❌

Visualização de leitura

Why Is Kim Yo-jong Suddenly Responding to a Binance Hack?

Binance hack Targeted

On October 29, Binance lost control of about $6.34 billion in digital assets in a matter of hours. The attackers did not break in on that day, though. They had been working their way inside since June. The Binance hack was a slow campaign aimed at a handful of engineers, and it used a tampered download, a fake job interview and the exchange's own internal AI tool to reach the systems that sign transactions. Binance CEO Richard Teng called it "one of the most sophisticated attacks the digital asset industry has ever seen." He said the company takes full responsibility and that no user will bear the loss.

Why the Binance Hack Targeted Engineers, Not Systems

According to the post-mortem Binance released on Tuesday, the attackers went after people with access to wallet infrastructure. In June, Wallet DevOps Engineer A searched for a popular AI coding tool and downloaded a tampered Homebrew installation. Binance's security team spotted the anomaly, replaced the device and rotated his credentials. But the damage was done in another way: Engineer A's role, and his colleagues on the wallet infrastructure team, were now known to the attacker. In September, the attackers moved to social engineering. Software Engineer B, whose profile on a legitimate job-hunting platform mentioned his Binance experience, was approached by someone posing as a project director. A first-round video interview followed with a supposed HR representative, who shared personal photos and videos on social media to build trust. Binance said this was more advanced than social engineering it had seen before. Binance hack infographic In the second round, held on a popular chat app, Engineer B was told to download an "assignment" onto his work computer. It contained malicious code that ran during setup, swapped a legitimate development tool for a malicious version, and connected to an attacker-controlled server. The zero-day malware was not detected by endpoint security tools at the time. On October 20, the attackers used Engineer B's compromised computer and an internal AI tool to gain control over Engineer A and another wallet engineer, Engineer C. They then found that Engineer A had a container deployment permission token on his machine.

How the Binance Hack Unfolded on October 29

Between 17:15 and 19:56 UTC, the attacker logged onto Engineer C's computer, used Engineer A's stolen credentials, deployed a container and triggered a malicious script. That gave them unauthorized access to an internal wallet signing service, which they used to send transactions outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address. Hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP. Binance then received an internal alert about large transfers, and another hot wallet sent 18,270 BTC.

Why Binance Couldn't Stop It Faster

Binance suspended withdrawals, but that did not end the outflows. The attacker had used the signing service to exploit Ethereum's EIP-7702 authorization mechanism. By submitting 50 signing transactions, they gave an attacker-controlled smart contract partial execution rights over a Binance hot wallet. Those authorizations lived on-chain and worked independently of Binance's withdrawal systems. And because the wallet used Multi-Party Computation, there was no single private key that could instantly revoke them. Binance had to build a special procedure to do it. The final unauthorized transfer of 2,961.9 ETH was confirmed at 23:56 UTC. At 00:10 UTC on October 30, Binance cleared the malicious delegation.

Who Is Behind It

Over the weekend, the FBI and other U.S. agencies blamed the theft on TraderTraitor, a North Korea state-sponsored group that has spent years attacking cryptocurrency platforms. Binance said it had detected and stopped 57 suspected North Korea-linked threats in 2026 alone, many using fake job interviews and malicious developer tools. On Tuesday, Kim Yo-jong rejected the U.S. findings, calling them a "grave political provocation" in a statement carried by the Korean Central News Agency. Observers noted the statement ended by saying Pyongyang had matters to "reconsider," without directly threatening retaliation. South Korea's Unification Ministry called her personal response unprecedented. An official said it suggested the North was taking the allegations seriously and was "increasingly conscious of its international standing."

Where Users Stand

Binance says it has set aside more than 100% of the funds needed to cover the loss. As of October 31, 98% of impacted token assets had been replenished, and Binance is buying the remaining, less liquid assets. About $2.85 billion has been frozen or intercepted with help from law enforcement, token issuers and blockchain intelligence firms. Withdrawals have broadly resumed. The exchange says it has rebuilt the affected wallet system and AI tool, replaced devices, revoked credentials tied to the affected engineers and brought in independent security firms. The investigation is ongoing.

FBI Seizes Bulletproof Hosting Domain Linked to Cybercrime

FBI seizes Virtualine

The FBI seizes Virtualine domain in a court-authorized operation alongside the U.S. Department of Justice , disrupting a so-called bulletproof hosting service accused of facilitating cybercrime, the distribution of child sexual abuse material (CSAM), and international money laundering. Before the seizure, Virtualine.net allegedly provided hosting infrastructure to criminal operations and continued supporting certain services despite repeated abuse notifications from law enforcement agencies and other organizations. The seizure followed a court-authorized operation against Virtualine, which also operated under the names Secury, Massgod, Spamhouse, Lanedo and Omegatech. According to court records, the service offered hosting, server solutions and domain purchasing options while advertising its ability to protect customers from law enforcement intervention.

