AI is writing more code than ever. Software specialist Sonar’s 2026 State of Code Developer Survey, based on more than 1,100 professional developers, found that 72% of those who’ve tried AI coding tools now use them every day, and that today, AI now accounts for 42% of committed code, a number that’s expected to reach 65% by next year.

But while developers embrace AI-enabled coding services, many professionals are uncertain about how their businesses will cope with this influx of AI-generated code. Sonar’s research additionally discovered that 96% of developers don’t fully trust it, and only 48% always verify it before committing.

In fact, 38% of developers told the researchers that reviewing AI code requires more effort than analyzing code written by human colleagues. That’s a pattern recognized by Tim Chilton, a managing geospatial consultant at UK mapping agency Ordnance Survey (OS). “There’s truth in the headlines that AI can get carried away, and developers spend more time fixing the code that’s been created than not,” he says.

While that’s not a pattern he sees at the OS, Chilton says his organization is cautious about how developers use AI coding tools, and conversations with other digital leaders suggest a similar approach. AI-enabled coding is indeed almost ubiquitous, and it can allow developers to reach new, higher levels of productivity, but more doesn’t necessarily mean better code.

To ensure that such coding services produce business benefits, CIOs must take control of the development process. They should exploit agents carefully, set professional responsibilities, and establish guidelines, policies, and organization-wide training.

Exploiting the agents

Snowflake co-founder and president Benoît Dageville suggests there are two ways to view AI-powered coding. One is the scary way, where AI takes over your tasks without human input. The second is the efficient way, where AI helps you do the same things as before, but at a fraction of the cost. He’s a big believer in the latter, both for himself and his teams.

“The route depends on the organization; their application of AI coding depends on their priorities,” he says. “However, I hope that overall, AI will have a positive effect on humans. I’m using AI every day to code, and if I compare myself to one or two years ago versus now, I’m more efficient and productive, but I’m also writing five times more code.”

Steve Lucas, CEO of integration technology specialist Boomi, also notes the increase in output. He quotes research that suggests 4% of GitHub public commits are already being authored by Claude Code. That proportion is expected to rise to 20% of all daily commits by the end of this year. Staff at Boomi already use AI tools to produce more code.

“We’re writing 10 times the amount today than we did two years ago,” says Lucas. The increase in AI-enabled coding is so significant that he’s spoken with Boomi chief product and technology officer Ed Macosky about goals for the proportion of self-modifying code.

“I believe AI should recursively modify 80% of a software organization’s code,” Macosky says. “Infinite improvement is demanded. If AI is extraordinarily good at breaking security protocols, the only way to keep up isn’t the kind of accordion model of human code design. AI use must be linear in scale and continuous.”

Crucially, Lucas suggests using AI to check and modify that AI doesn’t mean coders go away. “In fact, I think we’ll need more engineers, not fewer,” he says. “We need these professional experts to ensure the quality of the code that’s written.”

At OS, Chilton uses Coco, Snowflake’s coding agent. The tool does as much as 90% of a development task that he would otherwise complete from scratch. “It’s taken an hour to finish, instead of weeks or never,” he says, reflecting on the power of AI coding services.

However, the tool’s influence is carefully constrained. The agent doesn’t work in isolation, and Chilton checks its output in detail. He says all organizations need a similar process and should value experienced professionals who can use AI coding tools effectively.

“If you’re giving a tool to someone who isn’t capable of checking an agent’s work, as a digital leader, you run the risk of putting too much faith in AI just running with its output,” he says. “I think that’s a big risk, so there’s still a need for experienced developers.” 

Setting clear responsibilities

While placing humans in the loop can help ensure AI-enabled code is safe and effective, developers shouldn’t be weighed down by their new management responsibilities.

Gill Haus, CIO at Chase, the consumer banking arm of JPMorgan Chase & Co, says AI coding benefits can only be realized when agents are introduced with a strong focus on automating supporting technology and processes, which reduces the need for too much human input.

“If you have 12,000 engineers, they can write 12,000 engineers’ worth of code in a day,” he says. “If those 12,000 engineers have agentic technology, they can write much more. But if you don’t have automation left to right with confidence, you create more manual processes. You can’t move as quickly since there are only so many humans you can put in the middle.”

Haus says Chase never releases services in production that don’t pass its high bar for quality and security. Strong engineering practices, pipelines, and architecture, plus a tried-and-tested approach to automation, can help ensure AI coding produces solid outputs without a burdensome amount of human intervention.

“We’re focused on effective automation so we’re able to unleash this technology safely and effectively,” he says. “This is something many other companies should be focused on if they aren’t already, because otherwise you can’t keep up with the pace of change.”

François-Xavier Pierrel, group chief data and ad tech officer at French TV network TF1, is another digital leader who says maintaining control as AI writes more code means keeping the human in the loop in a clearly defined manner. His team documents agentic processes using Atlassian project management and collaboration tools, such as Confluence.

Pierrel says policy management is crucial as the agentic transformation gathers pace.  One key step is ensuring professionals who use agents conform to internal standards. Smart businesses set policies that state clearly when staff can explore an agent, delegate work to it, or release it in production.

“We don’t have hundreds of agents deployed yet,” he says. “But the moment you reach a certain level of volume, if you don’t have compliance and policies in place, AI becomes a critical mess, and then it can be disruptive in a negative way.”

Building strong foundations

Kirsty Roth, chief operating officer at content and technology specialist Thomson Reuters, agrees digital leaders must be proactive. Her firm’s explorations with models and agents suggest that AI can help with time-intensive coding processes, such as writing. This capability means her organization carefully considers the roles people fulfil.

“In the last 12 months, we’ve put lots of thought into where we’re seeing benefits,” she says. “It’s great AI can do some of the coding work, but what does that mean for people’s jobs? We used to have thousands of engineers. Do we now need more architects or product people?”

Roth refers to security. While cyber is always a priority for Thomson Reuters, the firm dedicates significant resources to controlling threats in the AI age. Developing high-level development and security skills requires a concerted effort. Yet Roth says ensuring people have the right skills to manage AI is in many ways a familiar IT trend.

“All this effort is no different than digital, cloud, mobile, social, or other big tech trends,” she says. “They all take several years to have an impact as the initial hype comes, and then you’ve got to work through the reality and think about how you upskill people for the new world.”

Crucially, coding is no longer the sole preserve of the software developer. AI coding tools make it much easier for non-IT professionals to vibe code applications. Tal Carmi, CIO at technology specialist WalkMe, says non-developers can create useful tools. However, effective outputs rely on a careful balance between enablement and guidance.

He adds that most of these employees don’t need in-depth capabilities, such as a database or a content delivery network. Instead, non-IT staff require a dedicated place to upload their products. WalkMe’s engineering specialists ask key questions to ensure their outputs are safe, considering credentials and potentially problematic packages.

“You need to add guardrails,” he says. “A lot of the work for in-house engineers is shifting from building to testing. The people who aren’t coders don’t necessarily have security in mind.”

The key takeaway, suggests Emmanuel Frenehard, chief digital officer at biopharmaceutical giant Sanofi, is that digital leaders must help professionals feel comfortable. Successful digital leaders ensure the business generates value from agents, and his firm is helping its staff, particularly its developers, to embrace these tools.

“I genuinely worry for professionals who don’t use AI to code, because in five years, they may not have jobs,” he says. “So we’re guiding, coaching, and training them, but people must take the journey. The train has left the station. You can decide to be on it, or just look at it.”

In Foundry’s 2026 State of the CIO survey, 83% of CIOs say their role is becoming more of a hybrid to lead both business and tech initiatives, rather than simply manage IT. As the two become more inseparable, the CIOs who see collaboration as a competitive advantage are putting daylight between them and those who see it as a cursory soft skill. And C-suites are responding as they rely more on IT to drive growth and accelerate efficiencies. So the CIOs who deliver the most value will bring collaboration skills to drive change and technical expertise.

Silos between IT and the business are falling

As the World Economic Forum notes, not every tech initiative requires deep collaboration. But as businesses move beyond routine IT investments into cross-functional, innovation-focused transformations, collaboration becomes essential.

For example, how can IT decisions help an organization open new markets faster, or emerging technologies reduce risk in areas like data privacy. It’s no surprise, then, that Deloitte found that 65% of CIOs reported directly to CEOs in 2025, up from 41% in 2015.

Because tech is now part of almost every business decision, it takes everyone’s expertise and insights — from the CIO to the CFO — to see the full picture of how an initiative will affect the company. Shared knowledge leads to better-informed decisions that give tech its biggest impact.

When silos persist, CIOs struggle to get buy-in for their initiatives. Protiviti’s Global Transformation survey found that while 61% of CIOs report being confident in their tech transformation outcomes, only 34% of CEOs and boards feel the same — and the gap is even wider for AI implementations.

That gap is, at its core, a collaboration problem. Without effective collaboration and communication, others can’t see the value of transformation efforts. CIOs who excel in these areas can more easily demonstrate value, win buy-in and keep their organizations at the forefront of technology.

Delivering speed and innovation

Collaboration goes well beyond getting buy-in. While it may be thought to slow IT down, it actually brings in the insights that make change more effective and faster.

As I’ve highlighted in the past, when organizations move away from rigid data ownership, cross-functional teams can share what drives further innovation.

The same holds across the C-suite. Perspectives from outside IT show CIOs how a tech implementation works for the company as a whole, and where new opportunities lie. That lets CIOs test, refine, and reshape solutions faster.

Most importantly, when teams share a common purpose and goals, everyone stays aligned on the best overall outcome for the business. Iteration happens much quicker because everyone is focused on the big picture rather than individual agendas. With increasingly rapid tech cycles, that speed is a competitive advantage in its own right.

Building your collaborative abilities

For CIOs used to the old way of doing things, shifting to a collaborative mindset can be a challenge. But like any capability, it can be developed and improved by applying some fundamental principles.

Earn trust through follow-through. Trust isn’t built at a kickoff meeting or with a mission statement. It’s built when people see you do what you said you would, again and again. For CIOs, that means delivering on commitments or flagging early when you can’t. Clear and consistent communication is one of the most reliable ways to build trust across an organization.

Make transparency the default, especially when news is bad. Transparency means more than status reports. It means being candid about costs, risks, trade-offs, and setbacks before they surprise anyone. When leaders sidestep difficult discussions, trust erodes and goals drift. And in technology programs, small unspoken issues have a way of becoming expensive ones.

Seek cultural fit in how you work, not who you are. Cultural fit isn’t about sameness or shared backgrounds. It’s about compatibility in management philosophy, values, decision-making, and communication. A CIO who values speed and experimentation, and a CFO who prioritizes predictability and control will clash unless both recognize the difference and agree on how to bridge it. The same is true when it comes to finding the best technology providers.

Focus on the what, not the how. Few things undermine collaboration faster than micromanagement. When leaders dictate how a colleague or partner should work, they signal distrust, stifle creativity and innovation, and tie up their own time policing activities instead of driving results. The better approach is to agree on clearly defined, measurable outcomes, and then step back. Letting go of the how isn’t giving up control but building enough trust that everyone gets there together.

This requires adjusting your workflows and skills, but the payoff is valuable insight from your collaborators and wins that lift the entire organization.

The new life of the CIO

The days when the CIO could simply be the tech expert behind the scenes are long gone. With AI and other technologies ingrained in every aspect of the business, the CIO must lead well beyond IT.

By making collaboration a priority, you can gain critical insights across teams to guide your tech strategy, and deliver the greatest value to your organization.

Following the IT and tech hiring boom during the Covid-19 pandemic, companies made space for AI initiatives that resulted in increased layoffs. But new data reveals that some IT hiring trends are starting to turn around.

Pay in the most AI-exposed occupations grew around 46% since 2021, compared to only 25% for jobs in the least-exposed category, according to the Dice Tech Sentiment report. The data reveals this gap began to grow in 2024 and continues to grow as job postings rebound after several rough hiring years.

As organizations begin to realize AI initiatives and investments, they’re now looking to fill their ranks with specialized skillsets, and it’s driving increased compensation. AI has changed the skills businesses need, and 84% of executives report they currently struggle to find specialized local talent while 64% say they feel unprepared for ongoing disruption, according to data from a 2026 report from Globalization Partners.

In a few short years, AI has caused multiple swings in tech hiring. As organizations understand the skills they need to realize AI visions, hiring, for now, appears to be on the upswing for candidates and jobseekers, with more competitive offers. On the employee side, as AI transforms job roles and business functions across every industry, there are, however, increased reports of burnout and a widening gender gap.

Salary boost for specialized skills

AI is currently creating some of the fastest growing and highest paying opportunities in today’s labor market, according to LinkedIn Research. Data reveals that AI job postings have doubled in 2026 from 2023, with the average job listing around $177k in compensation for AI roles, compared to $80k for non-AI roles.

Salary offers and benefit packages have again become more competitive, with 72% of employers saying they’re increasing compensation budgets to attract and retain top talent. Additionally, 65% of tech leaders said they’re offering salaries above their planned range, with 87% stating the top reason being a need to secure candidates with specialized skills, according to Robert Half.

Tech leaders are also seeking specific skills, with 92% acknowledging internal plans to offer higher pay for relevant AI skills. Across every industry, 42% of all business leaders say they’ll pay more for AI-related experience compared to other general tech skills.

Additionally, pay transparency, once relatively taboo in the hiring process, has now become normalized in hiring with 96% of organizations reporting they either already share compensation or plan to soon. Sharing compensation on job postings has several benefits including improving the quality of the candidate pool, more efficient salary negotiation, and a reduced time to hire. Business leaders seem to recognize the benefits, with 67% of employers saying their company takes pay transparency beyond legal requirements, offering more information than is legally required, adds Robert Half.

AI accelerates employee burnout

As daily AI use quadrupled over the past year, burnout doubled and confidence in tech’s long-term future dropped from 80 to 60%, according to Dice. The data reveals around 74% of employees say they plan to change employers in the next year, and 55% say they’re actively job searching, despite only 41% saying they believe they’ll find a better position.

Dice also reveals nearly half of all employed tech professionals report feeling burnout, with around 25% describing themselves as very burned out. And among those reporting burnout, tech and AI professionals express the highest rates.

High levels of burnout can cost companies lost productivity and hurt bottom lines. In 2025, a staggering 10 trillion was estimated to have been lost globally due to disengaged and burnt out employees, according to Globalization Parters. If companies are losing profits through employee burnout, costs of AI investments need to be greater priorities when planning AI initiatives.

AI is meant to boost productivity and efficiency, but Dice says that while speed without guardrails might create advantages for some, it’ll create anxiety for others. Similar to pay transparency, organizations must practice AI transparency. Yet fewer than half of employers report having formal AI policies in place to govern or dictate its use in the enterprise, adds Dice. 

AI gender gap emerges

While there’ve been efforts to move the needle on gender diversity in IT and tech over the years, AI has revealed another gender bias the tech industry will need to contend with to reach gender parity. Tech has always struggled with gender equity despite concerted efforts to make IT and STEM jobs more appealing to women.

Unfortunately, despite efforts to create cultural shifts, AI has once again widened the gender gap in tech. According to further data from LinkedIn Research, women only accounted for 26% of AI hires in the US in 2025, compared to 50% of hires into non-AI roles. And of course, the numbers drop more at the C-suite level, where only 13% of AI leadership at AI companies is held by women.

AI roles have also largely gone to candidates with college degrees with 91% of AI workers holding a bachelor’s degree or higher, moving up to 95% for C-suite and director level positions, so there’s an additional lack of opportunity for those women without a traditional education. Tech and IT leaders will need to avoid falling back into the old hiring patterns that initially caused an absence of representation in tech.  

