From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Billy Hurley

itbrew.com

Outsourcing your data destruction? Check out a service provider’s doors and cameras, says one IT pro.

How to vet your third-party data destroyer

Tom McKay

Government IT spending to increase in 2023

Quashing technical debt could cost an estimated $588.9 billion in 2023.

Governments will beef up their IT spending next year, according to Gartner projections

A recent survey indicates that many data centers are failing to track key environmental data.

Data centers aren’t crunching their own sustainability numbers

Data Management

 “Cost of a Data Breach 2025,” but IBM’s annual study offered some data points showing at least slight cybersecurity improvement among businesses:

The global average cost of a data breach decreased by 9% compared to last year—from $4.88 million in 2024 to $4.44 million this year.

The mean time that organizations took to find and contain a breach fell to 241 days, “reaching a nine-year low and continuing a downward trend that started after a 287-day peak in 2021.”

The number of orgs paying ransomware actors decreased, with 63% of companies opting not to pay, compared to 59% in 2024.

The review, conducted by the Ponemon Institute and analyzed and published by IBM, studied 600 organizations breached between March 2024 and February 2025.

“When I saw that the overall cost of a data breach went down, I was like, ‘Yes, it’s working!” Kevin Albano, global head of threat intelligence at IBM X-Force, told IT Brew, referring to practitioners enacting proactive measures like an 

The report also featured plenty of less-than-rosy news, along with security practices that need some work, including:

US costs have actually risen in 2025, thanks to factors like data breach fines;

One in six incidents this year involved “AI-driven” attacks like GenAI phishing messages and deepfakes; and

Here’s what Albano and the report’s writers say about what’s working and why.

 The costs of a data breach include assessment services, customer notifications, credit monitoring, regulatory fines, and lost business.

A leading factor reducing business compromise costs, according to the report, was “DevSecOps,” or what IBM 

 “an application development practice that automates the integration of security and security practices at every phase of the software development life cycle, from initial design through integration, testing, delivery, and deployment.”

According to Verizon’s annual data breach report, released in April, the exploitation of vulnerabilities initiated 20% of breaches.

Other cost mitigation factors, IBM’s annual study revealed, included 

IT Brew previously reported on a 2024 full of 

“People are beginning to understand that it doesn’t pay to pay the ransom,” Albano said. “Sometimes even if you pay the ransom, there’s no guarantee that you’re going to get that data back.”

The UK plans to prohibit public sector companies 

“We are complete advocates for not making a payment if it’s unnecessary,” Mark Lance, a ransomware negotiator and VP of digital forensics and incident response and threat intelligence at GuidePoint Security, told us this month.

The time to identify and contain a breach continues to decrease steadily. Albano sees “better detections in place” and greater information sharing between organizations as two factors driving shorter incident cycles.

The IBM report said security teams and their tools detected 50% of breaches—an improvement over last year’s total of 42% and 33% in 2023.

“Overall, organizations are beginning to understand that preparedness is the key to saving in the cost of a data breach,” Albano said.

Finding good news in IBM’s ‘cost of a data breach’ report

Ransomware payments, remediation time, and costs are down since last year.

At IT-training school MyComputerCareer, Russ Munisteri, program chair, lead instructor, and former systems administrator, teaches IT and gets learners on a path to achieving certifications. 

 on the latest and greatest tech may not come in handy if your first employment gig has lots of old servers, hardware, and software.

“What happens if somebody gets hired with modern-day certifications, but they’re walking into a legacy network? It happens all the time, because of money, and budgets, and people don’t like change,” Munisteri told us. “IT certifications are great. They get your foot in the door. They really teach you all the foundations that you need out there. But once you get on the job, that’s when you have to start to learn that company’s network.”

Munisteri spoke with us about lessons learned as orgs move from old to new tech, and all the different ways to learn on the job.

These responses have been edited for length and clarity.

Do you have any examples from your career that demonstrate a situation involving legacy hardware and having to address it?

Servers and operating systems get older. So, a very common situation: running maybe a critical business app on an old Windows Server 2008. Over time, that server would start to crash now and then. As time builds, as the databases grow, the hardware cannot keep up with the software…We bought about six to eight months of time by adding some physical RAM, just to keep the server going so it didn’t crash. And then from there, we came up with a nice, detailed budget plan to move from legacy to something more modern.

What strategies speed up that kind of upgrade?

