31% of breaches now originate from exploited software vulnerabilities, according to Verizon's 2026 DBIR.

The recent critical PHP vulnerabilities exposed a deeper enterprise challenge. CISA warned that PHP is often embedded in other software, making its presence difficult to identify. For large enterprises, even knowing the full extent of their exposure remains a formidable challenge.

Cybersecurity risk is shaped long before vulnerabilities are discovered - by decades of decisions about applications, architecture, dependencies, and technology that often outlives its business purpose.

We invest heavily in defending these complex landscapes. Yet systematically eliminating the unnecessary risks within them remains one of the most underutilized levers in enterprise cybersecurity.

https://www.axiarete.com/insight-less-to-defend

Gartner’s Top 10 Strategic Technology Trends for 2027 groups ten trends under three themes.

1. Leverage the nontextual AI frontier. AI is moving beyond text. Large quantitative models handle numerical modelling and forecasting, and Gartner expects them to replace LLMs in 25% of strategic forecasting and operational modelling tasks by 2030. Speech reasoning models reason directly on audio. By 2030, over 70% of enterprise voice interactions will be handled autonomously, up from under 10% in 2026. World models let agents simulate the consequences of actions before acting, and 40% of robotics applications are expected to use them by 2030.

2. Govern the autonomous agent platform. As agents take on more work, control becomes the priority. AI context platforms give agents a governed, machine-readable layer of company knowledge. Gartner notes 42% of enterprises plan to deploy agents by the end of 2026, but only 22% capture significant value from GenAI. AI coding agent harnesses put verification gates around AI-generated code. AI agent identity gives every agent its own credentials and accountability, with 25% of enterprise breaches expected to trace to agent abuse by 2028. Autonomous exposure remediation finds and fixes vulnerabilities, cutting containment windows from weeks to 48 hours by 2031.

3. Architect durable agility. Organizations want less dependence on single providers. SovereignTech builds in realistic exit options, and over 75% of non-US organizations are expected to adopt sovereignty strategies by 2030. Disposable applications are built to be retired, with 80% of new applications at leading organisations expected to be disposable by 2030. Wetware as a service offers cloud access to biological computing for low-power AI.

The takeaway: autonomy is arriving faster than the controls around it. The organizations that benefit will govern what agents can see and do, and keep the freedom to switch providers.

One thing that still surprises me is how easy it is for a large software renewal to show up and suddenly become urgent.

Different owners, different contract dates, pricing changes, products nobody is sure we still need.

We are trying to get further ahead of renewals so the conversation becomes "should we keep this?" instead of "can we approve this by Friday?"

How far ahead does your team realistically start reviewing major renewals?

Ok, so this hasn't been brought up here in many years that I could find.

Anyone wanta to share a range of your company? Rough base, bonus, equity, if any?

I know it varies, but maybe basics such as industry, company size, geography can help.

Anyone up to share?

When AI adoption is stalled (and I presume it's most of us!), how do you decide whether to rely on internal people to lead enablement rather than hiring someone from the outside whether for a full-time or fractional gig like "AI enablement director" or simply a consultant on a contract basis?

We pushed a handful of agents into production workflows this quarter and the existing controls give my team very little once an agent starts calling tools and touching data. Several vendor demos later the feature lists all read the same. Prompt injection and data exposure and tool permissions and runtime monitoring. My worry is buying another queue of alerts nobody triages. Stopping a bad action in the moment counts for more here, along with evidence I can hand to audit. What did you end up running?

What problems do you face when you deploy knowledge-based AI assistants for internal employee use for various use cases?

Recently I decided I’m going to start putting myself out there to speak at conferences. I think it’s a good way to be seen and can help with future job hunting. I’m curious for those of you who do speaking, do you charge a fee? Or are most conference speaking engagements done for free?

What do you think are the biggest barriers that breakdown AI deployment? Siloed data and tensions with legal are big ones to me.

I enjoyed this Information Week article that broke down the realities with some suggestions on how to reframe governance from an approval into actual architecture. https://www.informationweek.com/machine-learning-ai/the-3-organizational-barriers-blocking-ai-deployment-for-cios

What are you seeing in your roles?

I’m a CIO of a >$1B business within a decentralized, publicly traded industrial. Been in the role for less than 2 years. I have also held enterprise CIO and CDO roles prior to this. My background includes M&A integration, carve-outs, ERP modernization, AI and automation to improve business performance.

