From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Billy Hurley

itbrew.com

ChatGPT offers fast help to coders with questions

As Microsoft announces greater access to ChatGPT, developers see possibilities for coders.

Brianna Monsanto

At the beginning of 2025, David Khuat-Duy pulled off the ultimate 

trick. Stepping down from a quarter-century stint as CEO of Ivalua, the spend-management software company he founded in 2000, he ventured off into a new role within the company—not as a strategic advisor as some may expect, but instead as 

For Khuat-Duy, the transition into Ivalua’s inaugural CAIO role made perfect sense. As he told IT Brew, the emergence of ChatGPT signaled a disruption similar or even larger than the one following the rise of the internet. While Khuat-Duy had already begun to spend time focusing on AI technology, he said he ultimately felt it was time to make it the center of his attention.

“Because I was CEO and because I know very well the process, the organization, and all the leaders, I was the best person to help the company embrace that technology at its full extent,” Khuat-Duy said. (In January, Ivalua CRO Franck Lheureux succeeded Khuat-Duy as CEO as the latter transitioned into the AI-focused role.)

Since taking on the CAIO title in January, Khuat-Duy has kept himself busy. While he previously spent time growing his team and managing Ivalua’s operations, now he works more closely with his research and development team to enhance Ivalua’s framework around 

“I really focused the first eight months on building a framework where people can build their own agent,” Khuat-Duy said. “So, each employee of the company can build their own agent based on the data of the company.”

 Prior to taking on the CAIO role, Khuat-Duy—who has a PhD in math—said he was (and still is) a developer at heart. Ivalua has had an AI team for years, but it wasn’t until ChatGPT came out that he began to focus more on it.

“As soon as it was released, I spent almost most of my time learning more about it,” he said.

Khuat-Duy said one does not need to be an AI expert to take on the CAIO role. In fact, he thinks having advanced knowledge on AI could potentially be a hindrance.

“I feel if you’re [a] full expert in AI, it could disserve you because you have such a background of advanced expertise in AI and building [models] that this is what you like,” Khuat-Duy said. “Whereas here, it’s not about building a model. It’s about using the model and [integrating] them, which is a different skill set.”

Ema Roloff, co-founder and chief growth officer of Roloff Consulting, a digital strategy advisory firm, said companies seeking a CAIO are likely to look for candidates with a background in data science or skills related to the AI solution they wish to build. She told IT Brew she hadn’t heard of the CEO to CAIO transition before (neither had Khuat-Duy), but said it was an “odd switch” only because a CEO can also be a “digitally literate leader.”

“You can be a leader of a company who is aware of the technology, understanding the potential and helping set the vision for where you want the company to go using artificial intelligence…without having to pivot and change to have a role that’s specifically pointed at AI,” Roloff said.

R “Ray” Wang, founder, chair, and principal analyst at the technology research and advisory firm Constellation Research, told IT Brew in July that he believes the CAIO position is a “transitional role” that will eventually get absorbed into the CIO or other business technology roles. When asked if he foresees the CAIO role as a temporary position at Ivalua, Khuat-Duy didn’t have a clear answer.

“To be honest. I don’t know what the world will be in five years from now because the disruption is so big,” Khuat-Duy said.

In the next year, Khuat-Duy said he will focus on making sure Ivalua employees and customers are benefitting from agents. He added that learning and being open to experimentation are important to him in his role.

“We work, we learn, we test, we experiment, and that for me [is] the motto I have everyday,” Khuat-Duy said. “That’s how we’ll be successful.”

Headshot of David Khuat-Duy, Chief Artificial Intelligence Officer, contained in an abstract shape.

Why David Khuat-Duy traded in his CEO hat for the CAIO role

Khuat-Duy tells IT Brew that you don’t need to be an AI expert to be a CAIO.