Research. A big part of being in information technology is your ability to troubleshoot and to research. Every company has their problems, right? But when it comes to specific situations, speak to tech support; tech support becomes your best friend. If your company is paying for a solid support contract with Microsoft or whomever, those folks become very close, because they know their stuff, and they’re there to guide you to move to the next level and follow industry best practice.

When cost is a factor in keeping some of this old hardware around, what upgrade strategies are helpful?

Proper planning is huge. Communication is huge. Having your three- to five-year plans is very, very important. You can’t always think about now when it comes to IT. Always think “the future.” Always think “growth.” If you need to have one server today to run a website, think about buying three servers.

What else is important for the IT professional to get right in an upgrade situation?

Try to have a separate testing environment for yourself. You can build that out on your own desktop, making sure you have different versions and specific technologies at hand in your testing environment; you can play around with it, so you can learn it. You never want to learn on any production environment, because that could be a bad day for everybody…Have some of that legacy equipment there. It doesn’t matter whether it’s virtualized or not. Just be familiarized with it, because you never know when that knowledge is going to surface, and you’re gonna have to use it. I can remember I had all different types of virtual machines installed on my desktop: [Windows] Server, 2003, 2008, 2012. I had it all so I knew how to work with them when I had to. A lot of it comes down to just self-learning.

Tech office environment with computers and chairs

An IT instructor shares lessons learned from replacing legacy hardware

An IT pro with a modern-day cert walks into a legacy network.

During a recent IT Brew event dedicated to guiding tech pros through the 

, an attendee had the following question:

Culturally, how do I help my IT team be seen in the company as a driver of innovation and not a barrier to bringing on new tools? We recently had to shut down the use of an AI tool we hadn’t fully evaluated yet because of the large amount of proprietary data we have to keep secure and I’m worried it’s created a culture where employees are using tools anyways without us knowing (arguably more unsafe).

IT Brew guest and Gartner Associate Principal Analyst Olivia Montgomery told attendees that IT teams should soften their communication style and foster a more collaborative spirit, rather than banning new AI outright.

“Maybe instead of just shutting down an app completely, you work with them to integrate it into the ecosystem and be very clear about, ‘Hey, let’s 

 get this into a secure environment [where] you’re happy with the functionality and we’re happy with the security and the usage of it,” Montgomery said.

PwC’s annual CEO survey found that 49% of global chief execs—polled in October and November 2024—expected GenAI to increase profitability over the next year.

We posed the IT Brew reader’s question to Rohan Sen, a partner at PwC and leader on responsible AI use, who discussed a three-part strategy for IT teams to be seen as innovation drivers, not downers:

on behaviors that are “outside the box” of risk tolerance

 for IT teams and tech to present risks to business leaders

We asked Sen for examples of the rules and risks.

Below are his responses, edited for length and clarity.

Let’s say we’re sending some data to a third-party vendor. As an example, a rule of the road might mean that that third-party vendor needs to go through your standard procurement intake and due diligence process and be approved—not just from a “know your customer” concept, but maybe there’s also a degree of security reviews that have been done as part of that, the standard onboarding of that third party, and those approvals are in place. So, the question then becomes: If you’ve done that and it’s been approved, go. But if you’ve not done that, then pause, right? And then it becomes a decision about, “Alright, what are the risks here of not having that approval in place? And are those risks small enough to continue?” That’s a business and IT joint decision.

What kind of trade-offs can be discussed in forums?

In the [attendee] question, there was a hesitance, because the data was sensitive. Well, one approach might be to then de-identify the data, and that might actually reduce risk down to a level that might be acceptable. IT and business should think creatively as to what measures they can take to buy down the risk so that they can continue to drive that innovation.

Can you help me understand the concept of risk stratification, with an example or two?

Let’s say an employee at a company is using something like a Microsoft Copilot to write an email or summarize a document, but they are actually then reviewing that document or reviewing the summary and then incorporating it into some work product—having a human in the loop. Relatively low risk, right? It’s one person. They’re doing it to accelerate their productivity, versus an AI solution that perhaps is looking at large amounts of financial data, and then preparing summaries and narratives that are going out, let’s say, as part of an investor relations packet, or something that’s a little bit more public facing, that’s a little bit more high risk. The cost of getting that wrong right is much, much higher than that productivity example, and so aligning the level of controls and review and requirements based on risk—that’s what I’m talking about in terms of risk stratification. When you start embarking on an AI solution, understand, based on well-defined guidelines, what’s considered low, medium, and high risk.

image of human and robot shaking hands out of computers

Asked and answered: How to limit AI and still be seen as IT innovators

Techs pros from PwC and Capterra weigh in on the risk and communication strategies.

