeting you dread going in where you’re not acting like yourself. Are you more quiet than usual? Are you not asking the question you’d normally ask? Figure out what those issues are, and then address the things that make you uncomfortable. I went to college later because that bothered me. Those credentials do matter. So I addressed it and got my degrees and certifications.

The other thing is to find people you trust, people whose opinion you respect, and bring them on the inside of what you’re working on. Maybe it’s dealing with a difficult business partner. You may not particularly want to be friends with them, but you’re going to have to work with them. Find the people that work effectively with them. You do this with high integrity — this is not about talking about that person — but find the allies that work with them. Nine times out of ten, they feel the way you do, but they found a way to work with the person. Pick their brain. Bring them in the fold and say, “I need this alliance. I can’t get there, and quite frankly, I know I’m resisting because maybe I just don’t like them. How did you get there?”

People are generous. Ask their opinion, ask how they’re showing up. “Am I creating the trigger? Is there something I’m doing in that meeting or in that room that I’m not coming out with a decision or whatever I needed?”

The greatest gift is feedback. There’s feedback you do something with, and there’s feedback you don’t, but either way, it’s a gift. Somebody’s giving it to you. It’s not personal; it’s business. And those things really help build your confidence and leadership style.

In an era increasingly shaped by automation and disruption, Jane Connell believes the most enduring competitive advantage may come from something deeply human: the ability to inspire confidence, curiosity, resilience, and possibility in others. For more advice from this Hall of Fame CIO, tune in to the Tech Whisperers podcast.

See also:

• Mastering the chess of IT leadership today
• Developing a customer-first culture for IT
• Coherence: Where leadership and AI success intersect

A few years ago, I was retained to conduct a digital risk review for the chief executive of a mid-sized financial services firm. The brief was standard. Assess what was publicly available about the executive, identify exposure and advise on remediation. The AI tools I used completed the substantive reconnaissance in under ten minutes.

What came back was a synthesized profile. Board memberships and the dates they started. A pattern of public commentary that revealed which policy positions the executive held strongly and which ones he would likely bend on under pressure. A philanthropic interest that explained which causes he would respond to if someone framed an ask around them. None of this information was sensitive in isolation. But assembled into a single, queryable narrative, it was something an attacker could use immediately.

What I was looking at was a publicly accessible query to a general-purpose AI tool. And that is the problem most executive protection programs have not yet confronted. The reconnaissance phase for a targeted social engineering attack now takes minutes, not days, and the inputs required are trivial.

AI-aggregated executive data has become an attack surface. Most security programs have not yet adapted to it.

The reconnaissance phase has effectively collapsed

Traditional OSINT work against an executive target required skill and patience. A competent analyst could build a useful profile over several days by working through search engines, corporate filings, social platforms and archived media. That work was a meaningful barrier. It took time and it required judgment about which sources to trust. It also left trails if the attacker was careless.

AI aggregation removes all three constraints.

The speed advantage is obvious but it is not the most important change. The more significant shift is synthesis. A search engine returns documents. An AI tool returns a coherent narrative with inferred relationships and interpreted significance. When I query a major AI platform for a senior executive by name, I get a structured account of their career arc, their professional relationships, their areas of visible influence and frequently their personal interests, relationships and public-facing affiliations.

The MGM Resorts incident reported in 2023 illustrated the principle at scale. Attackers reportedly identified an MGM executive on LinkedIn, used that public profile information to impersonate them in a call to the IT help desk and obtained access credentials within minutes. The OSINT required was minimal and the manipulation was straightforward. What AI tools have done since is make that kind of reconnaissance faster, more complete and available to actors who lack the manual tradecraft to run it themselves.

As the Verizon Data Breach Investigations Report consistently documents, the human element is present in the majority of confirmed breaches, and social engineering remains one of the most reliable initial access vectors.

The accessible nature of AI tools is also expanding the threat population. Attacks that previously required a skilled analyst to design now require only a motivated actor with internet access. That changes the volume and targeting calculus. Executives who were previously too obscure to justify a sophisticated manual attack are now viable targets for anyone with a grievance and a query box.

What should CIOs and CISOs do about it?

The instinct in many organizations is to route anything involving an executive’s public profile to the comms or PR function. That instinct made sense when the risk was reputational. It no longer covers the exposure.

What follows is how I advise clients to structure this work.

Monitor regularly

The starting point is establishing visibility into what AI tools are actually returning about your executive population. Not a one-time audit conducted during a board meeting and forgotten. The profiles shift continuously as new content is indexed, old content is reweighted and the models are updated.

Assign ownership to run structured queries across the major platforms, including ChatGPT, Gemini, Perplexity and the Microsoft Copilot stack, on a regular cadence. Document what you find and track changes. Treat the output the same way you would treat a vulnerability scan as something to be prioritized and acted upon.

Reduce the available attack surface

Work with each executive to identify content that expands their AI-indexed profile without serving any legitimate business purpose. This includes legacy conference bios that contain personal details, social posts that reveal schedule patterns or family context and board announcements that, in aggregate, map an executive’s full professional network. For some of this content, removal is possible and worth pursuing with a targeted effort.

The more important conversation is around future behavior. Executives who habitually overshare on LinkedIn or in conference panels need to understand, concretely, what that sharing enables.

Family member exposure is a consistent blind spot. An attacker who cannot pressure an executive directly may look for leverage through a spouse, a sibling or a child. Executives rarely consider their family members’ public digital footprint as part of their own security posture. It is.

Shape the narrative where reduction isn’t possible

Public company executives, board members with mandatory disclosure obligations and individuals whose public profiles are central to their organizations’ credibility cannot simply go dark.

The objective shifts from reduction to shaping in these cases. The goal is to ensure that what AI tools synthesize from the indexed content is professionally bound and does not inadvertently surface high-value pretext material. This is a joint exercise between security and communications, with security defining risk boundaries and communications executing the strategy.

Train executives on what their own profile looks like

The most effective single intervention I have seen in executive briefings is also the simplest. Open a browser and query an AI platform on the executive in the room. Let them see the output. The reaction is consistent. They are surprised by the synthesis, uncomfortable with specific details that surface and immediately more engaged with the rest of the conversation than they were before.

Abstract threat briefings about social engineering risks rarely land with senior leaders who feel they understand their own security position. Demonstrated evidence of their AI-mediated profile lands every time. As covered in the context of executive-targeted attacks, awareness is a prerequisite for the behavior change that makes protection programs effective.

Integrate this into the executive protection program

This work belongs alongside endpoint security, credential management and physical protection in a unified executive protection program. When it remains a communications function, it lacks the reporting structure, budget authority and operational discipline that security work requires.

Assign an owner with a security mandate. Include AI exposure in the risk register. Report on it at the same cadence as other executive protection metrics. The organizations that have done this well have not created a separate program for it. They have extended an existing one.

What effective executive protection programs now include

The organizations that have integrated AI exposure into their executive protection work share a few characteristics that distinguish them from those still treating it as a communications edge case.

• They treat the executive’s public information footprint as a managed attack surface with a named accountable party. Someone is responsible for it, the same way someone is responsible for endpoint patching or identity governance.
• They include AI-assisted reconnaissance as a starting condition in red team exercises. Before any social engineering simulation begins, the red team runs the same queries an attacker would run. The pretext they design is based on what those queries return.
• Their executive protection briefings include an AI profile review as a standing agenda point. Physical security considerations, credential exposure and public information risk are reviewed together because they are connected. An attacker who knows an executive’s schedule from their public-facing content can time a credential reset attempt or a vishing call with equal precision.

The executive I reviewed several years ago had no idea what his AI-indexed profile contained or what it enabled. Most of the executives I work with today are in the same position. By the time you finish reading this, it is likely those queries have already been run on someone in your organization. The question is whether your program is positioned to detect it and respond in time.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The model of the forward deployed engineer is sweeping through enterprise IT like a gold rush, and I’m concerned that many companies don’t understand what they’re signing up for.

Let’s start with the headline numbers. AWS announced a $1 billion investment in a new Forward Deployed Engineering organization. Google Cloud committed $750 million to expand similar programs. Microsoft has been running Azure-focused embedded engineering teams for years, including partnerships with Accenture to scale forward deployed engineering practices. All three are pitching the same story: We’ll send engineers to work directly with your teams, help you deploy AI, and accelerate your digital transformation. You get top-tier technical talent for free, and we get to partner with you on your journey.

It sounds reasonable on the surface. It sounds collaborative, even generous. But I’ve been in this industry long enough to know that when a multi-billion-dollar company offers you something for free, they’re sure to get much more than they give.

What you actually get

The forward deployed engineer model isn’t new. The consulting industry has been doing some version of it for decades. What makes this different is the scale and the direct financial incentive behind it.

These engineers work for the cloud provider. They’re not your employees. They’re not independent consultants. They’re technically excellent professionals who are being paid to solve your immediate problems while simultaneously building relationships and architectures that favor their employer’s ecosystem. Think about it from their perspective. Those forward engineers are evaluated on whether customers succeed with their employer’s platform. They’re rewarded when enterprises adopt more services from that platform. Their career advancement depends on making AWS, Google Cloud, or Microsoft Azure the obvious choice for all of your technical decisions.

This isn’t a criticism of the individual engineers. Many of them are genuinely talented and genuinely want to help. But they’re operating within a system that rewards specific outcomes, and those outcomes align with the vendor’s financial interests, not necessarily yours.

The problem no one talks about

Here’s what I see happening at enterprises right now. A company decides they need help deploying AI. A cloud provider offers to embed engineers at no additional cost. Those engineers work alongside internal teams, make architectural recommendations, and help build out systems. Six months later, the company has a production AI system running on a single cloud platform, built by people with deep expertise in that specific platform.

The problem? Nobody evaluated whether that platform was actually the best choice for the business. Nobody looked at alternatives. Nobody asked whether a multicloud architecture or best-of-breed approach might deliver better results at lower cost.

The engineers embedded in these programs are not going to recommend that you split your workloads across providers. They’re not going to suggest you use open source tools where they make sense. They’re not going to point you toward a competitor when their employer’s solution will work well enough. That’s not how these programs are designed to function. What you’re getting is optimized architecture for a single cloud brand, not optimized architecture for your business.

The financial reality will hit

The bills are going to come due, and they’re going to be painful. I’ve watched this pattern play out before. When enterprises lock into a single cloud provider through these embedded engineering programs, they often discover two or three years later that they’re paying premiums that their more independent-thinking competitors avoided.

The reasons are straightforward. When you’re architecting systems around a single platform, you naturally fall into usage patterns that favor that platform’s pricing structures. You use their managed databases instead of portable alternatives. You adopt their AI services instead of evaluating third-party options. You build workflows that only work within their ecosystem. And when it comes time to renegotiate or benchmark against alternatives, you find that migrating would cost more than accepting whatever pricing they offer.

I’ve spent the past decade helping companies untangle from these situations. I’ve seen organizations with cloud bills 15 to 20 times higher than they should be, unable to migrate because their entire AI infrastructure is built on proprietary services that only work on one platform. The forward deployed engineer programs are accelerating this problem. They’re making it easier to get into these situations and harder to get out.

Think before you commit

Before you accept one of these programs, consider these three recommendations.

First, require independent architecture oversight from day one. Hire or engage architects who work for your company, not for your cloud provider. They should evaluate every recommendation made by embedded engineers against business requirements and compare options across providers. This isn’t about being suspicious of the engineers. It’s about ensuring that decisions are made with your interests in mind.

Second, demand a clear exit strategy before you begin. Ask the cloud provider to document which proprietary services you’re using, what migration paths exist, and what the cost would be to move to an alternative platform. If they can’t provide that information, or if the migration costs seem impossibly high, that’s a sign that you’re building technical debt that will be very expensive to service later.

Third, benchmark your costs continuously. Set up internal processes to compare your cloud spending against industry benchmarks and against what your competitors might be paying for similar workloads. Don’t wait until your contract renewal to discover that you’re paying premium prices. Monitor expenses from the beginning, and be willing to challenge your cloud provider if you’re not getting value that justifies the cost.

The bottom line

The forward deployed engineers are solving real problems. Enterprises genuinely struggle with AI deployment, and having experienced engineers available to help is valuable. I’m not suggesting these programs are fundamentally bad. However, they’re being marketed as neutral partnerships when they’re actually strategic sales programs designed to lock enterprises into specific platforms. The helpful engineers showing up at your office are building dependencies that will be very difficult to break. The “free” technical assistance is being funded by margins on services you’ll be buying for years.

Go in with your eyes open. Use these programs but add your own independent oversight. Build architectures that you could leave if you needed to. And don’t let the immediate satisfaction of having problems solved today blind you to the financial consequences that will arrive tomorrow.

This is Part 2 of a series on tech worker unionization. See Part 1: “A brewing battle: More IT workers want unions. The industry doesn’t.”

The best time for tech workers to unionize was 20 years ago, when they had plenty of leverage. The second-best time is now, when they don’t.

Mass layoffs, AI-driven displacement, corporate surveillance, workplace disillusionment have created conditions that have made organizing compelling for tech professionals. But the federal labor board that has historically protected workers’ right to organize has been weakened, and the companies that once feared it are openly defying it.

Here’s how organizers and labor experts describe the pros and cons to organizing — and how you can get started.

What unions can — and can’t — do for you

The single biggest benefit of a union contract for most tech workers isn’t pay — it’s protection against arbitrary termination, especially in the wake of recent mass layoffs in tech. In the United States, nonunion “at-will” workers can be fired at any time without a stated reason, while unionized workers negotiate protections written into their contracts.

“That fear of the company letting you go for anything at any time…with a union they just can’t do that,” says Zak Thompson, a senior software engineer at Kickstarter and union steward at Kickstarter United. Now that Kickstarter employees are unionized, people are less worried that saying something negative will result in termination.

“I’ve been shocked at the willingness of my co-workers to speak up against what they see as poor or controversial business decisions,” Thompson says.

Beyond job security, unions can deliver concrete material gains. Kickstarter United was formed in 2020, although getting there wasn’t easy: two employees were fired during the organizing campaign — which itself became a galvanizing event. And while the union hasn’t been able to prevent layoffs, it did negotiate better terms: four months of severance pay and four to six months of continued health insurance, versus the two to three weeks per year of work that management had initially proposed.

Other benefits include a four-day work week; AI protections; a minimum pay floor; and standards for raises, promotions, and time off for the company’s 59 employees.

Unions can give tech workers a voice in decisions that affect their daily work — including how AI tools are deployed. “Nobody I’ve spoken to is against new technology or getting trained in it,” says Max Belasco, a business systems analyst at the University of California Los Angeles School of Law and co-chair of the UCLA chapter of the University Professional and Technical Employees/Communications Workers of America (UPTE-CWA) Local 9119.

“But when new technology is being implemented, we want to know: what’s the five-year vision, the 10-year vision? Are we implementing this in a way that betters staffing, increases efficiency, or eases the lives of people already working? Or are we trying to take away jobs, automate people out of their pension or paycheck?” Belasco says.

The challenges are real. Tech professionals are less inclined to leave their jobs in the current market because wages haven’t been increasing as fast as they once were, and it can take longer to land another job.

“Tech moved from a very tight labor market in 2022 (1.85% unemployment rate) to a noticeably weaker one in 2024–2026 (3.49%),” although that’s still better than the national unemployment rate of 4.36% through May of this year, says Liya Palagashvili, senior research fellow and director of the Labor Policy Project at the Mercatus Center at George Mason University.

Flexibility is a concern. The more substantive challenge, raised by economists including Palagashvili, is that traditional union contracts impose uniform terms across an entire bargaining unit, limiting the flexibility that many tech workers — and their employers —currently enjoy. Tech firms need to move fast, adjusting teams, products, and roles on the fly.

“Collective bargaining agreements can make those adjustments much more difficult, whether by making them slower, costlier, or inconsistent with the contract,” she says.

Workers skeptical of unions in a survey of 1,900 tech professionals conducted by the career site Blind cited specific concerns: that unions are “not meritocratic,” “prevent innovation,” and “hold back earnings of top performers.”

Thompson from Kickstarter United pushes back: “We have nothing in our contract about ‘you can’t bend down and pick up a piece of trash because that’s someone else’s job.’ The company is free to give bonuses and individual raises as much as they like. This is all just up to the people who are bargaining the contract from the union side.”

Organizing carries potentially serious personal risks. During negotiations for a second three-year contract in 2025, Kickstarter United went on strike for 42 days. A few months later, the company announced layoffs.

“They let go strong union leaders, including a person who had bargained our last contract,” Thompson says. The union appealed, and the issue is now going to arbitration.

If you form a union, don’t expect much support from the National Labor Relations Board, the agency that certifies US labor unions and protects workers’ right to organize, in terms of prosecuting complaints of unfair labor practices, Thompson warns. “We’re in a political moment in this country with a pretty weakened NLRB. You have to be ready to organize and withhold worker power without any guarantee of safety.”

Organizers are up against an enormous union avoidance industry. Organizers can expect fierce pushback as soon as the business discovers that organizing is underway.

“There’s a multi-billion-dollar industry in union avoidance,” says Alan McAvinney, a Google software engineer and organizing chair, Alphabet Workers Union-CWA, a 1,400-member minority union of Alphabet employees. (Google is a subsidiary of Alphabet.)

US employers spend roughly $1.7 billion a year on union avoidance consultants and law firms, according to a May 2026 report by the Economic Policy Institute and LaborLab.

Expect hardball tactics. Management may play hardball during the time between when organizers announce their intention to unionize and the actual vote. For example, management can threaten to fire foreign-born workers in the US on H-1B visas if they support the union. Those workers would then have just 60 days to find a new sponsoring employer or lose their H-1B status, according to a recent Tech Workers Coalition blog post.

And at venture capital-backed startups, investment agreements sometimes require management to attest there is no union activity — meaning a public organizing drive can trigger funding withdrawal. Or, if a unionized company is acquired, the new management can dissolve the union overnight by reclassifying unionized workers as new hires.

With these sobering facts in mind, here is how organizers who have done it describe the process of creating a union.

Step 1: Start a conversation with your co-workers

At the University of California, a two-tier system had evolved where some tech workers were unionized and some weren’t, Belasco says. Management created new titles that fell outside the union even though they had similar job descriptions and responsibilities to those in the union. Those nonunion employees received lower pay and benefits than their unionized peers, which created resentment and instability.

Belasco and other organizers wanted to eliminate that division by bringing everyone under the same contract. But when they began their unionization drive, “the biggest barrier we faced wasn’t management opposition — it was that people felt this was just the best-case scenario realistically available: ‘We have this job at the university, we have concerns about automation and layoffs, but what can we really do about it?'” he says.

The antidote to that fatalism, organizers say, is simple: “Just start talking to your immediate co-workers. Are they experiencing the same challenges you are experiencing?” says McAvinney. “There’s no need to start talking about a union at this point.”

Just get a consensus and start building a group of like-minded individuals, Thompson advises. “Always start with one-on-one conversations, and that’s what you should do the whole time. That’s the key to organizing,” he says.

Tech workers often think they’re a special case, says Thompson, and therefore that unionization isn’t a good fit. “You’re not special. You are a company of workers, you are organizing, and there is a playbook for that. Trust the process, because it tends to work pretty well,” he says.

Step 2: Who’s on board, and who’s not? Map your workplace, but keep it quiet

Once there’s a consensus, continue to grow your network. Keep a list of everyone you’ve spoken with and note their disposition: “Is this person union-friendly or anti-union? Would they be a strong organizer?” Thompson says.

Maintaining secrecy early on is essential, because anti-union tactics will start immediately, and that can stop union organizing before it can gain momentum.

“Generally, employers do not want to share power with their workforce,” McAvinney says. Employers will deploy every means at their disposal to stop organizing efforts and peel away potential yes votes.

“If you look at historical examples, having 70% approval before the employer finds out about you results in a high percentage of wins when you actually cast the vote. Historically, that’s an effective buffer,” he says.

There’s a real threat of firing and layoffs. The traditional tech worker belief that job mobility makes collective action unnecessary is now being tested by a tighter job market, McAvinney says, noting that workers who many believe were fired for speaking out back in 2019 were a galvanizing factor in his union’s formation.

“You generally don’t want to be in a situation where the employer feels comfortable firing everyone. Part of that is thinking from a cynical standpoint about what the consequences would be to the employer if they did fire everyone,” he says.

One-on-one conversations that include personally asking co-workers to keep conversations confidential are key to keeping things quiet, Belasco says. When 2,100 UC tech workers voted to unionize in May, 96% voted in favor. To stay out of earshot of managers, avoid employee surveillance tools, and sidestep conference calls that could be recorded, organizers met with workers in their homes.

“That tactic is probably what made the difference between winning the election and getting the majority we got,” he says.

Step 3: Find the right union affiliation or go it alone

“Running a campaign against major employers requires the resources and expertise of the larger labor movement, even if workers publicly present as independent,” says Kate Bronfenbrenner, director of labor education research and senior lecturer emeritus at Cornell University’s School of Industrial and Labor Relations.

Options include the Communications Workers of America (CWA), Service Employees International Union (SEIU), and the Office and Professional Employees International Union (OPEIU), among others. Another resource, the Tech Workers Coalition (TWC), provides training on organizing tactics, AI-in-workplace issues, and contract negotiation, and can match workers to the right unions for their needs.

The Alphabet Workers Union decided early on to affiliate with CWA. “They gave us a bunch of support early on in our campaign with no strings attached,” McAvinney says.

Kickstarter is organized through OPEIU, Thompson says. “They’ll usually have resources and staff that can help you through the next steps: collecting signatures in support of a union, bringing that to management, holding a vote — the more formalized things that interact with US labor law. They’ll also help with organizing along the way,” he says.

For workers at institutions where a union already exists, there may be a faster path. Organizers at UCLA did what’s called a “unit modification,” aligning with UPTE. By organizing under UPTE, the workers didn’t have to negotiate a new contract from scratch — they joined an already-negotiated contract covering existing UPTE tech members, which put them in “a much stronger position” than starting fresh, Belasco says.

Step 4: Choose your union model: majority vs. pre-majority or minority

Assess what’s practical for your organizing effort. In a majority union, more than 50% of all workers in a defined bargaining unit must vote to join the union through an NLRB-supervised election in the private sector, or a Public Employment Relations Board (PERB)-supervised election for public sector workers.

The NLRB must certify the union, which then operates under its legal protections. This means, for example, that the employer must bargain, negotiated contracts are enforceable, violations must go to the NLRB or arbitration, and workers can’t be dismissed without just cause.

A pre-majority or minority union is a minority labor organization operating without NLRB protections or collective bargaining agreements. “Pre-majority means that workers are able to demonstrate majority support — through signed cards, petitions, a walkout, or everyone wearing solidarity T-shirts — without going through a formal election,” Bronfenbrenner says.

The Alphabet Workers Union-CWA (AWU-CWA) formed as a pre-majority union because achieving majority status across a globally distributed workforce of over 100,000 was not a realistic near-term goal. “An underground model where you try to reach 70% support across a workforce of over 100,000 people isn’t realistic,” McAvinney says.

A pre-majority union can still make a difference, he says. For example, the Alphabet Workers Union-CWA convinced management to offer voluntary exit packages — buyouts — prior to announcing layoffs.

For smaller organizations, a majority union may be the more practical option — it’s more attainable, McAvinney says. “I don’t think [the pre-majority union model] is the correct thing to do in all situations. I certainly would not recommend it to a 200-person shop.”

Kickstarter, which had fewer than 100 employees, was able to form a majority union, with 55% voting to organize.

Ultimately, says McAvinney, “there’s no inflection point where you go from being able to win nothing to winning everything, even with a contract and a supermajority. But the more people you have who are willing and able to fight for what they want, the more you’ll be able to get.”

Step 5: Who should — and should not — be in your union?

Belasco’s situation at UCLA illustrates a broader strategic choice that every organizing campaign must make. He had been in a union position in educational technology when he was told his role would be reclassified as a non-union position.

“I was given a choice: apply to the new non-union position to continue doing the work I’d trained for, or stay in my union position doing service desk work I wasn’t used to,” he says. “Essentially, it was a choice between job security and career progression.”

Belasco joined a “wall-to-wall” union, which represents a broad range of university professional and technical employees across the UC system rather than a single job category, such as engineers or tech professionals.

Kickstarter United is another example of a wall-to-wall union. “It’s not just the engineers who are unionized, but also customer support, designers — everyone,” Thompson says.

Wall-to-wall unions are more powerful, but they’re also more difficult to achieve. Under US labor law, “professionals have to vote separately on whether they want to be combined with other workers,” says Bronfenbrenner. “You can never have a wall-to-wall unit without giving professionals the chance to decide whether they want to be separate.”

The law’s “professional employees” category includes roles like software engineers and developers but not necessarily others. For example, customer support specialists and QA analysts would fall into the “non-professional workers” category.

“For decades, the pattern was either to organize everybody except the engineers, or manage to organize the engineers and fail to bring in everybody else — neither of which builds real worker power,” says Simone Robutti, an organizer with Tech Workers Coalition Global, an international branch of TWC based in Berlin.

Step 6: You won the vote. Get ready for what comes next

Winning a union vote means having a seat at the table, says Thompson. “Once the workers have come together and agreed they want that seat, you bring that to management, and they have a chance to voluntarily recognize a union,” he says.

But in most cases employers contest the results, which must be certified by the NLRB or PERB. That process, in which the employer uses various tactics to challenge the legitimacy of the outcome, can take weeks or months.

Unfortunately, the legal framework that is supposed to protect workers during this process has been significantly weakened in the last few years. In a potentially more ominous development, SpaceX, Amazon, Trader Joe’s, Starbucks, and the University of Southern California have in separate legal actions challenged the constitutionality of the NLRB, arguing that the agency’s structure violates the separation of powers. The Fifth Circuit Court of Appeals upheld injunctions against the NLRB in SpaceX’s case in August 2025 — a serious challenge to the agency’s authority.

In the meantime, some companies may disregard negotiated contracts, which can lead to lengthy legal appeals or extended arbitration.

“The NLRB can still force an election, but it can’t force a contract, and companies are saying they simply won’t comply,” Bronfenbrenner says. This is where the expertise and resources of affiliation with a major union can help, she adds.

As a result, contract negotiations can take far longer than workers might expect. At Kickstarter, for example, two years and four months elapsed from the time of the union vote to the first contract, and that was at a 59-person company with a relatively cooperative employer. At larger companies with more aggressive legal teams, the timeline will be longer.

Forming a union is hard work, Robutti says. “It’s not a service you pay for and they protect you. It doesn’t happen spontaneously, and it doesn’t happen magically. It’s the choice to take responsibility for improving your workplace.”

Security engineers play a pivotal role in enterprise cybersecurity, because they are the professionals who design, build, and deploy security systems to protect an organization’s data, applications, systems, networks, and other IT components against a variety of cyber threats.

Finding not just qualified security engineers, but the best and brightest available, needs to be a priority for CISOs and others overseeing security at their organizations. That’s especially true with the rapid rise of AI and the threats that brings to the enterprise.

Here are some of the key skills and traits of elite security engineers to look for when hiring — or to acquire in order to uplevel your cybersecurity career.

Acumen with AI-powered tools

These days, AI-related skills are in demand regardless of domain, and this certainly applies to security engineers. There’s a wealth of solutions leveraging AI in the market, tools that engineers can add to their defense arsenal.

“AI is transforming security engineering from reactive alerting to predictive threat detection,” says Praveen Margabandhu, digital engineering anchor at financial services firm Navy Federal Credit Union. “AI-driven anomaly detection now identifies behavioral patterns that indicate fraud or compromise before traditional threshold-based systems would fire. This shifts the security engineer’s role from incident responder to threat model designer.”

AI-powered tools have taken over a large portion of the detection and triage work that used to be the core of a security engineer’s day, says Maruf Ahmed, cofounder and CEO of global tech staffing firm Dexian. “Vulnerability scanning runs on its own now,” he says. “Threat flagging that used to require a team pulling through logs for hours happens in minutes.”

This has freed up capacity on most security teams and changed what the day-to-day work looks like, Ahmed says. “With detection increasingly automated, the engineer’s value sits more in interpreting what gets flagged and deciding what to do about it,” he says.

Keen understanding of emerging and established AI threats

Engineers must also have a thorough understanding of the risks AI presents, including AI-enhanced cyberattacks using large language models (LLMs) to automate and scale highly personalized social engineering attacks, craft sophisticated malware, and generate deepfakes.

Other AI threats they need to be aware of include prompt injections, data and model poisoning, disclosure of sensitive information, model theft, supply chain compromises, and excessive agency.

“The same generative tools that help security teams work faster are available to adversaries, and it shows,” Ahmed says. “Phishing campaigns read better and land more precisely than they did a year ago. Social engineering is harder to catch when the language is polished and tailored to the target, and security engineers are now defending against threats built with the same class of technology they use on the defensive side.”

That has raised the bar for what reliable detection looks like, Ahmed says. “The objective shift I hear most from clients is about trust in their own systems,” he says. “Two years ago, the priority was visibility — making sure you could see across your environment. Most organizations have that now. The harder problem is knowing whether what those tools are telling you holds up under scrutiny and having people on the team who can stand behind those findings in front of a regulator or a board.”

Appreciation of performance and business goals

The best security engineers understand how performance and security intersect, says Margabandhu, who leads performance engineering across Navy Federal Credit Union’s digital banking infrastructure, including real-time fraud detection, identity and access management, and cybersecurity infrastructure resilience.

“A fraud detection system that is secure but too slow to catch transactions in real-time is not secure at all,” Margabandhu says. “Elite engineers optimize for both simultaneously.”

Engineers must be able to put things in business context, Ahmed says. “An engineer who can work across domains, validate AI outputs, and learn new tools fast is valuable. But that value compounds when the person also understands what the organization is trying to protect and why,” he says.

Security engineers who understand the business make better risk decisions, write more effective policies, and generate less friction with the teams around them, Ahmed says. “That is the profile employers are hiring toward right now, and it is where the talent shortage is most pronounced,” he says.

Systems mindset

“One of the biggest misconceptions in cybersecurity hiring is that elite security engineers are defined purely by technical certifications or tool familiarity,” says Juan Mathews Rebello Santos, an independent cybersecurity researcher and ethical hacker.

“Technical skill absolutely matters, but the strongest engineers I’ve worked with consistently share a combination of analytical thinking, operational adaptability, communication ability, and deep systems understanding,” Santos says.

Elite security engineers understand how infrastructure, cloud services, identity systems, applications, APIs, networks, users, and business operations connect, Santos says.

“Modern attacks rarely target a single isolated component anymore,” he says. “Threat actors chain together weaknesses across environments. Engineers who can understand those relationships holistically are significantly more effective at both prevention and incident response.”

