From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Tom McKay

itbrew.com

Aline Lerner on why job coding tests have gotten so onerous

Interviewing.io founder Aline Lerner on what to expect applying for a job at a top-tier tech firm right now.

A man typing on a laptop in front of a rack of servers.

Legacy technology is still costing businesses big time, Deloitte survey finds

 A Deloitte survey found 82% of respondent companies had missed cost reduction targets; incapable technology infrastructure was the biggest complication.

Eoin Higgins

IT job woes don’t extend to AI sector, studies find

“It’s the tech area du jour,” one expert says.

Two dots and an arrow connected by a curving line denoting IT strategy

IT Strategy

Brianna Monsanto

 when they are with your outdated network infrastructure.

Breakups can also be pretty eye-opening. At least, that was the case for Kenneth Burdine, associate VP and deputy CIO at the Kentucky Community and Technical College System (KCTCS). Last year, KCTCS underwent a massive network transformation to address some of the 

 student and faculty members encountered when on one of the college system’s 16 colleges.

Burdine told IT Brew the college system made the transition to Juniper Networks from an industry-standard networking provider, a move that has invigorated KCTCS users and staffers.

“I’ve been doing this for 30 years. I have a whole new outlook,” Burdine said. “I’m excited.”

 Burdine said uptime is crucial for KCTCS students, who need to complete their coursework at the school’s more than 80 campuses.

Support tickets prior to the college system’s recent overhaul were mainly related to dropped network coverage and slower connection speeds. Burdine said wireless is a “fun beast to tame” because when an issue arises, users will often do a “drive by” ticket request, meaning the request is solved before IT staffers get to it.

“By the time we answer the ticket and we go and investigate, the issue has resolved itself, thus exhausting any kind of troubleshooting methods that we have,” he said.

Addressing faculty members’ problems with KCTCS’s network had a “grapevine effect,” Burdine added, because of how tedious it was to find time to discuss the reported issues.

“By that time…they’re so busy and they have other things to worry about that they forget, or they don’t have a complete understanding of what happened,” Burdine said.

Burdine said KCTCS’s old network infrastructure was about five years old. Shashi Kiran, CMO at 

 provider Nile, said the fast rate of change on the vendor side of the network industry has shortened the lifespan of network investments for organizations.

“Networks used to be looked at as investments for a decade or more,” Kiran said. “Then, it got down to five to seven years. Now, we are seeing faster refreshes happen, particularly with the old type of networks, which are predominantly designed for static environments.”

A network overhaul for an entity like KCTCS is not an easy one given its large footprint of campuses and buildings.

“We had 3,000 units, indoor and outdoor,” Burdine said. “That’s a lot of units over 90-plus locations all across the state of Kentucky.”

However, Burdine said the deployment of the new network infrastructure was a “seamless” and non-disruptive process because the brunt of the installation process involved taking one access point (AP) down and putting the new one up.

“It took longer to climb that ladder to…take the AP down and put it up than for it to [actually] register and start taking on clients,” Burdine said.

“Because of this, we were able to implement a complete overhaul of our wireless to Juniper in less than 90 days, which, wow. I don’t know? I think it’s a world record,” he added.

Once access points were up and running, Burdine said Juniper’s Mist platform, which leverages AI to improve user experience, takes the guesswork out of troubleshooting problems.

“You could go into the issue itself and then Mist would go into whitepapers and describe what the issue is, and 99.9% [of the time] it would say, ‘This is the first action you should take, second action you should take, third action you should take to resolve that issue,’” Burdine said.

 The network upgrade has paid off for KCTCS on many fronts. Burdine said the revamp has “rejuvenated” his IT staffers because they are learning something new.

“They’re happy to have something that’s more proactive than reactive,” he said.

Kristin Russell, CEO of IT solutions provider CBTS, said KCTCS hasn’t logged any single access point-related tickets since January. CBTS has partnered with KCTCS since 2002 and assisted the college system in its transition.

“With fewer manual fixes, they can focus on higher value work for students,” Russell said.

Students have not been vocal about changes to connectivity on campus, which Russell takes as a good sign, as users typically only reach out when they encounter a negative experience.

“We take great pride in [making] sure that we’re 100% up,” Burdine said. “And I know nobody can do 100%, I’ll take 99.99999%. How about that?”

