Billy Hurley

From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

itbrew.com

IT Brew

Hey there, this made me think of you. I read IT Brew to ensure I’m up to date on the latest industry news and trends…I love it and thought you would too. It’s completely free, plus it only takes 5 minutes to read. Subscribe using my personal invite link below to get IT Brew directly to your inbox.

IT Brew is a newsletter that delivers the latest news and analysis of trends shaping the IT industry. Sign up here:

ITBR: Low code no code audio embed

There was a time at Veterans Affairs when processes called for more paper than code, but times, and applications, have changed.

The Memorial Benefits Management System (MBMS), a web-based app deployed in 2019, for example, supports families and veterans with burial benefits. The task had once required manual data inputs and paper-intensive records, according to Veterans Affairs’ Jacqui Nissen, an acting director for low code/no code in its digital transformation center.

Now the MBMS tracks over 135,000 internments annually, Nissen said, and the VA’s app users don’t have to code to do it. VA agents use modules and menus to pull veteran names from databases and see schedules for the country’s 

, all integrated within a cloud-based platform-as-a-service (PaaS).

“It has to be fast, seamless, and accurate, so that those family members are not having to wait on a call for an hour and a half,” Nissen said.

Nissen says the VA now has over 200 projects that take a hard PaaS approach and require fewer coding requirements. Plenty of organizations have considered this “low code” method—one with democratizing upside and restrictive drawbacks, according to industry analysts who spoke with us.

The consultancy Forrester coined the phrase in 2014 and defines low code as “visual, declarative tools to deliver custom software,” not traditional lines of programming.

When given the low-code treatment, instructions are converted into a diagram of steps like “collect claim information,” “review claim,” and “attach claim copy.”

In Nissen’s case, she said, a PaaS option allows entrants to select data types (name and rank) from drop-downs and connect them to available cemetery times, without developers having to change any system logic with hard code.

Nissen describes the PaaS approach as a cloud-computing service model providing an environment to build applications, without the complexities of managing all the infrastructure parts, like servers, programming languages, databases, developer tools, patch updates, and backups. Developers can create applications, she said, by configuring elements, attributes, and workflows, instead of starting from scratch.

Low code is like having an application “template” already on a webpage that a developer configures to meet requirements, according to Nissen.

A September 2024 Forrester study found that half of North American developers used “low code for the majority of their development work.”

While not promoting one in particular, John Bratincevic, principal analyst at Forrester, mentioned a variety of low-code vendors from the pure-play OutSystems, Appian, and Pegasystems, to the ones offering low-code development as a feature, including the Salesforce platform, Microsoft Power Apps, and Google AppSheet.

Bratincevic also noted benefits to the low-code approach:

Without having to learn code and write code, low-code developers can build quickly.

Non-coders can code (well, deliver software).

 “Your business analysts, people who used to tell the coders what to code and document it, can write apps instead of writing requirements.”

 Because of tool constraints, “It’s easier to change stuff without breaking things.”

Pull Quote

, predicted the low-code application platform market to reach $16.5 billion by 2027. The market intelligence firm also estimated a compound annual growth rate (CAGR) of 16.3% from 2022 to 2027 for the product set, “creating a growth opportunity for current vendors and new market entrants.”

While Kyle Davis, VP analyst at Gartner, considers low code a democratizing way of empowering non-business users to create problem-solving apps, the VP analyst also sees portability challenges and drawbacks when a company is stuck with a vendor’s choices, including a provider’s prices. Low-code projects may also become victims of their own success, as the platform becomes popular, Davis warned.

“It’s a critical mass, and so now the organization has to support it and invest a lot in it,” he said.

Forrester’s 2024 developer survey found that the top low-code applications included complete internal-facing applications, “AI-infused” apps, admin apps for data tracking, and complete customer-facing applications.

Firms like Zoho and Google have already injected AI into low-code platforms to support and automate development tasks, Forrester said in another 2024 report, citing features like natural-language query options, autoconfigured app logic suggestions, and photo-to-app capabilities.

Nissen prefers low-code interfaces that connect to data sources, or one data “source of truth.” That beats the “keyboard pounding” of hardcoding, she told IT Brew. “Those ‘ifs’ and ‘ands’ and manually trying to interface the data, and essentially it’s creating multiple copies of the same data,” Nissen said.

For Nissen, low code offers a middle ground between custom development and a standalone SaaS tool.