Caroline Nihill

AI is having a huge impact on pretty much every part of the economy—and the environment. 

 expect the AI industry to consume at least 10 times the amount of electricity it demanded in 2023 by 2026, which is leading to big questions about the technology, energy-related emissions, and climate change.

In looking for ways to decrease that potentially massive carbon footprint, experts have championed solutions like optimizing workflow, using sustainable hygiene (like not running things the enterprise isn’t actively using), and even using AI itself to monitor emissions.

, a nonprofit spearheaded by tech execs, are aiming to set standards in the IT industry for best practices and provide training in order to reduce AI’s environmental impact.

Individual companies, like the multicloud and AI solutions company Rackspace Technology, have set sustainability goals. Rackspace aims to become 90% net-zero in carbon emission by 2045, with 50% net-zero emissions by 2032.

Ben Blanquera, VP of tech and sustainability at Rackspace, told IT Brew sustainability actually centers on optimizing teams’ workload. He suggested fundamental hygiene for ensuring sustainability and reducing environmental impact includes asking if the programs running are actually needed, because that translates into less energy usage

“When you talk about the impact of AI, you can get caught up by that, but you actually have to start with the basics of architecting what you need from a workload, minimizing the starting point of the resources you’re using, and that’ll get you 80–90% of the way there,” Blanquera said.

Brigit Hirsch, the Environmental Protection Agency’s press secretary, provided IT Brew with a statement saying the agency recommends data center owners and operators,consult with state and local air permitting authorities for information about the Clean Air Act requirements.

The EPA “regulates air emissions from different types of sources, which could include data centers” under the Clean Air Act.

Sustainability, sustainability, sustainability. 

Right now, too much of the IT market is not looking at sustainability in the long term, according to Forrester Senior Analyst Abhijit Sunil. He said that many organizations are considering the short-term gains of emerging technologies like AI while not always considering “negative impacts that might catch up” with them.

“There will be a scramble for green energy, the power purchase agreements, all those different types of things,” Sunil said. “As a framework for IT leaders to look at these technologies, it will be really specialized in terms of what they’re looking at.”

 in July detailing how technology leaders can use AI to guide sustainability—along with AI’s need for computing power, materials, and scale that could offset the benefits of innovation.

The study showed that advanced data centers can use sustainability technologies like advanced cooling and heat reuse to help save energy and boost efficiency. While the efficiency benefits can offset the savings through encouraging higher demand, Forrester recommended that data center operators choose modular and durable infrastructure equipment to encourage a sustainable IT life cycle.

Sunil said, “Even as an IT leader, if they’re taking a decision on their data center expansion or things like that, they can leverage some of these analytics solutions that will help them make better decisions, that will enable them to have better business resiliency.”

One choice for an IT leader to make is how to leverage an AI solution internally to help make better decisions.

According to Sunil, IT professionals can use models like GenAI to assist with measuring and reporting emissions through their implementation in a climate risk analytics software solution.

“AI can help with not just the assessment of various risks and making it easily accessible for various leaders within [a] company, but also to be able to make the data more accurate, the analysis easier for multiple personas within the organization to read and use,” Sunil said.

Rackspace has implemented an AI process that takes invoices from facilities around the globe and puts the data into an inventory of usage metrics. The technology pulls out the information from the invoice and categorizes it.

Blanquera explained this solution arose from a need to have complete and accurate data.

“We know that’s not sexy, or pretty, but it works,” he said. “We have put in our basics to make sure you can run with AI down the line. Without the basics, all those fancy algorithms, AI really don’t work.”

A view of Earth from space with red warning triangles floating around it.

How to make your AI products and services more sustainable

As demand for AI grows, some experts say the solution to environmental impact lies in the workflows choices of IT leaders. 

 difficult to navigate? The experience could be made worse with the influx of IT workers jumping from the federal government, either voluntarily or by reductions in force.

 affected or targeted by the widespread layoffs, a significant portion of them worked in IT–and some could consider the private sector for their next gig.