Update: Kenneth Burdine is deputy CIO. A previous version of this article stated that he was deputy CISO.

School building with Wi-Fi symbol above it.

A Kentucky college system’s seemingly seamless network overhaul

“We take great pride in [making] sure that we’re 100% up. And I know nobody can do 100%, I’ll take 99.99999%,” KCTCS Deputy CIO Kenneth Burdine says.

At the beginning of 2025, David Khuat-Duy pulled off the ultimate 

trick. Stepping down from a quarter-century stint as CEO of Ivalua, the spend-management software company he founded in 2000, he ventured off into a new role within the company—not as a strategic advisor as some may expect, but instead as 

For Khuat-Duy, the transition into Ivalua’s inaugural CAIO role made perfect sense. As he told IT Brew, the emergence of ChatGPT signaled a disruption similar or even larger than the one following the rise of the internet. While Khuat-Duy had already begun to spend time focusing on AI technology, he said he ultimately felt it was time to make it the center of his attention.

“Because I was CEO and because I know very well the process, the organization, and all the leaders, I was the best person to help the company embrace that technology at its full extent,” Khuat-Duy said. (In January, Ivalua CRO Franck Lheureux succeeded Khuat-Duy as CEO as the latter transitioned into the AI-focused role.)

Since taking on the CAIO title in January, Khuat-Duy has kept himself busy. While he previously spent time growing his team and managing Ivalua’s operations, now he works more closely with his research and development team to enhance Ivalua’s framework around 

“I really focused the first eight months on building a framework where people can build their own agent,” Khuat-Duy said. “So, each employee of the company can build their own agent based on the data of the company.”

 Prior to taking on the CAIO role, Khuat-Duy—who has a PhD in math—said he was (and still is) a developer at heart. Ivalua has had an AI team for years, but it wasn’t until ChatGPT came out that he began to focus more on it.

“As soon as it was released, I spent almost most of my time learning more about it,” he said.

Khuat-Duy said one does not need to be an AI expert to take on the CAIO role. In fact, he thinks having advanced knowledge on AI could potentially be a hindrance.

“I feel if you’re [a] full expert in AI, it could disserve you because you have such a background of advanced expertise in AI and building [models] that this is what you like,” Khuat-Duy said. “Whereas here, it’s not about building a model. It’s about using the model and [integrating] them, which is a different skill set.”

Ema Roloff, co-founder and chief growth officer of Roloff Consulting, a digital strategy advisory firm, said companies seeking a CAIO are likely to look for candidates with a background in data science or skills related to the AI solution they wish to build. She told IT Brew she hadn’t heard of the CEO to CAIO transition before (neither had Khuat-Duy), but said it was an “odd switch” only because a CEO can also be a “digitally literate leader.”

“You can be a leader of a company who is aware of the technology, understanding the potential and helping set the vision for where you want the company to go using artificial intelligence…without having to pivot and change to have a role that’s specifically pointed at AI,” Roloff said.

R “Ray” Wang, founder, chair, and principal analyst at the technology research and advisory firm Constellation Research, told IT Brew in July that he believes the CAIO position is a “transitional role” that will eventually get absorbed into the CIO or other business technology roles. When asked if he foresees the CAIO role as a temporary position at Ivalua, Khuat-Duy didn’t have a clear answer.

“To be honest. I don’t know what the world will be in five years from now because the disruption is so big,” Khuat-Duy said.

In the next year, Khuat-Duy said he will focus on making sure Ivalua employees and customers are benefitting from agents. He added that learning and being open to experimentation are important to him in his role.

“We work, we learn, we test, we experiment, and that for me [is] the motto I have everyday,” Khuat-Duy said. “That’s how we’ll be successful.”

Headshot of David Khuat-Duy, Chief Artificial Intelligence Officer, contained in an abstract shape.

Why David Khuat-Duy traded in his CEO hat for the CAIO role

Khuat-Duy tells IT Brew that you don’t need to be an AI expert to be a CAIO.

Billy Hurley

When Google’s AI Overviews arrived in May 2024, search engine strategists—the specialists who make a living by getting web pages to the top of people’s query results—took notice.