Consider this: You’re looking for a water bottle that exudes your style. Gatorade currently allows you to custom design your water bottle with a prompt of “anything you can imagine.” (“A panda flipping pancakes,” the site suggests.)

What could go wrong—besides that proverbial first GenAI pancake?

At a June 12 meeting in IBM’s Manhattan headquarters, the company’s agentic experts considered the disastrous outcomes in a custom-bottle scenario with no technical safeguards in place.

For one, a large language model (LLM) has to be ready to field offensive prompts and offensive outcomes in such a public application. 

You should filter and test the outputs and inputs to ensure they are customer-appropriate and in line with brand guidelines, according to Manish Goyal, VP and senior partner, global AI, and analytics leader at IBM Consulting. A technology must reject displeasing prompts before they even hit the LLM.

“You want to have guardrails on what I will allow or not allow,” Goyal said.

Before an agentic or generative AI tool goes live, IBM’s team offers workshops based on client needs to help orgs determine priorities and mechanisms to guard against potential negative impacts. (PepsiCo, Gatorade’s parent company, went through such an exercise, Goyal told us. Lily O’Brien, global comms lead for IBM, later shared in an email that IBM worked with Pepsi to establish a “Responsible AI framework” and set of governance policies.)

Goyal and Phaedra Boinodiris, IBM Consulting’s global leader for trustworthy AI, walked IT Brew through the data-governance drills in a theoretical scenario: a hotel wants an AI agent in guests’ rooms to act as a concierge and provide activity suggestions.

First, a consultant guides the client through all the people impacted: a front-desk employee, a child guest, an AI engineer, a restaurant owner, a litigator, to name a few.

They’re then placed into categories of:

Data subjects (a restaurant owner who has their data in the AI system)

Decision subjects (a guest whom the decision is about)

Pedestrians (those indirectly impacted, without a direct role in shaping system decisions)

Decision-makers (people using the AI to support a decision)

Data makers (people who input the information as data into the system)

System builders and influencers (people actively involved in developing and setting direction for systems)

“It’s so critically important to have the groups of people doing these exercises be truly reflective of the diverse communities that you’re serving, but also be multidisciplinary,” Boinodiris said.

Once that’s mapped out, a team dedicated to use cases, like procurement or a business unit, considers “secondary positive effects” (new partnership opportunities with a scuba-diving company) and “tertiary negative effects” (liability issues related to data sharing, or wrong and frustrating outputs).

Following a categorization of risk, the design team reviews agreed-upon company priorities—say, data privacy—and vote on “baseline,” “enhanced,” or “vigilant” guardrails.

A team may decide that “explainability” and “observability” are important aspects for the hotel AI deployment. That could mean basic security logs for observability (baseline) or live dashboards with anomaly detection (vigilant); each has varying costs. Explainability could mean simple explanations for what data was used to train the model (baseline), or it could mean links to evidence as part of its output (vigilant). “Enhanced” practices are the middle option.

“This gives people the language to use, both with the builders and with the buyers, so that they can understand when you use the word ‘fairness,’ or you use the word ‘explainability,’ what it actually means in terms of what needs to be built,” she said.

And every company can determine its important criteria: explainability, observability, or otherwise.

“If I have an AI that’s predicting the movements of ants on an ant farm, data privacy is not applicable,” Boinodiris said.

Then, the “grand finale,” according to Boinodiris, involves presenting an org’s AI council the business use case, the unintended effects or risks, and the approach for mitigating them.

A company’s requirements may change as the unexpected occurs. 

 recently shared how orgs are not prepared for “ethical nightmares” related to disasters like IP violations, discriminatory outputs, and privacy exposures. What could go wrong? In Gatorade terms: 

“It is always the right organizational culture that is required to curate AI in a responsible way, one that you know approaches this with humility and a recognition that this has to have constant reflection,” Boinodiris said.

Want an agent? IBM guides clients through AI guardrails

What should a hotel ask before it deploys a digital concierge? We went through the exercise. 

So, you woke up and your favorite SaaS tool now has an AI capability you didn’t ask for.

An attendee at our recent IT Brew virtual event asked how to track the legacy IT that suddenly gets AI-ified: “Should we be evaluating these tools differently?”