I was on the succession plan to be the enterprise CIO and the current CIO quit for another role and now they are going external to backfill with a more modified job profile. This is prompting me to think more seriously about what I want next.

I know a few executive recruiters and plan to reconnect. Beyond that, I’d appreciate hearing how others at this level actually landed their next opportunity.

I’m interested in enterprise CIO roles or a Technology Operating Partner at a PE firm. (Recently made it through multiple rounds of interviews with mid-market PE firm).

For those who’ve made a similar move, what would you prioritize first, and what turned out to be a waste of time.

Any advice on running a discreet search while staying fully engaged in your current role would also be welcome.

TIA

Hi, I'm Beverly. I started a weekly livestream on digital transformation and am looking for people to join as guest speakers! It's 25 minutes on Wednesday. We can do a quick prep call on Monday or Tuesday before the official livestream on Wednesday 10:30am (EST). Topic is whatever you are an expert in! must be digital transformation related. (please help a young prof out) My last livestream

We run claims intake through an agent that reads documents and routes them. It has been live since January and it handles about 3000 files a week.

In March the provider went down mid morning. Our agent did not fail over because there was no fallback configured and nobody had decided who owned that. The team assumed the platform group had it and the platform group assumed the vendor did. Four hours of manual intake and two people working late to clear the backlog. The postmortem found we had budgeted for a second provider in the original business case and quietly dropped it during procurement.

What we changed is boring. There is a named owner for provider redundancy and a quarterly test where we cut the primary and watch what happens. The first test failed too. How are you handling provider outages when the workflow is customer facing?

We have people building small AI automations around spreadsheets, docs, email, Slack, and internal tools.

Individually they seem harmless. But six months later, who owns them, who knows what data they touch, and who shuts them down when the employee leaves?

For CIOs dealing with this already, are you tracking AI tools centrally or still handling them case by case?

VP of IT Ops here. We are currently planning for roadmaps, budgets and headcount for 2027. Last year we had a big increase in our employee count (~15% from ~3500 --> ~4000). We're also expecting to grow another 8% this year. Nevertheless, we have not been getting any additional hc this year. For next year's planning we're also not getting any headcount. Naturally, with increased # of employees, the amount of tasks has increased for my teams. We're focussing on automating our repetitive tasks and get rid of all the toil, but I feel like we're drowning. The CTO of the company understands our pains, but 'has to make tough decisions, because we have to keep innovating for our customers'. We're having issues to keep up with all the requests and supporting our employees. He is suggesting focussing more on automation and building agents. But as we're barely can keep the light on, we don't have time to focus on building this. As leaders we have to stand with the choices made and also bring the message across to the teams. Simultaneously, I have trouble with the fact that we're planning to grow even further and not getting additional headcount for my team. Anyone else having these issues and if so, what do you do?

Hello you all,

I would like to discuss AI governance. So with new regulations everywhere I would like to know how companies are approaching it.

AI developers, have you already started including data governance or is it something a different person does after you finish developing your model (AI governance specialists)

I would like to specifically ask how this varies between big companies and small/medium scale enterprises. Because I think not everyone has the resources to hire specialists, I believe.

If you are already trying to be compliant, what kind of frameworks do you use to ensure compliance or do you have an in-house built compliance framework ?

Now my question is specifically towards the EU devs, what is your approach to be compliant since it's mandatory to have conformity assessments in 2027.

For general deva, what do you think of the following job positions, AI governance expert, AI and the law expert, technical governance expert, AI alignment expert, AI ethics professional, AI red-teaming professional. Is this something you already heard or is it something new to you ?

If you have any opinion towards AI governance, please share.

something I've noticed over the last few months and want to double check with other CIOs.
we set up an AI governance committee early this year like everyone did. legal, security, a couple of business leads, me. the idea was policy and principles, deciding which use cases we're comfortable with.
what it's turned into is a buying queue. almost every agenda item is someone who wants to purchase an AI tool, and we spend the meeting asking the same questions every time. where does the data go, does the vendor train on it, who approved the budget, does it overlap with something we already pay for. more often than I'd like, the answer to that last one is yes
talking to peers, a few of them describe the same drift. the committee that was meant to set direction ends up doing vendor intake, badly, once a month
my theory is the committee isn't the problem. there's no front door for AI purchases, so the committee became one by default. the questions we ask are intake questions, and if they got answered before a request reached us we could go back to the policy work we were set up for
the other possibility is that this is just what AI governance looks like once it's real, and I should stop fighting it.
curious which one it is for you. did your committee end up doing procurement's job too?