However, Joe Scheidler, the CEO and co-founder of Helios, a seed stage startup specializing in AI for government and policy, said that it’s unclear if the layoffs from the federal government will lead to people flooding the IT industry.

Helios builds an AI-native operating system for public policy, regulatory, and legal professionals to track changes and augment workflows.

“There’s always going to be a little bit of both. I think the pendulum will always swing one way or the other,” Scheidler said. “We’ve probably seen the majority of the federal government’s slim down effort. I would consider it to be in the rearview at this point.”

The conversation has been edited for length and clarity.

Why were you interested in getting Helios off the ground?

I would say that the impetus moment snowballing toward wanting to start Helios came when I was at the State Department, leading legislative affairs and congressional engagement on a G7 initiative.

A big part of my role was working to coordinate the interagency engagement strategy with [Capitol Hill] to ensure that we were appropriated and resourced in a sufficient manner to meet those goals. I was using a lot of the legacy policy research tools on the market and looking around for an AI-native solution as a one-man band that would enable me to spend a lot less time on the research and monitoring and writing processes that are just so intrinsic to day-to-day work and free me up to go grow relationships on the Hill. DC is super relational, and that’s really how you drive progress in a lot of ways, and I just spent a lot of time doing the former.

When I really wanted to build the prototype, [I] teamed up with the two other co-founders. We went out to San Francisco for the first time, full time, as a group in early March and made a ton of progress building…a very robust data corpus, fine-tuning models, and getting a lot of great feedback from folks across the public and private sectors, leading into the seed round raise. Now, today, [we’re] scaling the team and moving quite fast in a number of directions.

Can we flesh out the differences between the government and industry in the IT space?

The commercial side just moves a lot faster…The Valley is the cradle of innovation, and we saw that when we went out to San Francisco. You can stand up and ship product way faster in a startup environment than you would be able to even in a “startup team” operating within the government. You’re just able to move more freely in getting a prototype working. Obviously, when you start selling to government entities or Fortune 500s, you have to meet the same compliance thresholds that you would if you started out building in government. But I think [speed is] really the main difference.

You can just start building something, get it to a point where you can get early feedback from industry experts and pressure test your hypothesis: Is this really useful? Is this something people want? Then, if it is, buckle down and actually ramp up toward a proper go-to-market industry when you become compliant with…standards. Then move from there. That’s the approach we took. It’s something that you fundamentally aren’t really in a position to do if you’re working within the government.

Do you anticipate that these reductions in staff will affect the tech sector and flood the industry with people looking for a change?

We’re seeing folks start companies, start consultancies, start small businesses, and enter service in other ways, like going back to their home states and trying to bring that efficiency mentality to local county governments. I think that’s helpful. I do think there will be people who left government or were let go who may bring a really helpful perspective to their communities, private industry, some of these government affairs teams. I think a core tenant of American competitiveness, looking more globally at China, Russia, Iran, the [United Arab Emirates], those friendly competitors and adversaries who are leaning into AI adoption and digital transformation probably a little more than we are at the moment. Bringing an inside-government perspective to industry can be helpful in harmonizing public-private interaction. That’s going to be needed to compete and lead on the world stage over the next five to 10 years.

I’m not advocating for state-owned enterprise, which I know is a flash point right now…but I do think there is a real opportunity for the public and private sectors to work more efficiently together in America. AI can be a helpful tool in that effort, but the institutional knowledge and perspective that a lot of folks carried from their service in government will be another driver of that effort.

Cloud hovering over an employee working on a laptop. Credit: Anna Kim

What one government IT worker turned AI entrepreneur thinks about government IT hiring

A former govtech official turned startup founder said it’s unclear if massive federal layoffs will result in people flooding the IT industry.

, who on staff is going to own up to these AI aberrations?

 in August titled “Ready or Not: Governing AI in a Fragmented Regulatory Landscape,” an IT Brew attendee asked:

Who should ultimately own AI compliance? Is it IT, legal, or another business unit?