FBI Seizes Virtualine Over Alleged Cybercrime Activity

Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia, and Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, announced the seizure of Virtualine.net. Authorities said the domain had been used to facilitate multiple forms of criminal activity, including advertising sexually explicit images of minors, the intentional disclosure of nonconsensual intimate images involving adults and minors, and international money laundering.
FBI seizes Virtualine
Image Source: FBI
Virtualine marketed its services on cybercrime forums, where it openly promoted hosting options for users engaged in illegal activities. In September 2024, the service told a user on Exploit.in that its infrastructure could be used for activities including phishing, carding, email spam and port scanning, while claiming to prohibit child sexual abuse material and terrorism-related content.
However, court records allege that Virtualine knowingly hosted a criminal online forum, identified as Vendor 1, that allowed users to post and sell access to nude, sexually suggestive and sexually explicit images and videos involving minors and adults.

Hosting Provider Allegedly Ignored Repeated Abuse Reports

The investigation found that Virtualine continued hosting Vendor 1 despite receiving multiple notifications about sexually explicit images and videos of minors. According to court records, Virtualine assigned an IP address to Vendor 1 around December 2025, with notifications about the material beginning in January 2026. Reports came from law enforcement agencies in Germany, Canada and Australia, the U.S. National Center for Missing and Exploited Children (NCMEC), and an attorney representing a victim. Despite these notifications, Virtualine allegedly continued providing hosting services to the forum. The records also state that Virtualine worked directly with Vendor 1 to develop another website that allowed customers to upload illicit content and download it after making a purchase. Authorities said Virtualine continued hosting this website and had received at least one abuse complaint concerning sexually explicit images of children found on the platform. Vendor 1 also promoted a hack-for-hire service, through which customers could pay hackers to gain unauthorized access to victims’ online accounts and obtain explicit images and videos.

Virtualine Advertised Measures to Evade Law Enforcement

Beyond its hosting services, Virtualine allegedly offered customers additional protection designed to keep criminal infrastructure operational when authorities intervened. In March 2026, the provider advertised an “additional protection plan” that it said could be activated after receiving an official request from law enforcement agencies. Under the arrangement, Virtualine would move a customer’s criminal infrastructure to another shell company not affiliated with the provider, after which the server would be reactivated. The alleged practice illustrates how bulletproof hosting services can be used to maintain online criminal operations by moving infrastructure when enforcement or abuse complaints threaten existing arrangements. Virtualine also promoted its tolerance of abuse on underground forums. In a June 2025 post on HackForums, it claimed to have ignored more abuse reports than other providers.

Cryptocurrency Payments Linked to Money Laundering

Investigators also examined Virtualine’s payment arrangements and their alleged role in concealing criminal proceeds. According to court records, Virtualine accepted payments through Bitcoin, including specific unhosted Bitcoin addresses that allowed customers to make direct payments without their funds being flagged as illicit. The service received payments from criminal customers, some of which investigators could trace directly to various criminal groups. Virtualine then allegedly laundered the funds further to conceal their origin. Authorities identified international money laundering as one of the criminal activities facilitated through the service.

International Cooperation Behind Virtualine Takedown

The FBI’s Washington Field Office led the investigation, with significant assistance from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland and the United Kingdom’s National Crime Agency. Private-sector partners OverRIPE and Lumen also assisted, while the Justice Department’s Office of International Affairs provided additional support. Assistant U.S. Attorneys Laura D. Withers and Stefanie A. Schwartz are representing the government in the matter. The seizure of Virtualine.net disrupts a hosting service that authorities allege provided infrastructure and financial services to support criminal activity. The case also highlights the role of international law enforcement cooperation in targeting providers accused of enabling cybercrime across multiple jurisdictions.

Virtualine Domain Seized, but Allegedly Abusive Website Remains Online

The FBI seized Virtualine, a hosting service accused of supporting criminal sites, ignoring abuse reports and helping launder money from illegal activities

The FBI seized the website of Virtualine, a hosting service that sold its services to criminals. The seized domain is virtualine.net, and the government says the site was used to commit and facilitate prolific criminal activity. That includes the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate images of adults and minors, and international money laundering. A court authorized the seizure.

“Theophani K. Stamos, First Assistant U.S. Attorney for the Eastern District of Virginia, and Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, announced today the seizure of the website virtualine.net after it was used to commit and facilitate prolific criminal activity, including the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions of adults and minors, and international money laundering designed to conceal and promote criminal conduct.” The Justice Department has the details in a press release.

Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech, offers “bulletproof” hosting. It sells hosting, servers and domain names to customers who want a provider that ignores abuse complaints. It promotes its services on cybercrime forums.

Court records include examples of those ads. In September 2024, Virtualine told an Exploit.in user that it allowed illegal activities such as phishing, payment card fraud, email spam and port scanning, but banned child sexual abuse material and terrorism-related content. In June 2025, it boasted on HackForums that it ignored more abuse than three therapists combined.

In March 2026, Virtualine promoted an “additional protection plan” for customers, offered after the company received an official request from law enforcement. Under the plan, it would move the customer’s criminal infrastructure to another shell company unaffiliated with Virtualine, and then reactivate the server. It was a game of musical shell companies.