Plus, there’s an emerging gender gap on AI sentiment, with women holding more negative views than their male peers when asked about the impact of AI over the next 20 years, according to data from Pew Research. Women were more likely to say they felt negatively about the impact of AI on themselves personally (33%) and on society overall (43%), compared to 27% and 36% of men who said the same, respectively. Inversely, only 11% of women said they felt positively about AI’s impact on society, while 22% of men said they felt positive.

Women are also more likely to say AI is advancing too quickly — 68% compared to 58% of men. These opposing sentiments might contribute to the overall gender gap in AI roles, as women show more hesitation and caution with AI tools compared to male colleagues.

In Part 1 of this two-part series, I argued that the moat is dry. When NotPetya hit Merck in 2017, it didn’t climb a wall. It came in through trusted vendor software, the routine traffic every perimeter is built to admit, and Merck put the damage at more than $1.4 billion. Its insurers then tried not to pay, and after that fight, underwriters started asking much harder questions.

AI has since made attacks like that cheaper and faster. In IBM’s 2026 Cost of a Data Breach report, one in four malicious breaches was AI-enabled, and breaches that took more than 200 days to find and contain cost about $1.3 million more than those that didn’t. Deepfaked executives, software that can be talked into things and AI agents holding credentials are attacks on trust first and technology second.

Yet the people we hold responsible are set up to lose. Some 64% of CISOs still report into IT leadership, only 10% influence financial decisions, and only a quarter say board discussions of cyber risk run longer than 30 minutes. They are accountable for the breach without budget authority, and they check the work of the people they report to.

The organizations that feel safest about the next two years are not the ones with the most tools. They are the ones where leadership understands AI risk, someone clearly owns it, and the security team has the authority to act. That is a governance problem, and it has a governance fix.

A roadmap for reconstruction

1. Take security out of IT, and do it before the breach

No company lets the finance department audit its own books. That is why internal audit reports to the board’s audit committee rather than to the CFO. Security deserves the same independence for the same reason: the people who build and run the systems should not vouch for them. The CISO’s job is not to run technology. It is to govern how people, partners and machines behave around the things the organization cannot afford to lose, and to tell leadership the truth about that risk.

That does not make the job less technical. A CISO who can’t read an architecture diagram, question an engineer or spot a vendor’s overstatement will be steamrolled in the first meeting. The role needs an engineer’s depth. It is just bigger than engineering, the way a general counsel needs to know the law but is hired for judgment.

In practice, that means a direct line to the CEO and a board committee. Equifax did this after its 2017 breach. Its new CISO, Jamil Farshchi, called the direct line to the CEO and board the key to the turnaround, and noted that it costs nothing. Vertex Pharmaceuticals took a different route: its CISO reports to the Chief Scientific Officer, which puts security next to what the company actually protects, its research. Choose a model deliberately. Most organizations never choose; they inherit one.

2. Hand the CISO the AI governance pen

Only 19% of organizations report coordination between their AI governance and security teams. Every AI tool the business adopts is a security design decision, and it needs one accountable owner. Otherwise, you have a committee that approves tools and a security team that finds out later. But accountable doesn’t mean alone, which brings us to the most important step.

3. Give everyone a voice

A CISO knows security. A CISO does not know research, or claims processing, or the manufacturing line. Elevating the CISO works only if decisions get made with the people who live with them: research leaders, business owners, legal, finance and the CIO. Build a standing risk council where those voices shape controls before they’re imposed, and where a scientist can say “this will break my work” and be taken seriously. The point of elevating the CISO isn’t to put one person in charge of everyone else’s work. It’s to make sure the person who owns the risk is in the room, and that everyone affected by the decision is in the room too.

Security decisions made in isolation get worked around. Decisions made together get followed.

4. Define “ready,” then hire and develop to it

New York’s cybersecurity regulation for financial firms calls the CISO “a qualified individual” but never says what qualified means. Here’s a working definition, in the form of two tests a board can give. The first is technical, and it is not optional:

• Can you tell us what we own, who can reach it, and how fast we can recover, and when did we last test that?
• Have you personally used the AI tools our employees use? Can you explain prompt injection and agent permissions to us in plain English?
• Where does your threat knowledge come from besides vendors: peer networks, industry information-sharing groups, red-team results?

The second test is about judgment and behavior. It is the one most security leaders are never given:

• What do our people actually do when a request seems urgent and comes from someone senior?
• Which risks have you advised us to accept, and why? A CISO who never recommends accepting a risk is a gatekeeper, not a risk officer.
• Can you translate a risk into dollars and days of downtime?
• Which research and business leaders do you consult before a control changes how they work?

And one question for the board itself: Have we given this person authority that matches their accountability?

👉 Click here to download a sample CISO job description👈

5. Make sure AI agents are governed like employees

The CISO doesn’t provision these accounts; the CISO makes sure someone is accountable for every one of them. Every non-human identity needs an owner, the least privilege it needs, monitoring, and a kill switch. Among organizations that had an AI-related incident, 92% lacked proper AI access controls.

6. Hold everyone to the clock, not the checklist

Ask every part of the organization for time to detect, time to contain and time to recover, using tested numbers rather than estimates, and report them to the board. The 200-day line in IBM’s data is worth more than a million dollars per breach.

7. Make sure the boring things get done

Encryption, multi-factor authentication, asset inventory and network segmentation are not glamorous, but they are exactly what insurers began requiring after the Merck case. Doing this work belongs to the technology teams. The CISO’s job is to verify that it’s done and to tell the board plainly when it isn’t. If your underwriter is asking for these controls, your board should be too.

8. Give the board more than 30 minutes

Make cyber a budget conversation rather than a status update. If the CISO’s board time is spent on regulatory trends instead of business trade-offs, the board is being briefed, not governed.

A word to CIOs

I know how this reads to a CIO: someone telling you to give up a direct report. But a CISO who reports to the CIO is grading the boss’s homework. The CIO is measured on availability and speed of delivery. The CISO is measured on risk. That tension is healthy only between peers. Elevating the CISO doesn’t diminish the CIO; it frees the CIO to build without also serving as auditor of what they built. The two roles aren’t a senior and a junior version of the same job. One builds and runs the organization’s technology. The other is responsible for whether the organization, its people included, can be trusted.

A good CIO should lean on the CISO and also be a little afraid of the CISO, the way a good CFO relies on the auditor and is a little afraid of what the auditor will find. That fear is not hostility; it is the reason the books stay clean. Pair it with the partnership described above, and the CIO gets something no direct report can offer: someone with the standing to say “no, not like that” before the board has to hear it from an attacker.

The CIO’s seat at the table appeared when technology became the business. The CISO’s is appearing because trust has become the business, and AI has made that impossible to ignore. Some organizations are already moving. In IBM’s follow-on research, 85% said they plan to increase security spending after learning what frontier AI models can do to their systems, compared with 64% who planned to spend more after suffering a breach. Learning from the threat is far cheaper than learning from the post-mortem, and the organizations that get there first will be the ones where security, research and the business decide together.

The moat is dry. Stop dredging it, and give the person defending the castle a seat at the table.

In June 2017, a piece of malware called NotPetya got into Merck & Co. without climbing a single wall. It arrived through a backdoor in accounting software supplied by a Ukrainian vendor, the kind of trusted, routine traffic every perimeter is built to let through. It spread to some 40,000 of the drugmaker’s computers, and Merck put the damage at more than $1.4 billion.

Then several of Merck’s insurers argued they owed nothing, because the attack was attributed to Russian military intelligence and their policies excluded acts of war. The fight ended in a confidential settlement in January 2024.

Two lessons sit in that story. The moat didn’t matter, because the threat came in with the traffic the moat was designed to admit. And the people who price risk for a living were the first to notice and the first to send the bill.

That was 2017, when attackers still needed humans at the keyboard. Increasingly, they don’t.

Here is the argument of this two-part series in two sentences. Security stopped being a technology problem with business consequences; it is now a business risk with a technology component. Most organizations are still organized the other way around, and the person they hold responsible for that risk sits inside the IT department, reporting to the people whose work they are supposed to check.

What AI actually changed

IBM’s 2026 Cost of a Data Breach Report, based on 602 breached organizations, found that one in four malicious breaches was AI-enabled, a 56% jump in a single year. Those breaches averaged $6 million, about $1 million above the global average of $4.99 million. In the U.S., the average breach now costs $11.5 million.

You don’t need a computer science degree to understand what changed. Three things matter:

• The con got a better voice. Deepfake impersonation was the most common AI-driven attack in IBM’s data, at 45%. The oldest scam in business, the urgent wire transfer, now arrives in the CFO’s actual voice on a video call.
• Your software can be talked into things. “Prompt injection” means hiding instructions inside an email, document or web page that an AI assistant reads and then obeys. It is social engineering aimed at the software instead of the employee, and no amount of annual phishing training protects against it.
• You’ve hired employees with no background check. Every AI agent holding credentials is, in effect, a new hire with keys to your systems, no manager and no HR file.

Notice what those three have in common. Each one is an attack on trust, on whom we believe, what we obey and whom we let in, and only then on technology. That distinction matters for everything that follows.

Meanwhile, employees aren’t waiting for permission. Shadow AI, meaning tools staff use without sanction, showed up in 43% of breached organizations this year, up from 20% the year before. Breaches involving AI systems themselves rose to 21% of all incidents, and the most common way in wasn’t the model at all. It was the plumbing around it: compromised APIs and plug-ins, and misconfigured cloud workloads.

Why the moat is dry

Moat security is easy to recognize. There’s a perimeter, a couple of expensive appliances, an annual training module, and a binder of procedures nobody reads until the auditor visits. It assumes the enemy is outside.

Today, much of the risk has been invited in the assistant reading the email, the agent holding the credentials, the vendor pushing the update. When Johnson Controls was hit by ransomware in 2023, the attackers first got into the company’s Asia offices and spread from there across the network. The company confirmed data theft and more than $27 million in costs, net of insurance. One breach in a distant office, and the moat was irrelevant.

Moat organizations measure activity. Attackers measure time. IBM found the average time to identify and contain a breach rose to 247 days, the first increase in five years. Breaches contained in under 200 days cost $4.32 million; those that ran longer cost $5.65 million. And 53% of breached organizations hadn’t encrypted sensitive data at rest and in transit. The basics still aren’t done.

My email signature reads “Process is the evil twin of progress.” Moat security is process mistaken for protection.

Prepared versus old school: the numbers

In fairness, IBM sells security tools, and I’m aware of the irony of citing a vendor in a piece that warns against learning from vendors. The fieldwork is done by the Ponemon Institute, though, and the pattern matches what independent CISO surveys show. The gap between prepared and unprepared organizations is not subtle:

What separates them	Prepared	Old school
AI and automation in security operations	Breach costs nearly $2M lower	One in four still without
Breach found and contained	Under 200 days: $4.32M	Over 200 days: $5.65M
Employee use of unsanctioned AI	Low: $4.63M per breach	Widespread: $5.39M per breach
AI security maturity (CISO self-rated risk)	3.7 out of 10	7.8 out of 10
AI governance and security teams coordinated	19% of organizations	Everyone else

Sources: IBM/Ponemon, Cost of a Data Breach 2026; IANS/Artico Search, CISO Perspectives on AI Risk 2026.

The most revealing finding comes from the IANS survey of 113 CISOs. Mature AI security programs explained why some security chiefs feel safer today. But confidence about the next two years tracked something else: whether leadership understood AI risk, whether someone clearly owned AI governance, and whether the security team had budget authority and enough staff. In other words, the factor that matters most is governance, not technology.

The CISO problem: under-trained and under-armed

Under-trained. Many of today’s security leaders learned the job defending against people, not software that behaves like people, and much of what they know about AI came from the companies selling the cure. When IANS released its research this year, one of its partners pointed out that most AI risk data comes from vendors and so reflects the supply side. If your threat briefings, your training and your tools all come from the same sales channel, you’ll end up with a well-funded blind spot. Only 53% of CISOs in a LevelBlue survey said they felt prepared to defend against AI-enabled adversaries.

This is not about age. A veteran who keeps learning beats a newly certified buyer of AI-branded appliances every time. What matters is whether someone is still learning now, not when they first learned.

Under-armed. The IANS 2026 board engagement study found that 95% of CISOs brief their boards regularly, but only 10% influence financial decisions. Only a quarter say board discussions of cyber risk run longer than 30 minutes. And 64% of CISOs still report into IT leadership. That leaves the CISO accountable for the breach without authority over the budget.

The lab is not the accounting department

Everything above gets harder in a research organization. Research runs on unpredictable workflows, tools adopted the week they appear, enormous data transfers and outside collaborators. A control that slows a scientist doesn’t stop the work. It moves the work somewhere security can’t see.

The stakes are rising at the same time. Google’s threat intelligence group reported that in the second quarter of this year it investigated extortion cases involving stolen AI research, including one in which a healthcare organization lost drug research and an AI model. It also tracked a China-linked group targeting academic, medical and military research institutions in North America.

R&D doesn’t need an exemption. It needs a different deal: wide freedom in how the work gets done, in exchange for a short list of fixed rules around the assets that matter most. In practice, that means protecting around the lab rather than inside it:

• Make the safe path the fast path. Offer pre-approved sandboxes, compute environments and AI tools that are quicker to use than the workarounds. Researchers don’t resist security; they resist friction.
• Watch instead of block. Monitor what leaves the lab and how, rather than putting a checkpoint in front of every action. Unusual data movement and odd access patterns are how theft gets caught without slowing discovery.
• Classify by value, not by department. Open science, pre-publication results and proprietary or controlled work need different protection. Lock down the crown jewels, not the whole lab.
• Borrow from the research networks. The research and education networking community solved a version of this years ago with the Science DMZ, a design that moves high-performance research traffic outside the enterprise firewall and secures it with targeted controls and monitoring instead.

Some rules don’t bend: federal research-security requirements, defense contracting standards, export controls. But that list should be short, explicit and explained, not a binder of procedures nobody in the lab can name.

We regulate security by tax status, not consequence

Public companies must describe board oversight of cyber risk to the SEC, though the final rule dropped a proposal to disclose whether they even have a CISO. New York’s financial regulator requires the CISO to report to the board in writing every year, and the board must understand and fund the program, public or private. Hospitals still operate under a HIPAA Security Rule written in 2003; its overhaul has slipped to July 2027. A privately held research firm can fail as badly as any public company, and the rules barely notice. Don’t wait for a regulator to tell you what your risk already has.

That is the diagnosis. In Part 2, the prescription: an eight-step roadmap for rebuilding, starting with the reporting line that most organizations never chose and simply inherited.

There’s no point building your own agentic AI stack for a non-core function when a vendor already has a product ready to go that meets your needs. For non-tech companies in particular, building from scratch can take time, money, and expertise they don’t have.

Take for example, Fertitta Entertainment, with more than 600 Landry’s restaurants and the Golden Nugget hotel and casino. After the pandemic, the company had problems adequately staffing its call centers, says its director of contact center operations Brian Jeppesen. “The agents didn’t want to come back,” he says.

The virtual assistants didn’t work because the user experience was bad, and with the incoming call volume, 40 to 50% of them were abandoned.

“Everybody wants AI, but nobody wants BS,” Jeppesen says. “I talked to my CFO. This is what we’re abandoning. This is the potential revenue we’re losing. I can’t throw bodies at it anymore.”

Agentic AI has upped their game for the virtual assistants. Instead of only answering simple questions like check-in hours, it allows the company to connect APIs and carry out more complicated tasks, like making reservations.

“My abandonments fell to under 10%,” says Jeppesen. “From waiting 45 minutes to an hour, they can get their questions immediately answered, or immediately transferred and taken care of.”

And turnover went down. Call centers typically see 100% turnover, says Jeppesen. Not because everyone quits, but because the bottom 25% quit and need to be replaced over and over again.

Now that bottom tier doesn’t have to be rehired, while the people who stay are the most knowledgeable. “They give a better experience for my customers,” he says. “And it reduced my attrition by 50%.”