With the implementation of Overviews, Google’s first page search results, a target destination for anyone creating and optimizing content, suddenly sat below a response generated by Gemini, the company’s AI engine.

“Our initial reaction was, ‘Well, how is it going to work in the future? What kind of query is it going to take in, and how do we adjust to that?’” Tavish Harrison, a freelance SEO strategist, told IT Brew. “And I’m pretty sure every SEO on the planet was trying to adjust then, to figure out what it was doing exactly.”

Sarah McNaughton, founder of content-strategy consultancy McNaughton Digital Media, sees SEO as the “middleman” between the content team and engineering teams. While an SEO strategist might find relevant keywords and phrases to place within a story, much of the practitioner’s work is technical and unseen by a reader.

A site and its content, for example, needs to be indexable and contain the right “schema” or classifying metadata that a crawler can find and process for its output. Google also 

, so an IT pro and an SEO pro may have to coordinate to ensure that apps are functioning properly.

With AI Overviews taking a bite from search results, the SEO strategist role might appear to be in trouble. Following staff cuts of around 21%, Business Insider CEO Barbara Peng 

 that the company would pull back on areas sensitive to search traffic, like its SEO and Google-driven commerce business. The same month, the 

 a decline in news sites’ organic traffic (i.e., the number of visitors who arrive at a site via unpaid search results).

Meanwhile, AI is racking up pageviews. From August 2024 to July 2025, the market of over 10,500 AI tools recorded “nearly 100 billion estimated web visits,” according to a study from 

. The top 10 chatbots, led by ChatGPT, experienced a 123.35% year over year increase in web traffic, adding over 30.9 billion new visits.

But Noam Dorros, a director analyst at Gartner, said today’s SEO strategist should be excited about being in the field. It’s AI that’s allowing today’s SEO experts to play a more active business-leading role, informing strategy and helping people understand the evolutions of the search results, he said.

“It’s the shiny new toy out there,” Dorros told IT Brew. “AI is the elephant in everyone’s room, and they all want to know what to do. How do we measure it? And SEO specialists and people with SEO experience are the ones who can help and answer those questions.”

Today’s SEO strategists are adapting their techniques beyond the earlier paradigm of researching keywords and placing them throughout a web page or article, in the hopes that a search crawler will place their website at the top of a results page. “We are long, long past the days of targeting a single keyword for one article. That’s been outdated practice for a long time,” McNaughton said.

McNaughton lately has advised almost all clients to build FAQ sections for content—a structure that hopefully aligns with a person’s long-winded queries to a chatbot.

“We don’t know for sure, but just based on my own personal usage and other people’s usage, I’d say that it’s a good guess that people are going to be a little more verbose in their searches on [large language models] than they are on Google,” McNaughton said.

With click rates decreasing, Josh Petit, SEO manager for Monster, sees SEO undergoing a radical change in success metrics. These days, he considers search engine strategy a “real-estate game”: a blitz to get citations into AI Overviews, Google’s “People Also Ask” function (which shows related questions), its set of accompanying Image Packs, or whatever arises next.

Impressions—or how many times your site is seen—is more important for his team than click-through rates these days, according to Petit: “It’s not necessarily all about just the clicks.” To give his team the best chance “to take up as much space as possible,” he recommends an article make a question its own header and answer it directly “to make it real easy for AI to pull that answer,” Petit told us.

People are trying to do whatever they can to ensure visibility, according to Dorros.

“The difficulty is, these engines are all black boxes, right? They’re not giving playbooks to anybody to say, ‘This is what exactly you should do to show up,’” he said, adding that the people who have seen changes and algorithm updates are the ones best equipped to translate the new developments to marketing leaders.

For now, SEO strategists are left to rely on their bank of tried-and-true tactics, such as assigning metadata schema or arranging some frequently asked questions, and their own cleverness. When it comes to AI Overviews or whatever capability comes next, strategists like Harrison want to know what a new feature is doing and what powers its decisions.

“Curiosity is the basis that we all work from,” he said. “SEO isn’t a foundational thing in the organization itself, right? Because it is shifting, and people need to know how that’s adjusting. And I think that’s exciting.”

A search bar with colorful digital squares filling it up with AI stars surrounding it

How AI is impacting the SEO strategist role

Three search engine experts share why they’re still excited to be optimizing. 