“In March 2026, Virtualine advertised its “additional protection plan,” which it offered to its customers after “receiv[ing] an official request from law enforcement agencies.” Under this plan, Virtualine would move the customer’s criminal infrastructure to “another shell company not affiliated with Virtualine, after which the server is reactivated.”” continues the press release.”As Virtualine advertised to users on the platform HackForums in June 2025, “Virtualine ignored more abuse than your last three therapists.””

Despite saying it bans child content, the government says Virtualine knowingly hosted a website that carried it. Court records call that site Vendor 1. It’s a criminal online forum where users post and sell access to nude, sexually suggestive or sexually explicit images and videos of minors and adults, and it also promotes a hack-for-hire service in which people pay hackers to get into victims’ online accounts without consent and take explicit images and videos.

In January 2026, about a month after assigning Vendor 1 an IP address, Virtualine began receiving reports of child sexual abuse images and videos on the server. The reports came from police in Germany, Canada and Australia, the US National Center for Missing and Exploited Children (NCMEC), and a victim’s lawyer. According to the government, Virtualine continued hosting Vendor 1 despite those warnings.

The government also says Virtualine helped Vendor 1 build a new website. It allowed users to upload illegal material and download it after paying.

The site accepted several payment methods, including an option called “BTC [NO-AML].” It used bitcoin addresses outside a hosted payment service, allowing customers to pay directly and avoid that service’s checks for illegal funds.

Authorities say some payments came directly from criminal groups. They accuse Virtualine of accepting the money and moving it through further transactions to hide its source.

The FBI’s Washington Field Office led the investigation, with significant help from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, and private partners OverRIPE and Lumen. The Justice Department’s Office of International Affairs also assisted. Assistant U.S. Attorneys Laura D. Withers and Stefanie A. Schwartz represent the government.

A domain seizure doesn’t end the problem, and the government says so in plain terms. The new website Virtualine built with Vendor 1 has already drawn at least one abuse complaint about sexually explicit images of children, and the release adds: Virtualine hosts this new website to this day.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Virtualine)

Australian Data Breach Incidents Up 66% as AI Sharpens Scams

ASD Cyber Threat Report

Australians filed a cybercrime report about every six minutes over the past year, and artificial intelligence is making the attacks behind those reports faster and more convincing. That is the main finding of the ASD Cyber Threat Report 2025-26. It is the seventh annual assessment from the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC).

In FY2025-26, the agency received more than 82,000 cybercrime reports through ReportCyber. It responded to over 1,500 cyber security incidents, up more than 20% on the previous year and 36% over five years. It also notified Australian entities of potentially malicious activity more than 4,400 times, almost 80% more than in FY2024-25.

What the ASD Cyber Threat Report Says About AI

The report calls AI the defining force in the threat environment this year. In his foreword, Deputy Prime Minister and Defence Minister Richard Marles wrote that AI is helping malicious actors find vulnerabilities faster and exploit them at greater scale, speed and sophistication. He also noted that new threats have emerged in recent weeks from the unintended actions of AI agents and from model testing.

ASD’s ACSC makes one clear distinction. AI has not created new kinds of threats. It has amplified and sped up existing ones. AI-enabled cyber threats are most visible in social engineering. Attackers are using AI to write phishing emails with no spelling or grammar errors and to automate targeted spearphishing. The Australian Securities and Investments Commission has also seen a sharp rise in scams that use deepfake videos of celebrities and politicians.

The time defenders have to respond is also shrinking. The agency has previously observed that most vulnerabilities are exploited within two weeks, and some within 48 hours of a patch being released. It expects AI-driven tools to shorten that window further over the next 12 months. Publicly reported vulnerabilities (CVEs) rose 30%. Old flaws are still a problem too: ASD’s ACSC recorded the successful exploitation of a vulnerability first identified in 2008.

Incident Severity Grows in ASD Cyber Threat Report Data

Only one Category 2 incident was recorded this year. However, extensive compromises rose from 26 to 40. ASD’s ACSC identified 362 incidents after proactively notifying organisations. A single notification about cPanel vulnerabilities, sent to 340 entities in May 2026, led to more than 60 confirmed incidents.

The number of ransomware incidents held steady at 139, but extensive ransomware incidents rose from 16 to 24. Health Care, Professional, Scientific and Technical Services, and Manufacturing remained the most affected sectors. Data breaches made up 98 incidents, a 66% increase on the previous year. Separately, the Office of the Australian Information Commissioner received 1,205 breach notifications in 2025. That is the highest yearly total since its Notifiable Data Breaches scheme began in 2018.

The financial impact is rising for businesses. The average self-reported cost of cybercrime per business report rose 16% to $93,500. For medium-sized businesses, it rose 45% to $141,300. The average cost for individuals stayed at $33,000. Identity fraud remained the most reported cybercrime, although reports fell 18%.

Stolen access is now a major entry point. Compromised accounts and credentials were among the most frequently reported incident categories, and phishing appeared in 39% of incidents. Government survey research cited in the report found that 55% of Australians reuse passwords across multiple accounts.