Many orgs are likely asking a version of this question as they seek clarity on AI policy and who should lead that effort:

While CIOs and CTOs have often been the leads of IT initiatives, some companies want a 

 for today’s tech deployments. A May 2025 report from AWS, which polled 3,739 senior IT decision-makers in nine countries, found that 60% of organizations (both large and small) have appointed a dedicated AI executive.

A Gallup poll of US employees, conducted in Q2 2025, revealed only 22% of surveyed enterprise AI users said their company has communicated a clear plan or strategy for implementing the technology.

While Guru Sethupathy, founder and CEO of AI-governance platform FairNow, told attendees during IT Brew’s 

 that AI governance is a “shared responsibility.” “Ultimately, you still want someone who’s a decision-maker, because you don’t want to get lost in a kind of paralysis by analysis,” he added.

Sethupathy and other industry pros who spoke with IT Brew agreed on the shared responsibility of AI governance, but had slightly different views on who should be involved and who gets to make the big decisions.

AI governance refers to policies, process, regulations, and ethical guidelines considered as the technology is designed and deployed. The discipline will likely examine an AI tool’s impact on factors such as data privacy, transparency, and fairness.

Sethupathy sees “key stakeholders” like business, IT, compliance, and legal teams involved in the process of responsible AI deployment, but he stressed the importance of having that “ultimate decision-maker” chosen by the company.

“The question then becomes who’s ultimately responsible for calculating the trade-off between value and risk,” he said during the event. “Each company does that in a different way.”

Nathan Olson, senior manager of digital solutions at advisory, tax, and assurance firm Baker Tilly, agrees that AI governance should be a “shared responsibility” and a “collaborative model.” In the midsize orgs that he counsels, Olson sees:

IT pros examining model behavior, data pipelines, and infrastructure

Legal teams overseeing alignment with regulations

Business units defining specific use cases and ethical boundaries

But governance “ownership,” he said, falls to the group, which he recommends should meet regularly to approve or review existing use cases for efficacy, risk, and compliance.

“It’s important to have a clearly defined and maybe an AI governance charter of what responsibilities fall to what teams specifically,” he said.

Rohan Sen, a principal in PwC’s cyber data and tech risk practice focusing on data risk and responsible AI, sees the importance of cross-disciplinary collaboration with business leaders in IT, legal, cybersecurity, and privacy—those who own a particular risk domain in a company.

IT has an especially important AI governance role to play, surfacing various technology choices (like one model provider over another) and communicating their impact, he said.

Ultimately, Sen recommends having a single authoritative role—maybe a chief compliance officer, chief risk officer, or chief privacy officer, he said—to “break ties” and make the ultimate decisions once risk players in a committee provide their input.

“Otherwise, what you have is a whole bunch of different viewpoints, and nobody to be a referee or an emcee to say, ‘Okay, having heard all of these different viewpoints and considerations, what should we actually do?’” Sen concluded.

Photo collage of an AI icon in between two hands pointing at each other contained within abstract shapes.

Who owns AI governance (and is it IT)?

Industry pros recommend who should be accountable for the responsible deployment of AI.

Life is full of trade-offs. A late-night Uber may get you home faster, but for a higher price than walking. A pair of cute heels may win you compliments, but can hurt your feet…and AI coding may speed up development, but can open your software to large security risks.

 from agentic application security platform Apiiro suggests AI coding assistants might speed up developers’ workflow at a hefty security-related cost.

Apiiro researchers examined code from thousands of code repositories produced by developers from Fortune 50 companies. They concluded that AI-assisted developers produced 3-4 times more commits than regular coders, but had fewer push requests, a crucial part of the coding process that enables other team members to review code.

“If the pull request is very large [and] it contains a lot of code, it’s really hard to do a proper review because it overloads the security review that you need to do,” Apiiro Product Manager Itay Nussbaum told IT Brew.