Cross-disciplinary fluency and broad stack know-how

Being an elite software engineer today means having a range of technology experience and knowledge. “Organizations want engineers who can work across more of the stack than they used to,” Ahmed says. “A role that might have asked for deep specialization in one area now expects someone who can move between cloud infrastructure, application security, and compliance without needing a handoff at every boundary.”

The attack surface has continued to get wider, and the job descriptions for security engineers has followed suit. “That cross-domain fluency matters because security incidents rarely stay contained in one layer,” Ahmed says. “The engineer who can follow a problem from the network through the application to the data governance framework resolves it faster, with fewer people involved.”

The strongest security engineers bridge infrastructure, application, and business domains, Margabandhu says. “They can speak to a CISO, a developer, and a cloud architect in the same conversation,” he says. “An engineer who can explain what an authentication problem means for fraud exposure moves faster in a room full of executives than one who can only describe it in infrastructure terms. I’ve watched technically brilliant people lose that race repeatedly.”

Having the ability to communicate technical risk clearly to non-technical leadership can mean the difference between success and failure of attacks.

“Many security failures today are not caused by lack of tooling, but by misalignment between technical teams and business decision-makers,” Santos says. “Elite engineers can explain operational risk, prioritization, and security tradeoffs in language executives understand.”

Deep understanding of third-party risk and non-human threats

Threats can come from anywhere, including supply chains and non-human combatants. Third-party cybersecurity risks are on the rise. The 2026 Global CISO Leadership Report by executive search firm Hitch Partners, based on a survey of more than 625 information security executives across the US and Canada, says 43% put third-party risks as the No. 1 priority.

“Most teams are still better at securing what they own than securing what they depend on,” Margabandhu says. “The mental shift from perimeter thinking to dependency thinking is real and not everyone has made it. The engineers who treat every API call, every credentialed vendor, every third-party model as part of their attack surface approach design differently.”

Another growing source of potential threats are not human. Machine identities now outnumber human identities by ratios exceeding 100 to 1 in most enterprise environments, with some sectors closer to 500 to 1, according to the ManageEngine Identity Security Outlook 2026 report.

This includes service accounts, API keys, automation tokens, and AI agents, any one of which can present data governance and security risks.

Many organizations are still managing machine identities through manual processes that weren’t designed for scale, Margabandhu says. “Engineers who understand non-human identity governance are rare and increasingly important. This is not a future problem.”

Willingness to keep learning

Security engineers need to have a desire to never stopped learning.

“That sounds obvious until you work with people who’ve been doing this for 15 years and are still operating from the same threat models they built in 2012,” Margabandhu says. “Security changes fast enough that standing still is the same as going backwards.”

The security engineers who keep up aren’t reading one report a year. “They’re genuinely curious about what attackers are doing right now, this month, and they adjust how they think accordingly,” Margabandhu says. “That quality is harder to hire for than most technical skills, because it’s not on a resume.”

With AI presenting new and more sophisticated threats, keeping up with the latest developments is perhaps more important than ever. “Strong engineers are naturally investigative,” Santos says. “They actively study attack techniques, test assumptions, reverse engineer failures, and continuously adapt their understanding of risk.”

The best security engineers are often the people who remain intellectually uncomfortable because they know the landscape is always evolving, Santos says.

Employers have started paying closer attention to how fast someone can learn, Ahmed says. “The threat landscape and the defensive toolkit are both moving faster than any certification program can track, so hiring managers are probing for adaptability in interviews: how candidates have responded to recent shifts, whether they have picked up unfamiliar platforms on their own, how they work through problems they have not seen before,” he says.

A few weeks ago, a new hire at Aviator, fresh out of college, asked me a question I didn’t have a clean answer to. How do I become a senior engineer, or even a staff engineer? What should I learn, and how?

It’s a fair question and a harder one to answer than it was just a year ago.

The path used to be well-known. As a newly hired junior software engineer, you were given an experienced mentor who would assign you simple tasks to learn the ropes. You’d write some code, ask plenty of questions, open a pull request, get feedback in code review, think about it and fix your code. Rinse and repeat that a few hundred times. The tasks became more complex; the feedback got shorter and along the way you’ve been building judgment, the thing that separates a senior engineer from a junior one.

Now AI writes most of the code. The loop looks different and the easy assumption is that it’s broken: fewer tasks for juniors to cut their teeth on, an agent fixing the code that another agent wrote, thinner path to judgment.

Mentoring got easier, not harder

I knew just the person to ask: how do we grow senior and staff engineers in the AI era? Adam Berry is a staff engineer at Netflix, a member of The Hangar, our community of engineering leaders, and someone I have been discussing the evolving role of code review and knowledge sharing for a while now. He spends his time on getting AI adoption right, rather than just fast, in their engineering organization and has been working out the question of growing new engineers in practice. Mentoring juniors in an agentic world, Adam says, isn’t harder; it’s embarrassingly easy.

“You grow juniors and help them become better engineers the same way you always did. AI isn’t changing the methodology. It’s changing the details,” he told me. His point is that the agentic world gives a lot more options for giving juniors bounded tasks to work on and more feedback. The scattered remarks and comments seniors used to give in person now can be put into instructions and guardrails.

Adam breaks working with agents into three foundational skills:

• If you don’t know how to do something with the agent, ask the agent.
• If the agent does something you don’t like, figure out how to correct it and then codify it so it doesn’t happen again.
• Your sense of when the agent has gone off the rails.
  
  

“Most juniors can pick up the first two on their own. On the third one, they need guidance, he says.

His process for building it is staged. “The stages are about growing scope. First, you give a junior engineer a well-specified task—and these are now bigger than what you’d have given a junior before. You can give them task definitions that are like a prompt and instructions to drive that prompt, make sure they got to a good plan, make sure they understood the plan, and that they thought through the test cases, etc.

Then gradually you peel off some of that specificity so they have to build the muscle themselves. Once they’ve gotten good at that level of scope, they’re ready to work on larger scoped problems.”

Starting from more specific problems and going towards ambiguous problems is the definition of growing as an engineer.

Pair programming with the agent in the room

Seniors can still do pairing sessions with juniors, now with the agent in the room.

“In the pairing session, the earlier-career engineer should be the one driving. The agent can be set up to interrogate the junior rather than just answer them. None of you is manually writing code, but you’re still doing pair programming and mentoring. Even if it’s just a trivial bug fix, if you guide a junior through it, it forces them to do just that little bit of thinking.”

Adam says mentoring juniors today does not have to mean forcing them to write code manually. Seniors should teach them the process of agentic engineering, and that’s exactly what they should focus on during the pairing sessions. The habit he wants to be installed early is asking for options instead of answers.

“I aim to teach juniors to ask for options and think through them, even on small tasks. I ask them to explain what their input to the AI tool was that led to the code they got. But I’d also show them how I would have done the same thing.”

The pairing produces artifacts as it goes. “That’s where you get into conversations of, ‘This is why that wasn’t quite it for me,’ and if I see that that’s not baked into the repo, I’m going to add this into the ADR, into the design, into the instruction set. I’ll codify that so the junior gets it too, and they know why it exists, because they watched me go through it with the tool myself.”

That reshapes the code review instead of removing it. Making that work puts more on senior engineers, not less. “Senior engineers need to ensure that things like ADRs, or whatever system you use, are properly encapsulated in the repo for both the agents and the humans to consume.” His team also attaches the prompts to the pull request and has the agent summarize what it did against what the prompt asked.

Adam also teaches junior engineers how to bring in expert sources from outside into AI tools. He’ll point an agent at a book like Michael Feathers’ Working with Legacy Code as an example of what quality code looks like and have it work from the concepts directly.

Don’t outsource the thinking

His arguments make sense, but I also recently came across research examining the influence of AI tools on how and why members of software engineering teams interact. Their finding was not surprising: of the 131 surveyed developers, 51% said they now ask GenAI for technical help they once would have asked a person, and 62% said it was easier to ask GenAI without fear of embarrassment.

When a junior gets stuck now, their first move usually isn’t to message a senior on Slack. It’s to ask the agent. This is also the case in code reviews. The purpose of code reviews was always knowledge sharing as much as it was a quality gate. What I see junior engineers do now is take the feedback and, without reading it closely, hand it straight to the agent to resolve. The part where they would have to understand how their work differed from what the senior expected disappears. It got passed from the reviewer to the agent, and the junior skipped the understanding.

This isn’t really the junior’s fault. They need the motivation and the space to do it differently, and the default pattern under delivery pressure is to push the thing out and worry about it later.

The same research showed that developers turned to colleagues with questions about context (65% to clarify business logic or requirements, 50% for how something had been done before).

Respondents were also aware of the trap that Berry’s approach was created to avoid: AI tends to hand back a single answer, compared to multiple perspectives a colleague surfaces and they kept seeking teammates for context-specific expertise, mentorship and plain social connection.

The fix is almost mechanical: if you have to make a choice, you have to think about it. I do this in my own product thinking. Most of it happens by bouncing ideas off Claude, but whenever something is complex, I make myself lay out a few options, trade them against each other and decide which direction to take. That’s the same move Berry wants juniors making, and it’s what builds judgment, whether you’re twenty-two or forty.

Why we should still hire juniors

There’s also a hiring question underneath all of this. We recently hosted Kent Beck, an industry legend, at the Hangar in a session we called “Juniors FTW,” and his reasoning was that the industry is being remade fast enough that being new is an advantage. Juniors are too new to have absorbed what everyone “knows” is impossible, which leaves them less biased, more creative and carrying fewer preconceived mental barriers.

Beck also wrote about how important it is to hire juniors without the calculation of how many tasks they can perform.

“If all we cared about was today’s productivity, we wouldn’t have hired you at all. Instead, we (the seniors) are focused on the future: we know there’s going to be far more work here than we could possibly accomplish. We are paying your salary now as the option premium on the engineer you will become. If we play this game right, we’ll have a kick-ass next generation of engineers. If not, we’ll have to be doing the same engineering jobs ten years from now, and we really don’t want to be doing that.”

The pipeline is thinning

The trend is running the other way. Entry-level hiring at the 15 biggest tech firms fell 25 percent from 2023 to 2024, according to a report from SignalFire. In a recent survey of engineering leaders, a majority said they plan to hire fewer juniors, on the logic that AI lets seniors cover more ground.

That logic is short-sighted in a specific way. Senior engineers don’t appear from nowhere. They’re the juniors someone hired five or ten years ago and invested in mentoring them. Stop hiring and growing juniors now, and the gap doesn’t show up this year. It shows up later, when the industry needs people with the judgment that only comes from years of making mistakes and recovering from them and finds it stopped producing them.

So, here’s the answer to the question that the new hire asked: the path to senior and to staff is the same path it always was. You grow the range of ambiguity you can handle, and you stay honest about the part you can’t handle yet. What changed is the interface. The agent writes the code. Your job is to keep asking questions to your colleagues and the agents and keep doing the thinking until the thinking is good.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

I attended several major technology conferences in 2025 where the first AI agents embedded in enterprise SaaS platforms were announced. Some of these agents showed promise and a glimpse into the future of work, while others looked like natural language extensions of a platform’s existing functionality.  

At the end of 2025, Anthropic and OpenAI launched new AI models and code-generating capabilities. More developers tried vibe coding, and some platforms launched spec-driven development capabilities. By February 2026, even The New York Times reported that the AI disruption had arrived, noting that code generators were building “apps that may be flawed, but credible.”

Wall Street investors took notice of the code-generation improvements and other disruptive factors, driving a selloff in SaaS stocks, now referred to as the “SaaSpocalypse.” Part of their concern stemmed from the belief that CIOs would use AI to write software that would replace SaaS solutions.

AI innovations from SaaS and solution providers

But I thought differently and wrote a response in my article asking whether AI is the end of SaaS as we know it. CIOs might use AI to accelerate application modernization, but I doubt they would replace their ERP, CRM, and even smaller SaaS point solutions by building them.

Instead, I believed it would be SaaS companies that would take the most advantage of AI code-generation capabilities.

This hypothesis drove me to attend nine conferences this spring to see how SaaS companies were launching AI agents and defining a new future of work. I wrote eight articles on what CIOs need to know about data management, agile organizations, marketing, ERPs, critical process management, and other evolutions to plan for in the AI era.

Now, looking across all nine conferences, I can draw some conclusions about how AI agents are shaping the future of work. Here are my learnings and what CIOs need to consider when evaluating and deploying AI agents in the workplace.

Agentic, human-in-the-middle, or augmenting human?

SaaS companies have very distinct perspectives on the future of work, including the extent to which humans will play which roles and whether and how quickly we’ll see agentic, fully automated work.

For example, Atlassian proclaimed, “step into the future of human-AI collaboration,” while SAP unveiled “the autonomous enterprise.” Snowflake aimed to “make AI real for business,” while Appian targeted “serious AI built on process.”

These vendors’ marketers had to decide whether to lead with AI, people, or business in their messaging, but so must CIOs as they contemplate their AI strategies and how to get employees to fully adopt AI agents.

Some CIOs see a fully automated agentic AI as the future, with human-in-the-middle as a transitional phase as departments build trust in AI agents’ decision-making and automation capabilities.

Other CIOs see AI more as a tool that delivers productivity improvements by augmenting human decision-making capabilities. Many of these CIOs see human augmentation as essential to supporting critical thinking, innovation, and creativity.

Deloitte’s State of AI Report, published in January, provides a benchmark. It states that 36% of IT leaders expect at least 10% of their jobs to be fully automated in the next year, and 82% expect to reach that benchmark in three years.

Many organizations will have a mix of AI agents, choosing automation where reliability at scale is possible, but opting for human augmentation in operationally critical or customer-facing domains. But how CIOs position AI agents is not only an operational strategy; it’s also a cultural statement that shapes employees’ embrace of AI and whether detractors vocalize job-loss fears.

In the short term, it will also weigh in on which AI agents to use from different partners and which areas to build in-house.

Many options to test and deploy AI agents

Many solution providers are demonstrating significantly more AI agents this year. For example, SAP went from 40 Joule Agents in 2025 to over 200 in 2026. Three technology capabilities are fueling this significant growth:

• Adobe, Appian, Boomi, Cisco, Domo, Salesforce, SAP, Snowflake, and others offer data fabrics and data-pipeline capabilities to connect data sources outside the primary workflows supported by their platforms. Appian, Pega, Quickbase, and SAP also centralize business process automation, an important starting point for developing AI agents.  
• MCP servers enable integration and communication between AI agents and are used to facilitate multistep agentic workflows. Virtually all the companies announcing major investments in AI agents are also announcing MCP integration capabilities and related partnerships.
• Solution providers are not just using AI code-generating capabilities; many are launching their own AI agent development tools. The first beneficiaries of these development tools are the solution providers themselves and their integration partners, who use them to accelerate the development of AI agents and make them available to customers.

The result is that CIOs will have many options about which agents to test, but will have to dedicate analysts to understand the capability, cost, and compliance trade-offs. Additionally, expect AI agent capabilities to evolve significantly over the next few years, so CIOs should continuously revisit their decisions regarding deployed AI agents, focusing on performance, benefits, and ROI.

CIOs should also watch for signs of shadow AI and employee confusion about which AI agents to experiment with on different platforms. The AI strategy should include a transparent, defined process for selecting, reviewing, evaluating, procuring, deploying, driving adoption, monitoring, and collecting end-user feedback around AI agents.

AI development capabilities for engineers and citizen builders

The apparent ease-of-use of AI code generators may lead some engineering teams to build AI agents rather than buy them from SaaS providers. But CIOs should quickly realize that coding is just one step in developing AI agents, and that aggressively pursuing a build strategy can lead to AI debt and increased AI costs.

DevOps teams can code AI agents using tools such as Claude, Codex, Lovable, and Replit — a do-it-yourself approach. Some SaaS companies are providing an alternative, with AI agent development tools that leverage the data, infrastructure, and governance baked into their platforms. Many of these development tools offer flexibility, allowing developer teams to select AI models and development environments.

Examples of new and enhanced AI development tools I saw at conferences this quarter include:

• Appian Composer and Agent Studio
• Atlassian Rovo Dev
• Boomi Companion
• Cisco Cloud Control Studio
• Domo App Catalyst
• Pega Infinity Studio
• Quickbase Pave
• Snowflake CoCo
• SAP Joule Studio.

I also reviewed Nutanix Agentic AI, a platform-as-a-service for accelerating the deployment of agentic AI workloads, and Adobe Firefly AI Assistant for creatives.

These development tools can target different audiences. Some look like low-code development tools targeted at software developers, whereas others are no-code and enable citizen developers, i.e., businesspeople, to develop applications and agents. Additionally, some of these tools support spec-driven development and generate artifacts such as product requirement documents (PRDs), data models, and testing capabilities.

Before commissioning AI development for apps and agents, CIOs should sponsor proofs of technical, data, modeling, security, and governance capabilities.

The context layer powering AI agents

Between AI agents and the enterprise’s intelligence, including structured data sources, defined business processes, and agent interactions (both human-to-agent and agent-to-agent), lies an evolving “context layer.”

This layer refers to the enterprise knowledge that AI agents draw on when evaluating signals and recommending or taking actions. Context may include a knowledge graph, a semantic layer, cleansed document repositories, and other knowledge bases.

The context layer, skills, tools, out-of-the-box agents, and governance capabilities are some areas to review where solution providers differentiate. Some examples: 

• Many support the Open Semantic Interchange, and some brand their context layers, such as the Atlassian Teamwork Graph, Boomi Knowledge Hub, and the SAP Knowledge Graph.
• Some are branding their guardrails, such as Adobe’s AI Brand Intelligence, Appian’s Private AI, and Quickbase AI Control Center.
• To manage AI agents at scale, some are extending the notion of data catalogs and other governance tools to the AI domain with products such as Boomi Connect, SAP AI Agent Hub, and Snowflake Horizon Catalog.

CIOs should recognize that while solution providers will compete on capabilities, the real “secret sauce” of the context layer lies in the company’s trusted data, well-defined business processes, and employee adoption of AI agents.

Conversational user experiences and coworkers

AI agents use the context layer, but also tap into skills, which encode the procedures they can follow, and tools, which prescribe the actions they can take. Before AI agents are ready to pilot, their governance, including permissions, approval gates, and other guardrails, must be defined. Other capabilities to look for when defining AI agents include orchestration, testing evals, and observability.

In 2025, many solution providers bolted on AI agents to their existing user experiences. This year, many solution providers showcased new conversational user experiences that employees can use instead of traditional ones built with forms, flows, reports, and static dashboards. Conversational user experiences are where AI agents and people come together, whether it’s human-in-the-middle or human augmentation.

Solution providers also grouped their AI agents into assistants or coworkers. For example, Adobe CX Coworker illustrates human augmentation, helping marketers manage campaigns with prompts and monitor their performance. SAP launched Joule Assistants across several business functions, including finance, human capital, supply chain, and customer experience. Other assistants, such as Appian AI Copilot, Atlassian Rovo, Cisco AI Assistant, Nutanix NIVA, and Snowflake CoWork, offer AI-first user experiences to assist different end-user types.

CIOs should demo these AI-first user experiences to glimpse the future of work.

Developers are already getting used to these experiences through code generators and vibe coding tools. Now, similar capabilities are being tailored across all business functions. CIOs should ramp up their change management programs to accelerate the adoption of these AI capabilities.

Solution providers are showcasing AI capabilities that can help CIOs reshape their businesses. But in Q2, there were only a few examples of how AI can help CIOs drive growth, evolve business models, or embed AI into customer-facing products. I expect to see a wave of further AI innovations that will go beyond productivity improvements and efficiencies and help CIOs pursue growth-driving digital transformation strategies.  

Sacolick travelled to conferences mentioned in this article as a guest of Adobe, Appian, Atlassian, Domo, Nutanix, SAP, and Snowflake. In addition, he was hired by Quickbase to speak at its conference.

If you’re a software developer or architect, you might wonder if programming certifications are still worth the effort, especially in the era of rapid AI-driven evolution. The short answer is, it depends.

“Certifications are shifting from a checkbox to a compass. They’re less about proving you memorized syntax and more about proving you can architect systems, instruct AI coding assistants, and solve problems end-to-end,” says Faizel Khan, lead AI engineer at Landing Point, an executive search and recruiting firm.

“In the AI era, fewer students will get trained on the job, which means they have to train themselves,” Khan says. “Certifications—especially architectural ones like AWS, Kubernetes, Terraform—are still the clearest path to do that.”

Pros and cons of programming certifications

It’s not all black and white when it comes to deciding whether to pursue programming certifications. The effort involves both pros and cons.

“In terms of pros, certifications concretely demonstrate that you have a skillset at a documented level,” says Chris Riccio, vice president of engineering at Uplevel, an engineering optimization system provider. “They also show that you’ve put in the time and effort to learn, study, and prepare.”

Programming certifications are “a useful way to validate foundational skills and show that someone understands core concepts,” says Greg Fuller, vice president of Skillsoft’s training provider, Codecademy. “They’re especially helpful for people entering the field or shifting from adjacent roles.”

Certifications offer a structured path to demonstrate proficiency, and they can confirm your ability to build and deploy in various environments, Fuller says.

These types of certifications often demonstrate baseline proficiency and continuous learning, says Reshmi Ramachandran, head of partnerships and GTM strategy for Cprime, a consultancy. “These are often key indications of proficiency for companies looking to filter large candidate pools,” she says.

Certifications really do two things, Khan adds. “First, they force you to learn by doing,” he says. “If you’re taking AWS Solutions Architect or Terraform, you don’t pass by guessing—you plan, build, and test systems. That practice matters. Second, they act as a public signal. Think of it like a micro-degree. You’re not just saying, ‘I know cloud.’ You’re showing you’ve crossed a bar that thousands of other engineers recognize.”

But there are cons, too. “In tech, employers don’t just want credentials, they want proof you can deliver,” says Kevin Miller, CTO at IFS, a maker of factory automation software. “Programming certifications can be a valuable indicator of your baseline knowledge and competencies, especially if you’re early in your career or pivoting into tech, but their importance is dwindling.”

AI tools that can generate, debug, and optimize code are already performing tasks once done by entry-level developers, “which means fewer traditional programming roles are available,” Miller says. “As a result, the job market is becoming more competitive, and certifications aren’t seen as the noteworthy achievement they once were.”

What’s more, not all certifications carry the same weight, Riccio says. “Some may reflect only familiarity rather than true expertise,” he says. “Certifications also often measure ‘book knowledge’ rather than practical experience, and they don’t always map clearly to the requirements of a specific role.”

Programming certifications “can be a helpful signal, especially for confirming baseline knowledge in areas like cloud, security, or devops, but they’re not the full picture,” says Morgan Watts, vice president of IT at 8×8, a contact center platform developer.

“I’m more interested in a candidate’s attitude and aptitude: what problems they’ve solved, what they’ve built, and how they’ve approached challenges,” Watts says. “Certifications can show commitment and discipline, and they’re especially useful in highly specialized roles. But I’m cautious when someone presents a laundry list of certifications with little evidence of real-world application.”

A certification without experience doesn’t carry much weight, Watts says, and over-certification can sometimes signal the wrong focus. “Ultimately, it’s the ability to apply knowledge, collaborate, and adapt that sets great developers apart,” he says.

Finally, certifications can age fast, Khan says. “Tech stacks evolve and a badge from two years ago may already feel dusty,” he says. “And some certifications are paper-thin—multiple-choice exams that don’t prove you can debug production at 2 a.m. So, the risk is you collect badges but still can’t ship.”

Which certifications will get you noticed?

Despite the drawbacks, certifications are still very much in demand, and some carry more weight than others.

The most in-demand certifications are typically platform-based—Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure, and others, Riccio says. “Many of these platforms provide managed services that integrate with existing systems or serve as the glue between them,” he says. “Today’s engineering teams aren’t just building standalone systems in isolation; they’re using other systems to store data, orchestrate business workflows, and connect applications.”

A certification that demonstrates the ability to build solutions on these platforms can put a development professional ahead of the competition, Riccio says.

“The certifications I see in highest demand tend to reflect the evolving tech landscape,” Watts says. “Cloud certifications from AWS, Azure, and GCP are incredibly valuable, especially as distributed systems become the norm.”

Also in demand are certifications for devops and CI/CD tools including Kubernetes, Docker, and Jenkins, Watts says, “because deployment automation and reliability are critical at scale. Also, with AI reshaping development, we’re seeing growing interest in certifications around machine learning, data science, and AI model integration. These certifications stand out because they align directly with the skills that teams need to move faster and more intelligently.”

On the AI front, certifications in TensorFlow and other machine learning platforms are gaining traction as organizations look to embed AI across the development process, Watts says. “These are the certifications that align closely with where modern engineering is headed—scalable, secure, and AI-enabled,” he says.

And then there are cybersecurity credentials that continue to be in high demand. Security certifications, such as CompTIA Security+ or Certified Ethical Hacker, “have become essential as every company faces increasing cyber threats and compliance requirements,” Miller says.

“Core programming certifications are still a bit niche, but the adjacent skills, like those that help developers deploy, secure, and scale their code, are driving demand,” Fuller says. “Companies want developers who understand the full lifecycle, not just how to write code.”

Also see: The best Java certifications for software developers.

Certifications in the hiring process

Experts are clear that programming certifications alone will not get you the job. But they do play a role in the hiring process.

“The information technology world is characterized by rapid and continuous evolution, including the skills and knowledge required to work in the field,” says Diane Rafferty, managing director of the National Technology Group at Atrium, a global talent solutions and extended workforce management firm.

“Certifications not only prove that you have the skills and knowledge needed, but they also show employers that you’re invested in your education and career growth,” Rafferty says. “They can give you a competitive edge when looking for a job, as many companies now require candidates to have them.”

Certifications are one part of the hiring equation, “but never the only part,” Watts says. “They help validate that a candidate has taken the time to build foundational knowledge, and that’s a good sign. But I put more weight on how a person thinks, solves problems, and contributes to the team. I look for people who are curious and proactive, who are learning because they want to, not just because a course told them to.”

Certifications can also play a valuable role in retention, Watts says. “I encourage team members to pursue growth, and when they invest in their own development, the whole organization benefits,” he says. “But again, it’s that balance of knowledge, attitude, and applied experience that really moves the needle.”

Certifications “may allow you to breeze through the initial résumé screening process, potentially getting you to the next stage faster,” Riccio says. “At a minimum, they will set your profile apart from the rest of the pack. They also demonstrate that you’ve reached a baseline level of expertise, allowing hiring managers to quickly evaluate whether you have the skills for the role.”

Employers today “care far less about whether someone has passed an exam and far more about whether they can apply knowledge effectively in real-world situations, leverage AI tools, and solve complex problems,” Miller says. “A certification might get someone an interview, but being able to demonstrate problem-solving skills, teamwork, and adaptability will really make them stand out.”

Popular programming certifications

The following certifications consistently rose to the top in my conversations with tech leaders and hiring managers.

AWS Certified Developer—Associate

Showcases skills and knowledge in developing, optimizing, packaging, and deploying applications, using CI/CD workflows, and identifying and resolving application issues, according to AWS. This certification is said to be a good starting point on the AWS certification journey for professionals in IT or cloud developer job roles.

Azure Developer Associate

This certificate from Microsoft is intended for developers participating in all phases of cloud development, including design, deployment, maintenance, and monitoring. The course teaches developers how to create end-to-end solutions in Microsoft Azure, using the Microsoft Learn Sandbox environment to access Azure resources and services.

Certified Kubernetes Application Developer (CKAD)

This certification was created by the Linux Foundation and Cloud Native Computing Foundation. It demonstrates that candidates can design, build, and deploy cloud-native applications for Kubernetes.

Certified Secure Software Lifecycle Professional (CSSLP)

This certification, from ISC2, focuses on secure software development practices. It recognizes leading application security skills and demonstrates advanced technical skills and knowledge needed for authentication, authorization, and auditing throughout the software development lifecycle.

Databricks Certified Machine Learning Professional

Professionals learn about the latest data and AI techniques and how they can use the Databricks Data Intelligence Platform to build a variety of solutions across data engineering, data warehousing, data science, and AI.

Professional Cloud Architect

This certification from Google assesses the ability to design and plan a cloud solution architecture, manage and provision the cloud solution infrastructure, design for security and compliance, analyze and optimize technical and business processes manage implementations of cloud architecture, and ensure solution and operations reliability.

Terraform Associate

This certification from HashiCorp is for cloud engineers specializing in operations, IT, or development who know the basic concepts and skills associated with Terraform. It validates foundational skills in using Terraform for infrastructure as code development.

Like many CIOs, Omnicom’s Leif Maiorini has become all too familiar over the past few years with the challenges of ever-shrinking IT roadmaps.“CIOs used to follow a five-year planning cycle, but five years is an eternity,” says the advertising and public relations titan’s CIO for corporate services.

Agentic AI, arguably one of the most transformative technologies that technology leaders are grappling with today, only burst onto the public consciousness two years ago, Maiorini notes.

“We’ve only had the iPhone for 10 years,” he says. “How could you predict five years in the future?”

Yet staying on top of emerging and evolving technologies and their potential impact on business strategies is fundamental for IT leaders in support of the business’s missions. Doing so requires staying on the front end with clients to understand what they are doing and how evolving trends affect their businesses, Maiorini contends.

“It might not even be computer technology trends,” he says. “It might be biological technology; it might be life sciences. We [Omnicom] support a large number of different types of businesses, from communications and PR companies to life sciences companies.”

To thread this needle, Maiorini employs a strategic planning group within the IT function that focuses on looking forward. The group engages with Omnicom’s front-end businesses, specifically stakeholders focused on innovation and strategic initiatives.

“We need to understand what they’re seeing so we can use that to craft our IT strategy,” he says.

One of the most important areas of focus today is what agentic AI capabilities mean for Omnicom and its clients and how those capabilities will transform business processes.

“It’s not necessarily about what agentic AI can do for automating personal work, which it does,” Maiorini says. “My focus is on how we fundamentally change business processes as a result of being able to take advantage of this technology.”

Current business processes are based on human organizational systems and tend to be hierarchical, based on command-and-control messaging (top down), status messaging (bottom up), or information delivered from the front end.

“You get these communication lines going through lots of layers within the organization, vertically,” he says. “A lot of these technologies are going to shrink that down and change the organizational structure drastically. You’ll see a compression of the vertical organization into more horizontal, more focused teams on specific applications.”

Maiorini will discuss how CIOs can face the challenges of accelerating disruption at this week’s CIO 100 Leadership Live: New York conference at Convene, One Liberty Plaza. Anchoring the event’s capstone forum, “What’s Next for the CIO: Preparing for the Next 12-24 Months,” Maiorini and CIO Contributing Editor Lane Cooper will discuss what’s coming next for CIOs, from AI economics to organizational redesign.

The CIO 100 Leadership Live: New York conference will kick off on Thursday, offering CIOs and up-and-coming technology leaders peer insights into what is working inside complex organizations today.