State Actors and Critical Infrastructure in the ASD Cyber Threat Report

State-sponsored actors continued to target Australian government, business and individuals to gain sensitive information. The report says these actors are increasingly pre-positioning inside networks to enable future disruption. Marles wrote that the line separating state-sponsored espionage from sabotage and cybercrime is becoming increasingly blurred.

In April 2026, ASD’s ACSC and international partners highlighted a shift by China-nexus actors. These actors are moving towards large covert networks built from compromised home and small office routers, Internet of Things devices and smart devices.

Critical infrastructure accounted for 154 incidents, or 10% of the total, a decrease of almost 7%. Phishing was the leading initial access technique at 36%, and Financial and Insurance Services was the most affected critical infrastructure division at 30%.

What the Threat Report Asks Organisations to Do

In October 2026, ASD’s ACSC released the Essentials series. It evolves the Essential Eight into a principles-based framework with three chapters: Enterprise IT, Operational Technology and Cloud.

Under its Cyber Action Year, the agency is pushing five priorities:

  • Replacing or mitigating legacy technology.
  • Implementing best-practice event logging.
  • Managing supply chain risk.
  • Preparing for AI-enabled threats.
  • Preparing for post-quantum cryptography, including ceasing the use of traditional asymmetric cryptography by the end of 2030 or sooner.

The report also urges organisations to patch faster. For individuals, it recommends reviewing privacy settings and enabling multi-factor authentication or passkeys.

Suspicious activity, incidents and vulnerabilities can be reported at cyber.gov.au or through the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).

South Korea Police Dismantle AI-Driven Cybercrime Ring That Hit 90 Companies

cybercrime ring

Police in South Korea have broken up a cybercrime ring accused of using generative AI to hack about 90 domestic companies, steal roughly 8.2 million personal records, and demand money in exchange for silence. Investigators believe the group's leader, who never studied IT, used AI to rapidly expand the range of targets. 

Seven Suspects Tied to the Cybercrime Ring 

On the 26th, the Cyber Investigation Division of the Seoul Metropolitan Police Agency said it had apprehended seven people, including the 32-year-old ringleader, identified as A, on suspicion of extortion and violating the Information and Communications Network Act. A has been detained, while the other six are being investigated without detention.  The group allegedly broke into the systems of around 90 companies from September last year through this month, taking personal information and internal data. Victims included private academies, hospitals, golf courses and affiliates of major conglomerates. The suspects reportedly warned, "If you don't pay, we'll leak the information," and pointed to the reputational harm, surcharges and damages lawsuits a public breach could bring as extra pressure. 

How AI Widened the Attacks Across South Korea 

A is believed to have learned hacking through blogs and other sources and worked in penetration testing at a cybersecurity company from 2019 to 2022. Early on, A used automated tools to find website vulnerabilities, but from August this year expanded the attacks using generative AI and an AI-powered autonomous penetration system. Police believe about 60 of the roughly 90 victim companies were hacked with AI's help.  Digital forensic evidence, A's statements, and other materials pointed to about 8.2 million stolen records. The cybercrime ring demanded a total of 360 million won from 38 companies, but swift arrests limited its takings to just 300,000 won. Police are also examining whether other companies paid quietly or never reported the threats. 

Tracking Down the Cybercrime Ring 

The investigation began after one victim company filed a report in June. As similar cases surfaced nationwide, police consolidated them in August. From July to September, officers arrested five accomplices involved in the threats one after another, and early this month caught another who had directed the crimes via Telegram. Police searched A's residence in Yeoksam-dong, Gangnam-gu, Seoul, on the 13th, inspecting the generative AI running on a computer used in the crimes. After tracing access logs from victim companies and other records, they arrested A on the 15th and seized computers, hacking tools and accounts used to send threats. On the 23rd, A was sent to prosecutors in custody on suspicion of stealing about 900,000 records from 15 companies that had filed reports. Police plan to investigate allegations involving the roughly 75 remaining companies that have yet to report.

A First for South Korea

Police called it the first case in South Korea in which suspects were caught running a large-scale hacking and data theft operation that exploited generative AI. They said it shows the barriers to cybercrime are falling, as individuals, not just professional hacker groups, can now use AI to attack multiple companies in a short time.  Authorities will keep identifying additional victims and accomplices while tracing the proceeds of the crimes. 

CIOs rethink roles, skills, training, and talent models for the future

Longtime IT leader Matt Ausman envisions a future where developers may not have any backlog because AI will let them create new capabilities as quickly as they imagine them.

“The backlog will vanish because you will have infinite capacity,” says Ausman, SVP and CIO of Zebra Technologies.

He wonders whether business users will be able to keep up with the training required in a world where the software they use will change that rapidly. He also wonders whether IT workers are ready for that scenario: Will they be able to push back on bad ideas, or just build new capabilities simply because they can do so as rapidly as they’re proposed?

“Today we have to prioritize because we don’t have unlimited capacity. But in the future will they stop to ask, ‘Are we building the right things?’” he says, adding that “because someone thought it up, doesn’t mean it’s worth doing.”

Ausman acknowledges that such a reality is at least several years out, but he already sees AI changing how his IT team works, the work they need to do, and the skills required to do it.