Forrester did a total economic impact study for the specific vendor that Fertitta used, PolyAI, and the ROI came back at 391% over the course of three years, with a payback period of less than six months.

Jeppesen says he reviewed his own numbers and found that the automated reservations system alone brings in 3,000 reservations a month. “That’s $600,000 in revenue a month for us without the need to speak to an agent,” he says.

Next, Fertitta plans to expand it to handle to-go orders and web chats. There are also opportunities for agentic AI on the technical help desk, Jeppesen says.

Agentic AI on the menu

Fogo de Chão, a Brazilian restaurant chain with around 120 locations, is also deploying agentic AI in small, focused use cases, and sees ROI with some of the projects.

For instance, it deployed virtual call center agents from PolyAI, and saw positive ROI from day one since there were no significant up-front costs or usage-based pricing. After several months of testing and small-scale pilots in 2025, the system has been rolled out across the US, with 100% of calls now being answered instead of up to 25% being dropped, and a 10% increase in total bookings that wouldn’t have happened otherwise, says Michael Breed, the chain’s chief marketing officer.

“If we compared it to a media channel, it’d be twice the ROI from other media channels,” he says. “It’s almost like another customer acquisition vehicle.”

The company is also building agentic workflows for its team members.

“We’ve identified jobs that are very repeatable and time-consuming, and we’re training agents to take those tasks,” he says. These are low-risk jobs, like proofing menus or other text, or replacing manual processes, such as pulling data from one system into another that had no automatic integrations.

“The agent does a great job bringing in the data, then the human in the loop can inspect it,” says Breed. “Is it getting classified right? Is it getting to the right places? And when guests are dissatisfied, can we make it better?”

Built for SMBs

For smaller companies in particular, off-the-shelf agents make the most sense. AltaClaro, for example, builds training simulations for lawyers, and counts more than 100 of the top 200 US law firms as customers, all with just 10 employees.

One product is a deposition simulator, says CEO Abdi Shayesteh, a completely agentic, voice-based platform.

“It’s a fully simulated environment that creates the experience of doing the deposition,” he says. “Different agents play the role of the witness, opposing counsel, and the court reporter.”

He says it’s kind of like a Zoom call. The product is built on top of technology from Verbit, a legal tech company with a custom agentic platform.

“They’re taking care of the technical infrastructure and we have the material to ground the AI.”

A different vendor, Credal, provides a secure AI platform that allows AltaClaro to switch between different models. It can obfuscate names and keep other sensitive data from leaking out, Shayesteh says. “It ensures everything is anonymized and does secure calls,” he says. “We standardized on Credal because it’s highly flexible and secure. We serve law firms and we’re as invested in security as they are.”

But security isn’t the only issue that enterprises face when deploying agentic AI.

The hidden costs of buying AI

The temptation to jump into agentic AI is high, says Dana Simberkoff, chief risk, privacy, and information security officer at AvePoint Inc., a data security company. And off-the-shelf agentic AI can be so easy to adopt that companies deploy it before they’re prepared for it.

Enterprise vendors will often add the technology at no extra cost, just to get people using it, and companies turn it on for their employees before truly understanding what it does, and before systems and workflows are ready. “Then it immediately exposes problems that were already there,” she says.

Say, for example, an agent helps with research, normally considered a low-risk task.

“AI will follow sharing links across documents,” she says. “So if you haven’t taught your users how to properly use sharing links, the AI agent is just going to follow that path, and it could expose information that might have been obscured in the past. It’ll gobble up everything it can.”

The result is it could expose HR data, personal information, or proprietary information to people who shouldn’t have access to it. One company she knows had to shut down their AI project immediately and go back, classify, and label all their information, put governance controls in place, and teach people how to apply metadata.

According to Gartner, by next year, 40% of enterprises will demote or decommission autonomous AI agents due to governance problems that only show up after they’ve gone into production.

Token management

Another hidden cost of off-the-shelf AI? Token use. When agentic AI is embedded into a system that a company is already using, then the cost of switching it on can be as low as zero. But someone has to pay for all that token use.

When agentic AI comes out of pilots and goes into production, usage can change dramatically, and token costs can quickly spiral out of control. It doesn’t help that agentic AI use typically requires much more tokens than AI chatbots.

“A lot of the embedded AI should be utilized,” says Doug Vargo, head of the national AI and alliances team at consulting firm CGI. “If big parts of your business processes are living and breathing in ServiceNow, Salesforce, or another application, you should leverage that, but you need to understand the cost.”

This is playing out in the marketplace right now, he adds, as underlying model providers change their token costs.

“That changes the economics of the decisions,” he says. “And six months from now, it’s a different discussion, because they’re going to continue to move the needle.”

The employer’s prerogative

Another hidden cost that companies might miss is they need to put training and support systems in place for employees. Many off-the-shelf agentic AI tools might seem easy to use, but actual adoption still requires change management. CGI did offer training to employees when it rolled out GitHub Copilot, a popular coding platform with agentic functionality. “And we expected them to adopt and leverage it on day one,” says Vargo. But people quickly went back to their old ways of working, he says, and CGI had to pivot its strategy.

“It’s going from training programs to habit formation or transformation programs,” he adds. “And we’ve seen adoption skyrocket.”

The change isn’t in just how individuals adopt AI to improve their own work, though. “You’re now a manager of 10 to 20 specialized agents that are driving that work for you,” he says.

The error is when companies put the technology first. “They fall in love with the tech or a vendor, but they’re not really thinking about how they’re truly integrating these tools and technologies into the business.”

Embracing change

Change management is a particular challenge with agentic AI because the tools are changing at such a fast pace.

“It’s technology that’s constantly changed almost every month, or maybe every week,” says Scott Likens, chief AI engineer at PricewaterhouseCoopers. “The challenge I see is the timescale of change is much faster than what we’re used to.”

We’re still in the early stages of agentic AI, he adds, and waiting isn’t a good strategy. “You have to start, but keep flexibility over longevity in mind,” he says.

For Luis Huerta, group head of gen AI and agentic automation at International Airlines Group (IAG), change management is one of the most complex parts of agentic AI adoption, as it uses agentic AI to improve customer experience, operations, and efficiency.

“The technology is powerful, but the bigger shift is organizational,” he says. So the company isn’t just focusing on building agents, but also on business ownership, adoption, and governance, and helping colleagues understand how these capabilities change the way work gets done and how it can support them, rather than replace them.

Huerta says IAG also uses agentic capabilities embedded in enterprise platforms, but also builds its own agents, too.

They’re not alone. According to Anthropic’s 2026 State of AI Agents report, 47% of organizations take a hybrid approach to AI agents, while 21% rely entirely on pre-built agents, and 20% build their own.

“We take a technology-agnostic approach,” says Huerta. “Our priority is to select the right solution for each use case.”

CIOs are dealing with a lot of change, from the rapid rise of AI and cloud modernization, to cybersecurity and workforce transformation. Many are sharing what they’re learning as they tackle these challenges, including what’s working, what isn’t, and how they’re implementing new technologies in their organizations. Here, a select group of tech leaders reveal the CIOs they follow and why.

Suma Nallapati, chief AI and information officer, City and County of Denver

I follow Suma Nallapati primarily through public technology and AI leadership discussions. She regularly discusses AI adoption, responsible AI, digital transformation, technology strategy, AI governance, human-centered technology, and using AI to improve public services. I find her perspective particularly valuable because she connects AI strategy with practical organizational and citizen outcomes. She also emphasizes responsible and human-centered AI rather than viewing AI simply as a technology implementation exercise. One initiative I found particularly interesting was Denver’s use of AI through its multilingual Sunny chatbot and other city services. Her current role includes scaling AI across areas such as resident engagement, internal automation, permitting, and emergency response while maintaining governance, transparency, and public trust. – Sachin Gupta, senior IT manager, Arrow Electronics

Jennifer Hartsock, chief information and digital officer, Cargill

I follow Jennifer Hartsock through the CIO community, as well as through her thought leadership, interviews, and LinkedIn. I especially enjoy hearing her perspective in longer-form conversations where she talks candidly about the realities of leading technology and transformation in a large, complex organization. Hartsock talks about many of the issues CIOs are navigating right now, including AI, digital transformation, technology operating models, talent, and leadership. A consistent theme in her perspective is connecting tech decisions back to the business, including how tech teams work with the business, and how you create greater ownership closer to the outcomes you’re trying to achieve. – Kathy Kay, EVP and CIO, Principal Financial Group

Fletcher Previn, SVP and CIO, Cisco

Fletcher Previn’s profile shows how a modern technology leader can discuss change without reducing it to a narrative about vendors. He explores AI, culture, talent, and productivity, with an emphasis on conditions that determine whether transformation lasts. The insight worth returning to is his focus on adoption as a leadership responsibility. New technology fails when teams lack learning time, managers lack clarity, and incentives reward behavior that no longer serves the business. CIOs can apply that lens to modernization, security initiatives, and data governance. It encourages an honest definition of progress based on decisions and outcomes rather than launch dates or dashboards. – Sherif Koussa, CEO, Software Secured

Kellie Romack, CDIO, ServiceNow

What makes Kellie Romack’s perspective valuable is she talks about AI from inside a large enterprise IT organization, not the outside. Her posts regularly cover enterprise AI, AI governance, autonomous IT, workforce transformation, cybersecurity, digital transformation, and how the CIO role is changing.

The point that stayed with me was her argument that CIO organizations now have to redesign jobs, teams, and workflows around AI while building new human skills at the same time. That’s a useful distinction. It frames successful AI adoption as an organizational and leadership problem as much as a technology one. Her seat at ServiceNow also gives her a view of what happens after the experiments stop. ServiceNow has reported that its internal AI use cases grew from 15 to more than 200. That makes her worth reading about for any CIO trying to understand what scaling enterprise AI actually looks like. – Tapabrata Biswas, project manager, InfluxIQ Tech Pvt. Ltd.

Mike Blandina, CIO, Snowflake

I follow Mike Blandina for his practical perspective on enterprise AI adoption and the operational realities behind digital transformation. His commentary consistently connects emerging technology with the governance, workforce skills, and measurable outcomes needed to make it useful. One insight that particularly resonates with me comes from this CIO.com article.

He makes the case for building an editing culture rather than a writing culture. As AI increasingly handles first drafts of code, reports, and other work, he argues that the critical human skill becomes evaluating outputs, identifying mistakes, and knowing when to challenge the system. I also appreciate his emphasis on data lineage, access permissions, and measuring actual productivity improvements instead of AI tool logins. Those are the less visible decisions that determine whether enterprise AI adoption delivers lasting value. – Parth Patel, director of operations, Shaligram

Deepa Soni, EVP and CIO, New York Life Insurance Company

Deepa Soni’s insights are particularly valuable because she oversees AI in one of the most critical and regulated sectors of financial services, a Fortune 100 life insurance company where AI decisions have real consequences for policyholders and regulators.

Soni frequently shares in-depth thoughts on what responsible AI adoption truly looks like within a large financial institution. She discusses the delicate balance between the speed of innovation and the readiness of governance, as well as how tech leaders can foster cultures that promote both agility and accountability. What sets her apart is that her approach to AI strategy is rooted in operational realities rather than just vendor hype, which is a rare and precious perspective for CIOs facing similar challenges. – Viren Meghani, technical architect and independent researcher in AI governance

Sears Merritt, CIO and head of enterprise technology and experience, MassMutual

I follow Sears Merritt on LinkedIn and through his interviews. He talks about what enterprise AI costs to run and how to keep the option to change your mind. Merritt also discusses why AI vendor contracts should be capped at 12 months to maintain flexibility, how success metrics are defined before AI pilots begin to determine whether they should be scaled, and the data platform he spent three years building before the AI wave arrived. This is useful to other CIOs because he’s one of the few CIOs at a regulated insurer who talks about AI in the language of procurement and measurement rather than vision. – Egiziago Cioffi, IT/enterprise architect and CEO, SynSphere Italia

Ganesh Ariyur, CIO and head of enterprise technology, Gainwell Technologies

I follow Ganesh Ariyur for his insightful views on AI, enterprise architecture, transformation, tech strategy, governance, and ways CIOs can link tech investments to quantifiable business value. What I find particularly helpful is his content extends beyond just talking about new technologies. He continually positions technology choices in relation to business results, operational frameworks, financial discipline, and implementation. This is particularly important for CIOs facing pressure to showcase ROI from AI and modernization efforts.

An example is his work, The 2026 CIO Operating Model: Architecture, AI, and Enterprise Value. His main point is that tech strategy must be viewed more like capital strategy, with CIOs assessing issues like if cloud expenditures enhance unit economics, and if architecture facilitates quicker decision-making. That viewpoint is important as it transitions the dialogue from which technology to implement, to what ways technology should transform the enterprise’s operations and value creation. – Ketan Patel, digital marketing manager, WeDoWebApps

Jim Swanson, EVP and CIO, Johnson & Johnson

I’m interested in how Jim Swanson thinks about the relationship between technology and the business, particularly where innovation carries considerable responsibility. For example, he recently discussed how AI agents are changing the way people interact with enterprise software. What caught my attention was his emphasis on the complexity that comes with that change — the integration, oversight, and accountability required to make it work. Those are questions that deserve as much attention as the technology itself. – Bill Huber, partner, ISG

Kimberly Basile, CIO, Kyndryl

I follow Kim Basile along with her bylined pieces on Kyndryl’s newsroom and interviews in the business press. She discusses enterprise AI adoption, workforce readiness, AI governance, platform modernization, and security leadership, informed by her earlier role as SVP and CISO at Leidos. Basile speaks from inside a transformation few CIOs have experienced, having helped guide Kyndryl’s technology separation from IBM and consolidate its application portfolio. She treats governance and people readiness as part of AI adoption from the start, and she’s candid about what hasn’t worked. In a recent feature on agentic AI, for instance, she said Kyndryl initially focused on counting agents, and the number didn’t tell the true story. Her team pivoted to measure business process flows. She also identified automating a process that hadn’t been properly validated as one of the company’s biggest mistakes. Activity metrics are easy to report, so organizations default to them. Her lesson pushes CIOs to validate a process before automating it.

She matters beyond the technology because women remain underrepresented in IT leadership, and she uses her visibility to lift others. When she was named to Women We Admire’s Top Women CIOs of 2026, her second year on the list, she used her post to congratulate the other honorees by name and highlight how these leaders help employees embrace technology. That generosity matters in a field where women CIOs are still too few. As the co-founder of Girl Power Talk, I pay attention to leaders who open doors for the next generation of women in tech. Basile does that consistently. – Sameer Somal, founder and CEO, Blue Ocean Global Technology

When juniors take naive questions to an AI assistant instead of a colleague, dashboards record fewer interruptions and higher velocity. What they miss is the erosion of senior engineers’ architectural fluency, and the single point of failure that hardens until an outage forces someone to explain the system out loud.

Over the past year, I watched engineering teams celebrate a quiet drop in Slack interruptions. A junior used to ask a foundational question in a channel: why does this service retry three times instead of once? Today that junior asks an AI assistant first, messaging a senior only if the answer fails in testing. Already, 51% of developers ask generative AI for help they once asked a colleague, and 62% do so to avoid looking uninformed.

Because AI now absorbs routine implementation and debugging, it strips away the trial-and-error juniors once needed to grow into seniors.

Most writing about this shift worries about what juniors lose: less mentorship, thinner context and a shallower feel for production systems. That worry is real, but it is only half the balance sheet.

The costlier loss belongs to the senior engineer and the organization paying them to hold the architecture together. It rarely gets discussed because from the inside it looks like uninterrupted focus time.

What a naive question actually did

A junior engineer’s question was never just a request for a file path. It did three distinct jobs at once, and all three required a human on the receiving end.