We posed the question to IT industry pros, including Eoin ​​Wickens, director of threat intelligence at HiddenLayer, and Peter Eichelberger, director of IT at Altamont Capital Partners, who spoke with us during the 

Below we pulled insightful bits from a body of data to answer the query—you know, like a chatbot.

Matt Radolec, VP, incident response and cloud operations, Varonis:

 I don’t think of the AI threat much differently than the data sovereignty or the data security threat that’s always looming. I equate this back to when people started using Box and Dropbox and other types of file-sharing services; it created privacy concerns around those cloud providers having access to your data, and whether or not you had the corporate versions (the licensed and paid-for versions) or if you were using private ones…This same problem exists with all of your existing SaaS applications.

Jim Packer, practice lead, data security, data privacy and AI governance, GuidePoint Security: 

You have to understand exactly what data is flowing to the AI components, where it’s processed, internally or externally, and how it’s stored or transmitted to any kind of third-party AI providers.

Joshua McKenty, co-founder and CEO, Polyguard.ai: 

I think the safest way to think of this is a model that’s trained on your data 

. They’re called embeddings for a reason…You would want to know that the models that you are being provided access to are only being provided to you, or that you know that there is some sandbox around the way that data is being ingested and consumed.

Eoin Wickens, director of threat intelligence, HiddenLayer:

 Has there been security audits of their AI-operations pipeline? Is that data secure in transit? Is it secure in rest? Is the AI vulnerable to prompt injection? Is it sharing context between users? Is there a potential for data leakage thereof? These would maybe be some of the questions I would begin to start asking, because I think they’re important for you but also for the vendor to ask themselves.

You have to evaluate whether any of the legacy vendors are disclosing what AI models they’re using and whether they’re proprietary or third-party, like an OpenAI or Anthropic for example, and then what data-governance controls exist around the AI processing layer at the vendor level. So, this isn’t even at your level. You need to know what the vendor is doing first and foremost before you decide to go into business with that vendor and use that vendor’s technology. And then at your level, you need to then understand your data and how it’s going to be used within that vendor’s environment.

Scott Laliberte, managing director, CISO advisory, Protiviti: 

The challenge is: How do you find and root out potential AI that’s being used within the organization? I think we’re still in the early stages of that, but there are some solutions that are out there and starting to evolve. A 

, or cloud access security broker, can be used. Some CASBs have functionality to look for AI that may be interacting with users within the organization. For instance, Microsoft has its AI threat protection that’s built into their Defender for cloud apps, not only to see users interacting with potential AI SaaS, but also what they’re putting into the prompts.

Peter Eichelberger, director of IT, Altamont Capital Partners

: Being aware of the tech stack that you’re working in and partnering with your vendors is really what I would look to do, making sure that you’re aware of things that are coming down the pike. Not only that, but also knowing how to deactivate those things that may come up fairly quickly, so that you can take those opportunities for your users to go astray off the table.

Robotic hand shifting a mouse around the canvas in a circular motion

How to keep track of legacy IT that goes AI

Make sure you know where the off switch is, one IT pro says.

On May 7, a Toronto school board and the North Carolina Department of Public Instruction announced that threat actors had recently contacted and attempted to extort school district employees. The messages, which 

 cryptocurrency payment in exchange for not releasing personal data, arrived months after a compromise of a popular K–12 software service called PowerSchool, which was used by the two organizations and millions of students.

“PowerSchool is aware that a threat actor has reached out to multiple school district customers in an attempt to extort them using data from the previously reported December 2024 incident. We do not believe this is a new incident, as samples of data match the data previously stolen in December,” 

The ongoing disruption demonstrates a pair of disturbing trends: steady attacks on the education sector, and an increase in third-party compromises.

According to a Center for Internet Security’s study between July 2023 and December 2024, 82% of surveyed K–12 organizations experienced “cyber threat impacts,” ranging from temporary shutdowns to limited access to files.

, Comparitech found that the backpack of attacks is getting heavier: US K–12 school districts, colleges, and universities had experienced 3,713 data breaches since 2005, affecting more than 37.6 million records.

Education data breaches in 2023, Comparitech researchers found, impacted almost 4.3 million records—“a vast increase” on 2021’s and 2022’s figures, which were around 2.6 million.

Verizon’s latest Data Breach Investigations report found that the percentage of breaches involving a third party doubled compared to last year, from 15% to 30%.