The one-day event, complimentary for qualified IT professionals and their teams, will consist of CIOs and other senior technology and data executives discussing strategic initiatives they have led and how they achieved real-world results. The event will include a career development luncheon and a TechCrunch VC briefing offering insights from venture capitalists on emerging technologies that are gaining traction and poised to disrupt the enterprise.

The event will begin at 8:30 a.m. on Thursday, July 16, with an executive roundtable, “Beyond the Pilot — Building the Infrastructure for Real AI Returns.” It will end with a networking reception beginning at 4:30 p.m.

Early in my consulting career, I assumed maintenance windows reduced risk. After all, the purpose of planned maintenance is to improve reliability, apply fixes and prevent future outages. That assumption changed after I participated in what should have been a routine infrastructure change.

Every pre-check passed. Device health looked normal. High-availability synchronization was complete. Monitoring showed no obvious concerns. Yet shortly after the change, users began reporting application failures.

The root cause was not a failed upgrade, hardware fault or software defect. The maintenance activity exposed a dependency elsewhere in the traffic path that nobody had considered.

Since then, I have seen similar patterns repeatedly across enterprise environments. The change itself was rarely the problem. The problem was the assumption that the change was isolated.

Planned maintenance is intended to reduce risk, but in practice, it often introduces risk into an otherwise stable network.

Many production incidents result from routine tasks such as firewall updates, DNS changes, certificate renewals, routing adjustments, load balancer failovers, WAF updates, switch upgrades or software patches, rather than dramatic failures.

The reality is that “routine” does not equate to “low risk.” It simply means the activity has been performed before, not that the current environment will respond the same way.

Modern networks have become too interconnected for maintenance to be treated as a simple device-level task. A change to one control point can expose a dependency elsewhere in the traffic path. A firewall update can affect asymmetric return traffic. A DNS change can shift users to a data center where persistence is not aligned. A load balancer failover can expose stale ARP or MAC learning issues. A certificate renewal can cause an inspection or TLS negotiation to fail in the backend. A WAF update can block application behavior that was never visible in testing.

Failures rarely stem from the maintenance activity itself, but rather from the assumption that the change is isolated.

Why routine changes still cause outages

In traditional network operations, the unit of change was often a device: upgrade a switch, modify a router, add a firewall rule, renew a certificate or reboot an appliance. That model worked better when application traffic paths were simpler, and dependencies were easier to understand.

Today, a single user transaction may cross DNS, global traffic management, WAN routing, data center switching, firewalls, load balancers, TLS inspection points, WAF policies, API gateways and backend application tiers. Each layer may make an independent decision about availability, security, routing or session handling.

This creates a risky maintenance pattern. Teams often validate only the component they changed, not the complete traffic flow before and after the change. Devices may appear healthy, configurations may load correctly and all checks may pass, yet users can still experience failures due to a changed dependency somewhere in the end-to-end path.

Google’s Site Reliability Engineering (SRE) guidance highlights that changes remain one of the most common sources of service disruption, which is why mature organizations invest heavily in change validation, rollback planning and observability. The SRE book provides extensive discussion of change management, reliability engineering and operational risk in large-scale environments.

For this reason, maintenance windows should be evaluated as both operational events and potential failure vectors.

Common failure points during maintenance

One common issue is state mismatch. Firewalls, load balancers, NAT devices and application delivery controllers often maintain connection or session state. During failover, reboot or path change, existing flows may not survive even if the standby device becomes active as designed. New connections may succeed while long-lived sessions fail. In other cases, traffic may enter through one device and return through another, causing stateful inspection to drop packets that appear invalid.

Asymmetric routing is another frequent cause. A routing change may look harmless from a Layer 3 perspective, but if the forward and return paths traverse different firewalls or inspection zones, applications can fail intermittently. The network may still be “up,” but the security policy no longer sees the full conversation.

Layer 2 behavior is also underestimated. In highly available data center designs, MAC learning, ARP cache behavior, VLAN tagging, port channels and first-hop gateway behavior can determine whether traffic moves cleanly after a failover. A device may successfully assume an active role, but upstream switches or firewalls may still forward traffic toward the old path until tables age out or are refreshed.

DNS and GSLB changes introduce a different class of risk. Teams often test name resolution, but resolution is only the first step. The more important question is where users are being sent and whether that destination is ready to handle production traffic.

DNS resilience guidance published by the Internet Society emphasizes that successful name resolution alone does not guarantee application availability, particularly when multiple infrastructure dependencies exist behind the DNS response.

If global traffic management shifts users from one data center to another, the receiving site must have aligned firewall rules, load balancer configuration, health monitors, certificates, persistence behavior, routing advertisements and backend capacity. Otherwise, DNS sends users to a site that is not actually ready.

Certificate maintenance can also break more than the browser-facing endpoint. In many environments, TLS is terminated, re-encrypted, inspected or validated across multiple hops. Renewing a certificate on the external virtual server may not address backend certificates, intermediate chains, SNI behavior, cipher compatibility or trust stores used by inspection devices. The maintenance task may be described as a certificate renewal, but the real dependency is end-to-end TLS negotiation.

Security policy maintenance creates another risk. WAFs, IPSs, DDoS protection systems, bot defense platforms and firewall policies are designed to block abnormal behavior. But during updates, tuning changes or signature refreshes, they can also block legitimate application traffic if policy enforcement is not validated against real transaction patterns.

This is especially true for APIs, where small differences in headers, methods, payload structure or authentication flows can trigger unexpected enforcement.

The test environment problem

Many teams rely on pre-checks and test environments, but these controls are often less effective than they seem.

Pre-checks confirm device reachability, interface status, route existence, pool member availability and HA health. While necessary, these checks do not ensure production traffic will survive a path change because they focus on infrastructure rather than transaction validation.

Test environments rarely mirror production. Production environments involve real user volume, client diversity, DNS caching behavior, firewall states, certificates, backend latency and complex dependencies. A failover that succeeds in a lab may behave very differently in the real world.

This does not render testing useless, but test results should not be considered proof of production safety. They provide evidence, not a guarantee.

This challenge aligns with broader operational resilience guidance from the NIST Cybersecurity Framework, which emphasizes continuous monitoring, validation and recovery planning as critical operational capabilities.

A stronger maintenance process starts with mapping the traffic path before the window. For critical applications, teams should understand the normal ingress path, egress path, firewall zones, NAT points, load balancer virtual servers, DNS or GSLB decision points, TLS termination points, persistence requirements and backend dependencies.

The next step is defining failure expectations. What happens to existing sessions if a firewall is rebooted? Should source MAC, floating IP, ARP or upstream forwarding behavior change during a load balancer failover? How long will cached clients continue to access the old site after a DNS shift? Which clients and inspection devices validate the certificate chain when a certificate is replaced?

These questions should be addressed before the maintenance window, not during an outage.

Pre-checks should include both control-plane and data-plane evidence. Control-plane checks confirm configuration, synchronization, device health, routing tables, interface status and object availability. Data-plane checks validate real traffic movement: TCP handshakes, TLS negotiation, HTTP status codes, API responses, session persistence, source NAT behavior and return-path consistency.

During the change, monitoring should focus on symptoms that expose traffic failure early. Device CPU and interface status are useful, but they are not enough. Teams should also watch connection resets, denied firewall logs, WAF violation spikes, pool member selection failures, DNS answer changes, TCP retransmissions, backend 5xx errors and synthetic transaction results.

Rollback planning must also be precise. Simply rolling back a configuration is often insufficient. If a DNS record changes, cached clients may continue using the previous answer. If a firewall state table is cleared, restoring the rule does not recover active sessions. If failover alters forwarding behavior, upstream devices may require ARP refresh, route reconvergence or manual validation.

An effective rollback plan should identify lost state, persistent caches and the evidence required to confirm recovery.

Treating maintenance as a resilience exercise

The objective is not to make maintenance overly complex or bureaucratic. The objective is to avoid underestimating its risks.

Every maintenance window is a controlled opportunity to test whether the network behaves as specified by the architecture.

If failover is part of the design, maintenance should verify failover behavior. If a secondary data center is expected to handle traffic, maintenance should demonstrate that it can process real transactions. If security policies are updated, maintenance should prove that legitimate traffic is still allowed. If certificates are renewed, maintenance should validate the complete TLS path, not just the public endpoint.

Industry outage studies published by the Uptime Institute consistently show that human error and process failures remain significant contributors to downtime. Their annual outage research continues to highlight the role of operational processes and maintenance activities in service disruptions.

Maintenance windows provide an opportunity to identify those weaknesses before they become customer-facing incidents.

This requires closer collaboration between network, security, application and operations teams. Network engineers may own routing or load-balancing changes, but application teams understand transaction flows. Security teams understand inspection and enforcement behavior. Operations teams often see user-impacting symptoms first.

Treating maintenance as a shared traffic event rather than a device event reduces blind spots.

Routine maintenance will always involve some risk. However, the greatest risk is the false confidence that the term ‘routine’ conveys.

Modern networks fail in the spaces between systems: between DNS and load balancing, between firewalls and routing, between TLS inspection and application behavior, between HA design and actual forwarding state. Maintenance exposes those spaces.

For that reason, network teams should view every maintenance window as more than a checklist. It is a live test of architecture, operational discipline and production resilience.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

You’ll be hard pressed to find an area of corporate America where AI hasn’t found a place, and that includes the tech hiring process. A survey from MyPerfectResume found that 73% of employers say they use AI in hiring decisions, while 52% use it for decisions around restructuring and role planning.

On the other side, candidates are also increasingly relying on AI, with 52% of current job seekers reporting they use AI to help them in their job searches to refine submission materials (85%) and prepare for interviews (73%), according to data from SAP.

“Technology can help employers be more efficient, but hiring decisions still benefit from human judgment, especially when a candidate’s experience requires context that automated screening may not understand,” says Jasmine Escalera, career expert at online career and résumé builder Zety.

It’s clear AI is an integral part of the hiring process, and organizations need to prepare a strategy for what that looks like moving forward in terms of hiring bias, transparency, and striking the right balance of human effort and AI assistance.

Recognizing the warning signs

AI has the promise of bringing efficiency in hiring for both job seekers and employees, but if organizations aren’t careful, an overreliance on AI technology can lead to unintended consequences. Further MyPerfectResume data also reveals 65% of respondents say AI often automatically rejects applicants before a person sees them, and 14% say AI rejects more than half of applicants outright.

Additionally, 47% say they feel AI has filtered out candidates who would’ve otherwise advanced in the process. And 51% say they use AI to flag risky candidates, such as people who might be viewed as job-hoppers or who have employment gaps.

Flagging risky candidates and eliminating them before a human can look at their résumé can filter out candidates with experience that tells a more complex story than an algorithm is designed to interpret, says Escalera. Candidates re-entering the workforce after time off, for example, may have valuable skills that don’t fit neatly into automated screening criteria, she adds.

Similarly, there’s concern AI will reject a professional who wants to change industries, or has qualifications that don’t  perfectly reflect the language in a job description before a human has a chance to look.

Laurie Cure, CEO of consulting firm Innovative Connections, says she’s seen instances where AI has eliminated highly qualified yet nervous candidates who take more time than what the AI allocated to answer a question, or candidates may simply use a different language than the AI is programmed to look for, causing them to not be recommended to progress in the process.

She’s also seen where AI might use historical data to determine patterns of a successful employee, identifying certain schools, work histories, tenure, or other characteristics that, while not inherently bias, perpetuates the bias that accurate correlations exist between these elements, when they often don’t. Organizations need to ensure that humans remain a part of these processes, Cure adds, where they can bring context, intuition, nuance, and an ability to identify potential in a candidate that AI can’t replicate.

“I think we’re allowing AI to become the process instead of allowing it to support the process in ways that makes hiring better,” she says.

An emphasis on accuracy over speed

Cure says a major problem for most companies is that the balance is off, with companies using AI for the majority, if not all, of résumé screening rather than as a complement to human efforts. Organizations that simply implement AI to speed up different parts of the hiring process, without taking time to consider if a process stands to benefit from AI, run the risk of introducing bias.

“While this allows for managing high volumes of applicants, and provides greater degrees of consistency in applying job criteria, it likely misses many good candidates,” she says. “The human element needs to be highly active in developing job requirements so they’re not too narrow. Organizations need to look at how they ask AI to do its work, so be cautious how you frame the screening or other criteria.”

Ultimately, AI isn’t a tool to be implemented and forgotten, or one that should be viewed simply as a path to efficiency since many processes still benefit from and require a human touch. It’s important to conduct audits of AI processes in hiring, and to remember that the use of AI doesn’t eliminate the legal or ethical obligations an organization has for equal employment, says Cure, making the balance between human and AI even more important.

AI transparency and fostering candidate trust

AI has also introduced an element of mistrust into hiring on both sides, where employers can’t be sure candidates haven’t relied on AI the same way candidates aren’t always sure exactly how AI is being used in the hiring process. Candidates are aware that employers are implementing AI, but they’re often unsure of the extent it’s being used and when to expect to interact with humans.

“That lack of clarity can create skepticism and frustration, particularly in a job market that already feels highly competitive,” says Escalera. “The goal shouldn’t be to convince candidates that AI isn’t being used, but to help them understand how technology supports decisions rather than replaces the human judgment behind them.”     

Cure recommends organizations start with a process map that outlines every step of an organization’s hiring process to help visualize where AI is beneficial and which processes still require human intervention. Companies can shift to relying too heavily on AI or they may become too dependent on human effort, when that effort could be put toward more important tasks.

“Humans bring an understanding of a person’s broader history, and the ability to detect when a candidate has potential to grow into the role,” she says. “People can see non-traditional career paths and motivations more distinctly than AI. Yet AI brings consistency, efficiency, criteria standardization, and a level of objectivity the process benefits from. If we effectively blend these two at the right points in the process, hiring is enhanced, not diminished.”

Historically, humans have solved their toughest tasks by creating tools capable of withstanding greater strain to undertake the job or augment their abilities. From levers to steam engines and beyond, the structural evolution of machines is almost as remarkable as their ability to improve operational cultures.

In recent times, we have seen machines attain their highest structural complexity, productivity, and best aesthetics yet. The most relevant new technologies today focus on creating high-throughput physical machines and software that ‘thinks’, and, more futuristically, a fusion of both.

From moving machines to intelligent humanoids

Evolving from ‘moving machines’ capable of handling repetitive tasks to intelligent machines is a century-long goal for robotics. The rapid growth in this sector over the past half-decade, with a $218 billion projection for 2031, is driven by expectations that advancements in AI will extend to robotics and expedite the development of intelligent robots.

Current prototypes are robots capable of taking initiatives or executing tasks more efficiently with less supervision. These have been applied in agriculture, industrial-grade production, and healthcare.

Humanoid robots have attracted the most attention due to the excitement around their potential as near-human machines and the signals their development sends for the future of human-machine coexistence.

Tech leaders around the world are contributing to advancing physical AI with optimism about the impact of robotics on humanity.

Physical AI is a department of artificial intelligence specializing in developing AI algorithms and models for locomotive systems. This includes every kind of robot and, at a more advanced level, humans.

Recent developments in this field include Figure AI’s humanoid robot deployments and Tether’s investment in the NEURA, leading the fundraising of up to $1.4 billion in one of the largest robotics and physical AI investment rounds on record.

Physical AI researchers are exploring future-proof strategies to develop intelligent, safe humanoid robots that can collaborate with humans, undertake humanly impossible tasks, and handle routine tasks more efficiently.

The strongest case for AI-powered humanoid robots is that they complement human power. A World Economic Forum (WEF) report projects shifts in work roles. Humanoid robots increase the workforce, take over repetitive, strenuous, and boring roles, allowing humans to pursue more interesting career paths.

This way, superintelligent humanoid robots will lead sector-wide transformations beyond current imagination and uniquely transform the world.

In theory, it creates the ideal conditions for an improved global economy and a higher quality of life. This theory is challenged by the dystopian vision of a machine-dominated world in which humans become less relevant. However, history suggests otherwise. Every major wave of automation, from the industrial revolution to the rise of computers, initially sparked fears of human redundancy. Yet each ultimately created more opportunities than it eliminated.

Super-human advancements with physical AI

In ideal operations, physical AI will serve as a lever for humans as well. While progress in robotics is loudest, efforts to directly augment human abilities with physical AI are also yielding remarkable results. Brain-computer interfaces can now accurately decode speech in paralyzed and speech-impaired individuals through intracortical implants that detect brain activity. And this is only a ‘start’. Projections from leaders in this space give insight into the trajectory of this technology.

In a recent fireside chat with NEURA Robotics CEO and founder David Reger, Tether CEO Paolo Ardoino noted, “the evolution of robotics that Neura is making is going to allow testing and building of a framework[…] where the real impact is in the real world. Everything starts digital, but to see the true potential, we will see robots roaming the streets, helping people, and being part of society. It has to happen safely, it has to be transparent.”

Physical AI products designed for direct human integration are being developed differently, with a focus on ergonomics, a minimalist aesthetic, and performance. EVO, Tether’s arm leading the charge for human advancement through intelligent technologies, also shared plans for non-invasive implants that maintain high productivity and offer greater composability.

Technologies like these will allow humans to leverage high-level physical AI technologies to attain the same technical abilities as humanoid robots and outperform them by combining machine and raw human intelligence.

AI robotics in non-user-controlled infrastructures

Resource efficiency, data sovereignty, and surveillance are some of the biggest ethical considerations of Physical AI after safety and responsibility. The infrastructure line-up for Software and Physical AI relies heavily on managed systems, blurring the lines of control and governance.

Who is really in charge? The end user, developer, or proprietors of the centralized infrastructure that powers the product? The result is a product with multiple points of failure, disruptions, and most importantly, operational risks.

Physical AI solutions will be used by billions of people worldwide; they should therefore not be built on limited, slow, and centralized infrastructures. This necessitates localized or truly decentralized AI solutions. Local-first AI solutions like Tether’s QVAC also prioritize resource efficiency, since users are expected to provide the core infrastructure. QVAC is a modular, highly efficient, local-first AI platform that runs anywhere. Tether regards it as the invisible intelligence engine of the 21st century.

Open-sourcing and aligning intelligent robots for co-existence with humans

Yann LeCun, Chief AI scientist at Meta, notes that open-sourcing AI development is the answer to the most pressing ethical challenges of AI applications. According to LeCun:

“The magic of open research is that you accelerate progress by involving more people[…] the biggest danger of AI isn’t ‘bad behavior’ […] It’s that every digital interaction in our future will be mediated by AI. In that world, diverse open-source systems let users choose their own biases.”

Open-sourced (systemic decentralization) and local-first (Infrastructural decentralization) solutions are the only path to developing ethically aligned Physical AI capable of co-existing with humans as intended. A successful physical AI solution is expected to tick the check boxes of safety, resource efficiency, true user control, and tamper-proofness. To do this, it must embrace transparent development procedures and function without gatekeepers.

Learn how Tether EVO is building resilient technology built on fairness, inclusivity, and systems with zero points of failure.

Throughout my career, I’ve seen countless technological shifts categorized as “unprecedented” that turned out to be merely incremental. The recent deployment of advanced, agentic AI models — what we are categorizing here as the “Mythos” capability — is fundamentally different. It represents a permanent, structural shift in the risk and financial dynamics of the enterprise.

To understand why this requires immediate boardroom attention, we must look at the cybersecurity budgeting baseline we are leaving behind. For decades, we relied on a predictable equilibrium: vulnerabilities were discovered and exploited at human speed. That inherent latency gave us a reasonable runway to patch systems and allowed CFOs to safely manage cyber budgets via fixed percentages or predictable annual bumps. With the arrival of machine-speed AI agents, that equilibrium — and the financial assumptions built upon it — is gone.

I want to be clear: this is not a crisis that should cause panic. Rather, it is a severe, balance-sheet-level mismatch in capital allocation. Mythos-level AI hasn’t magically created new vulnerabilities; it has simply industrialized the discovery and exploitation of our existing, legacy technical debt at machine speed.

As leaders, we cannot apply a legacy budgeting model to a machine-speed paradigm. To protect the business, preserve insurability and ensure continuity, we must fundamentally rethink how and where we deploy our cybersecurity capital.

The core problem: The economics of asymmetry

To understand the necessary budget shift, we have to look at the math. The Mythos capability isn’t just fast; it possesses agentic reasoning. Threat actors are no longer manually probing our networks; they are using autonomous AI agents to stitch together low-level bugs into critical exploits in hours, not months.

This asymmetry creates a crushing economic burden on our side of the ledger. Historically, a standard enterprise team of 100 software engineers could conservatively spend about 17,700 hours per year triaging code and addressing bad-code issues – a baseline direct labor cost of roughly $708,000 at a conservative US blended $40 hourly rate. In the era of frontier AI models such as Mythos, that hidden labor pool becomes a strategic budget parameter. That’s because AI may accelerate discovery, but enterprises still need the skills of expert technical talent to validate, prioritize and remediate what AI finds.

Today, Mythos-driven scanners can identify up to seven times that standard volume of vulnerabilities. The bottleneck is no longer finding the flaws; it is the human capacity to fix them. I see highly compensated engineering teams drowning in “triage fatigue,” burning millions in payroll hours chasing AI-generated alerts while actual, critical threats slip through the noise.

Throwing more money at our current strategy will only accelerate capital burn. We need a structural pivot.

The capital reallocation mandate: Five strategic shifts

Simply expanding the IT budget is not the answer. Capital must be urgently reallocated away from legacy, perimeter-based defenses and directed into five critical operational areas:

1. Network redesign: Funding zero trust and micro-segmentation

We are still funding the “castle and moat” model, which is obsolete against autonomous agents that either bypass the moat entirely or originate from within it.

The shift: We must redirect OpEx from legacy firewalls and VPNs into Zero Trust Architecture (ZTA), prioritizing deep micro-segmentation alongside dynamic, AI-driven identity and access management.

The business case: Operating on a “never trust, always verify” basis is about limiting the blast radius. Micro-segmentation acts as digital bulkheads across your network. If an AI-driven agent compromises a single endpoint or workload, these internal barriers ensure it cannot move laterally to reach your crown-jewel financial or customer data.

2. Infrastructure modernization: Retiring legacy technical debt

Mythos models are incredibly efficient at weaponizing deeply embedded technical debt, particularly in older systems built on unsafe programming languages.

The shift: We need strategic CapEx allocated to systematically re-architect foundational systems into modern, safe languages.

The business case: You cannot hire enough humans to patch structural flaws at machine speed. Re-platforming acts as a permanent structural fix, eliminating entire classes of vulnerabilities before the code is even compiled. This requires upfront capital but permanently shrinks the attack surface and reduces long-term OpEx associated with triage.

3. Inside security controls: Governing shadow AI

The most immediate risk to your IP isn’t always an external hacker; it’s your own workforce. To speed up their tasks, well-meaning employees are feeding proprietary source code and sensitive financial data into unsanctioned, public AI models (shadow AI).

The shift: Budgets must account for prompt-level Data Loss Prevention (DLP) tools, the creation of secure, private AI enclaves for internal use, and robust Non-Human Identity (NHI) management.

The business case: A blanket ban on AI stifles productivity and innovation, but unmanaged use invites severe regulatory violations and IP theft. Upgraded internal controls give your workforce the AI tools they need to stay competitive while keeping your proprietary data inside the house.

4. Outside security controls: AI-native defense and contextual triage

Relying on manual labor to manually sort through machine-speed attacks is a losing proposition. We must invest in defenses that contextualize risk instantly.

The shift: We need to fund AI-native posture management platforms.

The business case: This is about maximizing the ROI of human labor. Modern platforms prioritize reachability over volume. If a scanner finds 1,000 flaws, but only 10 are actually exposed to the live internet, the platform filters out the 990 irrelevant alerts. This ensures your expensive engineering hours are deployed only where the business faces material financial exposure.

5. Operational execution: Deploying autonomous operations

Finding and prioritizing vulnerabilities is only the first step; executing the fix is where human bottlenecks create catastrophic enterprise risk. Relying on manual ticketing and reactive IT operations is no longer viable.

The shift: Capital must be allocated toward autonomous operations — platforms capable of executing complex, multi-step IT processes with limited human intervention.

The business case: This fundamentally changes the economics of remediation. By deploying trusted, purpose-built AI agents to handle automated patch management, configuration updates and routine self-healing workflows, you eliminate the human latency in your defense. It shrinks the vulnerability exposure window from weeks to minutes, while freeing your engineering talent to focus on revenue-generating product development rather than endless IT maintenance.

The bottom line

The veil protecting our legacy infrastructure has been lifted. Deploying capital strategically toward network redesign, structural modernization, autonomous execution and AI-native controls is no longer a discretionary technology expense — it is a core fiduciary responsibility and the ultimate determinant of corporate resilience.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Until recently, many tech professionals viewed themselves as a special and respected worker class: highly educated, hard-working, well paid, and in demand.

“They considered themselves above unions,” says Zak Thompson, senior software engineer at Kickstarter and union steward at Kickstarter United.

Big Tech issued aspirational mission statements that motivated workers, workplaces were seen as meritocracies, and employees were encouraged to speak out if they were unhappy. If workers didn’t like where they worked, they just moved on: other employers would be falling over themselves to hire them.

How times have changed.

Now, fed up with mass layoffs, disillusioned with Big Tech’s direction, and stunned by bold management proclamations that AI will displace huge numbers of people in many tech jobs — starting with programmers — interest in unions has risen sharply among tech professionals. Workers in some organizations, including Kickstarter, have already taken the plunge.

A surge in interest

“Starting in 2022, the industry as a whole started seeing very large layoffs across the board [and] that has dramatically shifted the balance of power. I think most people in the industry have experienced that one way or another,” says Google software engineer Alan McAvinney.

But not everyone is convinced that the layoffs have changed the power dynamic. “I wouldn’t say the balance has definitively shifted… some things point to workers losing ground and others point to improvement,” says Liya Palagashvili, senior research fellow and director of the Labor Policy Project at the Mercatus Center at George Mason University.

What matters, she says, is not the size of the layoffs but worker options: how easily laid off workers can find alternative work in their field.

For McAvinney, the decision to support a union was about a culture change at his employer.

“In 2019, Google fired four people (the ‘Thanksgiving Four’) after they organized and spoke out internally against the company’s work with the anti-union firm IRI and US Customs and Border Protection. That was a big turning point for me,” he says. “Historically, we had a pretty robust culture that actually encouraged us to speak up internally.”

Google said the employees were fired for violating data security policies, but many workers believed the move was retaliatory. It became a galvanizing event that contributed to the launch of the Alphabet Workers Union (AWU) in 2021, says McAvinney, organizing chair, Alphabet Workers Union-CWA. (Alphabet is the parent company of Google.)

So far, tech worker interest in unions hasn’t translated into higher membership numbers nationally. According to the US Census Bureau’s Current Population Survey (CPS), union membership in tech occupations was about 3.5% in 2025, says Palagashvili. “While there have been some high-profile organizing efforts, they do not yet show up as a broad national increase in tech-sector unionization.”

Overall, only 10% of American workers belonged to a union in 2025, the Bureau of Labor Statistics (BLS) reported — near an all-time low — but interest in labor unions is rising. A 2025 Gallup survey found that 68% of Americans approved of unions, up from 48% in 2009. Interest is particularly strong among younger workers, the Economic Policy Institute reports, and in a 2024 online survey of 1,900 tech professionals on the career site Blind, 67% of respondents said they’d be “very likely” or “somewhat likely” to join a union if their company had one.

Nonetheless, for most tech professionals, those positive perceptions have not so far translated into widespread union membership.

Fear, uncertainty, and doubt

In the wake of mass layoffs that began in 2022, the primary driver toward tech worker unionization may well be job security.

“I think a greater concern is that their work and skills have been devalued at the same time their jobs become less secure and their wages and benefits have declined,” says Kate Bronfenbrenner, director of labor education research and senior lecturer emeritus at Cornell University’s School of Industrial and Labor Relations.

The fear that AI will displace IT workers en masse is palpable, says Google’s McAvinney. Whether the mass layoffs to date were actually driven by AI or if AI was used as a pretext, “Large numbers of people have that concern, and that is absolutely part of the interest in collective action — getting organized, joining a union, or forming a union,” he says.

The second motivator is ideological disillusionment. “Workers recruited with promises that they would be changing the world discovered that they were really building surveillance systems or military technology,” Bronfenbrenner says.

The insidious use of AI surveillance is another concern, says Bronfenbrenner. For example, Meta’s announcement that it would use AI to track US-based workers’ computer activities, including clicks, keystrokes, mouse movements, and screen snapshots to train AI agents had a dystopian feel to it. Were these workers training AI to take over their jobs, just as US workers were asked to train their lower-cost foreign replacements during the offshoring craze in the mid-2000s? (Meta later paused the tracking program after employees twice demonstrated the inadequacy of privacy protections for the collected data.)

But Bronfenbrenner argues that AI’s bigger threat may be its use as a surveillance tool to prevent organizing. “My research on surveillance in organizing campaigns found that it tripled from 11% in the early 2000s to one third in 2021,” she says.

“The deeper pattern is the same one inherent in Taylorism — management trying to know everything that’s under the worker’s cap, to monitor every step so workers have no control and no secrets,” Bronfenbrenner says. “Now they have even more technology to do it, and they can potentially replace you entirely with AI.”

Simone Robutti, an organizer with Tech Workers Coalition Global, calls the current wave of tech layoffs “a prequel to whatever AI-driven layoffs are coming.” It’s part of the trend of “lowering the cost of knowledge workers, of cognitive workers, of office workers in general — because that’s the bet on AI,” he says.

Whether employers can in fact replace workers with AI (or will be able to soon) is an open question. “If Amazon lays off a hundred workers, and ninety of them find comparable jobs within a few months, that mitigates the concern,” says Palagashvili from George Mason University. “If most of them have to sell their houses and move across the country, or end up underemployed — not just unemployed, but working in warehouses instead of at a competitor — that’s a different picture.”

So far that hasn’t been a big issue for former Google employees, says McAvinney. “It used to be that if you left Google, you could get a job anywhere in tech instantly. That’s no longer the case, but most people I talk to are still finding work in the industry,” he says.

But for those newly entering the workforce, it’s much harder to find a job. According to the Stanford HAI 2026 AI Index Report, released in April, “employment for software developers ages 22 to 25 has fallen nearly 20% from 2024.”

Successes and setbacks

While organizing can be an uphill battle and workers often face aggressive pushback from their employers, there have been a few notable successes.

In the UK, workers can join a union as individual members before their employer formally recognizes that union for collective bargaining purposes. That’s how 300 workers in Google DeepMind’s London office initially joined the Communication Workers Union. In April, 98% of the 300 CWU members voted in favor of pursuing union recognition, formally requesting that management recognize the CWU and Unite the Union as representatives for approximately 1,000 staff. (Google DeepMind disputed characterizing the action as a vote to unionize).