, who on staff is going to own up to these AI aberrations?

 in August titled “Ready or Not: Governing AI in a Fragmented Regulatory Landscape,” an IT Brew attendee asked:

Who should ultimately own AI compliance? Is it IT, legal, or another business unit?

Many orgs are likely asking a version of this question as they seek clarity on AI policy and who should lead that effort:

While CIOs and CTOs have often been the leads of IT initiatives, some companies want a 

 for today’s tech deployments. A May 2025 report from AWS, which polled 3,739 senior IT decision-makers in nine countries, found that 60% of organizations (both large and small) have appointed a dedicated AI executive.

A Gallup poll of US employees, conducted in Q2 2025, revealed only 22% of surveyed enterprise AI users said their company has communicated a clear plan or strategy for implementing the technology.

While Guru Sethupathy, founder and CEO of AI-governance platform FairNow, told attendees during IT Brew’s 

 that AI governance is a “shared responsibility.” “Ultimately, you still want someone who’s a decision-maker, because you don’t want to get lost in a kind of paralysis by analysis,” he added.

Sethupathy and other industry pros who spoke with IT Brew agreed on the shared responsibility of AI governance, but had slightly different views on who should be involved and who gets to make the big decisions.

AI governance refers to policies, process, regulations, and ethical guidelines considered as the technology is designed and deployed. The discipline will likely examine an AI tool’s impact on factors such as data privacy, transparency, and fairness.

Sethupathy sees “key stakeholders” like business, IT, compliance, and legal teams involved in the process of responsible AI deployment, but he stressed the importance of having that “ultimate decision-maker” chosen by the company.

“The question then becomes who’s ultimately responsible for calculating the trade-off between value and risk,” he said during the event. “Each company does that in a different way.”

Nathan Olson, senior manager of digital solutions at advisory, tax, and assurance firm Baker Tilly, agrees that AI governance should be a “shared responsibility” and a “collaborative model.” In the midsize orgs that he counsels, Olson sees:

IT pros examining model behavior, data pipelines, and infrastructure

Legal teams overseeing alignment with regulations

Business units defining specific use cases and ethical boundaries

But governance “ownership,” he said, falls to the group, which he recommends should meet regularly to approve or review existing use cases for efficacy, risk, and compliance.

“It’s important to have a clearly defined and maybe an AI governance charter of what responsibilities fall to what teams specifically,” he said.

Rohan Sen, a principal in PwC’s cyber data and tech risk practice focusing on data risk and responsible AI, sees the importance of cross-disciplinary collaboration with business leaders in IT, legal, cybersecurity, and privacy—those who own a particular risk domain in a company.

IT has an especially important AI governance role to play, surfacing various technology choices (like one model provider over another) and communicating their impact, he said.

Ultimately, Sen recommends having a single authoritative role—maybe a chief compliance officer, chief risk officer, or chief privacy officer, he said—to “break ties” and make the ultimate decisions once risk players in a committee provide their input.

“Otherwise, what you have is a whole bunch of different viewpoints, and nobody to be a referee or an emcee to say, ‘Okay, having heard all of these different viewpoints and considerations, what should we actually do?’” Sen concluded.

Photo collage of an AI icon in between two hands pointing at each other contained within abstract shapes.

Who owns AI governance (and is it IT)?

Industry pros recommend who should be accountable for the responsible deployment of AI.

Gideon Rasmussen is no stranger to crises, or the crowded conference rooms that accompany them.

Rasmussen, a cybersecurity management consultant at Virtual CISO, has seen chief information security officers and IT pros pulled into discussions with communications professionals and executives following an outage or cyberattack. Inevitably, the talk centers around who needs to be informed and what information needs to be in the company’s memo to the public or to concerned customers.

“It’s a bit chaotic because there’s no preparation for this,” Rasmussen told a crowd during an August 18 session at ISACA and the IIA’s GRC 2025 Conference in New York.

Rasmussen and crisis-comms pro Brian McDonough shared with IT Brew ways that decisionmakers (and IT) can plan ahead for a cyber disaster, such as constructing a holding statement and a starting-five crisis-management team.

According to Identity Theft Resource Center, the first half of 2025 saw 1,732 data compromises—a little over half (54.9%) of 2024’s total of 3,155 incidents.

