From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Tom McKay

itbrew.com

Aline Lerner on why job coding tests have gotten so onerous

Interviewing.io founder Aline Lerner on what to expect applying for a job at a top-tier tech firm right now.

A man typing on a laptop in front of a rack of servers.

Legacy technology is still costing businesses big time, Deloitte survey finds

 A Deloitte survey found 82% of respondent companies had missed cost reduction targets; incapable technology infrastructure was the biggest complication.

Eoin Higgins

IT job woes don’t extend to AI sector, studies find

“It’s the tech area du jour,” one expert says.

Two dots and an arrow connected by a curving line denoting IT strategy

IT Strategy

Billy Hurley

During a recent IT Brew event dedicated to guiding tech pros through the 

, an attendee had the following question:

Culturally, how do I help my IT team be seen in the company as a driver of innovation and not a barrier to bringing on new tools? We recently had to shut down the use of an AI tool we hadn’t fully evaluated yet because of the large amount of proprietary data we have to keep secure and I’m worried it’s created a culture where employees are using tools anyways without us knowing (arguably more unsafe).

IT Brew guest and Gartner Associate Principal Analyst Olivia Montgomery told attendees that IT teams should soften their communication style and foster a more collaborative spirit, rather than banning new AI outright.

“Maybe instead of just shutting down an app completely, you work with them to integrate it into the ecosystem and be very clear about, ‘Hey, let’s 

 get this into a secure environment [where] you’re happy with the functionality and we’re happy with the security and the usage of it,” Montgomery said.

PwC’s annual CEO survey found that 49% of global chief execs—polled in October and November 2024—expected GenAI to increase profitability over the next year.

We posed the IT Brew reader’s question to Rohan Sen, a partner at PwC and leader on responsible AI use, who discussed a three-part strategy for IT teams to be seen as innovation drivers, not downers:

on behaviors that are “outside the box” of risk tolerance

 for IT teams and tech to present risks to business leaders

We asked Sen for examples of the rules and risks.

Below are his responses, edited for length and clarity.

Let’s say we’re sending some data to a third-party vendor. As an example, a rule of the road might mean that that third-party vendor needs to go through your standard procurement intake and due diligence process and be approved—not just from a “know your customer” concept, but maybe there’s also a degree of security reviews that have been done as part of that, the standard onboarding of that third party, and those approvals are in place. So, the question then becomes: If you’ve done that and it’s been approved, go. But if you’ve not done that, then pause, right? And then it becomes a decision about, “Alright, what are the risks here of not having that approval in place? And are those risks small enough to continue?” That’s a business and IT joint decision.

What kind of trade-offs can be discussed in forums?

In the [attendee] question, there was a hesitance, because the data was sensitive. Well, one approach might be to then de-identify the data, and that might actually reduce risk down to a level that might be acceptable. IT and business should think creatively as to what measures they can take to buy down the risk so that they can continue to drive that innovation.

Can you help me understand the concept of risk stratification, with an example or two?

Let’s say an employee at a company is using something like a Microsoft Copilot to write an email or summarize a document, but they are actually then reviewing that document or reviewing the summary and then incorporating it into some work product—having a human in the loop. Relatively low risk, right? It’s one person. They’re doing it to accelerate their productivity, versus an AI solution that perhaps is looking at large amounts of financial data, and then preparing summaries and narratives that are going out, let’s say, as part of an investor relations packet, or something that’s a little bit more public facing, that’s a little bit more high risk. The cost of getting that wrong right is much, much higher than that productivity example, and so aligning the level of controls and review and requirements based on risk—that’s what I’m talking about in terms of risk stratification. When you start embarking on an AI solution, understand, based on well-defined guidelines, what’s considered low, medium, and high risk.

image of human and robot shaking hands out of computers

Asked and answered: How to limit AI and still be seen as IT innovators

Techs pros from PwC and Capterra weigh in on the risk and communication strategies.

ITBR-Quantum computing audio embed

Not to ruin the party like it’s 1999, but there’s a looming Y2K-like technology threat that IT pros need to prepare for before it’s too late: quantum computing.

The promise of quantum computing and its problem-solving prowess also poses a glaring threat to old encryption methods like the 

With sensitive data potentially unlocked to adversaries, tech pros who spoke with IT Brew advised practitioners to reopen the Y2K playbook

and apply familiar preventative steps from that memorable turn of the century: take inventory, apply updates, and test. Quantum preparations, security specialists told IT Brew, include working through a checklist of tool inventory, vendor conversation, and a changeout from old encryption to new.

Instead of using bits, quantum computers deploy particle-manipulating qubits to quickly store and process data on refrigerated hardware running at temperatures approaching absolute zero. Some possibilities for the high-speed calculators include 

In 1994, computer scientist Peter Schor developed an algorithm that factored large numbers quickly. The demonstration revealed risk to the encryption of the time, given that the protection mechanism often relied on multiplying large prime numbers.