And in May, some 2,100 tech workers at the University of California joined the University Professional and Technical Employees union, which is affiliated with Communications Workers of America (UPTE-CWA), with 96% of the workers voting yes.

“A lot of tech workers right now are extremely concerned about job security and about their work being automated,” says Max Belasco, a business systems analyst at the UCLA School of Law and co-chair of the UCLA chapter of UPTE-CWA, Local 9119.

The CWA described the organizing initiative as “the largest tech industry organizing campaign in US history.” But it wasn’t the first.

“Between 2022 and 2024, CWA organized nearly 400 different digital media companies,” Bronfenbrenner says, including the game developer Activision and the New York Times.

Kickstarter’s 85 employees voted in 2020 to form Kickstarter United — the vote was 55% in favor — and most recently the union negotiated a contract that includes a four-day workweek, AI protections, and a minimum pay floor for 59 employees, including tech workers.

“What we ended up winning was yearly benchmarking of all employee salaries to the 60th percentile, along with yearly cost of living adjustments,” says Thompson.

But the way forward has been rocky. Shortly after the union was ratified, Kickstarter announced layoffs. The union, which is affiliated with the Office and Professional Employees International Union (OPEIU), wasn’t able to reverse that decision but did negotiate better severance terms, including four months of severance pay (versus 2 to 3 weeks for every year worked) and six months of health benefits.

When contract negotiations faltered in October 2025, the union went on strike for 42 days. By December, a new contract was ratified. Shortly thereafter, the company announced another round of layoffs that included four union leaders, one of whom had helped to negotiate the new contract. The union is currently fighting those dismissals and will be arguing its case in third-party arbitration.

The National Labor Relations Act of 1935 codified American workers’ rights to unionize and take collective action, and it established the National Labor Relations Board to protect those rights. Unfortunately for Kickstarter, NLRA enforcement under the Trump administration isn’t what it once was.

“Cases brought up for violations of the NLRA can go for months or years without ever seeing a hearing or having any sort of judgment. That gives companies more power to flagrantly ignore it,” Thompson says.

Tech firms have other weapons to dissuade employees from unionizing. Researchers from Carnegie Mellon University and Princeton University in 2025 interviewed 44 US-based tech worker-organizers, who cited additional pressure tactics including threats to withdraw venture capital funding — essentially killing venture-backed firms if employees vote to unionize — and threats of being fired that put tech workers with H-1B visas in an impossible position.

Kickstarter United is a majority union — one that has won NLRB certification. While that’s possible in smaller organizations, success in larger tech firms has been much more limited.

Alphabet is a prime example: the Alphabet Workers Union-CWA is a “pre-majority” union that lacks NLRB certification and has no formally recognized bargaining unit. Formed in 2021 with fewer than 400 members, today it represents 1,400 members, still a small fraction of Alphabet’s US-based workforce, estimated at over 100,000.

The challenge, says McAvinney, lies in trying to organize a distributed workforce of in-office, remote, and contract workers. “Large tech companies don’t split easily into discrete segments — there’s no strong geographic component to teams, and a single team is often spread across many locations,” which makes getting majority support unrealistic, he says.

But that doesn’t mean the union has had no impact. “In January, we launched our Googlers for Job Security campaign. Today we’re organizing around four demands: a guaranteed minimum severance package for everyone who’s laid off, voluntary buyouts before any mandatory layoffs, an end to GRAD quotas (GRAD being Google’s performance review system) so ratings reflect actual performance and aren’t given or changed to force a particular distribution, and the option to take severance as leave, giving workers, especially those on visas, more time on payroll,” McAvinney says.

“In response, Google did start offering voluntary exit packages,” he says. The union was also able to negotiate one contract, for Google Help workers. However, those workers aren’t actually Google employees: they’re contractors who report to Google management but work for Accenture.

The counterargument

Do unions get what they bargain for? Conservative business and labor economists say union contracts typically have rigid pay structures that restrict merit-based pay in favor of seniority-based wage increases, and that unions, as certified by the NLRB, create labor monopolies that limit worker choice and push up wages to levels detrimental to both workers and business.

The collective bargaining model is not well suited to the highly dynamic and innovation-driven tech sector, Palagashvili argues. “Firms often need to reorganize teams, redesign products, adjust roles, and redeploy talent quickly,” she says.

Collective bargaining agreements make those adjustments much more difficult by imposing uniform terms for an entire bargaining unit, regardless of individual preferences and circumstances. The contracts, she says, “are more about higher pay and less about flexibility.”

But Thompson says that hasn’t been his experience. “The thing with a union is you get to write the contract,” he says. “At Kickstarter we care about recognizing individual contributions, merit, and having a clear career progression.”

Kickstarter United pushed the company to clearly define what it takes to get a promotion, advocated for no “at will” employment, where employees can be fired any time without a stated reason; won standards for minimum pay, raises, promotions, and time off; secured AI protections; and codified a four-day work week.

Yes, some tech professionals voiced concerns about unions, such as that they stifle innovation and limit compensation for top performers, Thompson says, but “a lot of those people came around. They said ‘I was wrong. I feel way more protected, more secure, and I see the benefits.’”

Bronfenbrenner says it’s a mistake to think that tech workers are inherently different from other workers, adding that the two industries with the highest union density are entertainment and professional sports. “These are professionals with unique talents and capabilities, and they’ve organized successfully under the exclusive representation system.”

Will we see a unionized tech workforce?

If unions eventually prevail in tech, it will happen in the face of intense pressure from employers not to organize.

“The Alphabet Workers Union is a case study of the limits of the first wave of tech labor organizing,” says Robutti from the Tech Workers Coalition. “They hit a threshold beyond which they couldn’t fight the union busting anymore, and they became entrenched at that size.”

No one should expect large-scale unionization to occur overnight, Bronfenbrenner says. “The auto and steel industries weren’t organized in months. It took decades. Organizing global tech companies will take the same.”

While McAvinney acknowledges that a traditional majority union may be difficult to achieve any time soon in a company as large as Alphabet, he’s still bullish on his pre-majority union’s ability to make a difference. “Ultimately, regardless of which type of union you are, you can only win as much as you have leverage to win. Your leverage is inherently limited, but that doesn’t mean you can’t win anything,” he says.

Attitudes about unions appear to be changing rapidly. “Interest in unions is high, and I expect that will continue,” McAvinney says. “Now is an excellent time for people to start getting organized. I have seen lots of evidence of that.”

Thompson agrees. “We are seeing an uptick of people in tech reaching out, trying to get help organizing. When people have their job conditions continue to deteriorate, they are going to start organizing,” he says. “We’re definitely seeing a shift from ‘it’d be nice if we had a union’ to ‘okay, how can I actually do this now?’”

Come back next week for Part 2: How to unionize your tech workplace

With change a constant, cybersecurity professionals looking to improve their careers can benefit from the latest insights into employers’ needs. Data from Foote Partners on the skills and certification most in demand today may provide helpful signposts.

Analyzing more than 660 certifications as part of its 2Q 2026 “IT Skills Demand and Pay Trends Report,” Foote Partners calculated the most valuable IT security certifications to pursue right now based on two dimensions. The first, the average pay premium, measures the difference in pay between IT pros with a particular credential and those without it. The second, market value increase, measures the increase in pay gains over the past six months.

Together, average pay premium and market value increase can give cybersecurity pros a starting point in deciding which certification to pursue for more pay. Apart from considering their overall professional goals, security professionals should consider each certification’s training and exam costs, whether vendor-specific or vendor-neutral, and the lateral or vertical role opportunities it may open.

Here are the top 13 certifications paying higher premiums today in descending order.

GIAC Security Expert (GSE)

The GIAC Security Expert (GSE) portfolio certification is for security leaders wishing to prove their status as a top information security practitioner by showing they have offensive and defensive skills and hands-on practical skills. Available for more than 15 years, the GSE is considered one of the broadest and deepest cybersecurity certifications. To earn the certification, candidates must complete any six practitioner certifications and any four applied knowledge certifications.

GIAC allows candidates to customize the certification to fit their expertise and career. Candidates can also build their certification over any amount of time as along as the required certifications within the portfolio remain active. Practitioner certification exams are 2-5 hours in length, depending on the specific certification attempt, and applied knowledge certification exams are 4 hours in length.

Training fees: Some training is offered in affiliation with SANS Institute and costs $8,780.

Exam Fees: Because you need 10 certifications to achieve the GSE prices vary significantly. If you already hold a GIAC Certified Forensic Analyst (GCFA), the cost of one of the required certifications drops from $1,299 to $499. Most required certifications are priced at either $999 or $1,299 per attempt, though they can cost up to $11,190.

GIAC Security Professional (GSP)

The GIAC Security Professional (GSP) is designed to demonstrate the holder’s depth and breadth of information security knowledge. Launched approximately two years, this newer certification is the halfway point to the GSE. Customization of the certification is allowed, and to achieve it a candidate must complete any three practitioner certifications and any two applied knowledge certifications. Candidates can also build their certification over any amount of time as along as the required certifications within the portfolio remain active. Practitioner Certification exams are 2-5 hours in length, depending on the specific certification attempt, and Applied Knowledge Certification exams are 4 hours in length.

Training fees: Some training is offered in affiliation with SANS Institute and costs $8,780.

Exam Fees: Because you need five certifications to achieve the GSP prices vary significantly. If you already hold a GIAC Security Essentials (GSEC), the cost of one of the required certifications drops from $1,299 to $499. Most certifications required are priced at either $999 or $1,299 per attempt, though certification can cost up to $5,595.

Microsoft Certified Azure Cybersecurity Architect Expert

Those who earn the Microsoft Certified: Cybersecurity Architect Expert credential are able to translate a cybersecurity strategy into capabilities that protect the assets, business, and operations of an organization. Through the certification process, candidates learn to design, guide the implementation of, and maintain security solutions that follow zero-trust principles and best practices. You’ll also be able to design solutions for governance, risk, and compliance (GRC), security operations, and security posture management.​

As a prerequisite, candidate must have earned one of the following: Microsoft Certified: Azure Security Engineer Associate, Microsoft Certified: Identity and Access Administrator Associate, Microsoft Certified: Security Operations Analyst Associate certification.

Training fees: Self-paced training is available from the course’s page and free of charge. There is also an option to find an instructor-led training with pricing starting at $1,300.

Exam Fees: The exam costs $165 and Microsoft offers free practice assessments.

Certificate of Cloud Security Knowledge (CCSK)

As a certificate and not a certification — an important distinction — the Cloud Security Alliance (CSA) positions its Certificate of Cloud Security Knowledge as the foundation for future credentials and upskilling in the sector. From this perspective, the CCSK is helpful for cybersecurity analysts, compliance managers, security engineers, architects, and administrators. This vendor-neutral certificate has been recently updated and covers topics in zero trust, DevSecOps, cloud telemetry and security analytics, artificial intelligence, and more. CCSK offers a variety of training modalities, including an exam prep kit, instructor-led classes offered virtually and in person, and an online self-paced option. Candidates must score at least 80% on the exam, randomly pulling 60 multiple-choice questions from a test bank.

Training fees: Prices vary based on modality. A self-paced course and exam bundle costs $795, and online, instructor-led training begins at $995.

Exam fees: The exam costs $445, though discounts are available for corporate members, and US military veterans can take it for free.

Certified in Risk and Information Systems Control (CRISC)

Administered by ISACA, the Certified in Risk and Information Systems Control certification provides candidates with training across four domains: corporate IT governance, risk assessment, risk response and reporting, and technology and security. CRISC is ideal for candidates who want to enhance and optimize business resilience and risk management across their organization. The exam consists of 150 questions across the four domains. Since ISACA began offering CRISC in 2010, more than 23,000 people have obtained the certification. ISACA claims 52% of certificate holders experienced on-the-job improvement, and CRISC is the “4th top-paying certification worldwide.” To qualify for CRISC, candidates must adhere to a code of professional ethics and have three years of work experience in risk assessment and risk response and reporting. On passing the exam, candidates must submit 20 CPE credits annually and 120 continuing professional education (CPE) hours every three years to maintain their CRISC.

Training fees: ISACA offers three resources: an online review course, $895; a review manual in print or digital, $139; and an annual subscription to a 833-question test bank, $399. Discounts are available for ISACA members.

Exam fees: $575, ISACA members; $760 for non-members; plus $50 application fee.

Certified Information Systems Auditor (CISA)

The Information Systems Audit and Control Association (ISACA)’s CISA is geared toward IT auditors who wish to upskill or earn a pay boost. According to ISACA, 70% of CISA holders report on-the-job improvement, and another 22% receive a raise. The course covers five domains: information systems auditing, implementation, and operations; protection of information assets; and IT governance. The four-hour exam consists of 150 multiple-choice questions, and candidates must earn 450 on ISACA’s scaled scoring system, with 800 representing a perfect score. To maintain their CISA, certification holders must take 20 CPE credits annually and 120 over three years through conferences, volunteering, on-demand learning, and other methods as well as paying maintenance fee. To qualify, you must have five years of experience in IT or IS audit, control, assurance, or security. You can apply for an experience waiver for up to three years.

Training fees: ISACA offers four resources: an online review course for $895, an annual subscription to a question bank for $399, and a print or digital review manual for $139. Discounts are available for ISACA members. 

Exam fees: $575, members; $760, non-members; plus $50 application fee.

Certified Information Systems Security Professional (CISSP)

CISSP is a generalist cert from ISC2 aimed at security pros who have already established a strong track record. Advanced-level analysts interested in getting CISSP certified will need to know all the ins and outs of security and risk management, asset security, operations, security assessment and testing, and more. The CISSP certification requires five years of full-time experience in at least two of its eight domains. The exam is adaptive, ranging from 100 to 150 questions, including multiple-choice and advanced items of varying formats. Candidates need to score 700 points out of 1,000 to pass the exam.

Training fees: Online self-paced training fees start at $595 and can cost up to $1,993; online instructor-led bootcamp costs $2,880.

Exam fee: $749

Certified Secure Software Lifecycle Professional (CSSLP)

This ISC2 certification helps cyber pros build their career by training them to better incorporate security practices throughout software development phases. The CSSLP exam evaluates experience across eight domains: secure software concepts; secure software; lifecycle management; secure software requirements; secure software architecture and design; secure software implementation; secure software testing; secure software deployment, operations, maintenance; secure software supply chain. Those wishing to acquire the CSSLP must have four years of paid work experience as a software development lifecycle professional in one or more of the eight domains.

Training fees: Online self-paced training fees start at $550 and can cost up to $1,718; online instructor-led bootcamp costs $2,650.

Exam fee: $599

Check Point Certified Security Master (CCSM)

To become a Check Point Certified Security Master (CCSM) security professionals must have an active Certified Security Expert (CCSE) and mast have completed two subsequent Check Point Specialist accreditations. CCSM validates advanced expertise in configuring, deploying, and troubleshooting Check Point solutions. Check Point certifications are valid for 24 months.

Training fees: Training for CCSE is $3,500

Exam fee: The fee for CCSE is $300

GIAC Experienced Cybersecurity Specialist (GX-CS)

The Experienced Cybersecurity Specialist (GX-CS) sits within the applied knowledge certifications with GIAC. The certification is for practitioners to show their qualifications for advanced, hands-on IT systems roles across cybersecurity. Its intent is to demonstrate the candidate can navigate evolving real-world threats. The certification covers five areas: network security analysis and tools; evaluation of Windows and Linux OS security; advanced security tools and techniques; common attacks and defenses; and implementing overall cybersecurity and information security. The GX-CS is for GSEC holders who acquired additional experience — the GSEC exam costs $999, and SANS Institute offers training for GSEC.

Training fees: There are a few related affiliate training programs provided by SANS, each costing approximately $9,000.

Exam fee: $499 for those with an active GSEC; otherwise $1,299.

OffSec Certified Professional (OSCP+)

To earn the OffSec Certified Professional certification, candidates must complete the affiliated course, PEN-200: Penetration Testing with Kali Linux, and pass the subsequent exam. The course covers 20 plus modules, including information gathering, vulnerability scanning, encryption and cryptography, Active Directory and AWS exploitation, and more. Certificate holders will have shown mastery of penetration testing methodologies ideal for new roles, such as an ethical hacker, incident responder, or threat hunter. The OSCP+ exam is entirely hands-on, and test-takers must compromise systems within a lab environment.

OffSec does not enforce any prerequisites but recommends candidates be familiar with TCP/IP networking, scripting in Bash and Python, and Linux and Windows, which they can learn through its Network Penetration Testing Essentials Learning Path.

Training and exam fees: OffSec bundles the course and exam for $1,749 and as a yearly subscription that includes access to one 200 or 300-level course, the associated labs, and two exam attempts for $2,749 annually.

OffSec Experienced Penetration Tester (OSEP)

The OffSec Experienced Penetration Tester is ideal for penetration testers and ethical hackers who need more advanced techniques to sharpen offensive skills against modern enterprise defenses. Across more than 20 modules, the certification introduces these professionals to advanced offensive techniques, EDR and AV evasion, advanced Windows offensive security and more. During the two-day proctored exam, professionals must connect to a lab environment via a VPN and compromise multiple machines within a network through several possible attack paths. To pass, professionals must achieve the objective stated within the control panel or score at least 100 points — 10 points are awarded for every flag found in a local.txt or proof.txt file. Professionals who earn their OSEP can also obtain their OSCE³ Certification to demonstrate their mastery of offensive security. They would also need to pass the exams for WEB-300: Advanced Web Attacks and Exploitation and EXP-301: Windows User Mode Exploit Development, after which the OSCE³ is automatically awarded.

While there are no formal prerequisites for OSEP, OffSec recommends candidates take the PEN-200: Penetration Testing with Kali Linux or have a strong foundation in operating systems, networking, and scripting. 

Training and exam fees: OffSec bundles the course and exam for $1,749, and as a yearly subscription that includes access to one 200 or 300-level course, the associated labs, and two exam attempts for $2,749 annually.

OffSec Exploitation Expert (OSEE)

OffSec’s Offensive Security Exploitation Expert is a vendor-specific certification, focusing on advanced Windows exploitation, with OffSec deeming it its most challenging certification. As a penetration testing course, the material dives deep into topics such as advanced heap manipulations and disarming WDEG mitigations. Certificate holders can identify problematic code in Windows operating systems and develop exploits. For the practical exam, candidates must complete a comprehensive penetration test of software and create an exploit within a lab environment — all within 72 hours. To qualify, you must have experience debugging, developing Windows exploits, and using the following technologies: WinDBG, x86_64, IDA Pro, and basic C/C++ programming. OffSec recommends completing its 300-level certifications before OSEE.

Training and exam fees: OffSec offers only instructor-led, in-person training. Enterprises should inquire for more information.

At some point, every security leader gets asked a version of the same question: Are we good? It tends to arrive when something is at stake and the person asking needs to know they can rely on the answer.

I learned what that question really means at a firm I was with earlier in my career. We had received intelligence that threat actors were preparing to go after financial services firms over the holidays, counting on skeleton staffing and slower response times. We had procedures for exactly that kind of heightened alert, and we ran them. The moment that stayed with me came in a hallway. The head of business stopped me and asked, plainly, “Are we good?” He was not asking for a status report on our controls or a walkthrough of our incident response plan. He wanted a seasoned leader to look at him and say, with conviction, that we were good.

That instinct, the need for someone accountable enough to say “we’re good” and mean it, sits at the center of a debate the cybersecurity industry keeps having: Whether the CISO role has become unsustainable. The list of responsibilities continues to grow. Security leaders are expected to oversee cyber resilience, regulatory compliance, third-party risk, business continuity, AI governance, incident response and an ever-more-complex threat landscape. Boards, regulators, customers and investors simultaneously demand greater visibility into cyber risk than ever before.

The conclusion many people draw from this expansion is that the traditional CISO role can no longer work. If no single person can realistically master every domain that falls under modern cybersecurity, perhaps the role itself has become obsolete.

I believe the opposite is true. The modern CISO is disappearing from one version of itself and re-emerging as something larger. It is undergoing the same evolution the CFO role experienced over the last two decades.

Historically, CFOs were viewed primarily as financial operators. Their responsibilities centered on accounting, reporting, controls, audits and budgeting. As businesses grew larger, more global, more regulated and more dependent on technology, that model changed. The CFO evolved from a finance specialist into a strategic executive responsible for shaping enterprise-wide decisions. McKinsey documented this shift, finding that the number of functions reporting to CFOs had expanded significantly, and that business leaders had come to see them as critical drivers of change across the enterprise, not just stewards of the balance sheet.

Nobody looked at that expanding mandate and concluded the CFO role was becoming irrelevant. They recognized that finance had become more important to the business.

The same thing is happening in cybersecurity. For years, security was treated as a technical discipline operating on the periphery of the organization. Today, a significant cyber incident can halt operations, disrupt revenue, trigger regulatory scrutiny, damage customer trust and move markets. Cyber risk has become business risk, and that shift fundamentally changes what a CISO is for. Security leaders increasingly sit on enterprise risk committees alongside their peers, and regulators are paying far closer attention to how security is built into the design of products and systems from the outset. Both are signs that security has moved from a back-office function into the room where business risk gets decided.

The data reflects how much the role has already changed. According to Splunk’s 2026 CISO Report, nearly all CISOs now count AI governance and risk management among their core responsibilities. Seventy-eight percent report personal liability concerns tied to security incidents, up from 56% just a year ago. The role now carries individual legal exposure alongside operational accountability. That is a description of an executive function, full stop.

Modern security leaders are now expected to help boards understand risk, participate in strategic planning, navigate regulatory obligations, oversee resilience programs and establish governance around emerging technologies like artificial intelligence. These responsibilities extend well beyond traditional security operations, and the job has grown considerably faster than the organizational structures supporting it.

Some companies have responded by building larger, more specialized security leadership teams. Microsoft’s Secure Future Initiative is the most prominent example. The company established a Cybersecurity Governance Council led by a Global CISO, with over a dozen Deputy CISOs appointed across major security domains including engineering, AI, cloud services, gaming and government systems. It represents one of the largest security transformations in the industry, involving thousands of engineers and a governance structure built to coordinate security across a genuinely sprawling organization.

Some observers read structures like this as evidence that the traditional CISO model is breaking down. Look closer and you see the opposite. Microsoft expanded the organization supporting security leadership rather than dismantling it. Centralized accountability remains with a global CISO while execution is distributed across specialized leaders and teams.

This is exactly what mature executive functions look like at scale. Large enterprises do not eliminate CFOs when finance grows more complex. They add controllers, treasury leaders, FP&A organizations and investor relations teams. Complexity does not eliminate executive accountability. It deepens the need for it.

There is shared, organization-wide security: the SOC, vulnerability management and the other services the entire firm depends on. Then there is business-line security, led by deputy or business-unit CISOs whose job is to make sure their individual units are protected. Those embedded leaders drive requirements into the shared services and provide independent oversight of them, while staying close enough to their business to understand what it actually needs. One central executive owns the whole picture, with specialized leaders carrying it into every corner of the organization.

One structural point follows directly from this: The CISO should never report to the CTO. The person accountable for security should not sit underneath the person accountable for building and shipping technology, because those two mandates can pull in different directions. Security belongs under the COO, the CRO or the CEO, where it can speak to risk independently and be heard.

AI is accelerating this evolution further. Organizations are deploying autonomous systems capable of making recommendations, triggering workflows and acting at machine speed. What AI cannot do is own the decisions behind those actions. Someone still has to determine what can be delegated to machines, establish governance frameworks, define acceptable risk and answer for those choices to regulators, boards and shareholders. In most organizations, that someone is the CISO.

The most practical place to start is a simple principle: every AI action should trace back to an accountable human. Framed that way, we are not delegating decisions to AI at all. We are putting machines to work while keeping a person answerable for what they do. That principle forces accountability to live somewhere specific in the organization rather than dissolving into the system.

This is worth sitting with: AI may strengthen the case for executive security leadership rather than weaken it. For years, CISOs governed human behavior inside organizations. Now they govern human and machine behavior simultaneously, a mandate with no obvious ceiling.

The cybersecurity industry keeps asking whether the CISO role can survive the demands being placed on it. The better question is whether organizations are adapting their leadership structures fast enough to support where the role is already heading.

The future of security leadership is unlikely to be a loose collection of specialists operating without clear ownership. It will more closely resemble other mature executive functions, with specialized leaders operating under a single accountable executive who understands how risk connects to the business as a whole. As cyber risk becomes inseparable from business risk, that executive becomes indispensable.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Over the past two years, I have spent a significant amount of time discussing artificial intelligence with technology leaders, business executives and teams across my own organization. Most conversations begin with questions about the use cases, tools, governance and return on investment. Leaders want to know which technologies are creating the most value, where to invest next and how quickly they should scale adoption.

Those are important questions, but I have noticed another pattern emerging as organizations move beyond experimentation and begin embedding AI into everyday work. In many cases, the technology itself is not the primary obstacle to success. Instead, AI is exposing organizational challenges that have existed for years. Processes that were already inefficient become more visible. Ambiguous decision-making structures become harder to ignore. Accountability gaps that once slowed projects quietly now become more apparent as work accelerates.

This has led me to a simple conclusion: AI does not eliminate inefficiency. It amplifies it.

That observation should not be interpreted as a criticism of AI. In fact, it highlights just how powerful the technology can be. AI accelerates workflows, shortens analysis cycles, improves access to information and increases employee productivity. However, because it accelerates the way work gets done, it also magnifies the strengths and weaknesses of the operating environment in which it is deployed. Organizations with strong processes and clear accountability often realize value quickly. Organizations with operational complexity frequently discover that technology alone cannot overcome management challenges.

AI accelerates existing operating models

Many organizations approach AI as a technology initiative. They evaluate platforms, launch pilots and identify tasks that can be automated. While those activities are important, they can also create a false impression that AI itself is the primary driver of transformation.

In my experience, the greatest value comes not from the technology alone but from the willingness to rethink how work gets done. AI can automate tasks, but it cannot redesign a broken workflow. If a process contains unnecessary approvals, duplicate activities, conflicting priorities or poorly defined handoffs, those issues remain regardless of how sophisticated the technology becomes.

This idea is consistent with a broader lesson I explore in my latest book, Digital Inside Out: digital transformation succeeds when organizations focus first on how work gets done, how decisions are made and how accountability is established. Technology can accelerate performance, but it rarely compensates for weaknesses in the underlying operating model. In many cases, new technologies simply make those weaknesses more visible.

Researchers at the MIT Sloan School of Management have reached a similar conclusion. Their work suggests that organizations generate the greatest value from AI when they redesign workflows rather than simply automate individual tasks. In other words, the most significant gains come from rethinking how work flows through the organization rather than accelerating isolated activities.

I have seen this pattern repeatedly throughout my career. Enterprise systems did not fix poor business processes. Collaboration platforms did not automatically improve communication. Analytics tools did not create accountability. Each technology delivered substantial benefits, but only when accompanied by process redesign, governance improvements and leadership commitment. AI follows the same pattern.

Organizations that simply layer AI on top of existing complexity often find themselves completing inefficient work faster. Employees may generate reports in minutes instead of hours, produce presentations more quickly and analyze larger volumes of information. Yet the underlying process may still contain the same bottlenecks that limited performance before AI was introduced. The technology increases speed, but it does not automatically improve effectiveness.

Why decision-making becomes the new bottleneck

One of the most interesting effects of AI is how it changes the nature of organizational constraints. Historically, many companies struggled because information was difficult to access. Data was fragmented across systems, reporting cycles were slow and analysis required significant manual effort. Leaders frequently spent considerable time gathering information before they could make decisions.

AI is rapidly reducing those barriers. Teams can now summarize large volumes of information, identify patterns, generate recommendations and produce insights in a fraction of the time previously required. Access to information is becoming less of a competitive differentiator because the effort required to generate it continues to decline.

As this happens, another challenge becomes more visible. Many organizations discover that their greatest constraint is no longer information. It is decision-making.

When ownership is unclear, faster insights do not necessarily produce faster outcomes. Teams may have access to excellent recommendations yet still struggle to determine who is responsible for acting on them. Multiple stakeholders may believe they have authority over a decision. Escalations become more common. Consensus-driven cultures can become overwhelmed by the volume of information being generated.

Some of the most difficult conversations I have encountered in AI initiatives have had little to do with models, prompts or technical architecture. Instead, they involve governance, ownership, accountability and decision rights. These challenges existed before AI, but the technology makes them more visible because it removes many of the delays previously associated with gathering and analyzing information.

This trend is likely to become even more pronounced as organizations adopt AI agents capable of executing tasks and workflows. While technology can automate actions, accountability remains a leadership responsibility. Leaders must still determine who owns outcomes, who approves actions and who is responsible when decisions create unintended consequences.

What leaders should fix before scaling AI

Deloitte’s annual State of AI in the Enterprise research highlights the challenges organizations face when attempting to scale AI beyond pilots and isolated use cases. This finding reinforces a lesson many leaders are learning firsthand: realizing value from AI requires organizational change, process redesign and strong leadership, not just new technology

For CIOs and business leaders, one of the most important priorities should be simplifying processes before automating them. AI can reduce manual effort, but it rarely eliminates complexity that has been embedded into a process over many years. Organizations often achieve greater value by removing unnecessary steps before introducing automation.  As Jon McNeill writes in his book, The Algorithm, “No need to waste time speeding up the old process. Instead, design, simplify, optimize and begin to work your new process. Then speed it up.”

Leaders should also establish clear decision rights before scaling AI-enabled workflows. As information becomes easier to generate, organizations need clarity regarding who is accountable for making decisions and driving action. Without that clarity, AI can create more recommendations than the organization is capable of acting upon.

Another important consideration is measurement. Many organizations continue to evaluate AI success through adoption rates, license utilization or employee engagement metrics. While these measures provide useful signals, they do not necessarily reflect business value. Leaders should focus on outcomes such as productivity improvements, revenue growth, cost reduction, customer experience enhancements and risk mitigation.

Most importantly, leaders should recognize that AI adoption is fundamentally a leadership challenge. Technology can accelerate work, but leaders determine how work is organized, governed, measured and improved. Organizations that treat AI solely as a technology initiative often struggle to move beyond experimentation. Organizations that use AI as an opportunity to improve processes, clarify accountability and modernize operating models are more likely to achieve sustainable results.

As AI adoption continues to accelerate, I believe the organizations that realize the greatest value will not necessarily be those with the largest investments or the most advanced models. They will be the organizations willing to address the management and operational issues that AI brings into focus. In many cases, AI is not creating new problems. It is revealing existing ones with greater speed and clarity.