, and best practices from popular guidelines like the NIST cybersecurity framework call for some form of external communication when there’s a data breach.

Rasmussen, in his presentation, stressed the importance of having a prepared holding statement—a predrafted template for common crisis events—ready to go.

He suggested that a template written in advance with a company’s IT team, senior execs, communications pros, and legal team can buy much-needed time for security experts leading the technical incident response.

One quick template example that Rasmussen shared during his presentation: “At this date and time, we discovered X type of data had been compromised, and we’ll give you more information as it becomes available.”

“You need a week or so to really determine what’s the extent of the access that the threat actor has.,” Rasmussen said to the crowd of IT-governance pros.

McDonough, senior account director at crisis-comms firm Kessler PR Group, has seen his fair share of crowded conference rooms, while helping orgs like law firms, banks, and universities deal with cyber incidents ranging from ransomware to a successful phish for sensitive data.

McDonough advised companies looking for a head start on crisis comms to check their cyber insurance policy, which may offer communications assistance.

Also, McDonough recommended companies form a crisis-management team of five or so decision-makers with the authority to approve statements. Members can include an attorney (someone familiar with industry regulations) and other pros who “know the temperature” for external and internal communications (HR, for example). (“Make sure that their cell phones and emails are readily accessible, because you know this can happen at nine o’clock on a Tuesday night,” he warned.)

As for that first post-crisis communication, McDonough reviewed important factors for the crisis-management team to consider.

Communicate when an attack was discovered. If an attack was caught quickly, emphasize that, McDonough said.

Mention the steps taken to contain an attack, and what remediations will be added in the future, he advised, including ways to address customer’s privacy concerns—for example, dark-web monitoring or free credit-monitoring services.

There are plenty of “landmines” to avoid in this first communication, he added.

Don’t speculate, McDonough warned, because an early, inaccurate announcement of a successful containment could lead to a loss of credibility. He also advises having someone “a step or two below the CEO” provide the initial message: “If a CEO says something that is later proven to be inaccurate or incorrect, there’s no one to escalate above to repair the credibility of the situation.”

Don’t promise hourly updates if you can’t provide them, McDonough said, adding that it’s “perfectly acceptable” for a company to say they don’t have all the information and are working to learn more: “You don’t have to pretend that you know everything up front.”

There’s a way to involve IT in the messaging, too, while keeping them out of that crowded conference room. McDonough often sees IT leaders “bless” a final statement and confirm its accuracy, rather than have them deal with all the editing.

“The main goal is to make sure that your first step is not a misstep,” he said.

An animation of business woman holds a document on a clipboard next to a laptop with a warning sign flashing. Credit: Illustration: Brittany Holloway-Brown, Photos: Adobe Stock

How to handle the first statement in a cybersecurity crisis

 If you’re designing your incident-response playbook, don’t forget the communications plan.

There’s been a noticeable drop in CISOs who feel they are singing from the same song sheet as their corporate boards when it comes to cybersecurity, according to a new report.

A little under two-thirds (64%) of surveyed CISOs in Proofpoint’s 

 said they saw “eye to eye” with their board on cybersecurity matters. The proportion is a noticeable downtick from the 84% of CISOs who felt aligned with their boards on cybersecurity in 2024—a stat that Proofpoint Global Resident CISO Patrick Joyce notes could be an anomaly— and slight uptick from 62% in 2023.

The findings are based on a March survey by research firm Censuswide of 1,600 CISOs from 16 countries.

 What’s behind this downtick in CISOs who felt they were on the same page as their board about cybersecurity? According to the report, it could be a sense of complacency around the CISO role, given their 

“Some CISOs may say, ‘Well, I’m not that special anymore. I’m here all the time. I’m a member of the woodwork, just like the rest of the people that are members of the woodwork,’” Joyce told IT Brew.

Bluefin Payment Systems CISO Brent Johnson said the disconnect could also be a side effect of the growing focus on AI.

“There’s this huge push to get AI into your business plan that I think security is taking a back seat,” Johnson said.

. Joyce said CISOs who feel they aren’t aligned with their boards can highlight the need for good cybersecurity by “speaking in the language that the board understands.”

“Keep them engaged by speaking in the language of business and not speaking in technology,” he added.