“Low code is what I like to call the Goldilocks option,” Nissen said, because it’s “just right.” “It’s faster to get your application developed, and it’s cheaper to sustain.”

A pencil erasing code on a computer screen

Why companies have high hopes with low code

Industry pros and low-code developers explain the approach.

Tom McKay

ITBR-Mitigating downtime audio embed

No one likes trying to access a critical business system and instead landing on the dreaded service disruption notification.

One hundred percent uptime—or even “five-nines,” referring to 

—is difficult, at best, to achieve. Data center operators have to juggle maintenance and upgrades while accounting for unpredictable, external events like 

Yet they’re far from helpless. Here’s some of the basics on downtime, and how data center operators can set themselves up for success.

Daniel Saroff, a group vice president for IDC consultancy, 

 that strong performance uptime (and some other metrics like operational efficiency, security, and compliance) have become “table stakes for most IT departments.” Saroff cited IDC polling showing that systems availability was tied with IT project delivery as one of the top three metrics used to measure CIO success in 2024, arguing the focus on operational metrics shows a lingering mindset that “still pigeonholes IT as a support function rather than a strategic driver of innovation.”

Failure to maintain consistent uptime can have serious effects—

 by enterprise resilience firm Splunk indicated Forbes Global 2000 companies lose 

 per year to unplanned downtime, or around $9,000 a minute. According to the report, average unplanned downtime due to cybersecurity issues amounts to about 466 hours annually for a Global 2000 firm, while app or infrastructure-related downtime stacked up slightly lower at an average of 456 hours annually.

The authors of the Splunk report noted that while uptime at these firms generally stood at “multiple 9s” (i.e., 99% or higher), costs are still high considering they can stack across numerous systems. Just shy of three out of ten respondents to Splunk’s research said they had lost clients due to downtime, while 44% reported brand damage.

“A major IT service outage always makes front-page news,” Todd Traver, vice president for IT optimization and strategy at industry certification body Uptime Institute, told IT Brew. According to Uptime’s 

 of data center owners and operators, 54% said their most recent outage had cost over $100,000.

According to Traver, two systems are crucial for ensuring the reliability of infrastructure within a data center. The first is a building management system, which uses probes distributed across a data center’s 

 (OT) to alert personnel in the control center of any alarming readings. The other is the computerized measurement management system (CMMS), which is a single point of reference for data on any given device in the building.

“Basically, they gather all of the data about those thousands of assets, so when you know when the device was installed, the commissioning records, when it was tested—when it was brand new, what it was capable of doing, all the maintenance history on that device,” Traver said. He added they also often catalog any processes or procedures associated with the equipment.

CMMS systems often utilize barcodes or QR codes, allowing technicians to quickly look up the history of any component they may run into—important for both preventative and predictive maintenance. Uptime’s 2024 survey found 54% of the most recent impactful incidents or outages reported by respondents involved on-site power issues, and an additional 13% reported cooling issues, highlighting the importance of tracking components of OT systems.

Traver said data centers can be rated for their resiliency across four tiers. The most basic certification, Tier I, requires data centers to have basic power and cooling systems with no guarantee of uninterrupted service. The Uptime Institute doesn’t rate those centers, Traver said, and Tier II data centers (which feature increased redundancies) don’t count for much either.

For a data center to score a Tier III certification, Traver said, Uptime experts examine the design of electrical and mechanical systems to ensure every single component can undergo routine maintenance without affecting IT load. To get to Tier IV, data centers have to be fault tolerant; that means their backup systems kick in automatically in the event of a failure, without requiring manual switching. These tests can take days to perform, in part because any given data center may vary dramatically in its design, infrastructure, and components.

Uptime researchers wrote in the 2024 report the other factors like training and incident response plans should possibly be higher priorities for operators than improving redundancy, as respondents felt many incidents didn’t need to happen.

“Four in five operators believe their most recent significant downtime incidents were preventable with better management, processes, or configuration,” they concluded. Traver noted communications gaps between IT and facilities teams are often a problem.

App-related or software outages are also a major concern, whether it’s a glitch or the sudden loss of a crucial dependency. Traver said Uptime performs digital resiliency assessments, which looks at the entire tech stack to see how applications are designed and implemented. While such tests aren’t part of their tier system, he noted he’d seen banking systems crash due to unanticipated software issues.