That may be one of the most valuable contributions AI can make. By exposing inefficiencies that organizations have learned to tolerate, it creates an opportunity for leaders to address them directly. The companies that seize that opportunity will be better positioned not only to benefit from AI, but also to improve the way their organizations operate long after the current wave of innovation has passed.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

In the wake of AI, the early-talent job market is in decline across all jobs and industries, with a 10% drop since 2021, according to a recent report from SAP. When isolated for the top 10 most common entry level job titles, including software engineer, customer support, and data analyst, job openings declined 35% from 2024 to 2025.

AI is already impacting entry-level and task-based roles, leaving the question of what will happen to the future talent pipeline of IT leadership.

“Our research suggests that organizations create a gap in their future leadership pipeline if they continue reducing entry-level hiring without rethinking how early-career talent develops,” says Autumn Krauss, chief scientist for Future of Work Research Lab at SAP SuccessFactors. “Historically, people built business acumen, technical expertise, and leadership skills through the first few years of their careers. As AI becomes embedded in workflows, organizations need to be intentional about creating new ways for employees to build those skills.”

Companies have traditionally followed hierarchal processes that encourage employees to advance up the career ladder via promotions, with many taking a leadership path to IT director, CIO, or CTO. However, this process has always relied on workers starting with entry-level and routine work to create a natural first step for future leaders. But now, more companies are automating the work that entry-level and mid-level employees used to cut their teeth on, says Maruf Ahmed, CEO of IT staffing and consulting company Dexian.

For example, a junior engineer might start in QA and testing on the technical side, getting hands-on experience with how systems work. As they progress in their career, that knowledge continues to stack, creating future leaders who deeply understand the technology and the business.

“Maintaining a strong succession path starts with being honest about what AI removed from someone’s development, and then being intentional about replacing it,” says Ahmed. “Senior leaders need to spend more time actively teaching, and people need exposure to complex decisions earlier in their careers. Day-to-day work used to build that foundation on its own, and it doesn’t anymore.”

Redesigning jobs for AI and leading in uncertainty

As many have discovered, it’s not always easy to decipher quality AI outputs, especially as the technology has become renowned for hallucinating results. Current and future IT leaders need the foundational knowledge to have confidence when evaluating AI outputs, especially if they’re expecting employees to use AI. The most valuable leaders are the ones comfortable making decisions with incomplete information, and who can make calls on the spot about automated processes, no matter what may arise.

“We often see AI doesn’t stay contained in one function for long,” Ahmed adds. “Once an organization automates in one area, there’s an expectation to extend that more broadly, and leaders who built their careers inside a specific function are suddenly being asked to weigh in on AI use in areas they’ve never directly managed.”

According to recent research from Deloitte, 84% of companies haven’t done the work to redesign jobs around AI despite high expectations for automation, and 36% expect at least 10% of their jobs to be fully automated within a year, and 82% say within three years. Even with those results, fewer than half are making significant adjustments to talent strategies, with 53% saying they’re simply focusing on educating employees to raise AI fluency.

That leaves entry-level workers and those in task-aligned roles in somewhat unknown territory as automation replaces time-consuming tasks, and managers shift to overseeing human-AI teams. Deloitte points to a potential shift toward flatter structures, with more than half of businesses considering pod-based or non-hierarchal models, while 16% have already started to make a shift.

IT leaders will likely find themselves relying more on others in the company to make judgment calls around AI, opening communication and transparency as job roles evolve and structures begin to flatten. With AI adoption happening at a rapid pace, organizations need to evaluate how it’ll impact talent and leadership structures, and what the future of leadership will look like with automation.

Investing in early talent to maintain a leadership pathway

IT leaders need to avoid the trap of treating AI adoption as a technology rollout rather than a workforce development project, says Ahmed. Leaders will continue to invest heavily in new tools, services, hardware, and technology, and then expect employees to become self-taught on these platforms in their downtime.

“Our research found that leaders don’t often feel confident or equipped with the skills to lead that level of transformation. Instead, organizations often fall back on the tactic of giving employees AI tools and expecting them to figure out how best to use them on their own,” says Krauss.

If current IT leaders feel unequipped to lead through AI transformation, it’s imperative companies step back and reevaluate training and future leadership talent pools. Investments in AI should be weighed alongside the necessary investments for employee upskilling and training, and to redefine long-standing organizational structures.

Investment in early talent development programs can also be beneficial for tackling potential future leadership gaps left by AI adoption, with 86% of employees saying that an early talent program helped set them up for career success, according to the SAP report. But despite the beneficial nature of such programs, only 32% of early talent report participating in an early talent program, and 49% say their organization doesn’t offer one. Plus, only 35% of early talent employees say they’ve been given sufficient transparency into which roles in their organization may be automated in the future, while one in three express concerns their job may one day cease to exist due to AI advancements.

“As roles change, organizations need to give employees a clearer picture of where opportunities are emerging and what skills will be most important,” says Krauss. “Many employees are already uncertain about how technology will affect their careers, and that uncertainty can make it harder to stay engaged. People are more likely to invest in their growth when they see a path forward. That visibility is becoming increasingly important.”

AI가 가져온 혁신의 물결은 많은 IT 리더가 인정하고 싶어 하는 것보다 훨씬 빠른 속도로 IT 인재 육성 체계를 중대한 갈림길로 몰아가고 있다.

그동안 기업들은 신입 직급부터 인재를 육성해 내부에서 IT 전문성을 키워왔지만, 이제는 AI 활용 경험을 갖춘 인재에 대한 수요가 커지고 AI 자동화가 초급 직무를 대체하면서 이러한 전통적인 인재 육성 방식이 흔들리고 있다.

스탠퍼드대학교 디지털경제연구소(Stanford Digital Economy Lab)의 널리 인용되는 연구에 따르면, 챗GPT가 등장한 2022년 말 이후 AI의 영향을 가장 크게 받는 직군에서 22~25세 초기 경력 직원의 고용은 16% 감소했다. 신입 소프트웨어 개발자의 경우 감소 폭은 약 20%에 달했다. 실무 경험을 쌓은 초기 경력 IT 인재 풀이 줄어들면서 앞으로 IT 리더들은 보다 중요한 중급 인력을 확보하는 데 더욱 큰 어려움을 겪을 가능성이 크다.

일부 IT 리더는 비용 절감을 위해 주니어 엔지니어와 신입 IT 직무를 AI로 대체하는 전략이 결국 역효과를 낳을 것으로 보고 있다. 복잡한 문제를 해결하고 확장 가능한 시스템을 설계할 수 있는 숙련 인력이 부족해질 수 있다는 것이다.

가트너가 최근 전 세계 기업 경영진을 대상으로 실시한 조사에서도 비슷한 결과가 나타났다. 업무 자동화를 확대하고 인력을 감축한 기업들은 기대했던 생산성 향상 효과를 충분히 거두지 못한 것으로 조사됐다. 반면 새로운 직무를 만들고 직원의 역량을 강화하며 자율적으로 수행되는 업무를 관리하고 발전시킬 수 있도록 지원하는 시스템에 투자한 기업들은 수익성 개선 효과를 거둔 것으로 나타났다.

가트너는 앞으로 2~3년 동안 자율형 비즈니스 운영이 확산되면서 오히려 더 많은 인력이 필요해질 것으로 전망했다. 자율형 업무를 관리할 인재 채용이 늘어나면서 전체적으로는 고용이 순증할 것이라는 분석이다.

그럼에도 단기적으로는 AI를 활용해 인력을 감축하는 기업들이 투자자들로부터 긍정적인 평가를 받고 있으며, 많은 경영진 역시 이러한 전략을 추진하고 있다. 그렇다면 CIO를 비롯한 IT 리더들은 미래에 필요한 역량을 확보하기 위해 중견·고급 IT 인재로 성장할 수 있는 경력 경로를 어떻게 구축할 계획일까?

성장을 좌우하는 것은 ‘맥락 경험’

초기 경력 인력 채용이 감소하는 흐름에 대해 마이크로소프트(MS)의 마크 루시노비치와 스콧 한셀만은 최근 공동 기고문을 통해 다른 해법을 제시했다. 이들은 초기 경력 개발자를 제품 개발팀에 배치하고 숙련된 엔지니어와 멘토 관계를 맺도록 해야 한다고 주장했다. 이를 통해 신입 개발자가 AI가 놓칠 수 있는 실제 현장의 문제를 발견하고 해결하는 능력을 기를 수 있다는 것이다.

두 사람은 기고문에서 AI가 생성한 코드가 겉보기에는 정상적으로 작동하는 것처럼 보였지만, 숙련된 개발자들은 그 안에서 수십 개의 문제를 찾아냈다고 소개했다. 또한 MIT 연구를 인용하며, 글쓰기 작업에서 AI에 지나치게 의존할 경우 뇌 활동이 감소하는 이른바 ‘인지 부채(cognitive debt)’ 가 발생할 수 있다고 지적했다.

두 사람은 “AI 에이전트는 업무 속도를 높이고 반복적인 작업을 줄일 수는 있지만, 예외 상황을 예측하거나 견고한 시스템을 설계하는 직관은 갖추지 못했다”라며 “AI에 지나치게 의존하면 숙련된 엔지니어만 발견할 수 있는 미묘한 버그와 아키텍처 결함, 보안 취약점을 놓칠 위험이 있다. 기술이 발전할수록 인간의 검토와 비판적 사고, 도메인 지식은 오류를 바로잡고 혁신을 이끄는 데 필수적이다”라고 설명했다.

MS 부사장이자 기술 스태프(Microsoft Technical Fellow)인 한셀만은 소프트웨어 개발은 단순히 코드를 작성하는 일이 아니라고 강조했다.

한셀만은 숙련된 엔지니어는 무엇이 효과가 있고 무엇이 실패하는지, 실제 운영 환경에서 어떤 문제가 발생하는지, 뛰어난 설계란 무엇인지, 그리고 시스템을 어떻게 확장해야 하는지를 경험을 통해 체득한다고 설명했다. AI는 개발 생산성을 높일 수는 있지만 이러한 판단력을 신입 개발자에게 길러주지는 못한다는 것이다.

한셀만은 “흔히 ‘초기 경력(early in career)’이라고 말하지만, 실제로는 ‘맥락을 처음 접하는 단계(early in context)’ 에 가깝다. 주니어 개발자에게 부족한 것은 맥락(Context)이다”라고 말했다.

이어 “좋은 안목과 판단력은 안전하게 실패를 경험하는 과정에서 만들어진다”라며 “하지만 지금 많은 기업은 주니어 개발자를 채용한 뒤 곧바로 어려운 문제에 투입하고 소모품처럼 다룬다. 이는 사람을 성장시키는 방식이 아니라 잘못된 접근이다”라고 지적했다.

새로운 멘토링 모델

한셀만은 주니어 프로그래머를 감원하기보다 이들이 미래에 핵심적인 시니어 인재로 성장하는 데 필요한 역량을 키울 수 있는 체계를 구축해야 한다고 제안했다.

그가 제시한 해법은 의료 분야의 ‘프리셉터십(preceptorship)’ 모델이다. 숙련된 엔지니어가 주니어 개발자의 실무 경험과 판단력 향상을 공식적으로 책임지는 멘토링 방식이다. 한셀만은 간호사이자 프리셉터로 활동하는 아내의 경험에서 이 아이디어를 얻었다고 설명했다.

한셀만은 “프리셉터십은 간호사가 국가 자격시험을 통과했고 회사에 입사했으며 첫 출근을 했다는 사실을 인정하는 제도”라며 “현장에서 일할 자격은 충분히 갖췄지만 아직 업무에 필요한 맥락(Context)은 부족하다는 점을 전제로 한다”라고 설명했다.

기술 기업에도 이와 같은 모델이 필요하다고 그는 주장했다. 경험 많은 멘토로부터 단순히 결과물을 만들어내는 방법이 아니라 배우고 성장할 기회를 제공해야 한다는 것이다.

그는 “우리에게 필요한 것은 뛰어난 소통 능력과 높은 주도성을 갖춘 사람, 그리고 미래 인재 육성에 기꺼이 투자할 수 있는 사람이다”라고 말했다.

한셀만은 이러한 실무 중심의 멘토링 방식을 코딩 부트캠프와 비교하며 차이점을 설명했다.

그는 “부트캠프에서는 결국 많은 사람이 중도에 탈락한다. ‘당신은 해낼 수 없었다’는 평가를 받게 되는 셈이다”라며 “반면 프리셉터십은 숙련된 엔지니어가 주니어 개발자의 성장을 진심으로 돕고, AI를 활용하는 뛰어난 소프트웨어 엔지니어로 성장하도록 이끄는 관계다. 단순히 ‘바이브 코더(vibe coder)’를 만드는 것이 아니다”라고 말했다.

이어 “우리는 감에 의존해 코드를 운영 환경에 배포하는 것이 아니다. 이미 개발된 강력한 도구를 활용해 뛰어난 안목과 분별력을 바탕으로 대규모 환경에서도 높은 품질의 소프트웨어를 만드는 것이 목표다”라고 설명했다.

AI가 초래할 미래 인재 공백

AI가 일부 초급 업무를 대신할 수 있다는 이유로 주니어 직무를 없애는 기업은 단기적으로는 생산성을 높일 수 있을지 몰라도 장기적으로는 기술 경쟁력을 약화시킬 수 있다. 업계에서는 초기 경력 인재 채용에 대한 투자가 줄어들면 앞으로 리더십과 조직 내 축적된 기술 지식이 부족해질 뿐 아니라, 제품 품질과 AI가 생성한 코드 및 결과물을 효과적으로 관리·감독하는 능력도 떨어질 것이라고 우려한다.

패스트푸드 체인 소닉(Sonic)의 전 CIO이자 현재 컨설턴트, 이사회 자문위원, 저술가로 활동하는 크레이그 밀러(Craig Miller)는 “시니어 엔지니어는 단순히 코드를 작성한다고 만들어지는 것이 아니라 실제 시스템을 경험하면서 성장한다”라며 “시스템이 어떻게 확장되는지, 어떤 방식으로 장애가 발생하는지, 그리고 기술적 의사결정이 비즈니스에 어떤 영향을 미치는지를 이해해야 한다. 이런 경험은 자동화할 수 없다”라고 말했다.

클라우드 기반 HR 소프트웨어 기업 하이밥(HiBob)의 인사·문화 담당 부사장인 마케어 몬티니(Macaire Montini)는 주니어 개발자 채용 축소를 단순한 비용 절감이 아니라 장기적인 역량 리스크로 봐야 한다고 말했다.

몬티니는 “주니어 개발자 채용 감소는 단순한 고용시장 변화가 아니다”라며 “이는 장기적인 인재 파이프라인 문제로, 기술 리더는 이를 인프라 리스크와 같은 수준의 시급성으로 다뤄야 한다”라고 설명했다. 이어 “초기 경력 인재 영입을 중단하면 지금 당장 인력 공백이 생기는 데 그치지 않는다. 5년 후에는 조직을 이끌 리더가 부족한 상황에 직면하게 될 것”이라고 말했다.

그래프소프트(Graphisoft)의 CTO 졸트 케레첸(Zsolt Kerecsen)은 초기 경력 인력을 AI로 대체하면 인재 육성을 저해하고 조직의 자율형 시스템 운영 역량도 약화된다고 지적했다. 그는 CIO가 초기 경력 인재 채용을 미래의 서비스 품질과 시스템 관리, AI 거버넌스를 위한 투자로 인식해야 한다고 강조했다.

케레첸은 “AI를 학습시키고 결과물을 검증하려면 숙련된 개발자가 반드시 필요하다”라며 “주니어 개발자를 AI로 대체하려는 발상은 근본적으로 잘못됐다. 오히려 시니어 개발자의 지도 아래 AI를 활용해 주니어 개발자의 성장을 지원하고 더 빠르게 시니어 엔지니어로 성장하도록 도와야 한다”라고 말했다.

밀러는 초기 경력 채용 감소는 현재의 기술 인력이 후배를 제대로 양성하지 않는 이른바 ‘느린 쇠퇴(slow decay)’ 현상의 한 단면일 뿐이라고 진단했다. 그는 미래 인재 부족을 보여주는 또 다른 신호로 컴퓨터공학(CS) 전공 지원자 감소를 꼽았다.

밀러는 “취업시장 전망이 악화되면서 컴퓨터공학 전공 등록자도 줄고 있다”라며 “이런 추세가 이어지면 AI가 현재는 초급 개발자 수요를 줄이더라도 앞으로 5~10년 안에 시니어 엔지니어 부족 현상이 나타날 수 있다”라고 말했다.

이어 “진짜 위험은 AI가 개발자를 필요 없게 만드는 것이 아니다”라며 “기업들이 뛰어난 개발자를 길러내던 초기 학습의 장 자체를 없애고 있다는 점이 더 큰 문제”라고 지적했다.

미래 인재 파이프라인 구축

초기 경력 직무의 성격이 빠르게 변화하는 가운데 전문가들은 CIO에게 특히 개발자를 포함한 IT 인재의 채용과 육성 방식을 보다 전략적으로 재설계해야 한다고 조언한다. 핵심은 AI로 주니어 인력을 대체하는 것이 아니라, AI를 활용해 이들이 더 빠르고 효과적으로 성장하도록 지원하는 것이다.

몬티니는 AI 덕분에 주니어 개발자가 이전보다 더 복잡한 업무를 일찍 맡을 수 있게 됐지만, 숙련된 인재로 성장하려면 여전히 멘토링과 체계적인 지도가 필요하다고 말했다.

몬티니는 “해답은 단순히 사람을 채용하는 데 있지 않다”라며 “중요한 것은 초기 경력 인재가 입사한 이후 어떻게 온보딩하고 성장시키느냐이다. 체계적인 교육과 명확한 역량 개발 경로, 의미 있는 멘토링이 잠재력을 실제 성과로 연결해 준다. 이러한 성장 기반이 없다면 주니어 인력은 기업이 필요로 하는 중급 인재로 성장하기 전에 조직을 떠나게 된다”라고 설명했다.

헬륨 SEO(Helium SEO)의 CTO 폴 드모트(Paul DeMott)는 인재 육성은 신입사원의 첫 출근일부터 새롭게 설계해야 한다고 강조했다.

드모트는 “우리 팀의 주니어 개발자는 새로운 기능을 위해 코드를 한 줄이라도 작성하기 전에 먼저 전체 아키텍처를 설계하고, 이를 시니어 개발자들과 15분 동안 리뷰하며 모든 설계 선택의 이유와 트레이드오프를 설명해야 한다”라며 “주니어 개발자는 자신의 판단을 충분히 입증하기 전까지는 구현을 시작할 수 없다. 이 과정은 문법(syntax)보다 시스템 관점의 사고를 먼저 익히도록 만들며, 이것이 시니어 개발자로 성장하는 사람과 단순 구현 업무에 머무는 사람을 가르는 결정적인 차이”라고 설명했다.

드모트는 지난 1년 반 동안 이러한 방식 덕분에 주니어 개발자의 성장 속도가 빨라졌으며, 실제로 두 명의 주니어 개발자가 중급 개발자로 승진했다고 소개했다.

케레첸은 자사에서는 대학 단계부터 유망한 인재를 적극 발굴해 수년간 함께 프로젝트를 수행한 뒤 주니어 또는 경우에 따라 중급 엔지니어로 채용하고 있다고 밝혔다.

케레첸은 “AI의 잠재력, 특히 주니어 개발자를 대체할 수 있다는 능력에 대해 심각한 오해가 존재한다”라며 “그러한 접근은 서비스 품질과 장기적인 지속 가능성을 해치는 결과를 초래할 수 있다. 주니어 개발자는 우리의 미래를 위한 투자다”라고 말했다.

역량 개발 및 채용 전문 기업 커리어 하이웨이즈(Career Highways)의 CEO 리즈 에버솔(Liz Eversoll)은 조직이 비공식적인 도제식 교육에서 벗어나 역량 중심의 성장 모델을 보다 체계적으로 구축해야 한다고 말했다.

에버솔은 “차세대 시니어 프로그래머는 지금까지와는 다른 방식으로 성장하게 될 것”이라며 “주니어 엔지니어는 AI를 코파일럿처럼 활용해 이전보다 복잡한 업무에도 더 일찍 기여할 수 있다. 다만 이를 위해서는 실제 업무와 학습, 지속적인 평가를 유기적으로 연결하는 성장 경로를 조직이 마련해야 한다”라고 설명했다.

생산성이 아니라 ‘판단력’을 키워야 한다

궁극적인 목표는 주니어 개발자가 시스템을 이해하고 다양한 선택지의 장단점을 판단하며, 궁극적으로는 기술적 의사결정을 주도할 수 있는 경험을 쌓도록 돕는 것이다.

소닉(Sonic)의 전 CIO인 크레이그 밀러는 이러한 경험은 자동화할 수 없다고 강조했다.

밀러는 “이 문제를 제대로 해결하는 조직은 AI가 가져오는 효율성과 체계적인 멘토링, 실제 운영 환경에서의 경험을 균형 있게 결합하고 인재 육성을 장기적인 과제로 바라볼 것”이라며 “차세대 시니어 엔지니어는 저절로 탄생하지 않는다. 체계적인 도제식 교육과 적절한 AI 활용, 실제 운영 환경 경험은 물론, 판단력과 아키텍처 사고, 디버깅 역량, 비즈니스 맥락에 대한 이해를 의도적으로 키워야만 성장할 수 있다”라고 말했다.

팀 빌딩 플랫폼 기업 그로지악(Groziac)의 설립자 레마 로라스(Rema Lolas)는 AI가 기술 역량의 진입 장벽을 낮출 수는 있지만, 사람 간 협업 방식의 중요성은 더욱 커질 것이라고 전망했다.

로라스는 “AI는 기술 역량의 격차를 줄일 수 있지만, 사람의 업무 수행 능력 차이는 오히려 더 크게 만들 것”이라며 “이를 일찍 깨닫는 조직은 더 이상 인재 육성을 단순한 교육 문제가 아니라 시스템 설계의 과제로 접근하게 될 것이다. 구성원의 기술뿐 아니라 함께 일하는 방식과 성과를 내는 방식까지 의도적으로 설계하고 육성하게 될 것”이라고 설명했다.

MS의 스콧 한셀만은 지금 가장 중요한 역량은 AI 프롬프트를 능숙하게 작성하거나 빠르게 코드를 생성하는 능력이 아니라 시스템 사고와 커뮤니케이션 능력이라고 강조했다.

한셀만은 “이 분야에 새롭게 들어오는 사람이라면 시야를 좁게 가져서는 안 된다”라며 “사람들에게 도움을 주고 삶을 더 나아지게 하는 크고 복잡한 시스템을 만드는 일은 결코 상품처럼 대체될 수 없다. 큰 그림을 보는 사고력과 안목, 분별력, 올바른 판단력, 뛰어난 의사소통 능력, 그리고 기본기에 대한 탄탄한 이해가 필요하다. 우버를 이용해 이동한다고 해서 자동차 타이어를 교체하는 방법까지 잊어버리는 것은 아니다”라고 말했다.

업계 리더들은 초기 경력 인재의 성장을 엔지니어링 조직의 핵심 업무로 삼아야 한다고 입을 모은다. 이를 위해서는 주니어 개발자에게 실제 개발 업무를 맡기고, 업무 현장에서 시니어 엔지니어의 즉각적인 지도를 제공하며, AI를 사람을 대체하는 도구가 아니라 학습을 가속하는 도구로 활용해야 한다는 것이다.

커리어 하이웨이즈(Career Highways)의 리즈 에버솔은 “이제 시니어 인재 육성은 채용의 부산물이 아니라 의도적으로 설계한 조직 시스템의 결과”라며 “역량 기반 성장 체계에 투자하는 조직은 인재 파이프라인을 유지하는 데 그치지 않고, 그 성장 속도까지 더욱 높일 수 있을 것”이라고 말했다.
dl-ciokorea@foundryco.com

Whether you are using an AI code generator, vibe coding, or applying spec-driven development methodologies, your job doesn’t end with AI writing the code. Whether you’re using AI to develop applications, APIs, data pipelines, AI agents, or other automations, writing the code is just one part of the job. Developers must still perform code validation, test applications, automate deployment, and configure infrastructure.

According to one survey, only 16% of a developer’s time is spent writing code. The remaining 84% is spent on other activities including defining requirements, triaging bugs, and addressing vulnerabilities.

Additionally, while AI code generation speeds up development, it can come at the cost of quality and collaboration. In Atlassian’s State of Teams 2026 survey, nearly 50% of respondents say their AI outputs aren’t reliably high quality and admit that using AI is a compromise between speed and quality. Knowledge workers say the pressure to execute is also problematic, with 87% saying they lack time to coordinate and 70% saying their processes aren’t well-optimized for AI.

So, although AI capabilities have changed drastically in the past few years, code-generation tools are not the only ways AI can improve software development. In fact, developers should seek additional AI capabilities to support the full software development life cycle (SDLC). Here are five recommendations for the AI coding stack. 

Scale up testing environments

If coding is faster, development teams should have suitably configured environments that they can use to quickly and easily test changes against real APIs and databases. Testing apps and AI agents against environments that don’t mimic production can slow down development.

“Remote + local” development environments (local execution with remote context) are one option to accelerate testing. Developers can code locally on their own physical or virtual machine, but build and deploy to remote instances. Additionally, when developing AI agents, developers need an execution environment, such as secure sandboxes or ephemeral virtual machines.

“GenAI has been a step-change for developer productivity, absorbing the repetitive work of writing boilerplate, tests, and refactors so engineers can focus on intent and design,” says Aviram Hassan, CEO and cofounder at MetalBear. “But by compressing the time it takes to produce all of this, genAI has also exposed what’s always been the real bottleneck in the SDLC: the feedback loop against the real world. Validating code and configurations against a realistic cloud environment still depends on the same slow build-and-deploy cycles teams have tolerated for years.”

The goal should be to remove the friction and delays from where developers code to a complete, real-world infrastructure they can use to validate changes. Three tools to review are mirrord, Signadot, and Telepresence.

Validate the AI-generated code

At a recent Coffee With Digital Trailblazers LinkedIn Live event that I hosted on AI coding competencies, one speaker shared how he quickly went from a short spec to more than 10,000 lines of AI-generated code. He admitted he didn’t have the time, expertise, or tools to validate the code. He’s not alone. In Sonar’s State of Code Developer Survey, 96% of developers don’t fully trust AI’s output, but only 48% always verify it before committing.

“Agentic software development is generating code faster than any team can manually review it, but speed without confidence only results in technical debt,” says Scott Sanders, corporate vice president of engineering at Sonar. “What’s needed to avoid this is an automated independent verification layer embedded directly into the development workflow—one that unifies code quality and code security into a single, deterministic platform to deliver actionable intelligence before code ever reaches the repository.”

A big concern is that AI-generated code can produce 1.4 times as many critical issues as code created by developers, according to CodeRabbit’s State of AI Versus Human Code Generation Report. Top issues include code readability, cross-site scripting, code formatting errors, and incorrect concurrency control.

Another challenge is that 82.4% of AI tools originate from third-party packages, according to Snyk’s 2026 State of Agentic AI Adoption. The implication is that development teams have much more code to validate than they develop themselves, whether by humans or AI code generators.

“When tools like Cursor are installing dependencies and running actions on a developer’s behalf, they can unintentionally pull in malicious or unvetted packages,” says Randall Degges, vice president of AI engineering and developer relations at Snyk. “That’s why techniques like intercepting tool calls, validating inputs and outputs, enforcing least-privilege access, and isolating credentials are becoming foundational to how AI-driven development systems operate. Without security embedded directly into the agent loop, teams risk shipping faster into more exposure, not less.”

According to Qodo’s report on The AI Coding Paradox, 89% of enterprise engineering teams have experienced an AI-generated code incident and have had a production outage caused by AI-generated code. Development teams building a large portfolio of AI agents or heavily relying on AI code-generation capabilities may want to look at AI code-review tools that provide more contextual analysis than basic static code review tools.

“Current AI coding assistants suffer from a severe amnesia problem, and each session starts without memory of an organization’s unique context, subjective standards, and business logic,” says Itamar Friedman, CEO and cofounder at Qodo. “To safely scale AI, it requires integrating stateful systems equipped with persistent organizational memory that continuously learn from past pull requests and automatically enforce enterprise-specific governance. Ultimately, developers need tools that ensure code is guided by continuously learning organizational experience rather than just raw machine-generated code.”

Tools to review include static application security testing (SAST), software composition analysis (SCA), software bill of materials (SBOM), and AI code review tools.

Security and end-to-end testing

Even when AI-generated code passes all the tests, how can devops teams validate whether it meets business and non-functional technical requirements? Many devops teams have invested in continuous testing, and some support continuous deployment, but the underlying assumptions behind those practices are being challenged now by who is coding and how much code is being generated. 

Some spec-driven development platforms aim to bridge the gap. Tools like Appian Composer and SAP Joule Studio 2.0 generate product requirements documents (PRDs) before coding, enabling the introduction of business acceptance criteria. These tools create knowledge graphs from the business processes implemented on their platforms and provide environments for validating AI agents before deployment.

“For most organizations, the AI code-generation methodology question matters less than the verification question,” says Gal Vered, CEO and cofounder at Checksum.ai.  “Whether your team is prompting from intent or working from specs, AI-generated code still needs to be validated against a production environment before it ships.”

Beyond functional testing, developers must look at new security concerns, especially as AI agents integrate with Model Context Protocol servers. “Most teams are stacking generation tools on top of review tools and on top of testing tools, but without security validation embedded at every stage, you’re just automating the path to your next breach,” says Harshit Agarwal, CEO at Appknox. “Mature teams treat security feedback as a non-negotiable part of the build loop, running automated checks continuously rather than catching issues after the fact.”

Add observability tools

Developers save an average of 3.6 hours per week with AI coding tools, according to one report, and the more experienced engineers achieve the largest productivity gains.

What’s one way to blow these savings? When defects get pushed to production, it’s often the site reliability engineers and senior developers who are left to triage and resolve the issue. Establishing observability practices as a devops non-negotiable is a development investment that pays off significantly to help diagnose issues, resolve errors, and improve performance.

“In data and AI systems, even small changes like model updates, tool decisions, or shifts in data flow can silently cascade into issues no one anticipated, and the AI agent has no way to know that,” says Barr Moses, cofounder and CEO at Monte Carlo. “Leading teams are addressing this by embedding observability across the entire agentic stack, particularly at precommit checkpoints, so agents can surface the true impact of changes before they go live.”

While many devops teams have mature observability practices for APIs, applications, and data integrations, observability practices for AI agents are relatively new. One technique to consider is AI tracing platforms with notation queues for human review and LLM-as-judge evals. A second option is to implement an AI gateway with observability, caching, routing, and cost-tracking capabilities.

Develop reusable agent skills

One last element of the AI stack, especially for organizations heavily investing in AI agent development, is to adopt best practices for developing reusable skills embedded in code-generating tools.