Apiiro researchers also claim that while AI-written code had significantly fewer syntax errors and logic bugs, it often opened the door to much larger issues. 

 paths increased 322% in AI-assisted coding compared to standard-written code. Meanwhile, architectural design flaws jumped 153%.

“In other words, AI is fixing the typos but creating the timebombs,” the report wrote. “That makes reviews and automated scans less effective, and raises the stakes for context-aware analysis at design and code time.”

As of June, Apiiro said AI code produced 10,000 new security findings per month, a ten-fold uptick since December 2024.

Apiiro’s research echoes several concerns around AI-assisted coding as it continues to make waves across the industry. IT Brew has previously reported on the 

Quentin Rhoads-Herrera, VP of security services at Stratascale, told IT Brew that he leverages AI-assisted coding in his personal life and has seen firsthand the risks that come with it.

“I’ve seen pretty much everything I’ve coded as a hobby has vulnerabilities in it because it’s just giving me working code to my exact request, not looking at what the best practices are,” Rhoads-Herrera said.

Nussbaum said AI-assisted developers should make sure they have protective mechanisms in place, such as automating the security review process, to protect themselves from vulnerabilities.

Rhoads-Herrera also advised AI-assisted teams to continue to keep the human in the loop: “The human review of all the code is still very critical.”

Opened ai hand with falling red binary code and scattered red arrows.

AI is fixing coding typos, but creating ‘timebombs’: report

As of June, AI code produced 10,000 new security findings per month, according to research from Apiiro. 

While there’s no doubt agentic AI is one of the hottest trends affecting IT pros, the technology presents serious risks for companies looking to employ the tech and take humans out of the loop as a means to automate workflows or reduce the size of their teams.

Experts point to lack of visibility as a reason humans need to check on and be involved with agentic AI, especially when it is able to make independent decisions and drive a set of outcomes.

Thomas Squeo, the CTO for the Americas at Thoughtworks, called the first generation of agents “relatively simplistic” and said that providers were not typically able to offer them at scale in a production enterprise environment.

The standard right now, Squeo said, is keeping a human in the loop so that an agent isn’t running through an activity on an ongoing basis without human intervention.

If there’s a guardrail strike from the AI, the agent can send a request for a human to take action based on its confidence level of what the model is about to do.

Squeo offered an example of a billing system, where a paper bill comes in and the agent is doing 

 (OCR) analysis on a document—when an image is converted into machine-readable text—and only has 80% confidence—too low for it to automatically send along.

“You might send that along into a queue for customer service…or somebody that’s in client support that goes and looks at that and says, ‘Yes, this agent was correct,’” Squeo said. “That behavior, when the human in the loop says, yes, it’s correct, it might then say, ‘I can increase my confidence on that case going forward.’”

Now, with newer agents and the maturation of 

(MCP), the connection between agents and data sources, agents are able to understand the environment, act on behalf of a user, 

Squeo said that agents should operate within guardrails, and recommended that IT teams use an observability system to report when an agent strikes against the rails.

“In some cases, [the agent] might strike and it might be fine,” Squeo said. “It might be a strike because of the way that the rules for how that agent is operating is causing it to operate against its criteria for being able to be governed.”

Cyber professionals will typically divide what should be secured into layers. Alon Diamant-Cohen, principal consultant for Stratascale’s Hybrid Cloud Security team, pointed to the Open Systems Interconnection model, a seven-layer framework that contains application, network, and infrastructure layers for security to cover, as melding into one when an organization introduces agentic AI.

Diamant-Cohen said that an IT pro must figure out how to secure all of the layers in a tech stack at once. For experts, this can look like establishing governance or rethinking how professionals are thinking through policy constructions.

Within the layers is the network layer, where MCP exists for agentic AI. Diamant-Cohen said the concept is “awesome, because you get all these new capabilities out of your tools when you integrate them. But there’s not a lot of consideration to the fact that you’re adding some kind of permanent infrastructure and you need to secure it.”