For example, the average size of Scrum teams is shrinking, dropping from eight people to five or six who are producing more thanks to AI. Ausman believes Scrum teams may eventually be made up of two members: a functional product owner and a technical product owner who together use AI to gather requirements, generate mockups, create code, and so on, spending the bulk of their time supervising agents tasked with ensuring the architecture is right, bugs are fixed, security is in place, and the like.

Ausman also sees IT teams of the future producing work faster and drawing more from their business domain knowledge and less from their deep technical skills as they use AI to remake processes and workflows throughout the organization as well as in IT.

A shift in skills and mentality

These shifts will change not only how IT teams are structured but also the skills IT workers need, Ausman and other IT leaders and experts say.

True expertise in business domains, once merely a differentiator, is fast becoming a must-have for IT pros, Ausman notes. So is discernment (the ability to recognize when ideas aren’t worth pursuing), conviction (the ability to tell others that those ideas won’t produce benefits), and communication (the ability to be clear, concise, and diplomatic when telling others as much).

“They’ll need to be good partners to [the business] and be able to ask, ‘Are you sure we should do this thing?’” Ausman explains.

Of course, IT workers will continue to need technical skills, Ausman says, noting that most of his hiring today is for entry-level positions that draw in AI natives who help spread their AI knowledge throughout the enterprise. Still, he questions whether earning a computer science degree and knowing multiple programming languages will be as valuable 10 years into the future as they were a decade ago.

Problem-solving skills will be more highly prized in IT workers instead, he says. Emotional intelligence, authentic leadership, decision-making capabilities, and prioritization skills will also be in high demand.

“I think about my team and the fact that we can never outsource team care, the ability to have difficult conversations, emotional intelligence, [provide] psychological safety. Those things can never be automated,” he adds.

‘Hyperacceleration of learning needs’

CIOs across all industries are beginning to adjust their IT organizations in response to these evolving and anticipated changes as they contemplate the future of their IT workforces.

In a poll of CIOs at this year’s CIO 100 Awards and Conference in August, “talent, skills, and organizational change” topped the list of issues worrying CIOs, with 33% citing it. That put it ahead of “demonstrating AI business value and ROI” (27%) and “budget pressures and competing priorities” (21%).

When asked which capability will define the next generation of CIOs, 29% said “building organizational talent” — just behind “leading AI transformation” (30%) and ahead of “developing business strategy” (22%).

AI is obviously a factor here, as its use expands to automate more core IT tasks, but AI is only one of the dynamics driving change in IT. Demographics, market conditions, industry trends, and economics have all put pressure on organizations to be more responsive through the use of technology, says James Stanger, chief technology evangelist at CompTIA, an IT training and certification association.

Even as IT leaders feel the pressure of those dynamics, CIOs must also be ready to capitalize or respond to evolving technology as rapidly as it hits the market, Stanger adds. That puts further pressure on CIOs to rework their IT departments so that they’re able to meet such expectations.

Leading CIOs “have realized that technology is changing so utterly fast and because of that they need to change their organizations,” Stanger adds. “We’re finding that the traditional ways of doing things are being revised.”

Although most CIOs aren’t making radical changes yet, they are adjusting their approaches and the structure of their IT departments, Stanger notes.

CIOs are implementing more training initiatives and requirements to ensure their teams are better keeping pace with the changing tech landscape, Stanger says, noting that many CIOs have shifted from seeing training as a retention tool or a nice-to-have to something essential for enterprise survival.

And that commitment to learning is increasingly being incorporated into the day to day. “Microlearning is becoming more of a thing; there’s more of a steady stream,” he observes, adding that microlearning is beneficial because it can happen as rapidly as technology changes and accelerates hands-on retention of what is learned.

CIOs are also enlisting more talent from the business side to help develop technology solutions. These aren’t the citizen developers of yesterday, Stanger says, as they now often report via dotted lines to IT managers, allowing CIOs “to get a really good sense of what’s going on in those departments and what’s working and what is not.”

Conal Gallagher, CIO and CISO of Flexera, is leaning heavily into training to ensure his staffers have the skills necessary for the software maker to thrive.

AI fluency and AI use is at the top of Gallagher’s training list, as is AI administration and governance so that his staff can create AI tools that workers in other departments can safely use. And he’s working to develop more agentic AI skills among his workforce.

Like Stanger, Gallagher calls out the “hyperacceleration of learning needs” today, saying that most IT professionals are learning as they go, sometimes turning to online videos for instantaneous education.

The fast pace of technology evolution, however, makes it difficult to predict what will be needed from his IT workers a year from now. As a result, longer-term coursework is becoming less valuable.

“Traditional training as we know it probably doesn’t apply anymore,” he says, adding that the goal now may be to “just keep pace with the current.”

Reinventing roles to maximize IT capacity

Info-Tech Research Group’s 2026 IT Talent Trends report shows that IT leaders and IT pros alike expect nothing short of wholesale change for IT ahead. Nearly nine of 10 (89%) IT leaders anticipate restructuring their IT organization, according to the survey, and 95% of IT professionals acknowledge major skill changes would be required to keep pace with technology by 2030.