“A key emerging pattern is purpose-built AI skills: reusable, scoped instructions that give agents deep context for specific tasks, rather than relying on general-purpose prompting alongside antagonist agents that challenge other agents’ outputs,” says Phillip Goericke, CTO of NMI. “The defining shift is that developers are no longer writing code with AI assistance—they’re architecting the systems that produce and validate it.”

Development organizations that leverage code-generation tools are recognizing that coding is just one part of delivering business value from AI and resilient AI agents. Developing AI skills and establishing an AI stack are steps toward scaling to a dependable AI software development life cycle.

The transformative lure of AI is rapidly pushing IT leaders’ talent pipelines toward more of a crossroads than many may fully want to admit.

The traditional approach of growing IT expertise in-house from entry-level positions is being challenged by a combination of skills-demand shifts toward AI experience and the replacement of entry-level roles in favor of AI automation.

Employment among early-career workers, ages 22 to 25, in the most AI-exposed occupations has fallen 16% since the introduction of ChatGPT in late 2022, according to a widely cited study from Stanford’s Digital Economy Lab. For entry-level software developers, the drop was nearly 20%. As the pool of talent with early-career IT pros with hands-on experience shrinks, IT leaders are likely to face stiffer challenges filling more vital midlevel roles down the road.

Looking forward, some IT leaders believe replacing junior engineers and other entry-level IT roles with AI to cut costs will eventually backfire, leaving companies short of experienced staff who can tackle difficult problems and design scalable solutions.

According to a recent Gartner survey of global business executives, organizations that automated aspects of their businesses and reduced their workforces aren’t seeing returns from those supposed efficiencies. What has improved the bottom line? Investing in new roles, upskilling, and systems that amplify the capabilities of staff so they can supervise and grow autonomous work.

Moreover, the Gartner report forecasts that autonomous business practices will require more staff, not less, over the next two to three years, leading to a net positive in job growth as people are hired to manage those efforts.

Yet, in the short term, investors are rewarding companies that make AI-related workforce reductions. And many executives are pushing for the same. So how are CIOs and other leaders planning to build the necessary skills for future success by creating a pathway for middle- and senior-level IT talent?

‘Early in context’

In response to this downward trend in early career hiring, Microsoft’s Mark Russinovich and Scott Hanselman penned an article that pushes back on this trend. They propose bringing in early-career programming talent and pairing them with experienced mentors on product teams, where they can help new hires identify — and solve — real-world problems that AI might miss.

In the article, the Microsoft execs noted that experienced programmers found dozens of problems in AI-generated code that appeared to work correctly. They also pointed to the risk of “cognitive debt,” citing MIT research that found reduced brain activity among people relying heavily on AI for writing tasks.

“While agents can speed up workflows and reduce manual effort, they lack the intuition to anticipate edge cases and build robust solutions,” the authors wrote. “Relying too much on AI risks missing subtle bugs, architectural flaws, and vulnerabilities that only skilled engineers can catch. Human oversight, critical thinking, and domain knowledge are indispensable for both correcting errors and driving innovation as technology progresses.”

Hanselman, vice president and member of technical staff at Microsoft, argues that software development isn’t simply a matter of writing code. Senior engineers, he notes, have experience in what works, what fails, what can break in production, and what elegant design looks like — and how to scale it. AI can increase output, but it does not help a new developer learn this sort of judgment.

“When you say early in career, it’s actually early in context — junior devs are missing context,” he says. “The way that we develop good taste is through failing in a safe place. And right now, companies hire juniors, throw them at a problem, chew them up and spit them out — and that’s the wrong way to do it.”

A new mentorship model

Hanselman suggests, instead of slashing roles for junior programmers, companies should be creating systems that help them develop the skills necessary to become valued senior contributors in the future.

He proposes adopting a mentorship approach called a “preceptorship,” borrowed from the medical field, where senior engineers are explicitly responsible for helping juniors gain experience and develop good judgment. Hanselman’s wife is a nurse and preceptor, and her experience helped spur the idea.

“The preceptorship acknowledges that a nurse has passed the board,” he explains. “They’ve joined the company. It’s their first day on the job. They are qualified to be there. They are supposed to be there — but they’re missing context.”

Technology companies need a similar model, he argues, where programmers are allowed to learn, not just produce, from experienced mentors: “We need high communicators, with high agency — kind individuals who will invest in the future.”

He contrasts this practical, real-world mentoring approach with a coding boot camp.

“What do people do in boot camps? They wash out,” he says. “You couldn’t hack it. A preceptorship is a relationship between a senior engineer, who has your best interest at heart and is going to help you become a better AI-augmented software engineer — not a vibe coder. We’re not vibing into production. We are using the powerful tools that have been developed to create high-quality software with good taste and with good discernment at scale.”

A talent gap in the making

Companies that eliminate junior roles because AI can do some entry-level tasks may see improved short-term output while weakening their future technical capabilities. Tech executives say a lack of investment in early career hiring will show up in the future as a dearth of leadership and institutional knowledge, as well as a reduction in product quality and the ability to effectively manage and oversee code or other work created with AI.

“Senior engineers are built through exposure to real systems, not just writing code,” says Craig Miller, former CIO of fast-food chain Sonic, now a consultant, board advisor, and author. “They need to understand how things scale, how they break, and how decisions impact the business. That experience cannot be automated.”

Reducing junior developer roles should be seen as a long-term capability risk instead of a budget efficiency, says Macaire Montini, vice president of people and culture at cloud-based HR software company HiBob.

“The decline in junior developer roles isn’t just an employment trend,” Montini says. “It’s a long-term pipeline problem that technology leaders should treat with the same urgency as any infrastructure risk. If you stop bringing in early-career talent, you don’t just have a gap today — you have a leadership drought in five years.”

Zsolt Kerecsen, CTO at Graphisoft, argues that replacing early-career staff with AI hurts staff growth and undercuts an organization’s ability to manage autonomous capabilities. CIOs should treat early-career hiring as an investment in future delivery quality, system oversight, and AI governance, he says.

“Experienced developers are needed to train AI and validate its outputs,” he says. “That’s why trying to substitute juniors with AI is a fundamentally flawed approach. Instead, AI should be used — guided by seniors — to support junior developers and help them become seniors more quickly.”

Miller says the reduction in early career hiring is just one sign of a broader issue of “slow decay,” where current tech staff aren’t training their replacements. He points to other indications of a future talent crisis: “Decline in CS enrollments as prospective students respond to deteriorating job market signals, which could produce a senior engineer shortage in 5 to 10 years even as AI reduces demand for entry-level workers today. The real risk is not that AI will eliminate the need for developers. It’s that companies will eliminate the early learning ground that has always produced great ones.”

Filling the pipeline

With early-career roles evolving quickly, experts advise CIOs to take a more intentional approach to hiring and training IT talent, programmers in particular — one that uses AI to help junior staff become better, faster, instead of replacing them.

AI may enable junior developers to take on more advanced tasks earlier, Montini says, but they still need mentoring and structured guidance to become experienced contributors.

“We believe the answer isn’t just hiring,” Montini says. “It’s how you onboard and develop early-career talent once they’re through the door. Structured training, clear skill development pathways, and meaningful mentorship are what actually close the gap between potential and performance. Without that scaffolding, junior hires churn before they become the midlevel talent you need.”

Paul DeMott, CTO at Helium SEO, says organizations should rethink talent development from a new hire’s first day.

“Before a junior developer on our team writes a single line of code on any new feature, they have to propose the full architecture for it, present it in a 15-minute review with the senior team, and explain every tradeoff they considered,” he says. “The junior does not implement anything until they defend those decisions. This process forces systems thinking before syntax thinking, which is exactly what separates a developer who grows into senior roles from one who stays at the execution layer indefinitely.”

In the past year and a half, DeMott says, that process has helped junior hires rise more quickly through the ranks, with two junior developers promoted to midlevel roles.

Kerecsen says his company actively seeks out junior talent at the university level, works with them for several years, then brings them on as junior or potentially midlevel engineers.

“There is a concerning misunderstanding about AI’s potential, especially regarding its ability to replace junior developers,” Kerecsen says. “It is actually disastrous for delivery quality and long-term sustainability. Junior developers are an investment in our future.”

Liz Eversoll, CEO of upskilling and recruitment company Career Highways, says organizations should move from informal apprenticeship to a more intentional model for skills-based growth.

“The next generation of senior programmers will be developed differently,” Eversoll says. “Junior engineers can now contribute to higher-complexity work earlier by using AI as a copilot, but that only works if organizations provide pathways that connect real work, learning, and continuous assessment.”

Building judgment, not just output

The goal is to help junior developers gain the kind of experience that allows them to understand systems, weigh tradeoffs, and eventually guide technical decisions.

Former Sonic CIO Miller says that kind of experience cannot be automated.

“The organizations that get this right will balance AI-driven efficiency with structured mentorship and real-world exposure, treating talent development as a long-term priority,” Miller says. “The next generation of senior engineers will not emerge accidentally. They will have to be built through structured apprenticeship, guided use of AI, real exposure to production environments, and deliberate development of judgment, architecture thinking, debugging discipline, and business context.”

Rema Lolas, founder of team-building platform Groziac, says AI may make technical skills more accessible, but it will also put more pressure on how people work together.

“AI may level the technical playing field, but it will amplify the differences in human performance,” Lolas says. “The organizations that recognize this early will stop treating development as a training problem, and start treating it as a system design challenge — where people are intentionally developed not just in skill, but in how they operate and perform together.”

Microsoft’s Hanselman says the skills that matter most today are not just AI prompt fluency or the ability to generate code quickly, but systems thinking and communication.

“So for the young person who’s coming into this, you can’t have blinders on,” he says. “Making large, interesting systems that help people and make their lives better — that is not being commoditized. You need big-picture thinking, taste, discernment, good judgment, good communication skills, and a rock-solid understanding of the basics. Just because I’m riding around in an Uber doesn’t mean that I don’t know how to change a tire.”

Tech leaders say organizations need to make early-career growth a core part of engineering work. That means giving junior staff real programming work, in-the-moment senior guidance and AI support that accelerates learning without replacing it.

“Ultimately, developing senior talent is no longer a byproduct of hiring, it’s the result of deliberate infrastructure,” Eversoll says. “Organizations that invest in skills-based progression systems will not only sustain their pipeline, but accelerate it.”

AI is here, and we must help workers adapt: That’s the response of a new non-profit organization to the ongoing debate about whether AI will destroy jobs and cause catastrophe or take the economy to new heights.

Launched Thursday, Raise Us is a nonpartisan national organization that says it will partner with state governors, employers, workers, and training organizations to help the US workforce make a successful transition to an AI economy. It says it will design and pilot new corporate incentives to retrain and redeploy workers, develop new approaches to support people through job transitions, and create new training models tied to changing employer demand.

It has already raised more than $500 million and hopes to bring that up to $1 billion in multi-year commitments from philanthropists and industry sources. Anchor partners include Amazon, Microsoft, Anthropic, and the OpenAI Foundation, and more than two dozen other organizations including Cisco, IBM, ADP, AMD, and Deloitte have also signed on.

The organization is led by two former US state governors, Gina Raimondo, who will serve as CEO and co-chair, and Eric Holcomb, co-chair, and its initial government partnerships are with the states of Arkansas, Connecticut, Maryland, and Utah, which, it said, “will serve as the first proving grounds for outcome-driven pilots.”

However, analysts are skeptical that the initiative is anything other than a public-relations effort for the AI industry.

Jason Andersen, VP and principal analyst at Moor Insights & Strategy, said the organization’s initial communications are more marketing and posturing than strategy and action. “It also does not help that there are many CEOs involved who have already displaced thousands of workers due to AI,” he said.

The organization has chosen to work with state governments rather than the US federal government but even partnering at the state level may be too broad, he said, given that the industry makeup varies from state to state, with some leaning towards knowledge workers, while others are more manufacturing-focused.

AI-washing

Technology analyst Carmi Levy said Raise Us’s mission is laudable, but, “Unfortunately, for all its slick website and optimistic-sounding copy, Raise Us is possibly the highest-profile example of AI-washing thus far, a well-intentioned but ultimately futile attempt to illustrate that something is being done to cut through the uncertainty and empower the workforce of tomorrow. In reality, it’s a convenient vehicle for a diverse range of stakeholders, including state governments, educators, financial institutions, and companies like Amazon, Anthropic, Microsoft, and the OpenAI Foundation, to virtue-signal that they’re doing their utmost to solve the AI employment crisis and mitigate the impact of this generational technology deployment on everyday workers.”

Like Andersen, he noted that since many of those same companies have already had multiple rounds of tech-driven layoffs, “It’s more than a little rich for them to be joining an initiative whose mission revolves around protecting workers from the worst risks associated with AI.”

But, he said, “If Raise Us can deliver on its lofty promises, it could be an important first step in the great AI workforce transition. Otherwise, it could end up being little more than a high-profile exercise in creating plans and reports and conference panels with little on-the-ground execution to show for it. I’ll believe in its mission when middle-aged, mid-level administrative workers are realistically redirected into new AI-enabled career paths without a massive pay cut.”

Andersen, too, said he’s keeping an open mind, “but something more measurable and specific is in order, or this just looks like a public relations effort.”

This article first appeared on Computerworld.

AI is here, and we must help workers adapt: That’s the response of a new non-profit organization to the ongoing debate about whether AI will destroy jobs and cause catastrophe or take the economy to new heights.

Launched Thursday, Raise Us is a nonpartisan national organization that says it will partner with state governors, employers, workers, and training organizations to help the US workforce make a successful transition to an AI economy. It says it will design and pilot new corporate incentives to retrain and redeploy workers, develop new approaches to support people through job transitions, and create new training models tied to changing employer demand.

It has already raised more than $500 million and hopes to bring that up to $1 billion in multi-year commitments from philanthropists and industry sources. Anchor partners include Amazon, Microsoft, Anthropic, and the OpenAI Foundation, and more than two dozen other organizations including Cisco, IBM, ADP, AMD, and Deloitte have also signed on.

The organization is led by two former US state governors, Gina Raimondo, who will serve as CEO and co-chair, and Eric Holcomb, co-chair, and its initial government partnerships are with the states of Arkansas, Connecticut, Maryland, and Utah, which, it said, “will serve as the first proving grounds for outcome-driven pilots.”

However, analysts are skeptical that the initiative is anything other than a public-relations effort for the AI industry.

Jason Andersen, VP and principal analyst at Moor Insights & Strategy, said the organization’s initial communications are more marketing and posturing than strategy and action. “It also does not help that there are many CEOs involved who have already displaced thousands of workers due to AI,” he said.

The organization has chosen to work with state governments rather than the US federal government but even partnering at the state level may be too broad, he said, given that the industry makeup varies from state to state, with some leaning towards knowledge workers, while others are more manufacturing-focused.

AI-washing

Technology analyst Carmi Levy said Raise Us’s mission is laudable, but, “Unfortunately, for all its slick website and optimistic-sounding copy, Raise Us is possibly the highest-profile example of AI-washing thus far, a well-intentioned but ultimately futile attempt to illustrate that something is being done to cut through the uncertainty and empower the workforce of tomorrow. In reality, it’s a convenient vehicle for a diverse range of stakeholders, including state governments, educators, financial institutions, and companies like Amazon, Anthropic, Microsoft, and the OpenAI Foundation, to virtue-signal that they’re doing their utmost to solve the AI employment crisis and mitigate the impact of this generational technology deployment on everyday workers.”

Like Andersen, he noted that since many of those same companies have already had multiple rounds of tech-driven layoffs, “It’s more than a little rich for them to be joining an initiative whose mission revolves around protecting workers from the worst risks associated with AI.”

But, he said, “If Raise Us can deliver on its lofty promises, it could be an important first step in the great AI workforce transition. Otherwise, it could end up being little more than a high-profile exercise in creating plans and reports and conference panels with little on-the-ground execution to show for it. I’ll believe in its mission when middle-aged, mid-level administrative workers are realistically redirected into new AI-enabled career paths without a massive pay cut.”

Andersen, too, said he’s keeping an open mind, “but something more measurable and specific is in order, or this just looks like a public relations effort.”

Sich weiterzuentwickeln ist für ITler von jeher Pflicht. Das gilt heute umso mehr, weil gerade Cloud-Services schnell reifen und sich verändern. Zudem treiben Cloud-Infrastrukturkomponenten die Entwicklung der Enterprise-Rechenzentren voran.

Unabhängig davon, ob Sie Ihre Kenntnisse nur auffrischen oder sich auf ein neues Fachgebiet spezialisieren möchten, stehen Ihnen jede Menge kostenlose Ressourcen großer Technologieunternehmen zur Verfügung. IT-Profis sollten diese Chance nutzen, um der nächsten Beförderung – oder einem besseren Job – ein Stückchen näher zu kommen.

Kostenlose Karriere-Booster für IT-Profis

Die nachfolgend aufgelisteten Schulungs- und Weiterbildungsangebote sind qualitativ hochwertig. Sie bieten Videos, Referenzmaterial und in einigen Fällen sogar vollständige Laborumgebungen sowie kostenlose Softwaretools.

Oft gibt es auch Abschlusszertifikate, die Absolventen den Weg zu einer Zertifizierung ebnen können. Dabei sind die Angebote meistens kostenlos, bieten jedoch gegen Bezahlung zusätzliche Inhalte. Eine Registrierung ist fast immer erforderlich.

AWS Training

AWS bietet nicht nur Services im Übermaß, sondern auch eine beeindruckende Palette an Weiterbildungskursen an. Die Struktur der AWS-Trainingsbibliothek spricht sowohl Anfänger als auch Profis an – auch solche, die in weniger technischen Rollen in Vertrieb, Management oder Planung tätig sind. Die Kurse werden in Deutsch, Englisch, Spanisch, Französisch und einer Viezahl weiterer Sprachen angeboten.

Das Kursmaterial besteht bei AWS aus Text- und Videoinhalten sowie regelmäßigen Wissenstests. Letztere sollen gewährleisten, dass der Lernstoff auch im Kopf bleibt. Dabei lassen sich Kurse, die bereits bekannte Inhalte behandeln, im Schnellverfahren absolvieren. Zum Schulungsangebot gehört auch das etwas kitschige, aber durchaus innovative Open-World-Rollenspiel AWS Cloud Quest:

Zap drones⚡, Befriend pets 🐈 , Solve puzzles 🧩 AWS Cloud Quest is a role-playing game to help you build practical experiences with AWS. https://t.co/yHKu00Z9z3#AWSTraining #CloudComputing pic.twitter.com/QtNrNblADc

— AWS Cloud SEAsia (@AWSCloudSEAsia) July 2, 2022

Amazon Web Services bietet sowohl eine kostenlose als auch eine Abonnement-pflichtige Schulungsbibliothek an. Die kostenlose enthält über 500 Kurse, Übungstests für Zertifizierungsprüfungen und Cloud Quest. Abonnenten können zwischen einer Team- (ab 449 Dollar pro Jahr und Platz) oder einer Einzel-Subscription (29 Dollar pro Jahr) wählen. Zahlende Benutzer erhalten auch Zugang zu Laborumgebungen, zusätzliche Cloud-Quest-Rollen sowie Zugriff auf ein zweites Rollenspiel – AWS Industry Quest.

Cisco Skills for All

Skills for All von Cisco bietet eine Fülle von Kursen für Anfänger und Fortgeschrittene zu einer breit gefächerten Themenpalette – von Netzwerk-Basics über IoT bis hin zu Cybersicherheit. Die Kurse sind in Learning Collections von (im Regelfall) bis zu 70 Stunden gebündelt und vorrangig auf Englisch verfügbar, viele auch auf Spanisch und Französisch. In geringerem Umfang finden sich auch Angebote auf Deutsch, Portugiesisch und Russisch.

Das Kursmaterial von Skills for All umfasst Videoschulungen und interaktive Lektionen, die auf optimiertes Lernen und das Verinnerlichen von Lehrstoff ausgelegt sind. Cisco bietet auch einige Ressourcen zum Download an, darunter beispielsweise Packet Tracer, sein Simulations-Tool für die Netzwerkkonfiguration. Cisco bietet über Skills for All keine direkten Zertifizierungen an – einige Kurse wie etwa Python Essentials bereiten aber darauf vor.

Fortinet Training Institute

Das Fortinet Training Institute eröffnet einen kostenlosen Zugang zu den Network-Security-Expert (NSE)-Kursen der Stufen 1 bis 8. Die ersten drei ermöglichen es, Associate-Zertifizierungen zu erwerben. Die Kurse bauen aufeinander auf und bieten einen Überblick über Sicherheitsbedrohungen und Schutzmaßnahmen.

Darüber hinaus offeriert Fortinet auch Schulungskurse zum Selbststudium für eine Vielzahl von Sicherheitsprodukten. Einige Angebote können um kostenpflichtige, aber nicht zwingend notwendige Zusatzinhalte wie Bücher oder einen Laborzugang ergänzt werden. Die Schulungsinhalte bestehen größtenteils aus Videomaterial, aber auch interaktive Komponenten werden zur Überprüfung von Wissen und Skills eingesetzt. Vollständige Lernskripte stehen im PDF-Format zum Download bereit.

Viele Fortinet-Kurse beinhalten Abschlusszertifikate und können auch zum Erwerb von Continuing Professional Education Credits im Rahmen von (ISC)2-Zertifizierungen wie CISSP verwendet werden. Wie viele Stunden Sie angerechnet bekommen und welchem Zertifizierungsbereich diese entsprechen, ist in den jeweiligen Kursen angegeben.

HPE Juniper Learning Portal

Dieses Lernportal konzentriert sich weitgehend auf Juniper-Zertifizierungen – wobei auch kostenlose Schulungen auf der Grundlage bereits erworbener Zertifizierungen verfügbar sind. Wer kein aktuelles Juniper-Zertifikat hat, muss sich auf Associate-Zertifizierungen beschränken. Diese ermöglichen jedoch Zugang zu einem Kurs für jede Zertifizierungsschiene.

Nach Abschluss eines zertifizierungsspezifischen Kurses erhalten Nutzer einen Gutschein, der ihnen 75 Prozent Rabatt auf die Prüfung einräumt. Bis zum Professional-Level sind alle Vorbereitungskurse für eine Juniper-Zertifizierung kostenlos, sofern User die Voraussetzungen für die Zertifizierung erfüllen. Für Kurse, die auf eine Zertifizierung auf Expertenniveau vorbereiten, wird eine Gebühr erhoben. Darüber hinaus steht auch eine kleine Auswahl nicht zertifizierungsbezogener Kurse zur Wahl.

Davon abgesehen bietet HPE Juniper kostenlosen Zugang zu seiner vLabs-Plattform. Diese stellt vorgefertigte Laborumgebungen bereit, in denen interessierte Experten ihre Skills trainieren und validieren können. Die Anmeldung für diese Plattform erfolgt allerdings getrennt vom Lernportal.

Wenn Sie eine weitere Vertiefung wünschen, bietet Juniper auch diverse On-Demand-Schulungen gegen einen kursindividuellen Aufpreis. Alternativ haben Sie die Möglichkeit, sich mit einem All-Access-Pass unbegrenzten Zugang zu allen On-Demand-Kursen und -Laboren zu erkaufen.

Microsoft Learn

Die Schulungsbibliothek von Microsoft bietet Material zu vielen Themen, die für den Betrieb moderner Rechenzentren relevant sind, darunter:

• Active Directory,

• Windows Server,

• Hyper-V,

• Clustering und Hochverfügbarkeit,

• Speicher- und Dateidienste sowie

• unzählige hybride oder Azure-basierte Workloads.

Die meisten Inhalte in Microsoft Learn sind textbasiert. Interessierte werden also jede Menge Zeit damit verbringen, Kursmaterial zu lesen, Diagramme zu wälzen und Tabellen zu durchforsten. Das fesselt zwar nicht in dem Maße, wie es interaktives Schulungsmaterial vermag, gewährleistet aber den zugriff auf eine Fülle von Informationen, die in den meisten Fällen direkt mit Microsoft-Zertifizierungen korrespondieren.

Microsofts Lernplattform bietet darüber hinaus Gamification-Anreize wie Urkunden oder Erfahrungspunkte. Gelegentlich bietet die Windows-Company auch spezielle “Learning Challenges” an, bei denen Belohnungen in Form von Prüfungsgutscheinen erlernt oder erspielt werden können.

Microsoft-Zertifizierungen sind schon seit mehr als zwei Dekaden populär und konzentrieren sich heute vor allem auf Azure. Zusätzlich zu den Branchen-Kernzertifizierungen bietet der Konzern heute auch Fundamentals-Zertifizierungen an, die die Einstiegshürde für eine “richtige” Zertifizierung etwas senken.

Red Hat Training

Der kostenlose Bereich des Schulungsangebots von Red Hat umfasst zehn Kurse, die wichtige Themen abdecken, zum Beispiel:

• Grundlagen der Red-Hat-Administration,

• OpenStack,

• OpenShift oder

• Ansible.

Jeder Kurs führt zu einer Zertifizierung als Red Hat Certified System Administrator (RHCSA) oder als Red Hat Certified Specialist (RHCS). Zusätzlich zu den Kursen bietet das Unternehmen über die Streaming-Plattform Red Hat TV Schulungsvideos an. Diese sind sehr technisch gehalten und damit vor allem für IT-Profis nützlich, die sich mit den neuesten Red-Hat-Angeboten vertraut machen wollen.

Ein kostenpflichtiges Abo im Rahmen von Red Hat Learning ermöglicht unbegrenzten Zugang zu einer umfangreichen Kurs-Bibliothek, inklusive Cloud-basierter Labs und Zertifizierungsprüfungen. Die Preise beginnen bei 6.000 Dollar pro Jahr.

VMware Learning

Das kostenlose Basic-Abonnement von VMware Learning bietet in erster Linie textbasierte Produktübersichten und technische Einweisungen. Das geschieht allerdings auf hohem Niveau, die Inhalte werden in “mundgerechten” Häppchen mit eingestreuten Diagrammen und interaktiven Elementen serviert.

VMware Learning stellt darüber hinaus die VMware-Videobibliothek zur Verfügung, die auch ohne Basic-Abonnement öffentlich zugänglich ist und schnellen Zugriff auf zusätzliche Inhalte bietet. (fm)

Dieser Artikel ist im Original bei unserer Schwesterpublikation Networkworld.com erschienen.

Enterprises may soon be paying as much for their developers’ AI token usage as they do for their salaries.

According to Gartner, these costs will meet, or even exceed, the typical software engineer’s monthly salary within the next two years.

This is not only because developers are increasingly adopting generative AI and agentic tools, it reflects a trend toward consumption-based licensing models as vendors balance infrastructure investments with profitability. Rather than the flat per-seat SaaS model of the past, enterprises now pay for developer token use as well.

Gartner senior principal analyst Nitish Tyagi explained that it’s important to note that Gartner’s prediction is based on a global average salary of $2,000 per month; it doesn’t mean AI token usage will exceed all salaries. For instance, in the US, yearly pay rates can be six digits or more.

However, that kind of spend is not out of the realm of possibility, Tyagi emphasized. “I have heard scary numbers like ‘My developer consumed $20K last month,’ or ‘A business user consumed $32K’.”

If these amounts sound shocking, that’s the point. “The goal is to alarm the industry about the impact of token cost if it is not governed and controlled,” he said.

Lack of visibility, immature oversight

Enterprises are quickly moving from experimentation to scaled deployment of AI coding agents, but many still underestimate token costs, Tyagi noted.

This is because cost structures for software engineering workloads are “highly variable,” he pointed out, and there isn’t a lot of transparency into how token consumption is calculated and billed.

AI coding vendors have yet to deliver “mature, built-in cost optimization capabilities,” Tyagi said, and prices will likely only continue to rise as vendors further build out their models while at the same time trying to remain profitable.

Thus, enterprises struggle to forecast and control costs, and, because AI is moving so fast, many organizations lack the “maturity and frameworks” to determine ROI, he noted. Agent-driven workflows are difficult to govern, context windows become bloated, budgets are wiped out earlier than anticipated, and token spend becomes hard to justify.

Added to this, light users such as non-developers will increase their usage as they become more familiar with, and even reliant on, AI tools, driving up token consumption and spend even more.

Tyagi said that, while AI is incredibly valuable, he sees no “direct relationship” between the number of tokens developers consume and their productivity gains. Rather, applying context engineering principles to optimize or reduce token consumption increases quality.

“Tokenmaxxing is not directly related to higher productivity gains,” Tyagi said, “but optimizing token consumption is.”

Still, this in no way means that organizations should move away from AI coding agents, he emphasized. Optimizing token consumption simply means spending only as much as needed without compromising the quality and value brought by AI.

“Without a governed engineering operating model, costs can escalate faster than the productivity gains these tools are designed to deliver,” Tyagi said.

How enterprises can control token usage

The traditional ‘lines-of-code-written’ productivity metric no longer applies when AI can almost instantaneously produce entire Python libraries. Rather, value should be measured in quality, speed, and customer satisfaction metrics, Tyagi said.

For instance: How quickly are developers able to release important features? How much time is reduced between app development and feedback from business, product, and development teams? Shipping features quickly while maintaining quality can create competitive advantage and improve user and customer experience, he said.

Gartner also advises establishing strong governance and cost controls. For instance, introduce token thresholds, automate usage monitoring, and create explicit escalation policies.

“Embedding these controls into engineering workflows ensures consistency and prevents uncontrolled cost growth,” the firm notes.

In addition, enterprises should create a “use case driven” decision framework. This means clearly defining when AI coding agents should be used, and their appropriate levels of autonomy given certain tasks. Further, classify those tasks into three execution models: ‘developer‑led,’ ‘developer‑with‑agent’, and ‘fully agent‑led.’

Enterprises should also select models based on task complexity. Break work into smaller tasks that can be performed by smaller models, “with escalation only when complexity demands it,” Gartner advises. Engineering teams should route workflows deliberately, directing simpler, high-frequency tasks to smaller models and using frontier models only for complex and high-value work.

Another cost saving tactic is mandating specific context engineering practices, the firm says. Developers should be trained to optimize the context they input to AI, including only the information that’s relevant, summarizing that content as much as possible, and eliminating unnecessary data.

Further, teams should embed token usage reviews into development cycles. Regular review of high token consuming workflows can help identify inefficiencies, refine practices, and support collaboration, Gartner says.

Tyagi noted that developers tend to optimize for speed and convenience rather than cost efficiency, so token discipline cannot be achieved through developer choice alone.

His advice for leaders: Do not treat escalating AI coding costs as a reason to move away from AI, or to shift to open generative AI models for everything. “The goal is always to optimize costs without compromising the value.”

Start small, and focus on context engineering first, he said. Assess your current software engineering maturity and select the appropriate agent autonomy. AI assistive development can provide up to 20% productivity gains, “which is not a bad number.”