They all put “millions of dollars into designing data centers and millions of dollars into architecting the IT systems, but they didn’t understand some of the simple dependencies that took them down hard,” Traver added. “They were down and they were completely blindsided by it.”

“Unfortunately, typically, clients bring us in after the fact they have said they’ve had a major outage,” Traver told IT Brew.

Most commonly, he said, Uptime finds upgrades or vendor changes in key components like the building management system or CMMS lead to a “splintered” knowledge base. For example, operating procedures or capacity and commissioning records can become hard to find. The problem is exacerbated by turnover, as new hires take a “couple years until they’re 100% up to speed” and documentation is often spotty, Traver added.

IT and facilities teams can avoid self-inflicted downtime by sharing an integrated change control system—a formal process in which 

 of upcoming maintenance, rollouts, or other disruptions—to ensure both teams are aware of possible conflicts, Traver said. It’s also important for operators not only to have an incident response plan, but for it to be well-documented and establish clear plans for escalation and authority.

“Without that, if you have a site go down, or the site is just not operating properly, and there’s not a clear line of authority, who’s making the decisions?” Traver said. “Yes or no, are we doing this, who’s communicating to who? If that’s not all documented and understood and practiced, it’s a mess.”

3D blue, pink, and green error alerts layered over each other

Three warning triangles with exclamation points inside of them

Mitigating downtime risks: Strategies for ensuring uptime in critical IT systems

Consistent uptime is table stakes for most organizations—here’s how to achieve it.

Morning Brew Staff

Two shipping containers, one red and one blue, held up by crane hooks

Tariffs bring economic shifts, affecting many industries. Read this e-book to understand their sweeping impact across the healthcare, tech, retail, finance, and IT industries.

Tariffs: Understanding the impact

Super-charge your industry know-how with insights, tools, and tips from our team

Resources

A hand holding an index finger up to a fingerprint scanner

Some biometric options are an easier sell to employees than others.

How companies are deploying biometrics in 2024

If you’re feeling like a tech skeptic, you’re not alone. AI is a fantastic tool, but it’s not yet the one-size-fits-all solution that certain fields treat it as. This is especially true in the world of cybersecurity. TekStream breaks down the dos and don’ts of AI-SOC in their latest guide. Download it here and see how your team can responsibly implement these tools without exposing yourself to potential threats.

TekStream and Splunk

Please think responsibly: AI’s limitations in cybersecurity

ITBR-Quantum computing audio embed

Not to ruin the party like it’s 1999, but there’s a looming Y2K-like technology threat that IT pros need to prepare for before it’s too late: quantum computing.

The promise of quantum computing and its problem-solving prowess also poses a glaring threat to old encryption methods like the 

With sensitive data potentially unlocked to adversaries, tech pros who spoke with IT Brew advised practitioners to reopen the Y2K playbook

and apply familiar preventative steps from that memorable turn of the century: take inventory, apply updates, and test. Quantum preparations, security specialists told IT Brew, include working through a checklist of tool inventory, vendor conversation, and a changeout from old encryption to new.

Instead of using bits, quantum computers deploy particle-manipulating qubits to quickly store and process data on refrigerated hardware running at temperatures approaching absolute zero. Some possibilities for the high-speed calculators include 

In 1994, computer scientist Peter Schor developed an algorithm that factored large numbers quickly. The demonstration revealed risk to the encryption of the time, given that the protection mechanism often relied on multiplying large prime numbers.

In 2001, a quantum computer developed by IBM and Stanford University 

 and factored the number 15 on a 7-qubit processor. Since the demonstration, companies like D-Wave, 

As the computing advances, security pros fear that quantum tech can break the encryption guarding enterprise data.

Adversaries already have access to the technology needed to employ “harvest now, decrypt later” attacks, according to a 2024 Global Risk Institute report, “to intercept, copy, and archive encrypted communications for eventual decryption with a quantum computer.”

On August 13, in response to the quantum threat, the National Institute of Standards and Technology announced 

 for tech vendors and practitioners to start using.

Preparation for a quantum crypto-breaker has led many IT professionals to assess regulatory implications, update encryption standards, and collaborate with hardware and software vendors. Many, however, aren’t ready for the final exam.

A survey from international professional association ISACA found that 40% of respondents are not aware of their company’s plans, and 41% say they do not plan to address quantum computing at present.