First, it transferred tacit institutional memory that documentation never captured. When a senior explained why a payment service retried three times, they rarely recited the config. They narrated an incident from a year ago involving a partner’s rate limiter that never made it into a wiki. Documentation misses that history because nobody writes a design doc after the fact unless something breaks again.

Second, the question gave the senior a live audit of where the system had become needlessly opaque. A staff engineer who has owned a core service for three years goes blind to its rough edges; everything feels obvious once you know the history behind every compromise. A newcomer’s confusion is a free signal showing where the code no longer speaks for itself.

Third, and most overlooked, answering forced an articulation that kept the senior’s own mental model sharp. Explaining a state machine out loud to a colleague who asks follow-ups is a different mental discipline than silently knowing it. Teachers have known this forever: structuring knowledge for someone else exposes gaps and outdated assumptions in your own head. Seniors used to get that workout dozens of times a quarter for free.

The channel disappears without an alarm

Because those informal questions were never scheduled on a calendar or tracked in Jira, their disappearance triggers no alarm. When an AI assistant intercepts the first tier of naive questions, the senior simply gets interrupted less often. Over a single sprint, that silence feels like focus time. Over several quarters, it quietly erodes a senior engineer’s active command of the architecture they own on paper.

In practice, this decay stays hidden during routine code review because spotting a local bug on screen only requires passive recognition. Failure surfaces in postmortems when an incident demands active cross-system recall: tracing how failures cascade across service boundaries during a 2 a.m. outage. Across 211 million lines of analyzed code, structural refactoring has already collapsed from 25% of changes to under 10%, while duplicated code blocks jumped eightfold. Answering a junior’s “what happens if this service times out?” used to force seniors to trace those paths out loud every week. Without that rehearsal, the first live cross-boundary trace happens during an outage.

Why velocity dashboards hide the risk

For a CIO or VP of Engineering, this creates a treacherous blind spot. Standard engineering health metrics do not merely miss this erosion; they actively misread it as progress.

When juniors turn to AI assistants instead of pinging seniors, short-term output metrics look healthier. Pull request cycle times tighten, ticket velocity ticks upward and seniors report fewer context switches on surveys. On throughput dashboards, the organization appears to scale effortlessly.

Underneath those green indicators, three structural risks accumulate.

• Shared ownership collapses into a single point of failure. When architectural rationale stops circulating verbally, it stays trapped inside the heads of the veterans who wrote the code. If one leaves, what looked like shared ownership turns out to be unshared memory.
• Outage recovery times creep upward on complex incidents. Routine bugs get fixed faster with AI, but cross-boundary outages take longer. Every 25% increase in AI adoption correlates with a 7.2% drop in delivery stability, including mean time to recovery (the time required to restore service during an outage). When AI-generated changes hit production without shared context, seniors on the call spend precious minutes re-deriving how subsystems interact.
• Senior engineers’ verification load rises even as mentoring drops. In a 2026 study on developer skill formation, Anthropic found developers who delegated coding to AI suffered their steepest drop in debugging comprehension, creating a downstream “debugging tax.” In practice, seasoned engineers spend up to 19% more time verifying and fixing AI-generated code. When juniors skip foundational questions upfront, they still need a senior engineer’s help later, shifting the senior’s role from upstream architectural teaching to downstream code forensics.

An organization can coast on accumulated fluency for many months before the deficit shows. By the time it surfaces in postmortems or failed handoffs, the habits keeping senior engineers’ understanding sharp have been dormant for quarters.

Rebuilding the channel on purpose

When leaders notice institutional context slipping, their first instinct is more aggressive documentation or indexing wikis into AI retrieval tools. That solves lost context for readers, but not the senior engineer’s problem. Writing a static wiki page never forces a veteran to defend trade-offs or trace failure cascades under questioning. Documentation captures static answers; only live human friction keeps architectural fluency sharp.

Restoring that friction does not mean restricting juniors from using AI assistants, nor does it mean adding optional team meetings that get cut the moment a deadline tightens. If directors are rewarded solely on ticket velocity, informal coaching will always lose to the sprint board. Instead, leadership must embed live human articulation across the four moments where architecture is built, rehearsed, stress-tested and passed on.

• At code review: require verbal design defense on cross-boundary pull requests. Instead of letting seniors review large AI-generated diffs silently, require a ten-minute live walkthrough whenever a change touches service boundaries, retries or state machines. The junior explains what the code assumes about upstream systems; the senior explains why the boundary exists, replacing downstream code forensics with upstream architectural dialogue.
• Between incidents: run live system walkthroughs without slides. Once a month, a senior engineer walks peers through a critical production workflow on a whiteboard, tracing failure modes and historical trade-offs out loud. Where the explanation stalls or relies on guesswork, institutional memory has decayed before an outage can expose it.
• After an outage: require unscripted architectural narratives in postmortems. Do not let seniors satisfy an incident review by pasting a runbook link or an AI-generated summary. Require the service owner to explain live to adjacent teams how a failure propagated and why the boundary exists. Unscripted explanation under peer questioning is the only reliable test of whether a team still understands the software it runs.
• At the 90-day check-in: test architectural handoff, not just ticket count. AI makes it easy for a new hire to close starter tickets in week two without learning how the system fits together. Use the first structured performance check-in to verify whether the new engineer can modify a core workflow and explain its failure modes without escalating to the senior owner. If early ticket velocity is high but every structural change still routes back to one veteran after a quarter, AI is accelerating surface work while core architecture stays trapped in one head.

Every seasoned engineer knows the feeling of trying to explain a familiar system out loud and finding the words no longer come cleanly. That stumble rarely means they lost their edge. It means the friction that kept their understanding sharp was automated away, and leadership must put it back before the next outage asks for an answer.

SAP professionals can now renew their certifications through AI-based roleplays. The new service builds on SAP’s revamp of its certification program last year, shifting the focus from rote learning of facts towards real-world use cases.

“The evolution of Stay Certified reflects a broader shift already taking place across SAP Certification: moving beyond assessing what someone knows toward validating how they can apply that knowledge. AI-powered roleplays bring that principle into the annual certification renewal experience,” the company said in a blog post announcing the new option.

The AI-based scenarios across more than 100 certifications simulate customer interactions with a defined knowledge goal. “The scenarios are grounded in content reflecting the latest SAP product releases, helping learners demonstrate applied, up-to-date knowledge,” SAP said. Immediate feedback is provided to highlight what went well during the roleplay, and what needed improvement.

However, the use of the AI isn’t mandatory: IT pros can still choose to complete a standalone assessment quiz when renewing their certifications.

The process

Users have a 90 day renewal window before certification expiry to complete their recertification. To do so, they must have a subscription to the SAP Learning Hub, at $1452 per user per year, which provides expert-led live sessions to help prepare them, access to hands-on practice systems, four SAP certification exam attempts per year and access to “enablement and assessment to keep certifications valid.” Alternatively, SAP said, users can purchase and retake a certification exam each year.

Yet another option, being piloted at SAP TechEd in Berlin, will be an event-based approach giving eligible users the ability to fulfill their Stay Certified requirement via on-site, hands-on sessions.

A move in the right direction

Analysts are guardedly impressed with the revised approach.

“I think SAP is moving in the right direction, and the ERP industry could have addressed this sooner,” said Robert Kramer, managing partner at KramerERP. “With cloud, AI and automation advancing at their current pace, traditional certification models are struggling to keep up. Knowing the software is one thing. Understanding how to apply it to a customer’s business is another.”

He likes the idea of AI-powered roleplays, because they move certification closer to the application. “Evaluating how someone handles a customer conversation, understands a business problem and recommends a solution is more meaningful than testing whether they memorized product features,” he said.

Frank Dickson, principal analyst at Dickson Research, agreed. The quiz-based approach to renewals was inconsistent, he pointed out: “A credential earned by doing should not be maintained by answering trivia. Airline pilots do not stay current by retaking a written test. They go back into the simulator. That is the right model for cloud software that changes constantly.”

Valence Howden, an advisory fellow at Infotech, added, “SAP’s revised approach to certification is a positive step and a good idea, although it’s not a new or novel approach. In-room and virtual confirmation of the ability to apply training beyond the exam has existed in the industry for a long time, from Cisco certifications a few decades ago to ITIL and other frameworks where top-level certification created scenarios to be solved and addressed in order to validate the ability to apply learning.”

So, he said, “SAP has taken an old but valuable method that will improve the value of their certification, the value of those who achieve it, and provide some assurance around their skills for those who hire them.”

Sanchit vit Gogia, principal analyst at Greyhound Research, agreed. “The AI roleplay is not new to SAP certification,” he said. “It arrived in first-time exams a year ago. What is new is that it has reached renewal, across more than a hundred certifications, and renewal is where SAP’s installed base lives.”

But, he said, “The deeper question is who comes to own the definition of competence, because SAP supplies the AI that helps the consultant, plays the customer, and assesses the exchange. That is the part history will weigh.”

Questions remain

While Kramer approves of the model, he still has reservations about the new testing regime. “A successful roleplay doesn’t necessarily make someone a capable consultant,” he said. “ERP implementations are rarely textbook exercises. They involve decades of customer processes, customizations, industry requirements, questionable data and competing business priorities. Sometimes the best recommendation is not to implement the latest capability, but to address the customer’s readiness first.”

And, he added, “there’s also the question of governance and accountability. Who decides what counts as a correct response? How are assessments validated? What happens when the AI gets it wrong? These questions matter when professional credentials and customer confidence are at stake.”

Dickson, too, has concerns. “The umpire is now an algorithm. Every roleplay is graded by AI, so the strike zone has to be the same for every batter,” he said. “SAP has not said how scoring is calibrated, audited, or appealed. Two consultants giving the same answer should get the same result. Staying certified also requires an SAP Learning Hub subscription, according to SAP’s own FAQ. SAP sells the training and grades the test. That makes transparency on scoring more important, not less.”

SAP is right to test whether certified people can still apply what they know, he noted, and the roleplay is a good simulator. “But a simulator still needs a fair, transparent grader,” he said.

He also has questions about the testing methodology. “Last fall’s exams allowed candidates to use AI tools,” he said. “The announcement does not say what is permitted during a roleplay. If AI assistance is allowed, the roleplay partly measures how well someone works with an assistant. That may be perfectly fine. SAP should simply say so.”

Kramer, too, is looking for more detail. “I support the direction, but I would recommend SAP provide metrics that AI-powered certification produces better professionals, not just a more efficient certification process,” he said. “If it does, this could help close the ERP adoption gap.”

AI has a cross-cutting impact on businesses. It’s changing operations, management, and even decision-making processes. But it’s also modifying what they expect from their teams and how they’re organized. This has a direct impact on the decisions of both HR departments and CIOs, who must now consider issues that, until now, have flown somewhat under the radar.

In fact, the desired professional profile is pivoting. Research from Spain’s Open University of Catalonia (UOC) has found that polymath profiles are gaining value in the AI ​​job market based on changing needs and evolving expectations of skills. Now, in addition to understanding and leveraging technology, being creative, capable of critical thinking, and able to grasp the nuances of things, are essential. This is where polymath profiles are experiencing a potential golden age.

It’s important to first clear up the misconception that a polymath is someone who knows a lot about many things. “A polymath is rather someone who possesses relevant knowledge and skills in multiple disciplines,” says Óscar García Gozálvez, senior director of permanent staffing services at Hays Spain. “It’s also someone with broad and cross-disciplinary vision who’s able to make connections in order to problem solve, innovate, and make better decisions.”

Laia Lluch Molins, professor and researcher in education studies at the UOC adds that the difference isn’t in how much a person knows, but what they do with what they know. These types of workers are able to formulate new questions and solve problems that none of those disciplines could on their own. These qualities are what has made them so valuable and attractive to today’s companies.

Knowhow in the age of AI

With AI’s abundance today, simplicity is no longer the norm. “AI is making technical knowledge cheaper and anyone can access the best explanation for almost anything in seconds,” says Molins. “What’s scarce is no longer knowledge itself, but the ability to make informed judgments.” AI isn’t just replacing tasks, Gozálvez adds, it’s breaking down the barriers between disciplines.

Therefore, polymaths don’t simply tick off endless lists of tasks but connect the dots to find keys to success. “They don’t compete with AI in what AI does well, but rather help solve what AI struggles with,” says Molins. This forces a change in how we perceive the ideal profile, as well as pivot on where value can be created. “In the workplace, this translates into a shift in criteria from how much a person knows to how they apply that knowledge to a new problem, situation, or context,” she says. “What’s valuable now is how that knowledge is leveraged and how it’s used to respond to new challenges.”

These new profiles are of interest because they generate more economic and strategic value for the entire company instead of being contained to isolated specialists.

The necessity of change

The corporate culture also has to adjust in consideration of new dynamics put into practice. “Tell me how you evaluate your team, and I’ll tell you what kind of profile you’re developing,” says Molins. There might be a lot of talk about cross-functionality, but if it’s neither respected nor listened to, multi-talented individuals won’t contribute value and will stop sharing new perspectives.

This may be one of the biggest challenges for CIOs, because the IT environment has tended to reward technical depth. “This recognition system doesn’t always know where to place someone whose worth lies precisely in connecting, translating, and asking the questions that others don’t,” Molins says. “The risk isn’t the polymath profile not fitting, but the culture lacking the categories to appreciate it.”

Even so, Molins says this need is already known internally since bottlenecks are mostly due to miscommunication or a lack of alignment with the business, not technical hinderances. “There, the hybrid profile isn’t a foreign body, but rather the missing piece,” she says.

For now, though, IT hiring trends don’t yet show a boom for polymaths. “If we look at the Spanish market, for instance, we’re not seeing a massive demand for generalist profiles,” says García, but adds there’s been an increase in searches for professionals with a strong primary specialty, and a second or third skill that amplifies their impact on the company.

“My feeling is it’ll accelerate over the next three to five years,” he says. Companies are still learning to incorporate AI, and the next phase will be learning how to work in those environments where AI has changed everything.

What the IT team needs

In this new landscape, IT professionals will need to be able to communicate in different languages ​​and understand new fields. The paradigm is shifting, and in addition to advanced degrees, increasingly specialized training programs are recommended.

Regarding polymath profiles and their areas of expertise, the key will be the emergence of three intersections, as Molins calls them. These include business acumen, as something transversal and valuable, communication and collaboration skills to ensure smooth flow and avoid silos, and knowledge of humanities and social sciences, which encompass key issues such as ethics, something that will gain considerable weight in the coming years, according to García.

Until now, he explains, the IT talent career path has been very focused on tech skills, but in the leap to real-world adoption, much more complex questions arise such as biases, data ethics, and responsibilities. “That’s precisely why there’s growing interest in profiles that combine technology, risk, compliance, and AI governance,” García says.

These points of friction will define expectations for what is sought in technology personnel. “The strength of the hybrid IT profile is having a solid technical foundation from which to build bridges with sound judgment,” says Molins. So collaborations are sought after, such as software engineering with AI, data with cloud, cloud with security, or cybersecurity with risk and compliance. And, above all, critical thinking and business acumen — communication skills that have been discussed already for a long time.

Organizations are rapidly implementing AI, but employees often feel left behind about how AI is changing their roles. While AI can help get work done faster, it won’t necessarily help produce better quality work if employees aren’t confident in their AI skills.

In fact, a recent survey from workforce analytics firm Visier reveals that 48% of employees report exaggerating their AI expertise at least some of the time, and 45% said they often feel pressure at work to use AI despite not feeling confident with the tools.

“The risk of underinvesting in training and upskilling is that the alternative can be much more expensive,” says Andrea Derler,  principal researcher at Visier. “Layoffs, rehiring, and competing for top AI talent all come with significant direct and indirect costs. Investing in the workforce organizations already have can be an important part of making AI adoption sustainable.”