For developers, he advises: “Target context engineering as one of the most important skills for yourself. This is not only going to help your employer, but also your career.”

This article originally appeared on CIO.com.

Enterprises may soon be paying as much for their developers’ AI token usage as they do for their salaries.

According to Gartner, these costs will meet, or even exceed, the typical software engineer’s monthly salary within the next two years.

This is not only because developers are increasingly adopting generative AI and agentic tools, it reflects a trend toward consumption-based licensing models as vendors balance infrastructure investments with profitability. Rather than the flat per-seat SaaS model of the past, enterprises now pay for developer token use as well.

Gartner senior principal analyst Nitish Tyagi explained that it’s important to note that Gartner’s prediction is based on a global average salary of $2,000 per month; it doesn’t mean AI token usage will exceed all salaries. For instance, in the US, yearly pay rates can be six digits or more.

However, that kind of spend is not out of the realm of possibility, Tyagi emphasized. “I have heard scary numbers like ‘My developer consumed $20K last month,’ or ‘A business user consumed $32K’.”

If these amounts sound shocking, that’s the point. “The goal is to alarm the industry about the impact of token cost if it is not governed and controlled,” he said.

Lack of visibility, immature oversight

Enterprises are quickly moving from experimentation to scaled deployment of AI coding agents, but many still underestimate token costs, Tyagi noted.

This is because cost structures for software engineering workloads are “highly variable,” he pointed out, and there isn’t a lot of transparency into how token consumption is calculated and billed.

AI coding vendors have yet to deliver “mature, built-in cost optimization capabilities,” Tyagi said, and prices will likely only continue to rise as vendors further build out their models while at the same time trying to remain profitable.

Thus, enterprises struggle to forecast and control costs, and, because AI is moving so fast, many organizations lack the “maturity and frameworks” to determine ROI, he noted. Agent-driven workflows are difficult to govern, context windows become bloated, budgets are wiped out earlier than anticipated, and token spend becomes hard to justify.

Added to this, light users such as non-developers will increase their usage as they become more familiar with, and even reliant on, AI tools, driving up token consumption and spend even more.

Tyagi said that, while AI is incredibly valuable, he sees no “direct relationship” between the number of tokens developers consume and their productivity gains. Rather, applying context engineering principles to optimize or reduce token consumption increases quality.

“Tokenmaxxing is not directly related to higher productivity gains,” Tyagi said, “but optimizing token consumption is.”

Still, this in no way means that organizations should move away from AI coding agents, he emphasized. Optimizing token consumption simply means spending only as much as needed without compromising the quality and value brought by AI.

“Without a governed engineering operating model, costs can escalate faster than the productivity gains these tools are designed to deliver,” Tyagi said.

How enterprises can control token usage

The traditional ‘lines-of-code-written’ productivity metric no longer applies when AI can almost instantaneously produce entire Python libraries. Rather, value should be measured in quality, speed, and customer satisfaction metrics, Tyagi said.

For instance: How quickly are developers able to release important features? How much time is reduced between app development and feedback from business, product, and development teams? Shipping features quickly while maintaining quality can create competitive advantage and improve user and customer experience, he said.

Gartner also advises establishing strong governance and cost controls. For instance, introduce token thresholds, automate usage monitoring, and create explicit escalation policies.

“Embedding these controls into engineering workflows ensures consistency and prevents uncontrolled cost growth,” the firm notes.

In addition, enterprises should create a “use case driven” decision framework. This means clearly defining when AI coding agents should be used, and their appropriate levels of autonomy given certain tasks. Further, classify those tasks into three execution models: ‘developer‑led,’ ‘developer‑with‑agent’, and ‘fully agent‑led.’

Enterprises should also select models based on task complexity. Break work into smaller tasks that can be performed by smaller models, “with escalation only when complexity demands it,” Gartner advises. Engineering teams should route workflows deliberately, directing simpler, high-frequency tasks to smaller models and using frontier models only for complex and high-value work.

Another cost saving tactic is mandating specific context engineering practices, the firm says. Developers should be trained to optimize the context they input to AI, including only the information that’s relevant, summarizing that content as much as possible, and eliminating unnecessary data.

Further, teams should embed token usage reviews into development cycles. Regular review of high token consuming workflows can help identify inefficiencies, refine practices, and support collaboration, Gartner says.

Tyagi noted that developers tend to optimize for speed and convenience rather than cost efficiency, so token discipline cannot be achieved through developer choice alone.

His advice for leaders: Do not treat escalating AI coding costs as a reason to move away from AI, or to shift to open generative AI models for everything. “The goal is always to optimize costs without compromising the value.”

Start small, and focus on context engineering first, he said. Assess your current software engineering maturity and select the appropriate agent autonomy. AI assistive development can provide up to 20% productivity gains, “which is not a bad number.”

For developers, he advises: “Target context engineering as one of the most important skills for yourself. This is not only going to help your employer, but also your career.”

AI has created a tough job environment for entry-level workers and things aren’t getting better anytime soon — even those with AI capabilities now need “senior-level” skills to land a job.

“AI-exposed entry-level roles are seven times more likely to require traditionally senior-level skills such as judgement and leadership,” consulting firm PwC said in a study released this month.

That’s because AI is changing the traditional career ladder. Companies are increasingly looking for candidates that use the cutting-edge tools and services to amplify their performance and grow faster. “Organizations must rethink how they mentor and train junior staff, helping them step up to complex decision-making much earlier in their careers,” PwC said.

Entry-level job seekers with or without AI skills are already dealing with stagnant wages,  layoffs, and stalled hiring. 

(The PwC findings echo similar concerns raised late last year in McKinsey’s State of AI report. Many companies are reducing headcount by deploying AI agents to take over entry-level jobs.)

Early-career AI job postings “have flatlined in highly AI exposed sectors,” and listings for junior roles with mid-career or senior-level skills have grown 35% since 2019, PwC said.  The consulting firm largely discounted the notion that AI is taking jobs away, though other studies point in the opposite direction. 

By the end of May, AI-driven job cuts had reached 87,174 for 2026, already outpacing the total of around 54,836 in 2025, according to figures released by Challenger, Gray and Christmas earlier this month.

The AI-driven layoffs haven’t reached the “jobpocalypse” stage yet, and workers are more productive with it, said Andy Challenger, chief revenue officer at Challenger, Gray and Christmas. But companies are rethinking hiring and long-term operational strategies as AI becomes a routine component in daily workflows and processes, he said.

Businesses are “restructuring aggressively as they reposition for an AI-driven economy,” he said.

That’s putting downward pressure on entry-level hiring as AI tools absorb more routine work, said Kye Mitchell, head of Experis US, a part of ManpowerGroup. “That doesn’t remove opportunity, but it changes the expectations. Employers now expect candidates to come in with hands-on experience, AI familiarity, and the ability to contribute faster,” Mitchell said.

Compensation remains strong for specialized, in-demand skills, while more commoditized roles such as customer service, helpdesk, and some entry-level positions  are flattening. “The shift overall is toward skills-based hiring, where demonstrable capability matters more than credentials alone,” Mitchell said.

Graduates who combine technical fundamentals with practical experience, AI fluency and strong communication skills stand out quickly. Job candidates can’t rely solely on academic credentials. 

“Employers are moving away from ‘train-from-scratch’ hiring and looking for talent that can contribute earlier and continue to adapt,” Mitchell said.

The PwC study also focused on the productivity gap between companies that have invested heavily in AI and companies lagging in adoption.

Since ChatGPT showed up in 2022, AI-exposed companies have seen productivity gains of 40% versus other companies. “The companies achieving the biggest productivity gains from AI are not using it only to cut costs,” PwC said.

AI-forward firms are also raising headcounts and wages. “Far from being a job killer, AI may actually be a job expander when used to unlock growth and enter new markets,” PwC said. 

Workers who use their domain expertise to supplement AI tools can advance, with AI-exposed roles “2.5 times more likely to rely on skills like empathy, judgement, and creativity that become even more valuable as AI absorbs some routine work,” PwC said.

Last week’s HPE Discover event in Las Vegas marked the first time the annual user conference included the now-fully-absorbed Juniper Networks. Rami Rahim, former CEO of Juniper Networks and current EVP, president and general manager of HPE Networking, took to the main stage for a dedicated networking session after HPE CEO Antonio Neri’s morning keynote.

Rahim emphasized the network’s importance to AI and how AI is changing networking. He framed the AI conversation around one thing: network foundations. “AI is reshaping every part of the enterprise,” he said, “but none of that happens without the right foundation underneath it. And that foundation starts with the network.”

For network engineers, his keynote and customer conversations offered a clear blueprint for what comes next. Here are five key themes from the keynote and what they mean for your day‑to‑day work life and future career.

1. The network is now the AI foundation

Rahim opened with the story of San Francisco’s Millennium Tower, a visually stunning skyscraper that began to tilt because its foundation wasn’t built for long‑term environmental realities. He used it as an analogy for AI in the enterprise: Massive data movement, constant inference, real‑time responsiveness, and explosive scale will break any network that wasn’t designed for this new era.

“The network is no longer infrastructure sitting quietly in the background,” he said. “It’s become the strategic platform for how organizations operate, innovate, and scale.” You can buy “millions, if not billions, spent on GPUs,” he warned, but “if the network introduces latency and bottlenecks and instability, you’re limiting performance and slowing down outcomes.”

What this means for network engineers:

• Architect for AI-era baselines, not legacy traffic assumptions. Design for sustained east-west flows, low jitter, and deterministic paths that support AI training and inference, not just classic north-south traffic.
• Translate network health into AI business outcomes. When you speak to leadership, link latency, loss, and path diversity to model training time, inference SLA, or customer experience, not just “link utilization.”
• Get in early on AI projects. Push to join the initial design discussions so connectivity, security, and data movement patterns are engineered in rather than patched later.

2. AI for networks: Self‑driving operations are becoming table stakes

The core thesis of Rahim’s presentation is that the legacy network can’t withstand the rigors of AI. “The old model of networking, static, manual, and reactive, simply cannot keep up with the speed and complexity AI introduces.” His alternative is an AI-native, self-driving operations model spanning Aruba Central and Mist, powered by Marvis, Marvis Minis, and an “agentic AI framework.”

On stage, he was joined by Sunalini Sankhavaram, VP of product management at HPE, who elaborated on this shift. “Experience-first AI in action” is built on “real-life experience data, every user, every minute, validated against real customer support cases, and enriched with digital twins.” In one demo, Marvis detected that “over 6% of user minutes were bad,” isolated the issue to a few overutilized APs, and “autonomously fixed the problem by enabling dual-band 5 GHz,” cutting peak utilization from 90% to 54%. Rahim summarized the outcome: “The network identified the issue, understood the root cause, determined the right action, and resolved the problem automatically before any user even had a chance to complain.”

For engineers, that’s a fundamental shift: from being the resolver to configuring, supervising, and governing these AI systems.

How to respond:

• Lean into AIOps rather than treating it as a dashboard. Feed full-fidelity telemetry (“every user every minute”) into platforms like Mist and Aruba Central and actively test their recommendations.
• Redefine your role as a guardrail designer. Your value increasingly lies in defining SLAs, allowed action scopes, and approval workflows for autonomous changes, rather than hand-tuning every parameter.
• Learn the new language of operations: SLAs and “bad user minutes.” If your tooling speaks in experience metrics, you need to as well; they will become the common currency between IT and the business.

3. One AI‑native fabric across campus, branch, and routing

A big structural message in the keynote is unification: Juniper plus Aruba, Mist plus Central, wired plus wireless plus routing, all tied together by a common AI engine.

“We are innovating across both platforms to deliver a consistent self-driving experience,” Sankhavaram said. “With microservices, we can develop self-driving innovations once and deploy them on both the HPE Aruba Central and HPE Mist platforms,” much like a single app running on both iOS and Android. Marvis is being brought “right into the global north view” in Aruba Central, including the “Marvis Trust List”—actions you can set to run fully autonomously, such as automatically recovering a dead camera port to restore video without human intervention.

On the hardware front, HPE has already shipped a dual-platform AP and is bringing the “world-class HPE networking CX portfolio” to Mist for day zero, day one, and day two operations.” Rahim articulated the design principle clearly: “Our mission is simple. Bring the best innovations to both platforms, so that every customer in every industry gets the same powerful self-driving network, no matter which platform they choose.”

Advice for engineers:

• Design for platform optionality. Assume that over the life of your hardware, management planes may change. Favor equipment that can switch between Mist and Central (or similar ecosystems) without rip-and-replace.
• Embed digital twins into your workflows. Experience twins and synthetic testing should be part of pre-deployment validation and change management, not just a vendor demo.
• Build API-first automation muscle. Sankhavaram emphasized “an API-first approach,” making data and actions accessible programmatically. That’s your cue to deepen your skills in Python, CI/CD, and infrastructure-as-code.

4. Networking and security are converging, with AI‑aware controls

Rahim repeatedly stressed that networking and security can no longer operate separately. “Attackers are already using the network as their weapon of choice,” he said, “and with AI making threats faster, smarter, and more sophisticated, defenders need to use the network as part of their defense.” This aligns with my research, which has found that 83% of network engineers now have security as part of their remit. 

Customer voices underscored the point. “Security for us is job number one,” said Royal Bank of Canada’s Marlon Drummond. “We don’t have any other job other than protecting our client data. It’s our competitive edge, so we protect it with everything in our fiber.” RBC troubleshoots “at the network layer – the only place that you can get some immutable evidence,” using SD-WAN and DPI to create a “persona or personality for a user” and treat deviations as anomalies.

On the product side, HPE announced a unified SASE orchestrator that combines its Edge Connect SD‑WAN with its SSE stack into a unified SASE orchestrator with a single console. During the session, HPE showed an “AI‑aware firewall” that distinguishes sanctioned, unsanctioned, and tolerated AI apps, enforcing fine‑grained guardrails on uploads, prompts, and keywords. As Rahim put it, this lets customers “see, govern, and protect how AI is being used across their entire organizations without slowing down their businesses.”

For network engineers:

• Expect to own more of the zero‑trust and AI‑governance story. Policies like “block ChatGPT, tolerate Gemini with upload and keyword controls” will be implemented in your SASE and firewall fabric.
• Instrument the network as a primary security sensor. Follow RBC’s lead: build detection pipelines around network telemetry, lateral movement patterns, and per‑user “personas.”
• Treat self‑driving changes as security‑sensitive. Autonomous routing shifts, RF changes, and port resets must respect segmentation and zero‑trust boundaries. Think like both a network engineer and a security architect.

5. Experience‑first networking at real‑world scale

The most compelling parts of the keynote were the customer segments, which showcased just how unforgiving modern environments have become.

Ohio State CIO Rob Lowden described a campus that is “a small city” with 66,000 students, 8,500 faculty, 22,000 HPE APs, and a football stadium that can see “200,000 plus people” in and around the venue on game day. With that density, “we need AI ops to crunch all of that data in real time,” he said. They’ve gone from problems that “can take hours” to being “resolved in minutes versus hours.”

At Sentara Health, director Tom Johnson did a great job highlighting the problem in his industry. “We move massive amounts of data across the organization, and it directly impacts patient care. That’s why our network must be resilient, secure, and always available. Because when data is delayed, care is delayed.” Ambient AI that listens to patient conversations and generates clinical notes is already in production, but “for those kinds of capabilities to work, our network has to deliver that data in real time, reliably, securely.”

Disney’s Ben Croy, who runs global networking, described studio networks where a single animated feature “could easily generate a petabyte of content,” with “over 200 concurrent productions globally.” In that world, the requirement is simple: “speed and simplicity… that’s it.” The network must be “foundational” yet “ideally invisible,” so filmmakers focus on story rather than connectivity.

What network engineers should take from these stories:

• Measure what users feel, not just what devices report. Adopt SLAs around app quality (Zoom, EMR, VFX pipelines) as primary KPIs, and design your telemetry and AI‑ops to optimize those.
• Use AI‑driven twins and synthetic tests to avoid “disasters that never happened” becoming real ones. Pre‑test big launches (stadium events, AI rollouts, global premieres) with synthetic users and paths, then let Marvis‑style systems validate and remediate.
• Become a vertical expert. Whether you support healthcare, finance, education, or media, understanding domain‑specific workflows lets you prioritize and tune the network for what matters to clinicians, traders, students, or artists.

Final thoughts

Rahim closed with a challenge: “The old way of operating networks has reached its limits. The scale is too large, the complexity is too high, the pace of change is too fast, and AI is accelerating all of it.” In that world, “self‑driving networks are not a futuristic idea but a practical necessity.” For network engineers, the opportunity is to be the ones who build, govern, and extend that self‑driving foundation—before someone else does it for you.

I know many engineers still fear AI, but as the expression goes: AI won’t take your job, but another person who uses AI will.

Read more content from HPE Discover:

• HPE Discover: Neri outlines an AI architecture built for agents
• HPE CTO Russo drills into data, orchestration, and observability for the agentic enterprise
• HPE product barrage targets AI networks, agents, management

This year marks the 20th anniversary of AWS — and my 20th year building at Amazon.

My entire career is for the sole purpose of making developers’ lives easier. As a developer, it is a bit of a self-serving purpose. For example, I was constantly distracted by operating databases, so I joined the DynamoDB team to build a service that handles that, so that other developers and I would never have to operate databases again.

I then went on to work on Lambda and API Gateway. I didn’t have to babysit servers or handle request routing, and on CloudWatch, so I could see what my code was doing in production. Each time, the goal was the same: remove the painful, repetitive work and turn it into a service that just works.

I’m still chasing the same goal, just with a very different set of tools.

The rise — and limits — of vibe coding

Large language models added the ability to describe what I want in natural language and have code synthesized on demand. At first, this looked like “vibe coding” — ask for a change to the script, compile it, run it, copy the errors back and hope the next iteration was better.

Things got interesting when we wrapped the whole “vibe coding” workflow in agentic loops. Instead of me feeding back every error, an agent could call the model, run the code, see its own failures and keep iterating until tests passed. But there was a big problem: the agents wandered. That’s fine for side projects, not fine for large, critical codebases.

Spec‑driven development for agents

The way I’ve come to keep agents focused is through spec‑driven development. Instead of dropping an agent into a repo with a vague prompt, I co‑create three concrete artifacts with it before any serious coding begins: a requirements spec, a design document and a task breakdown, all in Markdown. These are a shared contract for what “done” means, written in a form that both humans and agents can read, critique and update.

In my day-to-day, I start with almost the same prompt I’d give any AI, but the agent expands it into a structured requirements document with clear “shall” statements and acceptance criteria. I review those requirements and chat with the agent until the document matches what I actually want. From there, the agent proposes a design, then breaks the work into tasks focused on getting something tangible running before adding polish and exhaustive tests.

What I like about this flow is not that it’s rigid. In practice, I bounce back and forth. I often see a design that reveals missing requirements, or I change my mind about the approach once I see code snippets. The point is that agents no longer “forget” what we agreed on. The spec, design and tasks are explicit, versioned and always visible. And when I want to tack on another feature or bugfix, I start with a fresh spec that describes exactly what I want to change.

Property‑based testing and keeping agents honest

Once the specs are explicit, you can turn them into invariants and use property-based tests to keep agents honest. Instead of writing one test for “given this exact input, expect this exact output,” I define properties that must hold across many inputs and sequences.

Without strong, spec-derived tests, I’ve seen agents game the system by “fixing” the tests instead of the code — commenting out assertions or weakening conditions just to get a green build. Property-based tests give me a way to encode my expectations once and have both humans and agents constantly prove we’re still meeting them.

This approach has clear implications for security as well. If security teams can encode expectations — about data handling, authorization and error behavior — as invariants in the same spec language the agent consumes, then property-based tests can hammer those invariants across many scenarios. That’s a much more robust way to shift security left than hoping every developer remembers every rule under deadline pressure.

DevOps agents and the next decade of practice

Over twenty years, I’ve learned that the key to incident response isn’t only about chasing the root cause — it’s systematically asking what changed, what callers changed, what limits were hit, what components failed as designed and what dependencies are involved.

A DevOps agent is becoming as important as any IDE. It plugs into the tooling teams already use and runs that investigation automatically whenever an alarm fires. It reads logs, metrics, traces and code, and often has a diagnosis and plan ready by the time I open my laptop.

I’ve seen incidents that once took eight hours of human sleuthing reduced to fifteen minutes, with the agent explaining the bug, citing evidence, and recommending a rollback and follow-up fix.

Between incidents, the same system scans past outages and infrastructure to suggest preventative work — code hardening, better retries, alarm tuning — that teams rarely have time to prioritize on their own, and that’s the most important part. Reducing downtime is great, but avoiding it altogether is a big reason why we’re here.

Looking ahead, I think developers will learn to wear all sorts of other hats — the operator, product manager, customer support — while agents take on their routine tasks. The most valuable work becomes problem-solving and ensuring systems are built right and serve the right purpose.

Other things won’t change at all. “If you build it, you run it” still applies, even when an agent wrote part or all of the code. Developers will still own production and post‑incident retrospectives that focus on how to prevent issues. Some parts — like data collection, impact analysis, root cause analysis — get faster with agents doing the legwork, but developers still direct the investigation, decide the real fixes and share those lessons across teams.

Twenty years ago, the big shift was turning infrastructure into services, so developers didn’t have to think about racking servers or babysitting databases. In this new era, the move is turning our best practices, operational experience and security expectations into specs and agents that can execute them consistently, at any scale. The lesson from the first two decades still applies: The pain you tolerate today is the platform someone else will build tomorrow — only now, agents give us a much faster way to close that gap.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The upper ranks of corporate security are seeing a high rate of change as companies try to adapt to the evolving threat landscape. Many companies are hiring a chief security officer (CSO) or chief information security officer (CISO) for the first time to support a deeper commitment to information security.

Follow this column to keep up with new appointments to senior-level security roles and perhaps gain a little insight into hiring trends. If you have an announcement of your own that you would like us to include here, contact Peter Sayer, executive editor of news, at peter_sayer@foundryco.com.

New CISO appointments in June 2026

SolarWinds appoints Justin Henkel as CISO

IT management software vendor SolarWinds has named Justin Henkel its new CISO. Henkel was previously deputy CISO at OneTrust, and before that spent 25 years as an intelligence officer in the US Air Force.

New CISO appointments in March 2026

Kathy Wang joints micro1 as CISO

Frontier AI model training company micro1 has hired Kathy Wang as CISO. She was most recently CISO at hospitality software developer Otelier, and has previously held top cybersecurity roles at Discord and GitLab.

Green Impact Exchange names John Visneski CISO

John Visneski has joined stock exchange operator Green Impact Exchange as CISO. He was previously CISO at MGM Studios, and following that company’s acquisition by Amazon became head fo security for mergers and acquisitions. His cybersecurity career began with the US Air Force, where he served as cyber advisor to the Secretary and Chief of Staff of teh Air Force.

New CISO appointments in January 2026

Julien Mousqueton joins Cohesity as field CISO for Europe

Data security firm Cohesity has hired Julien Mousqueton as field CISO for Europe. His previous role was as CTO at IT service provider Computacenter. He is a reservist advisor for OFAC, the French national police force’s anti-cybercrime division, and created the real-time ransomware activity-tracking platform ransomware.live.

Every major technology shift changes cybersecurity. I’ve spent much of my career working through major technology transitions, from the rise of the commercial internet to mobile and cloud computing. Each shift created new opportunities for innovation, but it also created new security problems organizations weren’t fully prepared for.

AI may resemble previous technology shifts in some ways, but it differs in one important respect: it challenges one of the foundational assumptions modern security programs were built around: predictability.

For most of my career, security teams operated in environments where systems behaved deterministically. Applications generally executed the same way every time. Infrastructure changed slowly enough for humans to map dependencies, understand trust boundaries and implement controls around them. Even cloud transformation allowed us to apply familiar security models to new infrastructure.

AI changes those assumptions.

Agentic systems make decisions dynamically. Large language models generate different outputs based on context. AI systems increasingly interact with external tools, APIs and environments in ways their developers can’t always fully predict ahead of time. When systems stop behaving consistently, the traditional “keep bad things out” approach to cybersecurity starts to break down.

Prevention still matters. But prevention alone is structurally insufficient for environments where risk evolves continuously at runtime.

Security was built for deterministic systems

When I was helping build security programs years ago, much of the focus centered on hardening systems before deployment. Security teams tried to identify vulnerabilities early, reduce exposure and prevent attackers from gaining access in the first place.

Even during the early years of cloud adoption, most organizations still approached security primarily through configuration and policy management. We worried about permissions, exposed storage buckets and identity sprawl while cloud security tools focused heavily on identifying misconfigurations and locking down infrastructure.

Those controls remain critically important today. But the cloud era also taught us that security failures rarely happen in static diagrams. They happen in live environments, where permissions change, APIs evolve and identities gain unexpected access paths while systems interact in ways architects never fully anticipated.

By the time organizations map one state of the environment, it’s already changed. Risk increasingly emerges at runtime, when identities inherit unintended access, APIs change behavior or AI agents interact with systems in ways no architecture diagram captured.

In conversations I’ve had with companies, I’ve seen them go from generating hundreds of thousands of lines of code per month to millions. AI-assisted development tools are fundamentally changing software engineering workflows. A Harvard Business School study found that after developers gained access to GitHub Copilot, coding activity increased by 12.4% while time spent on project management tasks dropped by nearly 25% – a shift that can leave less time for the reviews and coordination governance depends on.

From a business perspective, acceleration creates leverage, but it also compresses the time security teams have to understand what’s entering production. Attackers are beginning to use AI to reduce the manual effort historically required for reconnaissance, exploit chaining and vulnerability validation at scale.

Security by obscurity isn’t a winning strategy. For years, organizations often accepted certain vulnerabilities because exploitation required too much time, expertise or effort from attackers.

Vulnerabilities once considered difficult to chain together are becoming easier to operationalize at scale as attackers use AI to automate portions of the process. Security leaders need to recognize that some of the prioritization models organizations built over the last decade may no longer reflect today’s reality.

Why prevention alone no longer works

As AI systems become more autonomous, runtime visibility becomes critical.

Many organizations historically treated runtime monitoring as a secondary layer behind prevention, viewing it mainly as a safety net for edge cases.

That model breaks down when systems can evolve and interact faster than security teams can realistically validate in real time.

If an AI agent can interact with multiple systems, generate new actions independently or adapt its behavior based on changing context, organizations can’t rely exclusively on pre-deployment controls. Security teams need visibility into what these systems are doing while they operate.

That includes:

• What data AI systems can access
• How identities interact with sensitive environments
• What actions agents are taking
• Whether systems are deviating from expected behavior
• How quickly organizations can contain unintended consequences

In many ways, modern security is shifting from trying to prevent every compromise to limiting how quickly unintended behavior can spread once systems begin acting autonomously.

Security leaders should be careful not to overreact to this shift with fear-driven narratives. AI will absolutely create new security challenges, but it also creates opportunities for defenders.

Security teams can’t scale using human labor alone anymore. The sheer volume of infrastructure changes, software generation and vulnerability management exceeds what most organizations can handle manually.

We’re already seeing organizations experiment with AI-assisted triage, automated investigation workflows and defensive agents that can help security teams move faster and manage growing operational complexity. Security products are beginning to evolve into operational extensions of security teams rather than passive alerting systems.

That evolution makes sense. Attackers are using automation and AI to increase speed and scale. Defenders will need to do the same to maintain parity.

5 priorities for security leaders in the AI era

The organizations that adapt best to AI-driven risk won’t necessarily be the ones with the largest security teams or the biggest budgets. More often, they’ll be the ones that adjust fastest as software, infrastructure and attacker behavior evolve more quickly than traditional security operations were built to handle.

That shift requires you to think differently about how you manage risk, operations and resilience.

1. Rebuild vulnerability management for AI-scale software development

Many vulnerability management programs were already overwhelmed before AI accelerated software generation and lowered portions of the attacker cost curve. That challenge is becoming exponentially harder.

Stop assuming old exploitability models will hold up in an environment where attackers can use AI to accelerate reconnaissance, vulnerability chaining and exploit development.

You need to reassess how vulnerabilities are prioritized, validated and remediated because some of the assumptions organizations made over the last decade about attacker limitations may no longer reflect reality.

Some organizations are already investing in model harnesses to deploy new AI models more effectively and securely.

2. Treat runtime visibility as a primary control

Runtime monitoring can no longer be treated as a secondary capability behind prevention. Every team needs to invest in new forms of tooling to gain this visibility.

That said, runtime monitoring is not something security organizations can vibe code into existence. We need to expect our security vendors to build continuous visibility into workloads, identities, APIs and AI system behavior in production environments.

Prioritize clearer context around which vulnerabilities are reachable, exposed or being actively leveraged. This becomes increasingly important as AI systems interact with infrastructure and data in less predictable ways.

3. Use AI to augment defensive operations

Most organizations can’t hire enough people to keep pace with the operational demands AI introduces.

Use automation and AI to reduce investigation time, automate repetitive workflows and improve response speed. Human judgment still matters, but security teams are operating in environments where the volume of alerts, infrastructure changes and software generation exceeds what people can manage manually.

AI can help teams focus on higher-order decisions instead of operational noise.

4. Focus on resilience and containment

Perfect prevention has never existed, but it becomes even less realistic in highly dynamic AI environments.

Think more carefully about blast radius reduction, rapid containment and operational resilience. Your ability to detect unintended behavior quickly and limit downstream impact will matter far more as organizations deploy more autonomous systems.

I think many security leaders are still too focused on whether AI systems can fail instead of preparing for how to operate safely when they inevitably do.

5. Position security as an enabler of transformation

One of the biggest mistakes security organizations can make right now is to approach AI primarily as something to stop.

Boards and CEOs are pushing aggressively toward AI adoption because they view it as strategically necessary. If you position security purely as a blocking function, you risk losing influence during one of the most important technology transitions in decades.

Executive teams understand AI transformation can’t succeed without strong security leadership guiding risk decisions in real time.

That creates an opportunity to help your business move faster safely while building security programs better equipped for dynamic environments.

AI is forcing a new security operating model

The core challenge AI creates for security teams isn’t simply scale. It’s the erosion of predictability. The pace of change will accelerate as AI systems become more deeply integrated into business operations.

To operate effectively in this environment, focus on building security programs that can adapt quickly, contain risk in real time and support innovation without losing visibility or control. Drive this evolution through both hiring and vendor investments, with a stronger focus on AI fluency and operational expertise.

Only with prioritized investment in staff and tooling can you achieve stronger runtime awareness, faster response capabilities and operating models that keep pace with continuously changing infrastructure and software environments.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The insurance industry has long been regarded as a highly regulated, slow-moving monolith. But look closely, and you’ll see that we’re entering a new phase of significant change and overdue optimization – one that puts the consumer experience front-and-center.