ISACA released a quantum-preparedness checklist, including:

Checklist

Part of the readiness assessment can be simply seeing what breaks when a new encryption standard gets added.

 in its Chrome browser by default for the online-privacy protocol known as TLS 1.3, for example. A system admin can “use a browser with the new algorithms enabled…and see if they can still connect to old firewall interfaces,” Johannes Ullrich, dean of research for the SANS Technology Institute, 

A recent survey, commissioned by cybersecurity platform provider DigiCert and conducted by Propeller Insights, found that 69% of “cyber leaders” expect quantum threats to break encryption in 5 years, but only 5% have quantum-safe encryption in place. (Respondents included 1,042 senior and C-level cybersecurity managers in the US, UK, and Australia, according to the company.)

Quantum prep includes work for the individual IT pro, like updating encryption for data at rest, or provisioning a new certificate for, say, a smart TV that has to authenticate to a network. Other updates require conversations with a vendor.

In addition to ISACA’s recs, Mike Nelson, global VP of digital trust at DigiCert, also advises clients to talk with software vendor partners to understand their timelines for supporting post-quantum cryptography.

“They should be able to communicate with you about their plans for that so that you know when they will be introducing it, so that you can have that coordinated approach,” Nelson told us.

Deloitte’s Bill Briggs told us in January 2025 that the prep scenario had a Y2K—or “

”—feel. The year 2000 fortunately began 

Over one-third (34%) of the quantum-computing researchers surveyed by the Global Risk Institute in 2024 estimated that a quantum computer could break a 48-bit RSA encryption within 10 years. There is a quantum countdown; it’s just hard to know when it’s “Q o’clock” exactly.

Nelson sees a more disordered, “messy” situation than Y2K as IT pros get ready for a test with no clear date. Some will ace the exam, he said, and some will try to migrate fast when they absolutely have to.

“There’s going to be things that are going to break, systems that are going to go down, and there will be outages,” he said.

An illustration features a golden, unlocked padlock at the center of a blue atom model with orbiting electrons, all set against a solid light purple background.

How to prepare for when quantum computers break encryption

Find your encrypted data, and see if your SaaS vendors have a clear plan.

Everyone’s talking about AI, and for good reason. It’s not here to replace jobs—it’s here to make them better. Zendesk surveyed more than 800 employees across 17 industries to understand how AI is reshaping the workplace. What we found: 79% of employee service leaders say AI gives their teams a competitive edge. Want to know how? Download the report to uncover the 3 key ways AI is boosting employee satisfaction and performance.

AI is here to help—your people and your productivity

According to the latest findings from Rubrik Zero Labs, a whopping 94% of IT and security leaders report that their organization experienced a significant cyberattack last year. Where are these orgs being hit? Too many places: 67% of attacks are happening in SaaS applications, 66% in the cloud, and 51% on-site.

To help avoid these very unpleasant surprises, Rubrik Zero Labs’ latest report can help you learn to measure data risk. With findings from 1,600+ IT and security leaders, several leading cybersecurity organizations, and Rubrik telemetry, you’ll uncover:

how detrimental an attack could be for your org

Time for some pivotal prepping. Dive into the report to discover where you stand.

Rubrik

Do you know your data risk?

Beef up your cybersecurity with this free white paper from Veeam. You’ll learn how the NIST Framework 2.0 and Veeam® Data Platform work together to fortify your data fortress. No more cyber headaches—just solid strategies and the tools you need to keep your org’s info safe. Make cyber resilience a breeze with Veeam.

Lock down your data

An office desk with a lamp, laptop, and plant on top surrounded by WiFi and padlock, cybersecurity icons

Dive into the intricacies of securing access for hybrid employees, with insights into mobile device management, personal device policies, and remote access setup.

Resources

Our Picks

Why companies have high hopes with low code

Mitigating downtime risks: Strategies for ensuring uptime in critical IT systems

Tariffs: Understanding the impact

Recent Resources

Please think responsibly: AI’s limitations in cybersecurity

How to prepare for when quantum computers break encryption

AI is here to help—your people and your productivity

Why companies have high hopes with low code

Mitigating downtime risks: Strategies for ensuring uptime in critical IT systems

Tariffs: Understanding the impact

Do you know your data risk?

How companies are deploying biometrics in 2024

Lock down your data

Bridge the gap: Securing access for hybrid employees

How companies are deploying biometrics in 2024

Top insights for IT pros