To help bridge IT to the future, CIOs are adding more service owners (the modern version of product owners) and business relationship managers, says Brittany Lutes, research director in Info-Tech’s CIO practice. IT leaders view these roles as essential for delivering AI and other IT capabilities that create value for the business.

“If they didn’t have them, they’re adding them,” she says. “If they had these roles before, they have more now.”

CIOs are also creating broader roles that enlist staff to operate in multiple domains, Lutes says. A networking engineer may now be expected to work in database administration and database engineering, for example.

CIOs want their teams to be more flexible and more modular, so they can move personnel more easily to where work needs to be done. To achieve that, some CIOs are grouping workers in pools or centers of excellence and then assigning them out as needed.

Broadening IT roles also helps keep those positions working at full capacity as AI picks up more of the manual tasks previously assigned to IT pros working as specialists.

“CIOs are not losing headcount, but the way they’re your utilizing that headcount is changing,” Lutes says, pointing out that these dynamics are changing job titles, too. For example, one IT organization Lutes knows of changed the all its IT workers’ titles to simply “engineer.”

Leading CIOs are also creating new roles centered around AI implementation and management, Lutes notes. These new roles include decision intelligence lead; forward-deployed engineer; human-AI interaction lead; knowledge engineer; master data manager; memory engineer; MLOps engineer; prompt engineer; synthetic data engineer; and trust engineer.

The seemingly contradictory trends reflect a profession in flux.

“We’re still in a messy phase as an industry,” Lutes says. “We’re not going to get to that major shift in the next two years, but five years out we may see a complete restructuring of the IT organization.”

Preparing for the future state

Nick Nadgauda, global CIO of MetLife, is preparing for that future state.

“We continually evaluate whether we have the right blend of engineering depth, business understanding, adaptability, and leadership,” he says. “The goal is not simply to fill today’s roles; it is to build a workforce that can learn, unlearn, and relearn as the work changes. That includes building a strong early-career pipeline and giving emerging technologists the technical foundations, mentoring, and hands-on experience to grow with the organization.”

This ongoing evaluation has reinforced three priorities at MetLife, Nadgauda says.

“First, AI fluency needs to become a broad workforce capability, not a specialty confined to a small group. Second, strong fundamentals in software engineering, cloud, cybersecurity, data, and architecture remain essential. We’re putting an emphasis on making our organization more technical. Third, we need teams organized around clearer accountability and closer alignment to business outcomes,” he says.

Nadgauda is investing in continuous role-based learning, creating more opportunities for hands-on learning, and bringing critical expertise in-house.

But he also acknowledges a degree of uncertainty about what’s ahead for IT, saying, “We can predict the direction more confidently than the exact destination.”

He adds, “We know AI will become a natural part of how work gets done across engineering, operations, and customer-facing teams. We also know that judgment, creativity, accountability, and deep domain expertise will remain critical. What is less certain is how quickly individual tasks and roles will change. That is why adaptability matters so much. The best hedge against uncertainty is a workforce that can learn continuously, experiment responsibly, and apply new capabilities to real business problems.”

AI won’t kill jobs. Bad team design will

In a recent finance training session, an FP&A analyst took the prompting method we had covered twenty minutes earlier and applied it to a monthly variance report spanning four business units. The report normally took one and a half to two hours. It was finished in about two minutes, live, in front of the room. Every leader watching did the same math: if experienced people can work like that, why hire the junior analyst in next year’s budget?

That question sits under most of the early AI jobs story, which has been dominated by fear: fewer junior openings, thinner entry-level ladders and senior employees using AI to absorb work that used to train the next generation.

There is evidence behind that concern. Researchers at the Stanford Digital Economy Lab found that employment among workers aged 22 to 25 had fallen in occupations with high exposure to generative AI. The effect was concentrated in jobs where AI could automate tasks. Employment held up better where companies used AI to support employees.

The companies furthest ahead on AI appear to be doing the opposite, according to recent research from Revelio Labs and Ramp reported by the Financial Times. Among nearly 22,000 U.S. companies, the heaviest AI adopters grew white-collar headcount by 10.2% over two years, with entry-level roles up 12%.

The study does not prove that AI caused the hiring. AI adopters were already larger, more engineering-focused and more likely to be growing, but the findings still matter. Companies making serious investments in AI were expanding their workforces, including their junior ranks. Companies making serious investments in AI were expanding their workforces, including their junior ranks. The difference is team design. AI productivity gains have a shelf life: within a year or two the new pace becomes the baseline, and companies that cut their junior layer to capture those gains will have no one ready to step up.

In my previous CIO article, I argued that successful AI adoption requires companies to change how they operate. Giving employees new tools while leaving existing workflows and decision-making structures in place produces scattered experiments and limited gains. Companies need to give the people closest to the work more authority to test AI, improve processes and teach others what works.

Team design is the next part of that transformation. Once AI changes how work gets done, companies also need to change how teams are built and how employees develop. That includes the junior roles where people gain the experience required to become future managers and specialists.

Cutting junior roles creates a capacity problem

The mistake is easy to make. A company trains its existing staff on AI. Suddenly, experienced employees are 30% to 60% more productive. Junior hires start to look like overhead. For a while, that logic feels rational.