PowerSchool provides cloud-based educational tools, like personalized learning and enrollment assistance, to “ 60+ million students,” its company site says.

On December 28, 2024, PowerSchool became aware of “unauthorized exfiltration of personal information from certain PowerSchool Student Information System (SIS) environments,” a March 2025 site bulletin shared. That info, according to the company, related to “current and former students and educators” and possibly included details like contact info, Social Security numbers, and “limited medical alert information.”

“The record that you can obtain from a school is for a student that has a pristine credit history. So, these records are highly monetizable, because they can be abused for quite a long time before somebody actually finds out,” Mike Hamilton, field CISO at Lumifi Cyber and former CISO for the City of Seattle, told us.

, began with “compromised support credentials.”

PowerSchool also admitted in a statement that it paid a ransom following the December incident. “We thought it was the best option for preventing the data from being made public, and we felt it was our duty to take that action. As is always the case with these situations, there was a risk that the bad actors would not delete the data they stole, despite assurances and evidence that were provided to us,” the company wrote on its site in May.

PowerSchool did not respond to IT Brew’s request for comment.

. Pros like Hamilton say paying ransoms incentivizes the adversary and may just allow a depressing cycle of cyber incidents to continue.

“When you pay that ransom, you’re going to try and put everything back together, but that doesn’t mean that you didn’t leave the same vulnerability in place that allowed them that initial access so you may get reattacked,” Hamilton said.

Mouse arrows pointing towards a backpack inside a bullseye target. 

Data extortionists hit school districts, as education remains enticing target

Cybercriminals have contacted school districts in Toronto and North Carolina, months after a compromise of popular education software PowerSchool.

Decades before Rob Hughes became CISO at RSA Security, he led tech-support at a small marketing-services software company—and got an early crash course in incident response.

“Someone came in and grabbed a bunch of laptops and just ran out of the building,” Hughes said.

These days, employees are likely the ones taking their laptops out of the building, if they even come into the office at all. An especially remote-friendly workforce today means work devices are carried to conferences, airports, hotels, cars, and coffee shops—and sometimes left behind (or taken).

We spoke with IT pros, including Hughes, about what to do when an employee loses a laptop to ensure data is protected and services remain running.

 If the asset has been abducted, Hughes and Tom Gould, senior architect at consultancy West Monroe, recommend early actions that can be initiated from an enterprise device management platform like Microsoft Intune or a cybersecurity console of choice:

Check the security profile for defenses, such as encryption and multi-factor authentication

Remotely wipe a device of corporate data—perhaps email, chat exchanges, and videoconferencing conversations

 tools offer similar remote-action capabilities for phones—as long as employees keep IT in the loop about any new

“From the mobile phone perspective, the biggest concern is actually [it] getting reported that it was lost or stolen,” Gould said.

With Intune, Gould and his team have implemented mechanisms that block access from a Windows device or phone that hasn’t been online for a predetermined time frame—say, 30 days.

Verizon’s Data Breach Investigations Report, released 

, found that a small portion—149 of the 12,195 breaches studied between Nov. 1, 2023 and Oct. 31, 2024—involved lost or stolen assets.

Lost assets and their involvement in breaches has been trending downward year to year, according to the DBIR, hopefully due to controls rendering data inaccessible when an item disappears. “Either you got the memo that encryption is a good thing or you did not,” the DBIR said.

“People are working from all over the place, and I can’t honestly say how much insight employers have on where their employers are working. So, the odds and chances of someone leaving a device at a random location are much greater,” Gould said.

 For lost devices, many third-party cybersecurity tools, including Microsoft’s Entra ID or Defender, can reveal the last time and location of a user’s device login, Gould told us.

Hughes, similarly, recommends reviewing logs from identity-management tools to spot known attempted login locations.

For signs of a more targeted attack, Hughes advises IT pros to consider the 

 of the employee. “Were they someone that was setting up the booth at a conference, or were they a high-profile target, like the CEO?” he suggested asking.

Hughes also recommends an IT pro review other valuable items that might be stored in a bag with a laptop, like ID badges, USB drives, and security tokens.

The missing laptop problem is an easier one to address, Hughes told us, since the days where threat actors would scoop up laptops like they were running through the aisles in 

. A major improvement, he said, has been that mechanisms like passcodes and encryption are standard.

“I don’t really have a big worry about someone losing a laptop. It’s fairly routine, because we have good protections in place,” Hughes said.