When the pace of AI implementation is rushed, however, employees often default to AI compliance, meaning they’ll use AI tools as they’re rolled out, even if they haven’t received the proper guidance or training from their organization to make the most of the investment. So for companies investing millions into an AI future, adds Derler, it’s critical to ensure employee participation is part of the bigger picture to avoid performative AI usage.

Make the most of AI investments with training

Derler acknowledges that AI adoption goals vary widely from company to company. Some will need stronger investment in upskilling and training, while others might need to invest in new resources, talent, or tools to help employees get comfortable with the new pace of work, and to source the right skills for an AI-driven workplace.

Either way, the early stages of AI adoption should involve a basic framework to assist in employee adoption, one that involves open transparency and foundational guidelines for how AI will be implemented moving forward. At bare minimum, employees should be briefed on concepts around general data security, how to spot false outputs from AI tools, and expectations around AI’s impact on their job roles.

“A few foundational skills and concepts every employee should understand include protecting sensitive data and uploading information with the greatest care, understanding the basic capabilities of approved tools available at work, and checking the work before sending AI-generated output to others,” says Derler. “Most importantly, employees need to take full responsibility for the output. The AI isn’t responsible, the person using it is.”

Avoid setting blanket goals as well, where everyone is measured simply by a certain percentage of AI usage per individual or team. This can overlook reality, she says, creating a false narrative around AI usage and adoption, and a focus on quantity rather than quality. Instead, adds Derler, leaders need to strike a balance between mandating adoption and encouraging employees to explore, discuss, and learn together where AI makes sense.  

Embracing transparency around AI

When asked if they felt their organization had a clear plan for how AI affects employees and jobs, 59% in the Visier survey said they didn’t believe or were unsure that their company had a clear plan for AI implementation. And only 28% said they felt leaders in their organizations fully understand how employees use AI today, while 33% thought leaders understand how much training and support employees need.

Overall, employees are eager to embrace AI, but when asked what would boost confidence around using it at work, respondents first ranked AI training and upskilling opportunities as most important, then greater transparency from leadership, more opportunities for career growth and advancement, followed by better communication about how AI will impact employees.

Clarity from the top

Employees have made it clear they want training and transparency from leaders about how AI will affect workflows and processes. This is especially true when it comes to career paths, as AI stands to remove certain skills and expertise deemed irrelevant.

Workers know the future will look different in the wake of AI, but they want to understand exactly what that looks like so they can prepare and shift their own expectations and career goals. Part of keeping employees engaged is ensuring they’re invested in their own future at a company, but that’s difficult if the future is particularly unclear.

“Most organizations are still learning which parts of a workflow AI can take over or augment, so creating opportunities for experimentation and learning is an important step before setting formal adoption goals or metrics,” says Derler. “Many organizations, however, are still piecing together workforce data and don’t have a complete picture of their workforce, making it harder to understand where AI can create meaningful efficiencies.”

Few CIOs are likely to suddenly decide to give an AI agent broad authority over corporate systems. The more likely path to autonomy is far less dramatic. An agent starts with a narrow task. It proves useful, so another system is connected. It then needs more data, so another permission is added. Then human approval becomes a bottleneck, so the organization removes it, and exceptions that once went to people start being handled automatically.

Each decision may be sensible in isolation. Taken together, however, they can leave an agent with considerably more authority than anyone originally envisioned.

That’s the danger of autonomy creep. And as enterprises move from AI systems that recommend actions to agents that execute them, CIOs need to govern not only what those agents were originally designed to do, but what they have gradually become capable of doing.

It starts with small permissions

Jim Taylor, president and chief product and strategy officer at identity security company RSA, sees a familiar pattern. Organizations typically create an agent for a specific purpose and give it the permissions necessary to accomplish the task. Later, the job expands.

“They just give it tasks, permissions; it just sits there and accumulates things,” he says. “Over time, it develops potentially toxic combinations. It gets too much access and can see too much data. It can do too many things.”

Humans accumulate permissions, too, of course, but organizations have developed processes around employees joining, changing roles, and eventually leaving. Agents may not have the same natural lifecycle. “They never give permissions back,” Taylor says.

Nancy Wang, CTO of 1Password, argues that CIOs should treat each expansion in an agent’s responsibilities as something more consequential than another feature. “Every time you expand the scope of the agent’s effective authority, you’re essentially adding a new authorization boundary,” she says.

That distinction between capability and authority is important. An agent may be technically capable of accessing a system, changing data, or executing a transaction, but that doesn’t mean the enterprise should automatically authorize it to do so.

Success can weaken oversight

Ironically, autonomy creep often occurs when AI works well. Paul Dongha, head of responsible AI and AI strategy at NatWest Group, sees that potential at the bank.

NatWest deployed agents in complaint handling, he says. Parts of the workflow that involve retrieving information from systems can be automated relatively easily, while humans continue to make the final decision on whether to uphold or reject a complaint.

If a system consistently produces the correct result, human reviewers may begin treating approval as a formality. The organization may eventually decide that the check is no longer necessary. “The temptation is to give over to the AI because it’s so reliable,” Dongha says.

NatWest sometimes reduces checking when an AI system demonstrates sufficiently high performance, he adds, but the decision is deliberate rather than incremental. It involves stakeholders and risk managers, and the system continues to be monitored afterward.

That’s a critical distinction for CIOs. Removing an approval step doesn’t necessarily represent poor governance. Removing it because everybody has gradually stopped paying attention to it does.

The warning sign is when a human moves from making a meaningful decision to merely rubber-stamping one — and then entirely disappears from the workflow without anyone reassessing the authority the agent has gained.

Put the controls outside the model

As agents acquire more authority, CIOs can’t rely solely on the agent to respect instructions about what it should and shouldn’t do. At 1Password, Wang advocates what she calls verified loops. Before an agent begins work, humans define its task, which tools it may use, what evidence will demonstrate that it completed the task successfully, and which actions it should never perform.

A separate verifier then compares evidence from the agent’s actions against that human-defined policy. “What you want to avoid here is something recursive where you have a fox guarding a henhouse, or the agent looking over its own work,” Wang says.

The principle applies beyond software development. A model might be instructed never to transfer more than a certain amount of money, delete a production environment, or access particular data. But if violating that rule would have serious consequences, the limit should also exist outside the model.

RSA’s Taylor makes the same distinction from the identity and access side. “Model-level guardrails are necessary, but not sufficient,” he says. “The real limits need to sit outside of that in enterprise control.” He argues for layered controls around agents, including identity policies, provisioning rules, lifecycle policies, governance, monitoring, and attestations.

In other words, CIOs shouldn’t ask an AI agent to exercise restraint where the infrastructure could simply prevent the unauthorized action.

Govern access in real time

Traditional access governance often operates on a schedule. A manager might review an employee’s permissions quarterly and determine whether those permissions are still appropriate. Agents may evolve too quickly for that approach. “Agentic identities are dynamic,” Taylor says. “So we need a mechanism that certifies them continuously, rather than performing periodic reviews.”

If an agent suddenly gains access to another database, for example, that event itself could trigger reassessment. Organizations should determine whether the new permission is appropriate or creates a dangerous combination with access the agent already possesses. “Privilege and authority should never be permanent,” Taylor adds. “They should always be reviewed.”

Wang favors an even more granular approach of task-based authorization. Rather than giving agents standing access or long-lived credentials, organizations can make authorization decisions at runtime and provide short-lived credentials only when required for a particular task. “We espouse no standing privileges,” she says. “No long-lived credentials.”

That effectively applies least privilege at agent speed. A change in task becomes an opportunity to reassess whether the agent still needs the access it’s requesting.

Make someone own the agent

Technical controls, however, don’t eliminate the organizational question of accountability. Taylor believes enterprises should be able to associate agents with a responsible identity. If an employee creates an agent, the organization needs to know who’s responsible for it, what its purpose is, and what happens to it if that person changes roles or leaves. “Every agent action needs to be attributed to a responsible identity,” he says.

Ownership also needs a lifecycle. An agent that remains important after its creator leaves should be transferred to another designated owner rather than simply continuing indefinitely.

Dongha makes another distinction. For AI embedded in a business process, he believes the business owner should remain accountable because that person owns the customer relationship, the process, and often the P&L. “It’s the business owner who has the responsibility because their people run it, and they’re responsible for the customer relationship,” he says.

That creates a useful division of roles for CIOs: IT may provide the infrastructure and controls, but the business can’t outsource accountability for the consequences of autonomous decisions.

Multi-agent systems need system-level controls

The challenge becomes more complicated when agents begin working together. An individual agent might remain entirely within its permitted scope while contributing to an overall outcome nobody intended. One agent generates an output. Another accepts it as input and takes an action. A third agent then acts on the result. Again, the individual actions may all appear legitimate.

Dongha says enterprises therefore need to test not only individual agents but the entire network as a system. “You need something overarching on top of a multi-agent system,” he says.

NatWest is working on an AI control tower that would give authorized users visibility into a network of agents, including messages passed among them and the guardrails surrounding those interactions. Dongha considers governance of multi-agent systems an emerging problem that nobody has fully solved yet.

Wang also points to a related challenge that identity becomes more complicated when agents are ephemeral. An organization may spin up a temporary team of agents, tear it down, and recreate it later. If something goes wrong, the enterprise needs to reconstruct which agent made which decision during which session, and how that action propagated through the system.

That makes traceability increasingly important as autonomous systems become less like individual applications and more like networks of interdependent actors.

Set the bar before the agent reaches it

Before an agent goes into production, Taylor says CIOs should be able to answer several basic questions: Who owns it, what can it do, what’s its maximum authority, how will the organization know if that scope changes, and which actions require a human decision.

Other industries don’t need to replicate the governance machinery of a large bank, but they can borrow one important principle: controls should be built into the system from the beginning. “Governance shouldn’t be a check at the end,” Dongha says. “It needs to be embedded when you build an AI system.”

For CIOs, that may be the central lesson of autonomy creep. The question isn’t simply whether an agent can be trusted today but whether the organization has mechanisms to notice when tomorrow’s agent has quietly acquired authority that nobody ever intended to give it.

CIOs bring a lot to their new jobs: decades of leadership, transformation, pattern-recognition, and outcomes. But none of that matters in your new job. During a time of generalized uncertainty, your team — and every stakeholder — needs to trust you more than anything. But how do you build that trust in a new environment, and as quickly as possible? For Cengage CIO Ken Grady, the best approach is an architectural one.

What is a trust architecture, and why did you develop it?

I’ve been a CIO for almost 20 years, and when I joined Cengage six months ago, while I had roughly 7,300 days of evidence that I knew how to do this job, not one person in that building had ever seen any of it. The proof existed on my résumé. The trust did not.

On day one as a new CIO, you have no shared experience with your team, so you have no trust. Your team might have respect for your background, and hope you’ll succeed, but personal trust is something you must build from scratch.

So how do you do that when the currency of trust for your team can shift depending on the situation? Establishing trust with the people in your new business requires an intentional approach, an architecture.

What are the different currencies of trust?

The first is technical currency. My team needs to know that as a new CIO, I’ll respect their technical expertise, have enough of my own to be helpful, and engage in healthy technology discussions. To solve for that, I sat down and led an open conversation early on about whatever was on their minds, and I showed them that their technical expertise is valued.

The second is investment currency. Can I, a technology leader, speak to ROI or NPV? Can I explain why we should invest in this technology, or address this technical debt, or move from this version to that one? My team needs to respect my ability to guide our investments.

The third is human currency, which addresses the questions people are afraid to ask. Why did we move our offices? Why are we incentivized this way and not that way? IT people are people, and they have non-technical questions.

Technical, investment, and human currency get exchanged in a cadence of conversations, and that cadence almost matters more than the content itself. People value leaders who are steady.

How are you using the trust architecture now?

People have questions when a new leader comes on board, and they need a safe place to ask them. That’s why we built a monthly Enterprise Architecture Review, an open meeting with no agenda where technical people talk through hard problems concerning what we’re trying and learning, what’s working, and what isn’t.

We’ve also built a monthly portfolio review called Steps-to-Green. We talk about the yellow and red projects, and how we can help each other move them to green. There’s no punishment in this room, only encouragement. If your product is yellow, that means you’re one step closer to green.

But the fear is wondering if it’s okay to say what you really think, so the senior leadership team holds a monthly anonymous Q&A. Ask us anything, what you’re worried, frustrated, or even angry about. We might not have all the answers, but we’ll try. If you give your team that kind of safety, they’ll use it.

What’s the benefit of this safety?

You get a high-functioning team willing to challenge existing norms and continuously improve. There’s no such thing as a perfect organization, and safety creates an environment where anyone can suggest an improvement, try it, test it, and report back.

What you get with safety is democratic governance. If there’s a quality problem, anyone in IT can hit the big red button to say we’re not doing this release, we have a quality problem. Anyone on the team can know more than I do about this technology, migration, or this HR issue, and hit the button.

It doesn’t mean there’s no bandmaster. I still need to lead the band since that’s my job as CIO. But the trombone player has to trust me enough to tell me we’re not playing it right.

What advice do you have for CIOs building a trust architecture in a generally anxious workforce?

I cure prosciutto in my basement. Every time I start a new one, I remind myself it takes 18 months, regardless of how many years I’ve been doing it. Trust doesn’t care about your résumé. It’s earned, not given. Before your next conversation, ask yourself if you’re building trust in the currency this person accepts, or the currency I’m most comfortable spending.

Empathy should be your lens. With my team, I show up ready to learn something, connect with them, not to perform leadership. With my stakeholders, I understand they don’t care about my migration strategy. They care whether I’m making their life easier. With my board, empathy isn’t warmth. It’s precision on knowing they need confidence from me, not just an update.

Each direction takes a different currency for team, stakeholders, and customers. As a CIO, you can’t be comfortable in one lane and neglect the other two. You must invest in all three.

To succeed today, CIOs must be strategic partners. It’s no longer something to work toward achieving.

“What used to be an aspiration, having a seat at the table, that’s now needed,” says George Westerman, a senior lecturer at the MIT Sloan School of Management, digital fellow with the MIT Sloan Initiative on the Digital Economy, and co-chair of the MIT Sloan CIO Leadership Award. “AI has made it more important for the CIO to be able to exercise influence and give advice, because now you have a major technology that every C-suite person is wondering about and feels they need to use, and, given its transformative nature throughout the organization, this is where the skills of a CIO who is a strategic partner can be really useful.”

That, though, may not be enough for CIOs in the future.

The CIOs of tomorrow will be crafting the vision of what is possible for the organization, advising their C-suite colleagues on integrating agents into their teams, and navigating high-pressure situations, says Westerman and other IT leaders.

That will require even more of the CIO.

To deliver on such expectations and ensure career longevity, CIOs and executive advisers cite these nine strategies for future-proofing IT leaders’ careers.

1. Cultivate a transformational mindset

CIOs going forward must have “the willingness to look at the situation and think about what’s better,” Westerman says, explaining that this goes beyond improving how existing processes operate to remaking and transforming the organization into something new.

To achieve that, CIOs of the future will need to be visionary and adaptable, with the decisiveness to pivot quickly and the ability to “convince other people to come with you,” Westerman says. IT executives who have or who cultivate those traits now will be “ready for whatever tomorrow brings,” he adds

He and others note that some CIOs are already demonstrating these capabilities, for example, by developing a deep understanding of AI so they reimagine what’s possible for their organizations and remake their IT infrastructure and teams to deliver that envisioned future state.

What CIOs need to provide in the future is “the vision, the innovative ideas, the bold execution, the willingness to take calculated risks, the humility to admit when an idea isn’t working and to pivot, and the ability to leverage a team of talented coworkers who all are critical to the success of the business,” adds Keri Pearlson, senior lecturer and principal research scientist at MIT Sloan School and founding president of the Austin Society for Information Management (SIM). “That’s what CIOs need today and, in the future, to be the leaders we need them to be.”