“A lot of MCP configurations have some black box elements to them, where you just can’t see what it’s doing,” Diamant-Cohen said.

The “most terrifying” aspect of this process, according to Diamant-Cohen, is the network layer, specifically as it pertains to the connectivity between agents.

“You’re essentially standing up a node with outbound and inbound connectivity to your AI agent,” Diamant-Cohen said. “Which is trained on all your sensitive data that has some black-box elements that you do not have full visibility into, or you can’t fully understand why it made the decisions it did.”

An AI Agent's hand reaching out to press a button labeled "Step 1"

Why your agentic AI still needs a human in the loop

Agentic AI systems are now able to understand an environment, act on behalf of a user, and reason with newer models and a matured Model Context Protocol.

On Wednesdays, we wear pink and on Fridays, we play with AI…if you work at the language-learning company Duolingo, at least.

This past summer, Duolingo employees, known internally as Duos, have spent their Fridays learning 

 to improve their workflows. Natalie Glance, chief engineering officer at the company, told IT Brew that Duolingo has set aside two-hour time blocks for its workforce every week and developed structured learning materials to better improve employees’ understanding of these tools.

“In addition to the Fridays, we also have a weekly or biweekly hour-long engineering AI assembly where people present updates about new tools, or give demos of successes they’ve had, or things that work [and] things that haven’t worked,” Glance said.

The Friday sessions are not Duolingo’s first AI rodeo. In April, the language-learning company 

 an all-hands email penned by CEO Luis von Ahn to LinkedIn that officially announced it would be going “AI first.”

At the time, von Ahn said the company would slowly phase out contractors used for work that AI could perform, only increase headcount if a team was unable to automate more of its work, and consider using AI during performance reviews and the hiring process. Duolingo’s recent rollout of dedicated time for employees to learn AI—known internally as “FrAIdays”—is a way of working toward its “AI-first” status.

“Being AI first means we will need to rethink much of how we work. Making minor tweaks to systems designed for humans won’t get us there. In many cases, we’ll need to start from scratch,” said von Ahn, who then 

 on the company’s AI vision in response to backlash it received, clarifying, “I do not see AI as replacing what our employees do.”

 on the topic, von Ahn explained, “What will probably happen is that one person will be able to accomplish more, rather than having fewer people [employed].”

Glance said the adoption of AI tools at Duolingo has “taken off.” On an average day, 80% of Duolingo’s engineers are using an AI tool, she said.

As more employees continue to experiment with AI tools, Duolingo has taken a measured approach as to how it approves certain tools for internal usage. For instance, Glance said AI tools used to create production-level code must go through a security review at Duolingo, while AI tools used for prototyping new features go through a “lightweight” approval process, with a limited set of use cases when approved.

, Glance noted the company has been “willing to have several different products” it works with.

“For example, Claude Code just burst onto the scene and everybody wanted to be able to use it, so we really fast-tracked the security review for that and the entire approval process and getting the contract signed,” Glance explained. While Duolingo has traditionally secured one-year contracts for AI tools, Glance said she has been in favor of six-month contracts because of how rapidly innovation is occurring in the market.

Harley Sugarman, founder and CEO of the security platform Anagram, told IT Brew that experimentation is key for companies looking to go all in on AI. While some companies may choose to take a “strict” approach to the exploration phase, he believes it is more beneficial to give employees freedom over the tools they can trial and use in their workflows.

“Letting developers experiment with that is really important because if you don’t, you are just going to end up having them sort of do it in the shadows,” Sugarman said.

Since allowing employees to experiment with AI tools, Glance said she has seen interesting use cases throughout Duolingo. She recalled one intern, for example, who was able to use Cursor to finish a project five times faster than if she had completed it on her own.

“That’s pretty remarkable for an intern.”

AI