According to Swimlane CISO Michael Lyborg, CISOs should focus on telling a narrative as opposed to relying on technical statistics.

“There’s that old saying from the military: KISS, keep it simple, stupid,” Lyborg said. “I always have to tell myself that people don’t care about, necessarily, what you use or how you got there. They care [about] where you were at and where you’re at now.”

Polished hand with suit shaking a battle hardened textured hand

Fewer CISOs feel aligned with their boards on cybersecurity this year

Sixty-four percent of CISOs in Proofpoint’s “Voice of the CISO” report say they see “eye to eye” with their board on cybersecurity. 

Caroline Nihill

Pat Casey, the chief technology officer and EVP of development operations at ServiceNow, wasn’t always a technologist.

He first went to college to be an engineer, but switched his major to biology after becoming disillusioned with engineering and realizing, “I could spend my whole career in the US, and you built like one bridge. It just wasn’t a lot of infrastructure, in my perception, being built.”

Casey later pursued a PhD program for neurophysiology while working at Aldus PageMaker, a desktop publishing company. Aldus, which was later bought by Adobe, put Casey to work in IT. He would install mail onto a computer, reset someone’s password, or help another to figure out why their C drive wasn’t working.

“I remember I woke up one morning, sometime [in] my second year as a graduate student, and I was just in this horrible mood,” Casey said. “Then I realized I had my days wrong, it’s actually one of the days I was going into the office…My mood lifted. I’m suddenly looking forward to the day.”

Shortly after this epiphany, Casey dropped out of the neurophysiology program and took a full-time position at Aldus.

Casey found himself working for Adobe in Seattle. He said that others had told him the dreariness of the Pacific Northwest was going to get to him, but he figured that was just to keep Californians from moving there.

By the second winter, the weather was starting to get to him.

“The weather was so depressing for me, I don’t know a better way to put it,” Casey said. “It got so bad that I would actually get in my car and I would drive out to the top of the Snoqualmie Pass just to get in the sun, like stop at the side of the road.”

A friend of Casey’s got in touch with him because their software company Peregrine Systems in San Diego was hiring in its engineering department. Casey said the weather in San Diego was appealing, and that “I’d love to be in engineering instead of IT.”

Fred Luddy, who was serving as Peregrine’s chief technology officer, interviewed Casey for the position. Luddy would later begin ServiceNow, where Casey now works.

Luddy was inspired to begin ServiceNow after working for Modernfold Doors, where he worked on the order entry system. Luddy worked to automate the process for putting orders in their system and presented it to an employee whose job it was to manually type in delivery addresses.

“For [Luddy], that was a trivial piece of work, for her, that had meaningfully changed her life for the better,” Casey said.

After working at Peregrine for a few years, Casey decided to start his own company writing maintenance management software.

Casey sold the company he started to the Peregrine customer base because he knew them and because it was a reseller group. The company would sell his product, and both he and Peregrine would profit.

“Hopefully, everybody won, including the customers,” Casey said.

He said that for the first six months of working on his own, it was “glorious.” As a “super strong introvert,” he was productive, but also felt himself going into a “small hole of introversion.”

“I realized that, independent of the economics of it, I needed to be in a working environment to have people around me, which was really important—at least it was for me,” Casey said.

“I think I have a really strong need to have other people in my life…For me, being at work, it’s one of the ways I get to meet people.”

Casey joined ServiceNow in 2004, motivated by what Luddy was doing at the company and that Casey would get to work with people again, “as opposed to working with myself from the couch.”

Casey also said he didn’t join the company “because my goal in life is to be part of a really successful, multi-billion dollar software company.” He said that it was important for him to work in an environment with a positive culture, and that “the work we were doing helped a human being.”

Michele Richards, the SVP of impact engineering at ServiceNow and the 

(a group of technical or technical-adjacent employees who aim to help customer experience) project management officer, said that after being at the company for 10 years, Casey has taken on larger, public roles over time.

“Now he’s on stage…and he’s really accepted, as his role has grown, that people do want to see him,” Richards said. “If he’s in the UTG Connect and you’re in a social event, he will really work the room.”

“He has really grown from being a real introvert, hands on keyboard [and] head down, to being this impressive leader.”