2. Translate IT into business value

CIOs now and in the future will have to show that they’re not only visionaries but that their visions deliver value to the organization, says Peter Kreutter, WHU Otto Beisheim School of Management’s CIO Leadership Excellence Program faculty director and a member of the board of trustees for CIO Stiftung.

“CIOs have to be much more on the business side, know the business model, and translate IT into added value,” he says. “You want to be a CIO who can co-create with the business, not one who talks about the AI models.”

3. Develop an understanding of business risk

CIOs must also identify and communicate any business trade-offs or risks associated with their IT vision, choices, and agenda. Some IT leaders are doing that now, but the call for CIOs to be business risk stakeholders will only get louder in the coming years.

“CIOs need to demonstrate they understand the potential as well as the risk not from a technology side but from the business side,” Kreutter says.

Executive coach Lacey Leone McLaughlin, president and founder of LLM Consulting Group and host of the podcast “Unfolding Leadership,” shares that perspective.

“As technology becomes more capable and accessible, the differentiator for CIOs will increasingly be judgment: knowing where technology can create real value, where it introduces risk, what should change, what shouldn’t, and how quickly an organization can realistically absorb that change,” she explains.

4. Embrace the technologist persona

In recent years some questioned whether IT chiefs really needed a technology background, but experts now say it’s clear that modern CIOs do indeed need to be well versed in technology — particularly AI.

“We’re figuring out how AI will change how we live and work, but AI is just the latest revolution in technology. There was the internet, then the move to cloud, now AI. There will always be new tools, and we [CIOs] need to know how these things work, so we can inform others on how to use the tools,” says Matt Richard, CIO of Laborers’ International Union of North America (LIUNA).

To do that, Richard commits to learning about emerging technologies and “what they can do, how they’ll impact jobs, how they’re going to change how teams do work, how to implement them, how to find partners, how to manage expectations, and how to make sure we have security and guardrails.”

He takes sales calls from vendors and schedules demos, admitting he does so specifically to learn, not to buy.

And he still plays around with tech, breaking it and putting it back together, so to speak, to test its limits — a pastime many CIOs share.

“That’s important to do now and in the future. CIOs should be getting into the sandbox and trying to build things as the technology comes out,” Richard adds.

5. Drive change with agility, speed, and empathy

Many CIOs have embraced the change agent aspects of their jobs. But that is not enough in at a time when new technologies evolve at an ever-increasing pace, the impacts of that are significant, and fears of job loss and displacement are high.

“It can be an exciting time or a fearful time, but the CIOs who future-proof their careers are working on how they communicate around that, and how they show up and lead,” Leone McLaughlin says.

To be effective leaders now and tomorrow, Leone McLaughlin says CIOs must “communicate it in a way that excites versus elicits fear. They need to say, ‘We’ve gone through changes before; it just has to happen more often and faster, and [this new technology] will help us get smarter, help us do jobs better, help you spend time on tasks that really matter.’”

IT leaders must embody that mindset, too, she says. They need to have — or develop — agility. They must also embrace new technologies, adjust as technologies and markets change, and pivot without fear.

“They need to adapt and adjust to the changes coming, which are coming faster,” she adds. “A larger amount of adaptability is required today, and CIOs should be asking, ‘Am I adaptable enough?’”

6. Create an IT org where agents and humans work together

Pal Narayanan, chief digital and information officer at Kenco Group, a large third-party logistics provider, agrees that the CIO role will be redefined over the next few years. He also believes that all IT jobs will be remade because of agentic AI.

As a result, CIOs will need to lead and manage teams comprised of people and agents — and they’ll need to know how to train and hire staffers and leaders capable of working alongside agents, too.

This will require CIOs to partner with the HR department to revise how IT jobs are structured and how the department is organized. It will also require CIOs to be highly skilled in governance and accountability, as they’ll need policies and procedures to enforce governance as their workforce transitions to a hybrid of humans and agentic AI.

7. Prepare C-suite colleagues to manage agentic-human hybrid teams, too

Savio Lobo, CIO of IT services provider Ensono, expects CIOs will guide their business colleagues in how to manage an agentic-human hybrid workforce.

“As AI agents take on more work, CIOs will need to encourage business leaders to think about how people and agents will work together: which tasks an agent can handle, where a person needs to exercise judgment, and who is accountable for the result,” Lobo says.

To be ready to do so, Lobo says CIOs should be working toward clear identity, permissions, data access, security, and audit trails so they give teams the confidence to move faster.

“Equally important to getting the tech right, CIOs and tech leaders must explain how and why changes are needed with employee-level context, and help them build the skills to work differently,” he adds.

8. Lean into curiosity and continuous learning

Quantum computing is on the horizon, and there’s always the possibility that artificial general intelligence becomes real. As such, CIOs say it’s critical to not become complacent or wedded to the technologies they embrace today, because history shows us nearly all technologies become obsolete someday.

“CIOs can’t afford to be stuck in what worked in the past,” Leone McLaughlin says. “So CIOs have to be curious, ask the right questions, listen, learn, and hire people smarter than they are.”

Lobo agrees, saying that the arrival of other disruptive technologies is inevitable. “Today it’s AI; tomorrow it’s something else,” he says.

He’s focusing on learning what that “something else” will be by leaning into briefings, partner engagements, and public forums where people are speculating about what’s next.

He expects his direct reports and others on his IT team to do the same, and he works to cultivate a “really good culture of learners” through formal training and development programs.

9. Improve your leadership abilities

CIOs who want to continue working on what matters next need to demonstrate exemplary leadership capabilities now. “We are at another inflection point for the skill set and role of a CIO today,” Pearlson says.

Westerman believes many CIOs have work to do here, as they to date have advanced their careers more due to their tech talent than their management and executive skills. As a result, CIOs often have more work to do to sharpen those skills than others in the C-suite.

CIOs have plenty of opportunities to improve; they just have to be intentional, Westerman says, noting that tried-and-true leadership development strategies continue to work.

Develop relationships, deliver on promised expectations, seek feedback on how to do better, and then find ways to improve. “CIOs should be asking themselves, ‘Am I getting enough feedback? Am I effective in my environment?’” he adds.

Similarly, Kreutter advises existing and would-be CIOs to seek what he calls “heat experiences” — tasks or projects that come with a lot of pressure — so they’re well prepared for a future that will likely have more high-pressure situations for CIOs than it does today.

“You need to train and do sparring,” he explains. “Building up this experience is crucial.”

So volunteer to enter the fray, and step forward to lead through a crisis. “They’re opportunities to learn and show that you can demonstrate leadership,” he adds.

Regulated industries have been dealing with the equivalent of sovereign data for a long time. And as the geopolitical situation makes it more broadly relevant, it doesn’t make it any easier to deal with.

From concerns about the reach of the US CLOUD Act and what telemetry or sensitive business data gen AI models might collect, to implications of the US government taking part ownership of a range of technology companies and the impact of EU regulations, the state of the world means more organizations need to think about where data is located.

The result is a flood of announcements from hyperscalers about new EU cloud regions, as well as pitches from regional and private cloud providers. The promised sovereignty may be anything from a local availability zone to more sophisticated approaches to ownership structure, compliance frameworks, where logs are stored, or where support staff work.

Actual data sovereignty involves legal, technical, contractual, governance, and infrastructure questions, but all too often, what’s on offer is what IDC research director Rahiel Nasir calls sovereignty washing. “When you look under the lid, all they’re really offering is a solution for data residency and data localization, keeping data in country,” he says. “That’s part of sovereignty, but not all of sovereignty.”

In his experience, in-country data centers are the first thing organizations ask for to support data localization and data residency, but they also require enhanced controls over identity and access management. That’s critical because data sovereignty is as much about who has access to the data and why, as where it lives.

“It’s really important the only people who touch my data in what is supposedly a sovereign cloud environment are those I give permission to,” he adds. “Because it’s my data, and I’m the only one who can give the authority to grant access to it. That also applies to support and admin staff.”

Companies want control through where they store data but also to restrict how users can interact with it that might expose that information outside an approved environment or jurisdiction, adds Acceldata SVP Ali Afsar.

Access and control

Don’t confuse the regulatory requirements of data residency with data sovereignty, Scality CMO Paul Speciale warns. “Residency is about geography,” he says. “Sovereignty is about control, jurisdiction, and who ultimately has the legal authority to access data.”

For CIOs, the question is no longer simply where the data is but who can access it, who controls the encryption keys, under which legal framework it operates, and can that control be proven. That includes being able to show who accesses data, from where, and for what purpose, which requires verifiable controls like jurisdiction-aware data placement, immutable backups, tightly governed admin access, and clear audit trails.

The UK government’s recent call for evidence on the impact of international data flows on sovereignty makes this explicit, referring to transfer by access where personal data remains in the UK but is accessed from overseas, including by a user located in another country. Access transfers include administrative access, backups, disaster recovery, support incidents and sometimes — depending on the specific regulations — processing the data.

GDPR doesn’t mean data has to stay in the EU but it does require data to be protected to EU standards wherever it goes. Data transfer obligations for other jurisdictions can be far more restrictive, so multinational organizations may need access controls limiting who can see what regulated data from different locations.

RBI-regulated payment-system data, for instance, must be stored in India, but can be processed outside India, Afsar explains, as long as it’s deleted from overseas systems within 24 hours. And with limited exceptions, personal data in Saudi Arabia must be processed within the Kingdom, and China treats overseas access to some categories of data stored in China as a cross-border data activity. Russian laws require similar strict data localization, and personal data of Russian citizens has to be stored, processed, and kept within the country’s borders at all times, which is why LinkedIn was blocked there.

Elsewhere, regulations are most restrictive for specific markets like healthcare, financial, and public services. Not everything needs to be transferred to a sovereign cloud, Nasir points out, as use of that data is subject to regulatory compliance, and the increasing need for AI training.

“This is the data that’s going to have catastrophic business impacts if leaked,” he says. “To give enhanced controls and security for that data, you’d consider wrapping sovereign controls around it. Everything else not subject to compliance nor sensitive data can be accessed by whomever you want and from wherever.”

Sovereignty and safety

Organizations typically know data sovereignty rules well but still experience incidents like data breaches, government data access requests, and unauthorized cross-border transfers caused by, for example, traveling employees or excessive admin access, according to Kiteworks’ 2026 Data Security and Compliance Risk report.

“Location only tells a regulator where the data rests, not who can still reach it,” says Kiteworks’ EMEA GM Dario Perfettibile. “Every real exposure we’ve seen so far happens through access not geography.”

Thinking data needs to stay in region because then it’s safe gives a false sense of security if practiced as a substitute for proper data management. Access, data labelling, and retention polices take more work but are what can prevent incidents. “If you have a data policy in place, it can force a reapproval of the access,” he adds. “It can restrict access to you only, or it can block you out immediately.”

Location isn’t everything

Using a service closer to home doesn’t automatically make any of that easier. “Many organizations still assume sovereignty can be achieved by moving data from one cloud provider to another, or by replacing one hyperscaler with another,” says Keepit Group CISO Kim Larsen. “That misses the bigger picture.” CIOs should treat sovereignty as an operational capability not a compliance exercise, he adds, since sovereignty isn’t about scale or ownership of infrastructure for its own sake, but maintaining control.

“If an organization doesn’t know who can access its data, which legal frameworks govern that access, or whether it can recover its data independently, simply changing where the servers are located does little to reduce risk,” he says.

Just because something is based in your region doesn’t automatically make it a good choice. The EC, for instance, has set up accounts on W Social, an independent social media platform based on the AT protocol designed for data mobility and user migration, which Bluesky uses but is hosted in Europe.

The Commission’s own open source strategy suggests open source promises more control over digital infrastructure by avoiding vendor lock in, and a recent policy brief positions digital sovereignty as a form of digital independence. But having servers in the EU isn’t the same as freedom of digital movement since unlike Eurosky, based in Europe and using the same protocol, W limits interoperability so it can require identity verification, and has closed its source code after security researchers pointed out vulnerabilities.

Most organizations will continue to use both global and local providers, though they might prioritize what Nasir called glocal options built on partnerships between the two. “Organizations want to use a mixture of local and global providers,” he says. “They want all the innovation capabilities that the Microsofts, AWSs, and Googles of the world give us, that they consider local providers can’t match.”

IDC figures suggest only 4% of European organizations plan to switch to purely local options. “We can’t live without US technology today and there’s no appetite to do that,” says Nasir. Availability matters and local providers may not have the same level of infrastructure as global options. They can offer low hanging fruit like video conferencing solutions, but not more complicated directory and database services, or productivity software that’s intertwined with those US-provided services.

Choices about where to store data, and the technical controls to enforce that, have their own operational implications.

“Redundancy and resiliency are key tenets of sovereignty,” he adds. “You want to make sure your operations are always available. In order to enable that, you want to spread the risk.”

The IT job hiring market appears to remain strong, as data from the Dice September 2026 Jobs Report shows that IT job postings continued to increase through September after experiencing a slight dip in August. Overall, the data shows that year over year, IT job postings rose 17% compared to September 2025.

Two areas that saw the most growth include AI and ML, where tech postings grew 88% in September 2026 compared to 2025, about five times faster than the average growth rate for tech postings. As employees embrace AI tools and organizations realize AI implementation goals, they’re shifting a hiring focus to security and finance roles, helping to manage and oversee emerging risks and threats as AI becomes commonplace.

With this increased focus on security and finance, organizations are realizing their AI implementation strategies. And for companies ahead of the AI curve, the focus is now on cybersecurity, governance, responsible and ethical AI use, and financial operations to support AI costs.

Skills that matter most

AI skills continue to grow in demand year-over-year and month-over-month. September saw a sharp rise in demand for Claude skills and those including agentic AI, enterprise integration, and the ethical and responsible use of AI. These skills reflect similar patterns that show in the June data, suggesting they continue to be skills consistently in demand for tech workers.

Comparing skills month-to-month, there were slight changes in demand, but electronic engineering remained the fastest growing skill since July, and skills for managing AI systems grew over September. There was also an increase in IT job postings from those looking for skills including creative problem solving, team performance management, and demonstration skills.

As AI implementation takes hold and presents new risks and challenges to IT departments across every industry, companies are also shifting focusing on cybersecurity and critical thinking skills. September saw an increase in demand for endpoint detection and prevention, as well as financial technology, indicating companies are looking for talent to manage the security and cost of AI processes and tools.

The highest growth in demand over the past year are skills involving:

• Claude AI (1033%)
• Agentic AI (446%)
• Responsible AI (401%)
• Enterprise integration (376%)
• AI agents (308%)
• Product family engineering (295%)
• AI infrastructure (283%)
• Tooling (277%)
• Engineering practices (277%)
• AI adoption (276%)

Month over month, the Dice report’s list of fastest growing skills includes:

• Electronic engineering (64%)
• Autodesk Revit (57%)
• Endpoint detection and prevention (51%)
• Creative problem solving (51%)
• Database management systems (49%)
• Team performance management (48%)
• Data migration (45%)
• Demonstration skills (44%)
• FinTech (43%)

Hot hiring markets

In terms of metro areas seeing the fastest increases of job postings, not much has changed since June’s report. However the Washington-Arlington-Alexandria (DC-VA-MD-MW) area did pull ahead of New York-Newark-Jersey City (NY-NJ) metro areas, where IT job postings dipped from over 20,000 in June to just over 16,000 in September. IT job postings in metro Dallas, Chicago, and San Francisco have remained relatively unchanged since June, demonstrating potential hiring stability in these areas.

Metro area	IT job postings (September)
Washington-Arlington-Alexandria, DC-VA-MD-WV	19,248
New York-Newark-Jersey City, NY-NJ	16,441
Dallas-Fort Worth-Arlington, TX	10,966
Chicago-Naperville-Elgin, IL-IN	8,385
San Francisco-Oakland-Fremont, CA	8,371

Credit: Dice September 2026 Jobs Report 

In depth:

• AI skills are boosting IT pay — but mostly for senior roles
• State of IT jobs: AI sparks rapidly changing market for skills
• Facing an AI skills gap? A skills-first training approach can help
• AI experience is the hottest IT hiring need. What if you don’t have much?