The problem is that this kind of approach has an expiry date. A year or two from now, those productivity gains will be absorbed into the business. The new pace will become normal. Clients will expect more. Internal teams will take on more. Senior employees will be stretched again; except this time there won’t be a trained junior layer underneath them.

The company then has limited choices. It can overwork its experienced staff, compete for expensive external hires or promote people before they are ready. Each option carries a cost.

This is a pipeline problem as much as a hiring problem. Companies cannot produce experienced employees on demand. Judgment develops through repeated exposure to real decisions, feedback and consequences.

Research on AI and customer service offers a clue about how companies can approach this. A study of more than 5,000 support agents found that access to a generative AI assistant increased productivity by 15% on average. Less experienced workers benefited the most. The system helped them apply some of the practices used by higher-performing colleagues.

That finding should interest any leader thinking about early-career development. AI can help junior employees reach competence faster when the tool contains useful organizational knowledge and employees receive guidance on how to use it.

Building teams like multi-agent systems

When we build multi-agent AI systems, we usually build them in a hub-and-spoke model. There’s an orchestrator agent in the middle, then smaller agents handling specific tasks around it. In a marketing function, for example, one agent might handle social media, another might handle SEO, another might handle analytics and another might handle reporting. The user works through the orchestrator, which coordinates the system.

I think this model offers a useful template for team design.

The senior employee acts as the hub, with junior employees and AI agents working as the spokes around them. Instead of simply delegating tasks, that senior person shapes how the work gets done: teaching the AI systems and juniors what good looks like, and helping junior employees build judgment by working inside the same system. The junior employee learns from the AI by seeing how it approaches research, drafting, analysis and problem-solving; the AI improves because the junior is constantly correcting, refining, rejecting and escalating its outputs.

That’s where the training model changes. Historically, juniors learned through repetition, writing the first draft, building the spreadsheet, checking the details, sending the recap and slowly absorbing the standards of the job. AI will take over parts of that repetitive work, but it won’t remove the need for training. It changes where the learning happens: juniors are no longer just learning by doing the task from scratch, they’re learning by directing the task, judging the output and feeding better decisions back into the system.

A junior employee now needs to learn how to question an AI output, spot weak reasoning, understand what a client or stakeholder actually needs, and know when to escalate. This kind of judgment is built like a pilot’s instincts: not by watching someone fly, but by spending time in the cockpit as experienced pilots navigate real decisions.

What companies should hire for now

This changes what hiring managers should look for in junior talent.

Curiosity has always been a crucial quality to look for, but it matters even more now. Juniors need to be willing to learn the tools and understand how AI changes the work. But the stronger signals are emotional intelligence, good interpersonal instincts, discernment, judgment and the ability to explain why they made a decision.

The World Economic Forum’s Future of Jobs Report 2025 supports this broader view of skills. Employers expect AI literacy and technological capability to grow in importance. They also continue to value analytical thinking, curiosity, leadership and social skills. The report found that 77% of surveyed employers planned to upskill workers in response to AI disruption.

That’s also why senior employees need to work differently. Engineers need to spend more time with business teams, so they understand how the company actually operates. Business teams need to spend more time with technical teams so they understand what the tools can and can’t do.

If companies want to keep moving faster, they still need to hire junior talent. But the apprenticeship has changed. Instead of learning by taking repetitive work off someone else’s plate, juniors now join AI-enabled teams where they can see how experienced colleagues think, learn from the systems those colleagues build, and develop judgment through decisions they’re gradually trusted to make. We’re all managers now, some will manage humans, some will manage machines and a select few will build the skills to manage both.

IT jobs report: Employers consider AI risks and ethics

The IT job hiring market appears to remain strong, as data from the Dice September 2026 Jobs Report shows that IT job postings continued to increase through September after experiencing a slight dip in August. Overall, the data shows that year over year, IT job postings rose 17% compared to September 2025.

Two areas that saw the most growth include AI and ML, where tech postings grew 88% in September 2026 compared to 2025, about five times faster than the average growth rate for tech postings. As employees embrace AI tools and organizations realize AI implementation goals, they’re shifting a hiring focus to security and finance roles, helping to manage and oversee emerging risks and threats as AI becomes commonplace.

With this increased focus on security and finance, organizations are realizing their AI implementation strategies. And for companies ahead of the AI curve, the focus is now on cybersecurity, governance, responsible and ethical AI use, and financial operations to support AI costs.

Skills that matter most

AI skills continue to grow in demand year-over-year and month-over-month. September saw a sharp rise in demand for Claude skills and those including agentic AI, enterprise integration, and the ethical and responsible use of AI. These skills reflect similar patterns that show in the June data, suggesting they continue to be skills consistently in demand for tech workers.

Comparing skills month-to-month, there were slight changes in demand, but electronic engineering remained the fastest growing skill since July, and skills for managing AI systems grew over September. There was also an increase in IT job postings from those looking for skills including creative problem solving, team performance management, and demonstration skills.