I’ve long anticipated this transition. My experience in recent years working on the core machine learning (ML) team at Google taught me that the true value of artificial intelligence is not in hardware efficiency but in the radical personalization it enables. I learned a valuable lesson earlier in my career: Even the most tech-savvy tools can fail if they don’t solve a human problem. It’s a belief that’s been reinforced after recently joining The Zebra team as chief AI officer, a position that empowers me to better employ AI and ML to maximize the synergy between product and technology and make for a more efficient and customer-centric insurance shopping model.

From keywords to context

For years, consumers have used basic SEO keywords to find insurance policies while carriers relied on simple ML to price these policies. But that paradigm is changing quickly. It won’t be long before we see automation processes occurring across several different areas, particularly on the customer-facing side, where we are attempting to collect as much context as we can.

Today, customers provide deep, intent-based context, with a shift toward hyper-personalized, highly detailed queries. The next logical step is for Large Language Models (LLMs) to parse this massive amount of customer intent data and map it against complex and unstructured policy data. This represents both a major challenge and a fantastic opportunity: successfully and efficiently organizing our internal insurance data so that it can be presented back to the consumer. The goal here is to advance to a stage where organizing policy data (the provider side) and collecting information (the customer side) blend to create a perfectly personalized middle ground.

I’ve observed this incredible shift firsthand. Customers used to find The Zebra after using a basic two-word Google keyword search like “car insurance.” But courtesy of LLMs, their queries today are much more specific and customized: “I need car insurance for my 2022 Honda Civic in Austin, Texas, and I park it outside.” Providing this rich data upfront and directly to our advisors changes the whole game, allowing us to bypass tedious intake and start nurturing genuine human relationships.

I love the automation side of AI – especially its ability to eliminate manual data entry. Still, handling sensitive customer information means that AI tooling can quickly throw gasoline on a growing fire. That’s the reason I’m committed to creating a controlled environment. At The Zebra, we’ve spent a decade researching how humans sell policies, and I want to ensure our models don’t “reward hack.” A good illustration of this is an unsupervised model believing that hanging up on every customer ensures it will never technically lose a deal. At our company, it’s my job to build the guardrails that prevent these bizarre optimizations.

Exciting developments underfoot

We’ve entered a sea change moment, signaling a shift toward agentic coding and dynamic UI and away from the hard-coded, static websites that earlier dominated the insurance space. At present, most insurance online portals are linear, with the sequence of questions typically predetermined by a developer. In the coming phase, however, the LLMs will define the questions and the order in which they are asked, and UI components will be chosen or generated ad hoc, depending on the consumer’s particular context. That’s real progress.

Even more than the interface, I’m energized about forthcoming improvements in the agent-to-agent ecosystem. I envision a future where, for example, an online car-buying service like CarEdge or AutoCompanion learns key info about a given user, including their vehicle preferences, budget and safety priorities; then, at the moment the user clicks “buy,” that entire world of context is communicated directly from that website and its human or AI agent to an insurance agent. This layer of interaction eliminates the need for the customer to repeat redundant details while also ensuring that they are instantly offered the best personalized insurance policy.

Peering forward, I’m especially excited about this “agent-to-agent” future. Years ago, I built recommendations, search engines and pricings for a used car e-commerce platform, employing basic filters like “Toyota under $30,000.” But nowadays, people hunt online with so much more context and use conversational AI for nuanced intent, with focused queries like “I need a car for a family of three that fits a bulky stroller.” Extracting that deep context from a vehicle-purchasing AI agent directly into our insurance workflow is a fantastic opportunity to eliminate friction.

Another trend that has me stoked? AI’s increasing ability to help regional insurers structure their data. Smaller insurers, which know their local markets more than national players, have traditionally struggled to aggregate their numbers for digital marketplaces. But by better leveraging AI agents, we can now provide info to customers that was previously difficult to obtain, introducing them to insurance companies that are a better fit.

What’s behind my continued fascination with AI agents? Maybe it has something to do with our corporate culture at The Zebra, which emphasizes creativity, curiosity and fun – as exemplified by our obsession with Legos. Walk into our offices or attend a virtual meeting and you’ll see everyone clicking bricks together. We even commemorate exceptional company or career milestones by gifting Lego sets. These all-ages toys serve as a physical manifestation of a “Tinker mindset.” Legos have taught me that complex architectures are simply collections of tiny but well-defined parts you can remix inventively. When we launched Zebra Labs, it dawned on me that “vibe coding” with AI is akin to playing with digital Legos: Snapping together prompts, models and APIs to construct a security triage agent calls for the same kind of foundational logic needed to assemble a Lego Technic Porsche 911. To me, this mindset makes AI development feel like an organic extension of how we already work.

Navigating challenges ahead

It’s natural to be optimistic about what’s just beyond the horizon. Still, the industry has to be careful about “AI slop” – using AI to build things too quickly without truly knowing where and how it fits. This is an especially slippery slope when it comes to licensing. Case in point: If you ask an off-the-shelf LLM which policy to purchase for a Porsche (the real, non-Lego kind), it could suggest one that violates licensing laws.

You also have to think ahead about hidden hazards when operating in a regulated financial space. In my previous job at Google, I worked on improving the efficiency of Waymo models; at The Zebra’s Austin headquarters, I constantly see these autonomous vehicles, which have taught me quite a bit about edge cases. A Waymo can spot a city stop sign completely obscured by overgrown leaves thanks to its LiDAR and internal maps, safely stopping the car and logging the danger. At our company, strict compliance rules represent those hidden stop signs. Imagine a generic LLM confidently advising a user to drop comprehensive coverage to save a few dollars; doing so means it is acting as an unlicensed advisor – a massive legal liability. The lesson here is that you can’t just give AI the keys, ask it to be professional and simply hope for the best.

To prevent this, I’m creating a digital sensor suite using strict evaluation platforms. This way, before an AI agent can interact with the customer, it has to survive a simulated gauntlet graded on three metrics: factuality (is the information correct?), compliance (did it avoid making a regulated recommendation?) and accuracy (did it hallucinate any features?).

I was recently in Nashville for the Insurance Innovators conference. The audience wanted to know where I’m placing my business bets for The Zebra. My answer was simple: “personalization agents.” I’m investing heavily in resources that evaluate colossal volumes of policy data that can supercharge our human advisors. By extracting the specific data points they require exactly when they need them, I can help eliminate administrative friction and ensure they receive the perfect coverage for their unique risk profiles.

But it’s important to prioritize jobs as we make this transition to more grounded LLMs. This sector isn’t ripe for disruption simply because you can decrease and automate costs by subtracting people from the equation. This next phase I foresee should produce a more synergistic partnership between AI and human beings – especially licensed advisors who make sure we apply hyper-personalization and avoid the kinds of mistakes AI is known for. Yet we also want to unlock an experience so precise that relying solely on human decision-making will eventually feel like an unnecessary risk.

This customer-focused and increasingly bespoke insurance experience I’m dreaming of requires moving beyond simple task automation to a point where data is efficiently structured, and both human and AI agents communicate effectively across platforms. We’re almost there, and everyone – from the policyholder to the underwriter – stands to benefit.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Because generative AI (genAI) tools and services have become so ubiquitous (and popular), the costs of using them are going through the roof — leading to an insatiable appetite for tokens.

Tokens represent a common way to measure and price AI use. Much like letters and words in English, large language models (LLMs) grasp a sentence or query by breaking words into tokens.

With the AI explosion well under way, tokens are now “the fundamental units of data our models process, many representing a problem being solved,” according to Google CEO Sundar Pichai. (Google, by the way, processes about 3.2 quadrillion tokens a month.)

But as the price of all those tokens adds up, business and IT execs are looking for ways to cut costs while keeping corporate productivity up. Uncontrolled token use has already landed one company with an unexpected $500 million AI bill. 

There are a number of ways companies can rein in the price of AI at the model, infrastructure, silicon, and business levels. Here’s a look at how some of those savings might actually be achieved.

Switch to lower-cost models

One way of potentially saving money is by re-routing AI work to a cheaper model, Pichai said. At Google that would Gemini 3.5 Flash. It delivers “frontier-level capabilities at less than half the price of comparable frontier models.

“If companies use a mix of [Gemini 3.5] Flash and other frontier models, they could save a lot of money,” Pichai said.

Those kinds of models provide cheaper tokens, with reasoning that’s good enough for many users — if not as strong as mainstream Gemini 3.5 — to deliver useful results.

“There is sometimes overkill with the [LLMs],” said Deepak Seth, senior director analyst at Gartner. “I don’t always need a large language model which has been trained on the works of Charles Dickens and Shakespeare and Harry Potter.”

Hyperframe Research principal analyst Steven Dickens can’t stop using Amazon’s Quick, which costs $20 a month, for personal tasks. “It is great personal ROI as it has not only made tasks faster, but unlocked tasks I would never have even attempted previously,” Dickens said.

Don’t forget the hardware and software part of the equation

The token crisis isn’t new, said Dheeraj Pandey, CEO of DevRev, who likens what’s going on now in the AI market to the disruptions that emerged with the arrival of cloud computing and virtualization years ago. 

“We let chaos reign and then we had to rein in the chaos,” Pandey said. “The word that people started using was server consolidation and virtualization.”

The answer to the token problem, he said, is the same: “Anything in systems can be solved with caching and indirection.”

DevRev, for example, is building a memory layer between AI agents and primary data sources, such as Salesforce or ERP records; that can cut token load and make data movement more efficient. The layer holds a knowledge graph with answers to common agent questions and runs on cheaper CPUs, avoiding more costly GPU cycles.

Sending agents straight at systems like ServiceNow and Salesforce “will burn a lot more tokens. It’s also not precise. And finally, it’s not safe enough where I can roll it back in case an agent has committed a mistake,” Pandey said.

Network automation firm NetBrains uses a different method: It uses conventional computing to map a network’s layout then feeds only key information to models for planning and reasoning, where AI excels. “So you don’t have to spend all the tokens,” said Netbrains CTO Sang Peng.

Focus on prompt efficiency

Staffing firm ManpowerGroup has found that prompt efficiency can be an effective tool for improving token use, both internally and externally for clients.

For example, users accessing its internal labor-market tool initially needed 10 follow-up questions to drill into a query. A year later, more efficient use of prompts has brought that number down to an average of four, said Max Leaming, head of data science and AI solutions at ManpowerGroup. 

“They’re using fewer tokens and they’re simply more efficient,” he said. “And that in large part has to do with your ability to prompt efficiently.”

Go local

New AI hardware that generates free tokens at home could ease some of the cost crisis.

At GTC Taipei earlier this month, Nvidia and Microsoft unveiled RTX Spark, an agentic AI desktop PC that runs agents and 120-billion-parameter models locally on Windows. The goal is “to deliver unmetered intelligence to every home and every desk with Windows,” Microsoft CEO Satya Nadella said in a statement.

Some companies are looking to reduce cloud AI costs by putting their own hardware in data centers, with vendors such as HPE and Dell providing servers installed in independent facilities. (On-premise AI is gaining ground amid sovereign AI and geopolitical concerns, including the recent conflict in the Middle East, where large data centers were struck with missiles.)

“There are local, region-specific and multiple vendor AI solutions. All of those things can help mitigate the risk. But they’re not going to eliminate it,” said Max Goss, senior director analyst at Gartner.

Use forward-deployed engineers

Reducing token costs is something that may fall to forward-deployed engineers (FDEs) in customer environments, said Taimur Rashid, managing director of AWS’s Generative AI Innovation Center.

“I expect these teams to be able to architect systems that have those cost requirements in mind, whether it’s use a different model or a different use case that doesn’t increase the per-token cost,” Rashid said.

Companies may spend heavily on token consumption, “but if you’re generating revenue, as long as the economics work out, then you’re at peace,” Rashid said.

The use of FDEs is gaining ground as IT decision-makers look to both rollout successful AI deployments while also keeping an eye on costs.

Change the measure of success from tokens to outcomes

Even with the current emphasis on reducing token use to save money, the metrics used to measure AI success are likely to shift, Gartner’s Seth said. At some point, token-based pricing will move more toward an outcome-based model, where the unit of value is outcomes, not fragments of words.

“Some companies are moving towards outcome-based pricing,” Seth said. “When people start realizing the real cost of tokens, then companies will start looking at token efficiency.”

Beth Tschida, who became Jamf CEO in May after serving as CTO and as interim CEO, is the first woman to lead the company in its near 25-year history. I spoke with her this week at the London Jamf Nation event, where the company introduced its new AI Governance solution.

How the transition to CEO is going 

“It’s been a great privilege and an adjustment,” she said. “Jamf has always been a company deeply focused on culture, which is exactly why I love being here. Having the ability to influence and improve that culture from this role is something I feel very supported in doing.”

The last few years have seen a variety of changes at Jamf, which was briefly a public company. “We’ve come through a period of change, not all of it easy,” Tschida said. “But we now have a great partnership with Francisco Partners. We’re private, we’re focused on solving customer problems, and we’re finding ways to lean into what we’re good at.”

Women in tech and mentorship

Tschida is a good choice to lead a software engineering company, as she’s an engineer herself. She originally joined Jamf as vice president for software engineering in 2018, moving up to CTO in 2022. She’s also one of the few women in leadership positions in tech. (To Jamf’s credit, the company also has CIO Linh Lam on its team.)

“I think it’s important for women to stay deep in the tech, build their skills and find their voice confidently,” Tschida said. “You’ll never know all the technology out there. Nobody does. What matters is the ability to keep adapting and evolving.”

Tschida stressed the importance of mentorship. “I feel very honored to have a chance to be a role model for other women,” she said. “I had women who forged a path for me, including a female CIO early in my career who I asked to mentor me and learned an enormous amount from. I’m certainly not the first woman in tech, but I do want to play my part in helping others grow in their careers.

“Ultimately, I want to be respected for what I do, not for my gender. That’s how everyone should be judged.”

AI Governance

Tschida’s product focus means she knows what matters to Jamf. “If you focus on the problems customers have and how your product can help fix them, that’ll take you to where you want to go.”

For many in the enterprise, both in and beyond the Apple space, the next big problem is AI — how to deploy it, how to manage it, and how to regulate it.

AI Governance is a new Jamf solution that has been developed in response to those pain points. Countless surveys, including Jamf’s own data, show that AI is being widely used across every company, but IT lacks visibility into its use. It’s hard to know what data is being shared with AI tools, which services are being used, and how to report on that use effectively — particularly in regulated industries.

AI Governance is designed to make it possible for anyone managing an Apple fleet to get granular insight into AI use across their Mac, iPhone, and iPad devices. It uses telemetrics to shed light on that use, offers governance and management tools to help IT gain better oversight and control over it, and provides highly comprehensive reporting tools suitable for internal or regulatory review.

“AI is happening whether organizations know it or not,” said Tschida. “That’s the problem. You can try to block it, but that’s very hard to do well. It’s far better to build visibility and governance around it.”

The offering makes it possible for companies to enable the AI use they already know is taking place while protecting corporate interests and enabling fast and accurate reporting. You can find out more details here.

Empowering better AI

Jamf’s approach is focused on endpoint management. AI Governance means IT can see what’s running on a device, categorize it, and understand what AI tools and models are in use. “If you know how people are running AI on your fleet, you can open it up safely. Then all of your customers and employees can find their way to figure out how AI is going to optimize their workforce,” she said.

What does that look like in practice? Think of it as an orchestration layer. IT can define different AI configurations for different teams: HR might use one set of models, engineers another. And admins can apply opinionated postures per group: what models are permitted, what cloud services they connect to, what’s visible to IT versus the CISO versus the CFO. “It’s an extension of what Jamf has always done, it just now applies to AI endpoints too.”

What about regulatory complexity across geographies? “A lot of governance controls are shared across regulations; a good base set is a healthy way to run regardless. But each regulation has its own twists. Our mission is to make sure customers operating in different markets can expand on that base and fit the specific models and regulations they need, getting the right configurations to the right devices.”

Managers must prepare for AI cost challenges

There’s a second dimension beyond management — cost. The industry is developing quickly, with new AI models appearing almost every week. Yesterday’s leading LLM is tomorrow’s fading star, even while the cost of AI infrastructure goes through the roof. As that churn slows, investors will want to start seeing returns on their bets, which is why token costs — the price of running AI services, at least in the cloud — are climbing fast.  

As costs become more realistic, that’s going to change the nature of AI deployment from the laissez-faire, anything goes approach to a more strategic management of such use. “Models keep dropping fast, but token costs are only going to go up,” said Tschida.

“Organizations will need to decide: just because you can build something with AI, should you? What’s the right model for what work? We’re helping customers move from, ‘We’ll just block it’ or ‘We’ll turn it on and hope for the best,’ toward a place where they have a real viewpoint and can manage and change that viewpoint over time.”

The ever-changing AI world is also prompting Jamf to make more of its APIs externally available. “We’re used across every industry and every geography, at every scale,” said Tschida. “There’s no way we can build every workflow every customer needs, we’d never get to all of them.”

Embracing openness also helps build future foundations. “Thinking about where we’re heading next — agentic endpoint management — having platform APIs allows our customers to build things they can imagine, that we can learn from, in a way that solves their specific problems.”

Apple, WWDC, and the enterprise

Tschida’s comments come shortly after WWDC 2026, where Apple introduced a raft of AI advances that formed a strong foundation for its future, improvements that matter to Jamf. “When Apple innovates, Jamf celebrates,” she said.

“Apple is doing great things in their AI ecosystem, revamping Siri, expanding their AI capabilities, making Apple the platform people want to run AI on because those machines simply perform better. Our job is to take what Apple builds and bring it into the enterprise in the way that enterprises actually need it.”

Most of the industry recognizes that Apple’s enterprise story has changed dramatically as its products see accelerating use, and momentum is not slowing. Tschida reflected on how just a few years ago, Apple in the enterprise was an option in employee choice programs. “Now it’s becoming the clear choice,” she said. “We expect that trend to continue. And the more Apple invests in AI running natively on device, the stronger that argument gets.”

Where is Jamf going?

AI Governance is a unique answer to an increasingly important set of questions that are now beginning to affect the IT management of Apple’s platforms. (It’s not clear whether anything as sophisticated exists for other platforms at al, but as the need to manage AI grows, demand for such solutions will grow.)

Ultimately, the company’s latest move reflects Jamf’s inherent strategy under its new CEO. “Focus on customers, listen to them, solve their problems, and don’t throw tech at it. Ask: what’s the problem? Can we solve it? That focus is what takes you where you need to go.

“We’re on a good trajectory, customers stay with us, and the culture has always underpinned us. Now we’re finding ways to lean into it even further,” she said.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon and subscribe to The Core.

Over the past two decades, I’ve had the opportunity not only to witness the evolution of enterprise software development, but also to help shape parts of it firsthand. Throughout that journey, one objective has remained remarkably consistent across every wave of innovation: reducing the distance between an idea and a working solution.

Today, we are entering another major shift. AI coding agents, vibe coding and AI-orchestrated development workflows are changing not only how software gets written, but how large portions of the software development lifecycle are executed. AI is no longer limited to generating snippets of code or assisting with isolated developer tasks. Increasingly, it is helping define requirements, generate workflows, build integrations, refine user experiences, support testing and coordinate deployment activities.

For many organizations, this shift can feel sudden or even disruptive. From my perspective, however, it is the natural continuation of a much longer trend toward accelerating innovation at scale. The destination has remained largely the same. What continues to evolve are the tools, interfaces and operating models that help organizations get there faster.

Over time, enterprise software evolved from traditional coding to visual development platforms, then from visual development to low-code and no-code environments. Each stage compressed the software lifecycle while expanding the number of people capable of participating in innovation. Yet despite those advances, software creation remained relatively centralized and technical. Users still had to understand workflows, data models, governance frameworks, integrations and platform-specific logic. We reduced complexity, but we had not fundamentally changed who could participate in building operational systems.

That distinction matters because the true bottleneck in enterprise innovation has never been coding capacity alone. More often, it has been an organization’s ability to translate ideas into operational execution quickly enough to keep pace with change.

Expanding the innovation surface area

One of the earliest inflection points I experienced was the rise of workflow and business process management platforms. These technologies introduced visual ways to design and automate processes that previously required extensive custom development. For the first time, organizations could model workflows graphically instead of building everything manually through code.

Low-code platforms accelerated that momentum by abstracting much of the complexity involved in application creation. Teams could reuse components, streamline integrations and deliver systems in months instead of years. Much of my career has centered around advancing these kinds of platforms, but the ambition was always broader than improving developer productivity. The real goal was helping organizations respond to business needs faster and with greater flexibility.

The emergence of true no-code platforms expanded innovation even further by bringing business users directly into the development process. Citizen development evolved from an aspirational concept into something operationally viable inside the enterprise. More teams could experiment, more workflows could be digitized and more ideas could move from whiteboard discussions into production far faster than before.

At the same time, organizations realized that democratization alone was not enough. Enterprises still needed governance, operational standards, methodologies and trust in how applications were being built and maintained at scale. That challenge ultimately led me to co-author the No-code Playbook and later the No-code Toolkit, both focused on helping organizations operationalize no-code successfully across the enterprise.

Sustainable acceleration has always depended on balancing empowerment with structure.

What AI changes this time

What feels different about the current AI wave is that it does not simply accelerate one layer of software creation; it changes the interaction model altogether.

Previous generations of platforms still required users to learn the language of the system. Even in low-code and no-code environments, people had to think in terms of workflows, logic models and application architecture. AI-native development begins to reverse that dynamic.

Instead of forcing people to adapt themselves to the tooling, platforms are increasingly learning the language of the user. Intent becomes the interface. A business user can describe a process conversationally. A developer can outline an architectural goal. A product leader can upload requirements, diagrams or workflows. AI can then help translate those inputs into applications, automations, integrations and operational systems collaboratively and iteratively.

For the first time, software creation is becoming conversational, adaptive and context-driven in ways that dramatically reduce the barrier between identifying a problem and operationalizing a solution.

Importantly, this is not just about generating code faster. AI is beginning to accelerate the broader software development lifecycle itself — from requirements gathering and workflow generation to testing, documentation, optimization and deployment preparation. We are moving beyond AI-assisted coding toward AI-orchestrated software delivery.

As AI takes on more implementation mechanics, the role of humans also evolves. People shift further toward defining intent, guiding outcomes, orchestrating systems and applying business context and governance. In many ways, AI amplifies human expertise rather than replacing it.

From applications to innovation systems

AI is also changing expectations around enterprise platforms themselves.

For the past two decades, SaaS applications largely evolved around predefined modules, user-based licensing, workflow limitations and incremental customization. Those models made sense in an era where software creation remained constrained and highly specialized.

But AI-native development changes both the economics and expectations of innovation. Organizations increasingly want platforms that support continuous experimentation, rapid automation, AI agents and operational adaptability without introducing artificial limits around workflows, users or application boundaries. Increasingly, the enterprise platform is evolving from a static application suite into something closer to an innovation operating system.

This reflects a broader shift in how organizations think about software itself. Traditional enterprise systems were largely designed from the inside out, reflecting how organizations structured themselves and broke down processes functionally. But customers, employees and partners increasingly expect experiences that adapt to how they want to engage and operate. As expectations evolve faster than internal systems can change, organizations need platforms flexible enough to support continuous adaptation rather than rigid process enforcement.

Historically, scale was closely tied to headcount and software access. More users typically meant more work could be completed. But as AI agents and automation become embedded throughout operational workflows, scale increasingly depends on how effectively organizations coordinate people, systems and intelligent automation together.

The future enterprise will not simply operate faster. It will operate differently.

Organizations that succeed in this environment will not necessarily be the ones with the largest development teams or the most rigid technology standards. They will be the ones capable of turning ideas into operational reality continuously while adapting systems and workflows as quickly as business conditions evolve.

The next era of 10X innovation

Looking back, the broader pattern becomes clear. Every major evolution in enterprise software development has focused on reducing friction between ideas and execution. Visual workflows abstracted complexity. Low-code accelerated delivery. No-code expanded participation. AI-native development now accelerates orchestration itself.

What feels different today is the scale of the transformation. Traditional boundaries are beginning to blur — between developer and business user, between tool and collaborator, and increasingly between design and execution. AI agents are evolving from passive assistants into collaborative execution partners embedded throughout enterprise workflows and development systems.

The future is not simply about AI writing code, but about AI helping organizations orchestrate software creation and operational innovation end-to-end. And that shift has implications far beyond engineering productivity alone. It changes how organizations experiment, how they operationalize ideas and how quickly they can evolve in response to changing markets and customer expectations.

For years, enterprise software innovation focused primarily on making development faster. What AI-native systems introduce is something broader: the ability to expand who can innovate, how rapidly organizations can operationalize ideas and how continuously businesses can evolve.

In many ways, that is the larger transformation now underway. The future of enterprise software will not be defined solely by better applications, but by how effectively organizations turn ideas into operational reality at scale

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Hot AI companies can’t stop talking about forward-deployed engineers (FDEs), which are now very much in vogue. 

FDEs, in case you haven’t heard, are hired by companies looking (hoping?) to successfully deploy AI tools and services. It’s one of the hotter professions in a world still trying to understand the impact of AI on careers.

So, what exactly are FDEs — are they techy lone rangers like the ones OpenAI, Google and Microsoft are hiring? Turns out it’s not so much about individual engineers who swoop in to design and roll out AI deployments; it’s more about a team of engineers working together at customer sites.

At least, that’s the view at Amazon Web Services (AWS).

In fact, according to Taimur Rashid, managing director of the AWS Generative AI Innovation Center, the FDE concept pre-dates the current generative AI (genAI) gold rush. The same kinds of engineering teams were needed for the earlier machine-learning and cloud eras to help companies with deployments.

Rashid recently talked about how AWS sees FDEs as a profession in a conversation with Computerworld. And he weighed in on the desired job skills the company seeks in this increasingly AI-centric era.

What is an FDE? “We view it as a team. It’s a cross-functional team that has engineers, scientists, strategists, and folks that can piece technology and business together. In some cases, we do have to have security engineers in there, too. 

“I see them as anesthesiologists. They have to prep so many things, monitor things throughout. We see ourselves as a frontier deployment team helping customers adopt all forms of AI, whether it’s genAI, agentic AI, even emerging trends like physical AI. We’re helping these companies become frontier themselves.”

How does an FDE engagement begin, and how is it structured? “Where we see the forward deployed model is when customers come in — for example, we have our executive briefing center in Seattle and in Arlington, VA. When customers share what they’re trying to do, very quickly a customer’s like, “What’s the quickest way I can go and build something with you?” 

“We’ll forward deploy our people in, we’ll embed them in your business and we’ll go through these 45-day sprints that we typically design. Through those successive sprints, we’re building stuff together, we’re proving value, and then they can expand that to a much broader engagement.

Where do FDEs actually sit? Client side, internally, or in-between? “It’s mixed, and it largely depends on what the customer’s preference is. We’ve seen models where the customer has been very adamant that, ‘We want your teams with us in our business.’  In those cases, we forward deploy the majority of the teams on site. 

“We have models where customers are fine with you being wherever you’re based, as long as you’re still embedded virtually. And then there’s a hybrid. We deploy anywhere from five to seven people. Sometimes, the baseline is actually three.”

Will cost savings be the job of an FDE, or someone else on the team? “I expect these teams to be able to architect systems that have those cost requirements in mind, whether it’s use a different model for a different use case that doesn’t increase the per-token cost…or think about ways where you can use semantic caching. I personally think you may have a high spend in token consumption, but if you’re generating revenue, as long as the economics work out, then you’re at peace.”

What challenges have you gone through deploying FDEs in the real world? “One of the challenges worth highlighting is when customers get really excited about us forward deploying resources, what they end up realizing is [that] they’re not set up to absorb that right away. They realize they have to go through … process-related things, security access — all those operational things. 

“One very good example is the Commonwealth Bank of Australia. They said: “Prioritization’s a big thing, and if you forward deploy and you’re 100% dedicated, how do we ensure that our teams are also equally 100% dedicated?’ When you’re sitting in your office, you’re distracted by your day-to-day. So they said, ‘Why don’t we create a neutral ground in Seattle? You fly your people, we’ll fly our people. We’ll give them three weeks of dedicated time so they have no distractions.’”

Have you gone into projects where they want AI but have no security or governance ready? “I’ve been through this before, certainly. We do see customers that have security processes and capabilities, but it’s not as tight as it should be in the age of AI. Governance is the biggest area where customers right now have the biggest gap. I’m talking governance around agents. In the past two months, almost 100% of the conversation around agents is not about capability. It’s all about governance. 

“That is a big area right now where forward deploy teams are helping with governance education, and building the scaffolding for that.”

How does software engineering fit into the FDE model? “One of the greatest learnings is that as we forward deploy resources and get customers to take AI and integrate it into their systems, the knowledge of software engineering is so important. Today, a customer can use one of the Claude models and scan their code base and look at vulnerabilities. 

“The tough part is not assessing those vulnerabilities, it’s remediating [them]. Remediating [them] requires software engineering experience, because you have got to merge code, test it, deploy it. We largely see that the frontier software development teams are smaller and they’re managing agents that are doing various tasks across the software development lifecycle.”

AWS has many models at your scale, open source, closed — it’s more complex than what other AI vendors offer.  How do you nail down the talent? “It’s massive, and when you look at not only scale, it’s the complexity of the stack. We take an approach where we fundamentally do three important things: No. 1, we want to ensure people understand concepts; they have to understand pre-training, post-training, reinforcement, fine-tuning. 

“Secondly, we make sure that our teams are well versed in their first-party services. The third thing is that by design, AWS has always been about choice. We say, ‘Let’s do 80-20 here. What is 20% of those specialties that we need to have, which can cover 80% of what most customers are trying to do?’”

What skills should software developers learn to move into FDE work — the top three or four things? “We look at three categories. First category is entirely functional. Are they more engineering specific? Are they science specific? Are they security specific? Our litmus test is not only knowledge of the function, but the actual hands-on work that they can do with it. Secondly is around domain. I focus on what is their domain understanding across the whole AI lifecycle? The third thing is cultural. We are looking for folks that are okay at dealing with ambiguity, being good at stakeholder management, and having that startup mindset. 

“This AI transformation’s not for the faint of heart.”

There’s a rush for FDEs from OpenAI, Google, and others. What’s different about what you look for? “I don’t know entirely what the others are looking for, but I’ll tell you what we have been looking for in the past. When we hired solution architects, it was about systems level understanding. But what I see more and more is hands-on experience, cultural mindset, all these things are very important. If I had to pick one thing that is going to be very important in the talent that we either upskill or future talent that we hire, it has to be the application of AI towards software engineering and system integration tasks.

You’re upskilling AWS talent as well? “We do. You will see some publications coming out in the next couple of weeks around how do we do this across our software teams and how does that translate to customer-facing roles.”