July 2026: Demand for AI fluency rises

AI skills continue to drive IT job postings, with 75% of US technology openings requiring AI fluency in June, up 178% year-over-year, according to the Dice July 2026 Jobs Report.

Roles in the software industry continue to rise, ranking second behind consulting as the industry seeking the most IT help right now. Aerospace/defense, finance/banking, and manufacturing round out the top five.

Most sought after in the market right now are software engineers, data engineers, systems engineers, electrical engineers, business analysts, data scientists, network engineers, systems administrators, data analysts, and AI engineers, according to Dice.

While these roles remain in high demand, the biggest shift can be seen in the skills that hiring managers are seeking — a list now dominated by AI or AI-adjacent skills as companies rush to adopt enterprise AI tools and services.

The skills that matter most

Demand for enterprise integration skills grew 638% from June 2025 to 2026, the biggest rise year over year, according to Dice, noting that this aligns with other indicators that “connecting agentic systems to existing infrastructure is growing faster than the agentic systems themselves.”

Following in terms of highest growth in demand over the past year are skills involving:

• Agentic AI (587%)
• AI agents (503%)
• Responsible AI (495%)
• AI infrastructure (366%)
• Vector databases (353%)
• Event-driven programming (310%)
• Product family engineering (287%)
• Prompt engineering (253%)
• Observability (251%)

Month over month, the list of fastest growing skills in Dice’s July jobs report includes:

• Electronic engineering (69%)
• API system integration (58%)
• LDAP (55%)
• Digital forensics (54%)
• Data exchange (53%)
• Enterprise integration (50%)
• Threat detection (48%)
• NIST Cybersecurity Framework (47%)
• SAML (45%)

Again, the rise in demand for API, data exchange, and integration skills highlights the recent push to “connect AI systems to enterprise data and workflows,” according to Dice.

Hot hiring markets

Some metro areas are seeing faster increases in tech job postings, with a focus around the New York, Washington, Dallas, Chicago, and San Francisco metro areas. These areas have seen greater growth than the rest of the country, making these metro areas the best to live in if you’re a job seeker with AI fluency skills:

Metro area	IT job postings (June)
New York-Newark-Jersey City, NY-NJ	20,858
Washington-Arlington-Alexandria, DC-VA-MD-WV	19,906
Dallas-Fort Worth-Arlington, TX	11,932
Chicago-Naperville-Elgin, IL-IN	9,346
San Francisco-Oakland-Fremont, CA	8,699

Credit: Dice July 2026 Jobs Report

New Jersey (64%), Maryland (47%), and Illinois (41%) are the states that have seen the highest year-over-year increase in hiring.

Roles in demand

Companies are looking for enterprise systems and consulting managers, including Appian developers, Oracle Cloud financial consultants, ServiceNow managers, principal consultants, and technology consultants. Additionally, they are seeking out IT software engineers, C++ software developers, configuration analysts, support engineers, network infrastructure engineers, AI analysts, and cyber threat intelligence analysts.

Outlook

Businesses inside and outside the tech industry will continue to seek tech workers to help realize AI visions, requiring a wide range of AI fluency and skills. It seems this trend will continue for the foreseeable future, as the job market slowly recovers from several tumultuous years.

In depth:

• AI experience is the hottest IT hiring need. What if you don’t have much?
• State of IT jobs: AI sparks rapidly changing market for skills
• What an IT career will look like in 5 years — and how to thrive through the changes
• The 10 most in-demand tech jobs for 2026 — and how to hire for them

Companies are moving fast to put AI into chatbots, virtual assistants, and other customer service tools. But for CIOs, that comes with a risk: if the technology gives customers the wrong information, makes biased recommendations, or mishandles data, it can immediately damage the trust companies have worked hard to build.

Unlike conventional software, gen AI doesn’t always give the same answer to the same question. An answer can sound confident and convincing while still wrong. And when customers rely on AI for information about their finances, insurance, or health, a mistake can have much greater consequences.

Sumit Johar, CIO at cloud-based software company BlackLine, understands that inaccurate AI responses hurt the customer experience, force companies to spend money and resources to fix problems, damage the brand, and create regulatory risks. AI systems can also expose confidential information, making it important for companies to understand the data sources behind their responses.

“An AI failure creates a massive trust issue around the core solution being provided,” Johar says. “In the financial sector, bad AI advice or outputs can compromise balance sheet accuracy and lead to severe legal and personal liabilities.”

For Citizen Health CTO Daniel Wang, for instance, the stakes are particularly high because the company’s users include rare disease patients and caregivers.

Citizen Health works to ensure that important information provided by its AI can be traced back to the original source, such as patient records, clinical information, or medical studies. The company also reminds patients to talk with their healthcare providers before making medical decisions.

Wang says one of his biggest concerns isn’t just that AI can make a mistake, but that a wrong answer can sound right.

“An AI system can present an answer that sounds caring, informative, and authoritative, even when the underlying information is inaccurate,” he says.

That risk has affected how Citizen Health releases AI products, and has delayed AI launches when the company needed more time to understand how the technology was coming up with its answers, or to make sure those answers were accurate. So instead of rolling out new AI tools to everyone at once, smaller groups of patients might be tested first, and their feedback used to make improvements before a wider launch.

Citizen Health also tests its AI tools before launch using questions with known answers, and uses both automated testing and human review, watches for unusual AI responses, limits what the AI can answer, and gives patients ways to provide feedback.

Moving at the speed of trust

Other tech leaders are taking a similarly cautious approach. Jonathan Tushman, CTO and CAIO at Hi Marley, an insurance technology company, says it’s had tech that was ready to ship for years but chose to spend more time on testing, observability, legal review, and training before releasing it.

“If it weren’t for that trust-and-governance bar, we’d have gone live a year earlier and had faster adoption,” Tushman says. “We chose not to.”

Hi Marley calls that approach working at the speed of trust. For Tushman, releasing customer-facing AI also requires the ability to see what the system is doing once it’s running. That includes monitoring individual conversations as well as looking for patterns across tens of thousands of interactions. Companies also need kill switches that can shut down a system, and the ability to roll back changes if something goes wrong.

But technology alone isn’t enough. Customer service, IT, DevOps, and CloudOps teams all need procedures to respond to AI problems, Tushman adds.

Udaya Bhaskar, senior application security analyst at global farming company Corteva Agriscience, says one mistake companies make is moving too quickly after seeing an impressive AI demonstration without fully testing how the tech will perform with actual customers.

He adds that companies can also run into problems when they rely too heavily on vendor claims, or launch AI tools without giving customers an easy way to reach a person when something goes wrong.

The hidden cost of AI mistakes

The pressure to deploy AI is often tied to the promise of greater efficiency. A chatbot that handles more customer questions, for example, can reduce employee workloads. But those time and cost savings can shrink quickly if employees have to spend their time checking and correcting the AI, something referred to as the hallucination tax.

Companies may budget for developing the technology without fully accounting for ongoing costs of running and monitoring it.

Jess Lampe, global lead technologist at Launch Consulting says those hidden costs can include employees spending time checking AI responses and redoing work when the technology gets something wrong, as well as regulatory and legal risks. Another cost can be harder to measure: loss of customer trust.

Chris Slovak, global field CTO at managed enterprise AI delivery platform Unframe, sees the resulting damage to a company’s reputation as one of the largest hidden costs.

“Anything customer-facing is a representation of your brand,” Slovak says. “Yes, poor implementations with bad experiences have a material cost from the perspective of tokens. However, the impact on your brand is far more costly. Often, companies add AI to deflect customer support. Consider you have a customer who’s already frustrated, and meeting AI makes it worse. The loss in trust can be massive.”

But Kevan Yalowitz, global software and platforms lead at Accenture, says mistakes are going to happen whether work is performed by people or technology.

“The true hidden cost is destroying user trust when mistakes happen, regardless of the source,” Yalowitz says. “The most successful organizations quickly admit when these mistakes happen, provide a transparent explanation, and explain how it was an opportunity to learn and ensure the mistake doesn’t happen again.”

Human oversight remains critical

For CIOs, preventing those problems means putting controls around AI before it reaches customers.

Johar says human oversight is particularly important for critical decisions. In highly regulated industries such as finance, AI shouldn’t independently handle decisions where accuracy is essential. Companies also need reliable data feeding their AI systems, and the ability to audit what happens when something goes wrong.

Lampe says the level of oversight should depend on what an AI system is allowed to do. An AI tool that summarizes information, for example, doesn’t pose the same risk as one that can take action involving a customer’s money or account.

Companies should also continue testing after launch. AI behavior can change over time, meaning a system that performed well when it was first released may not continue performing at the same level later on.

Toyan Espeut, chief customer officer at cloud-based work management and collaboration platform Smartsheet, says companies also need strong rules around customer data.

“It can’t be mixed across tenants or used to train third-party models, and AI can never operate outside a customer’s existing permission structure,” she says. “If a person can’t access something, the AI acting on their behalf shouldn’t be able to either. Every AI action needs to be fully auditable, and customers should always have transparency into when AI is involved, and the ability to review or validate AI-generated outputs.”

Who’s responsible when AI gets it wrong?

Even with extensive controls, companies need to prepare for their AI to make mistakes, but the AI itself can’t be solely to blame.

At Citizen Health, Wang says a problem involving customer trust quickly becomes a company-wide issue. The company has support and on-call procedures, but serious concerns are also brought to leadership. Citizen Health also maintains direct channels for users to report problems so they can be investigated quickly.

Tushman at Hi Marley makes a distinction between the person who initially handles an AI problem and the executive ultimately responsible for it. A customer success or help desk team might receive the first complaint, but he says accountability for customer-facing AI rests with him as CTO. “It isn’t something you outsource to the system or hand to the vendor,” he says.

Corteva Agriscience’s Bhaskar similarly says the company deploying the AI remains responsible for what it does since AI is a tool rather than a decision-maker, and companies can’t shift responsibility to the technology when something goes wrong.

And Lampe adds that every customer-facing AI system should have a named person responsible for its behavior and performance, along with a clear process for escalating problems, and allow customers to challenge incorrect outcomes and reach a human.

Speed: only one measure of success

The push to adopt AI is unlikely to slow down. But tech leaders say companies need to be careful about the standards those investments work by. Simply counting how many customers use an AI tool may not say much about whether it’s making their experience better.

Espeut says companies should look at whether customers are solving problems faster, making better decisions, and getting better business results.

“Companies should also expect fewer support tickets because that tells you customers are actually succeeding with the tool, not just using it,” she says. “Expanded engagement across the organization is also an indicator instead of staying siloed in one buying center. They should pay attention to the quality of customer feedback and feature requests as well. When customers actively help shape your product, it’s a strong signal they trust the technology and see its long-term value.”

With a career built at companies like Visa, Ellie May, and Blackhawk, Selim Aissi, a 2026 CSO hall of fame inductee, understands how boards and executives demand a clear justification for cyber security investment, especially considering today’s difficult economic climate.But getting security leaders to communicate tech debt, operational fragility, and long-term cyber risk in business terms the board can actually act on isn’t always straightforward.

A lot of organizations add tools, and more platforms and controls in response to new threats. Yet that doesn’t necessarily address underlying complexities. Security investment can actually increase operational and strategic risk.

“I think there’s a tipping point once a reasonable depth of defense is in place,” he says. “When there’s a reasonable level of automation of security controls and cross integration of security tools, anything beyond that could potentially be overspend and could potentially add risk to the entire organization.”

So the challenge is to know when an environment exists and functions without the need for a sudden budget spike.

“All of the KRIs and KPIs in place should be able to indicate the level of resiliency,” he adds, “in addition to other controls such as making sure there are processes that would allow for detection of, let’s say, API abuse, cloud-level abuse, and, increasingly these days, AI as it adds yet another threat vector.”

Understanding risk also lies in recognizing the distinction between organizations that are genuinely resilient, and those that appear mature on paper, focused on fine-tuning policies, compliance, governance, and frameworks.

“These are all important but they shouldn’t be the main focus,” he says. “The first step is knowing where the data is and once in transit, how it needs to be protected with the most updated protocols.”

Aissi expands on how organizations unintentionally create risk through tool sprawl and operational complexity, how boards should think about long-term cyber resilience, and why AI and cloud expansion are accelerating security debt faster than many enterprises can manage. Watch the full video below for more insights, and be sure to subscribe to the monthly Center Stage newsletter by clicking here.

On resiliency: A security organization that’s mature — and I’ve seen many and have built several — is one that’s architecturally designed to be resilient. But resiliency means different things to different people. To me it means that recoverability is tested often, making sure that in case of an event or breach case of lateral movement, the company can react according to a very clear playbook that’s been thoroughly tested. I also think a resilient organization is one that has the right controls of the right places, and one that also has metrics around them that indicate if there’s an event, and how well the tools work.

An area which I’m really passionate about is data protection. But how do you know the data is protected? A resilient organization doesn’t look at whether the data is encrypted at rest or not. It looks at the entire lifecycle of that PII. Meaning the organization has a very clear discovery mechanism to know exactly where the data is. It could be on laptops, servers, or in a public cloud. It could be in many different places, and it can be structured or unstructured.

On organizational risk: My definition of security debt is the accumulation of risk because of investment in areas where complexity is added, where a lack of automation is exaggerated, and where there’s overcompensation for some controls that aren’t needed. So if an organization spends money without effectively simplifying security controls, and automating more than what needs to be automated, that is tech debt.

Most commonly, tech debt in security is defined as the accumulation of vulnerabilities that aren’t patched, the over complexity of identity exposure management (IEM), and a lack of understanding of where data is. So most significant organizations, especially in fintech, have a huge volume and velocity of PII, and in health tech, PHI and security debt is not knowing where all the data is, or that it’s potentially not protected in some areas. So in addition to the data itself, IEM, and lack of automation and overlaying security tools are other forms of tech debt.

On managing board expectations: The board really wants to understand the risk of cyber security investment, and anything else could potentially be perceived as noise. I see many CISOs taking metrics upon metrics, and dashboards upon dashboards of all sorts of variations of vulnerability management. But what the board really cares about is what the risk is to the business if the most critical systems aren’t patched. Anything else could be perceived as not a concern or a business risk.

CISOs should speak in terms of impact of any real or perceived threat on the business, and be specific. So going back to vulnerability management, let’s say there’s a zero day that was patched or maybe multiple ones that were patched. How do you explain that to the board? You say we patched five zero day vulnerabilities. And honestly, the reaction is probably, who cares. The story should sound like these five vulnerabilities if unpatched, could have put certain systems down for three days, or it would’ve been much easier for an adversary to attack this revenue generating system. That’s what the board cares about, the impact on the revenue. And that’s how CISOs need to speak to them.

On AI: Security didn’t get a seat from the beginning when it comes to AI. So how do we explain to the board that developers might start sharing the company’s source code with Claude and it could potentially leak? This is something we’re all trying to figure out. But we should start speaking from a business perspective about the benefit of AI to the security organization, to the security tooling, to security operations, how it could be more efficient and effective, and at the same time, highlighting some of the risks to the organization — not theoretical risks, but risk related to the organization. If it’s a financial institution and AI agents are deployed in some transactional application, I think the CISO should speak to the board about the business risk of not deploying the necessary security tools to ensure that those AI agents don’t go rogue, that the LLMs are protected. So those are the business terms we need to be speaking about.

The AI industry says enterprises can’t absorb AI. Its answer is to absorb it for them.

That’s not the same thing.

The engineer across the table knew the model cold. Not vendor-deck cold. He could tell me where it would break, what it would cost, and which benchmark numbers to ignore. One of the better technical minds who has ever sat in that chair.