As AI implementation takes hold and presents new risks and challenges to IT departments across every industry, companies are also shifting focusing on cybersecurity and critical thinking skills. September saw an increase in demand for endpoint detection and prevention, as well as financial technology, indicating companies are looking for talent to manage the security and cost of AI processes and tools.

The highest growth in demand over the past year are skills involving:

  • Claude AI (1033%)
  • Agentic AI (446%)
  • Responsible AI (401%)
  • Enterprise integration (376%)
  • AI agents (308%)
  • Product family engineering (295%)
  • AI infrastructure (283%)
  • Tooling (277%)
  • Engineering practices (277%)
  • AI adoption (276%)

Month over month, the Dice report’s list of fastest growing skills includes:

  • Electronic engineering (64%)
  • Autodesk Revit (57%)
  • Endpoint detection and prevention (51%)
  • Creative problem solving (51%)
  • Database management systems (49%)
  • Team performance management (48%)
  • Data migration (45%)
  • Demonstration skills (44%)
  • FinTech (43%)

Hot hiring markets

In terms of metro areas seeing the fastest increases of job postings, not much has changed since June’s report. However the Washington-Arlington-Alexandria (DC-VA-MD-MW) area did pull ahead of New York-Newark-Jersey City (NY-NJ) metro areas, where IT job postings dipped from over 20,000 in June to just over 16,000 in September. IT job postings in metro Dallas, Chicago, and San Francisco have remained relatively unchanged since June, demonstrating potential hiring stability in these areas.

Metro areaIT job postings (September)
Washington-Arlington-Alexandria, DC-VA-MD-WV19,248
New York-Newark-Jersey City, NY-NJ16,441
Dallas-Fort Worth-Arlington, TX10,966
Chicago-Naperville-Elgin, IL-IN8,385
San Francisco-Oakland-Fremont, CA8,371

Credit: Dice September 2026 Jobs Report 

In depth:

July 2026: Demand for AI fluency rises

AI skills continue to drive IT job postings, with 75% of US technology openings requiring AI fluency in June, up 178% year-over-year, according to the Dice July 2026 Jobs Report.

Roles in the software industry continue to rise, ranking second behind consulting as the industry seeking the most IT help right now. Aerospace/defense, finance/banking, and manufacturing round out the top five.

Most sought after in the market right now are software engineers, data engineers, systems engineers, electrical engineers, business analysts, data scientists, network engineers, systems administrators, data analysts, and AI engineers, according to Dice.

While these roles remain in high demand, the biggest shift can be seen in the skills that hiring managers are seeking — a list now dominated by AI or AI-adjacent skills as companies rush to adopt enterprise AI tools and services.

The skills that matter most

Demand for enterprise integration skills grew 638% from June 2025 to 2026, the biggest rise year over year, according to Dice, noting that this aligns with other indicators that “connecting agentic systems to existing infrastructure is growing faster than the agentic systems themselves.”

Following in terms of highest growth in demand over the past year are skills involving:

  • Agentic AI (587%)
  • AI agents (503%)
  • Responsible AI (495%)
  • AI infrastructure (366%)
  • Vector databases (353%)
  • Event-driven programming (310%)
  • Product family engineering (287%)
  • Prompt engineering (253%)
  • Observability (251%)

Month over month, the list of fastest growing skills in Dice’s July jobs report includes:

  • Electronic engineering (69%)
  • API system integration (58%)
  • LDAP (55%)
  • Digital forensics (54%)
  • Data exchange (53%)
  • Enterprise integration (50%)
  • Threat detection (48%)
  • NIST Cybersecurity Framework (47%)
  • SAML (45%)

Again, the rise in demand for API, data exchange, and integration skills highlights the recent push to “connect AI systems to enterprise data and workflows,” according to Dice.

Hot hiring markets

Some metro areas are seeing faster increases in tech job postings, with a focus around the New York, Washington, Dallas, Chicago, and San Francisco metro areas. These areas have seen greater growth than the rest of the country, making these metro areas the best to live in if you’re a job seeker with AI fluency skills:

Metro areaIT job postings (June)
New York-Newark-Jersey City, NY-NJ 20,858
Washington-Arlington-Alexandria, DC-VA-MD-WV19,906
Dallas-Fort Worth-Arlington, TX11,932
Chicago-Naperville-Elgin, IL-IN9,346
San Francisco-Oakland-Fremont, CA8,699

Credit: Dice July 2026 Jobs Report

New Jersey (64%), Maryland (47%), and Illinois (41%) are the states that have seen the highest year-over-year increase in hiring.

Roles in demand

Companies are looking for enterprise systems and consulting managers, including Appian developers, Oracle Cloud financial consultants, ServiceNow managers, principal consultants, and technology consultants. Additionally, they are seeking out IT software engineers, C++ software developers, configuration analysts, support engineers, network infrastructure engineers, AI analysts, and cyber threat intelligence analysts.

Outlook

Businesses inside and outside the tech industry will continue to seek tech workers to help realize AI visions, requiring a wide range of AI fluency and skills. It seems this trend will continue for the foreseeable future, as the job market slowly recovers from several tumultuous years.

In depth:

❌