Forty minutes in, I asked which of our problems he would point to first. He named a minor workflow one of my directors had mentioned that morning.

The easy read is that he didn’t know my business. True, and not very interesting. Here is the real issue: the people who sent him are making the exact mistake they are being paid to fix.

They’re not wrong about the problem

The frontier labs aren’t confused, and I want to be fair before I disagree.

MIT found that about 95% of enterprise AI pilots produced no measurable profit impact, despite tens of billions spent. Winning the benchmark wasn’t winning the deal. And a customer who never gets to production never renews.

So, they did the logical thing. They sent engineers:

• OpenAI: Launched the OpenAI Deployment Company in May with $4 billion of initial investment from 19 partners, starting with 150 forward-deployed engineers (FDEs) and deployment specialists.
• Anthropic: Partnered its engineering capability into an enterprise AI services venture with Blackstone, Hellman & Friedman, and Goldman Sachs, reportedly valued above $1.5 billion.
• Microsoft: Launched Frontier Company in July with $2.5 billion and approximately 6,000 embedded engineers and industry experts.
• AWS: Committed $1 billion to a forward-deployed engineering unit embedding engineers with customers.
• Market surge: FDE job postings grew roughly 800% in nine months, with principal-level compensation past $1.2 million.

That is a serious response. But it answers the wrong question.

All that capital is aimed at getting customers into production and keeping them there. We have been reading it as the playbook for getting AI into the wider economy. Those are two entirely different problems, and only one of them currently has anyone working on it.

The same mistake, twice

One structural fact tells you what this really is: the forward-deployed function sits on the commercial side of these companies, not in research. OpenAI capitalized its deployment arm as a separate business with outside investors.

That’s not an accusation; the org chart is simply more honest than the positioning. What that structure measures is pilots converted to production within the quarter. Against that scoreboard, the model isn’t shallow at all. It’s optimal.

Now look at the same failure from my side of the table.

A team builds an intelligent demand-forecasting agent. Accuracy improves by double digits. The engineering readout is genuinely good. And absolutely nothing happens to cash.

Accuracy was never the point. It only matters if it changes an operational decision: how much safety stock you hold, what commitments you make to suppliers, or what you schedule to build. If none of that changes, you haven’t freed a single dollar. Worse, if the model was tuned for fill rate, because that’s what the commercial team asked for — inventory climbs, working capital gets suffocated, and you are worse off than before. The project wins. The company loses.

Anyone who runs S&OP knows this reality: inventory is cash sitting on a shelf. Every forecast is a claim on that cash. Every service-level promise decides how much liquidity you lock away. The value is never in optimizing a single, isolated number; it is in managing the trade-offs between them.

Outside engineers cannot own those trade-offs. Look at what their engagements are sold on: a deflected ticket, an automated records request, a closed underwriting case. Local, siloed inside one function, and measurable in weeks. Those are the only outcomes an outsider can deliver before rolling off to the next logo.

The results a CFO cares about cross three functions and only show up in cash two quarters later.

Delivery vs. Diffusion

This gets celebrated as AI reaching the real economy. In practice, it does close to the opposite:

• The learning runs one way. Anthropic’s job listings are the most explicit about this, asking engineers to codify repeatable deployment patterns and contribute those insights back to product and engineering. That is honest, and it is the point. Analysts have flagged the same concern from the buyer’s side: that deep reliance on frontier labs hands those labs insight into the very industries they may later enter.
• Capability is replaced instead of built. The engagement leaves behind a functioning workflow, but zero internal muscle to solve the next bottleneck. Constellation Research warned this year that FDEs are often used as a crutch for product immaturity, and as part of a broader vendor dependency play. Without Palantir’s feedback loop — where every deployment continuously enriches an integrated customer ontology — this is simply an expensive systems consultancy with a frontier brand name.
• The mid-market waits. Dice reported in August that the shortage of engineers is now directly holding back enterprise AI returns. The scarcest engineering talent sits inside Fortune 50 anchor accounts, while the companies that make up most of the economy queue behind them.

In engagements structured this way, the lab learns your business. You learn their product.

So here is the test I now apply to any engagement, including the ones I sign: when it ends, are we better at finding the next problem ourselves?

If the capability leaves the building when the outside engineer packs up their laptop, that was delivery, not diffusion. Delivery is a fine business, but it doesn’t compound. Diffusion is nothing but compounding.

What we did instead

We eventually fixed our inventory problem.

Not by pointing an off-the-shelf frontier model at raw ERP tables, but by redesigning our entire planning architecture from the ground up. We staffed the initiative with operators who had spent years inside our supply chain and knew where the real constraints actually sat — the lead time, the allocation rule, the supplier commitment that no outsider would have known to model and then applied AI directly to those decision points.

The result: Inventory came down and stayed down, turns improved, and the part that matters for this argument, nobody had to be flown in to do it again the following quarter.

There is no version of that outcome a single outside engineer could have designed, no matter how brilliant the model in his hands.

The bigger stake

Scale this up and the macro picture becomes clear. A country’s AI advantage will not come from a few hundred flagship deployments. It will come from millions of operators applying AI to operational decisions they were previously making badly.

Which brings me back to the man across the table.

We are spending millions sending AI experts to learn business. We should be sending business operators to learn AI.

• Business knowledge is slow. It took most of my career to instinctively know which trade-offs to make around working capital and inventory.
• AI execution is fast. An experienced operational team can master agentic tooling, evals, and model orchestration in a matter of months.

We are running the harder transfer at immense cost and mistaking it for progress.

I don’t need more forward-deployed engineers. I need backward-deployed domain experts.

Nobody is selling those. Which means the only people who can build them are already on your payroll.

Are you looking to become or move forward as a CIO? Then you’ll need to polish your business and leadership skills across a range of domains or risk career stagnation.

“CIOs really need to be conversant across just about everything the company does,” says Mike Loukides, vice president of emerging technology at technology and business training firm O’Reilly. “That kind of breadth doesn’t come easily and it’s not a specialized, single-skill job.”

We spoke with industry leaders to identify the skills that CIOs who enterprises fight over have in common. Here are the seven fundamental skills that will help you become a CIO superstar.

1. Visionary leadership — and innovative results

CIOs should be visionary, employing technology skills and insights to enhance business outcomes, says Peter Silas, CEO of medical records and billing firm Enable Healthcare.

Silas says his firm’s CIO was able to achieve assertive leadership by innovating new systems and using data effectively to improve service and efficiency. “An effective CIO in healthcare will ensure that technology is used to assist with actual outcomes, such as improved patient care, reduced delays, and data-driven prevention of illness,” he says.

A strategic leader will strive to build an innovation culture, Silas says. “At Enable, we facilitate an open teamwork environment in which all individuals across departments are invited to share their ideas with IT,” he states. “When everyone feels involved in change, the entire organization advances together.”

2. The business insights of a COO

Technology prowess alone is not enough, warns Ha Hoang, CIO at cyber resilience and data protection software firm Commvault. “CIOs must also be strategic storytellers, with a customer-forward mindset that clearly connects technological investments with measurable business outcomes.”

While a deep technical fluency and understanding of emerging technologies is essential, CIOs must also get out of their comfort zone and get to know operations, sales, and other functions to understand the full scope of the business, Hoang says. “This includes staying up to date on the latest business trends and engaging regularly with fellow CIOs, CISOs, and others in your field.”

In some respects, having strong business insight is like being a COO, Hoang says. “That’s because you have to understand the entire value chain to fully empower your team and lead the organization’s evolution.”

3. Strategic thinking — and transformative instincts

Strategic thinking separates a good CIO from a great one, says Justice Erolin, CTO at BairesDev, a nearshore software development company. “Technology is changing fast, so a leader’s ability to see around corners, align tech initiatives to business goals, and think long-term is essential,” he states.

Strategic thinking makes you proactive, Erolin says. “You start anticipating business needs, guiding digital transformation initiatives, and creating value for the company,” he explains. “That’s what the board wants and what teams need.”

Become a great listener, Erolin advises. “You shouldn’t try to be the smartest person in the room,” he says. Instead, try to build the smartest room. “Strategic thinking thrives when you’re curious, open-minded, and collaborative.”

4. Internal fortitude

While everyone talks about collaboration, technical vision, and business acumen, what really makes a successful CIO is fortitude, says Troy Gibson, fractional CIO for Centric Consulting’s CIO Services unit.

As a CIO, you’re running a business unit with CEO-level strategic responsibility, COO-level operational complexity, and CFO-level financial pressure — all while being the face of every system failure and project delay, Gibson says. “Without fortitude, you’ll crack under that pressure,” he warns. “It’s what keeps you focused on the long game when everyone wants quick fixes.”

A CIO can build fortitude simply by getting thrown into the fire, Gibson says. “Find mentors who’ve been battle-tested — not just the ones who tell you what you want to hear,” he recommends. Consider working with an executive coach who can show you how to deal with adversity. “Volunteer for the projects others avoid,” Gibson advises. “You can’t build this muscle in a comfort zone.”

Fortitude isn’t a static trait — it’s reinforced through consistent action and discipline, Gibson says. A CIO gets better at handling challenges by establishing clear principles, creating strong operational guardrails, and holding oneself accountable even when it’s inconvenient. “You strengthen fortitude by making difficult decisions transparently, owning outcomes, and learning from both wins and setbacks,” he says. “Over time, those around you will come to see your constancy as a stabilizing force for the entire organization.”

5. The business acumen of a CFO

Business acumen, alternatively known as business savviness, is highly desirable because it connects IT directly to the enterprise’s bottom line, says Nic Adams, CEO of 0rcus, a cyberthreat security firm. This attribute helps a CIO to communicate effectively with the C-suite and the board, speaking the language of business rather than technical jargon.

A CIO with strong business acumen can also effectively prioritize IT investments based on their potential return on investment and strategic impact, identifying opportunities for digital transformation that will truly move the needle for the business, Adams says. “Acumen transforms the CIO office from a cost center into a strategic value creator.”

A CIO can acquire strong business acumen by serving as a strategic partner, proactively engaging with business leaders to understand their challenges and propose technology solutions, Adams states. Obtaining this skill requires translating technical risks into business risks and consistently measuring and communicating how IT initiatives contribute to key business metrics, such as revenue growth and operational efficiency.

“Ultimately, a CIO who masters business acumen uses data to inform strategic choices and fosters a culture of innovation that solves real business problems,” he says.

6. Outcome orchestration talent

Outcome orchestration is the disciplined conversion of strategy into shipped value across people, data, platforms, and AI, says Dalibor Siroky, general manager of Plutora at Planview, a software firm that aims to improve application delivery speed and quality.

Siroky believes that orchestration can be effectively achieved by following a few simple steps. “Define a few measurable outcomes and make one leader accountable for each,” he suggests. Next, fund and govern against those outcomes. “Run a weekly cadence that exposes impediments early,” he advises.

Boards buy results, not roadmaps, Siroky states. Outcome orchestration combines strategy, funding, delivery, and adoption into a single system. “It shortens time to value and forces clear trade-offs,” he explains.

Start with two or three outcomes the business values most, Siroky recommends. “Appoint empowered product owners, spend time on the frontline every week, and remove roadblocks quickly.”

7. Solid communication skills

A CIO must be a skilled communicator. “It’s important to be able to explain complex technical concepts in ways the rest of the organization can understand and to be able to define the business value disruptive technologies like AI will bring,” says Rohit Garewal, CEO of technology consulting firm Object Edge. “They must also be able to assuage fears about the disruption and displacement that may happen with wide-scale AI adoption.”

Historically, CIOs haven’t been great communicators and business leaders haven’t been great technologists, observes Garewal. “An effective CIO must be someone who can bridge these gaps and serve as a liaison between parties in order to secure reliable technology acquisition and implementation.”

Continuously promoting ideas and building consensus is an important communication skill. Yet it can’t be a political game, Garewal says. “A CIO must have an opinion about the business direction of an enterprise as well as how technology can help achieve enterprise goals.”

8. Culture building and team empowerment

Strong CIOs know when to tackle a problem themselves and when to build alignment and empower their teams to solve it, says Keyur Ajmera, CIO at AI infrastructure developer Boomi.

Among the toughest parts of a CIO’s job, Ajmera notes, are earning trust, driving adoption, navigating competing priorities, and getting the organization aligned with change. By understanding what the business truly needs and then prioritizing accordingly, CIOs position IT as a business enabler rather than a cost center — a journey that hinges on the CIO’s ability to develop a business-aligned IT culture and to empower teams to execute.

“It also means getting comfortable saying ‘no’ when necessary, along with a reason and an alternative, rather than allowing every request to become another item in the backlog,” Ajmera says.

9. Industry foresight

Great CIOs know their business, where their industry is headed, and can see around corners.

As Rajeev Jaswal, founder and CEO of AI agent developer Argo Intelligence, warns, IT leaders can’t get stuck in the present, as technologies, use cases, and their industries  will likely change rapidly in the years ahead. “A CIO can end up choosing an excellent technology for a version of the company that won’t even exist in seven years,” he explains.

CIOs should be able to describe, in plain language, what their business will look like several years from now, Jaswal says. “Ask yourself, is the technology you’re buying today built for that version of the company, or the one you’re leaving behind?”

To establish that kind of vision, CIOs need to get out of the IT department, Jaswal advises. “Sit with your sales team, listen to customer service calls, and find out which competitor keeps your CEO up at night,” he suggests. Then write down your view of where the industry is going, share it with your executive team, and revisit it every year. While you’ll be wrong about some of it, that’s okay. “Having no view is worse than having one you need to correct,” he says.

10. A business-eye view of technology risk

With technology so entwined with the business, IT leaders are fast becoming key players in managing business risk. To succeed here, CIOs need to be able to explain technology risk in business terms, says Marcus Tommy, co-founder of MALTO Cyber, a Toronto firm that helps Canadian businesses and startups pass audits. That includes knowing how to tell the CEO and the board what a failure would cost, what the fix will cost, and what the enterprise will have to give up either way.

Tommy advises CIOs to practice this on real budget requests. “For each security or infrastructure task, try writing one paragraph your CFO could read in a minute.” Next, run a tabletop incident exercise with the executive team — not only IT — and write down what the CFO and general counsel ask. “Learn to answer those questions before the next real incident,” he says.

11. Judgment under uncertainty

Based on conversations with hundreds of CIOs as part of the MIT Sloan CIO Symposium, Allan Tate, the symposium’s executive director, sees judgment under uncertainty as a standout skill.

Tate notes that as AI moves deeper into organizations, CIOs must have the ability to weigh competing forms of evidence, expose assumptions, make sound decisions, and be willing to revise those decisions as new information becomes available. “CIOs that have this skill are naturally curious, can articulate complex technology into a business context, and build trust by supporting cross-functional collaboration, education, and shared accountability,” he says.

12. The nimbleness to navigate divisions and change

Having the ability to convert rapidly moving technologies, especially AI and cloud projects, into clear business value is crucial, says Srinivas Chippagiri, a senior member of the technical staff at Salesforce.

Nimbleness means standing between the engineering organization and business operations, making each intelligible to the other so that technical decisions map to outcomes leaders actually care about, such as revenue, risk, reliability, and cost.

Most failures are not failures of technology, they’re failures of translation, Chippagiri says. “Teams build the wrong thing, or they build the right thing and can’t explain its value, so it never gets funded and adopted,” he says. In today’s hectic AI cycle this tendency is sharper than ever, given the enormous pressure to adopt tools quickly — and with very little clarity on which capabilities are durable and which are hype.

Over time, nimbleness changes the CIO’s role from being a simple order-taker to strategic partner, Chippagiri says. “Technology stops being a series of isolated projects and instead becomes a coherent capability that compounds, because every investment is chosen and communicated in terms of durable value.”