In 2001, a quantum computer developed by IBM and Stanford University 

 and factored the number 15 on a 7-qubit processor. Since the demonstration, companies like D-Wave, 

As the computing advances, security pros fear that quantum tech can break the encryption guarding enterprise data.

Adversaries already have access to the technology needed to employ “harvest now, decrypt later” attacks, according to a 2024 Global Risk Institute report, “to intercept, copy, and archive encrypted communications for eventual decryption with a quantum computer.”

On August 13, in response to the quantum threat, the National Institute of Standards and Technology announced 

 for tech vendors and practitioners to start using.

Preparation for a quantum crypto-breaker has led many IT professionals to assess regulatory implications, update encryption standards, and collaborate with hardware and software vendors. Many, however, aren’t ready for the final exam.

A survey from international professional association ISACA found that 40% of respondents are not aware of their company’s plans, and 41% say they do not plan to address quantum computing at present.

ISACA released a quantum-preparedness checklist, including:

Checklist

Part of the readiness assessment can be simply seeing what breaks when a new encryption standard gets added.

 in its Chrome browser by default for the online-privacy protocol known as TLS 1.3, for example. A system admin can “use a browser with the new algorithms enabled…and see if they can still connect to old firewall interfaces,” Johannes Ullrich, dean of research for the SANS Technology Institute, 

A recent survey, commissioned by cybersecurity platform provider DigiCert and conducted by Propeller Insights, found that 69% of “cyber leaders” expect quantum threats to break encryption in 5 years, but only 5% have quantum-safe encryption in place. (Respondents included 1,042 senior and C-level cybersecurity managers in the US, UK, and Australia, according to the company.)

Pull Quote

Quantum prep includes work for the individual IT pro, like updating encryption for data at rest, or provisioning a new certificate for, say, a smart TV that has to authenticate to a network. Other updates require conversations with a vendor.

In addition to ISACA’s recs, Mike Nelson, global VP of digital trust at DigiCert, also advises clients to talk with software vendor partners to understand their timelines for supporting post-quantum cryptography.

“They should be able to communicate with you about their plans for that so that you know when they will be introducing it, so that you can have that coordinated approach,” Nelson told us.

Deloitte’s Bill Briggs told us in January 2025 that the prep scenario had a Y2K—or “

”—feel. The year 2000 fortunately began 

Over one-third (34%) of the quantum-computing researchers surveyed by the Global Risk Institute in 2024 estimated that a quantum computer could break a 48-bit RSA encryption within 10 years. There is a quantum countdown; it’s just hard to know when it’s “Q o’clock” exactly.

Nelson sees a more disordered, “messy” situation than Y2K as IT pros get ready for a test with no clear date. Some will ace the exam, he said, and some will try to migrate fast when they absolutely have to.

“There’s going to be things that are going to break, systems that are going to go down, and there will be outages,” he said.

An illustration features a golden, unlocked padlock at the center of a blue atom model with orbiting electrons, all set against a solid light purple background.

How to prepare for when quantum computers break encryption

Find your encrypted data, and see if your SaaS vendors have a clear plan.

Caroline Nihill

If US-based Googlers want to say goodbye to their “innies,” the company is offering buyouts to more teams.

Google spokesperson Courtenay Mencini told IT Brew that the company teams are offering the buyout program with severance for employees based in the US, “who many want to leave the company, whether for professional or personal reasons.”

“Earlier this year, some of our teams introduced a voluntary exit program with severance for US-based Googlers, and several more are now offering the program to support our important work ahead,” Mencini wrote.

The statement continued: “US-based employees on teams offering the voluntary program are able to apply regardless of role or level.”

Those on Google’s knowledge and information (K&I), central engineering, marketing, research and communication teams are able to part ways with the company. This follows earlier buyout announcements that affected Google’s 

Buyouts offered to the platforms and devices team were offered as a result of the large operating systems and hardware team’s merger last year, 

, and given as an option to employees that might not have been aligned with Google’s mission.

Mencini did not elaborate on the “work ahead” or respond directly to a question regarding what prompted these buyouts.

 reported that Google is offering a minimum of 14 weeks’ pay with an enrollment deadline of July 1 to employees in some orgs.

, mandating office returns to remote workers who live within 50 miles of an office to begin a hybrid work schedule and bring employees together in-person, which the company confirmed.

The outlet also shared a memo written by Google executive Nick Fox, who leads the K&I team, concerning the buyouts, which reads: “I really (really!) hope you don’t take this! We have ambitious plans and tons to get done…On the other hand, this [voluntary exit program] offers a supportive exit path for those of you who don’t feel aligned with our strategy, don’t feel energized by your work, or are having difficulty meeting the expectations of your role.”

Google announces expansion to company buyout for US employees

Google says the buyout program is now stretching to central engineering, knowledge and information, and research teams, among others. 

Consider this: You’re looking for a water bottle that exudes your style. Gatorade currently allows you to custom design your water bottle with a prompt of “anything you can imagine.” (“A panda flipping pancakes,” the site suggests.)

What could go wrong—besides that proverbial first GenAI pancake?

At a June 12 meeting in IBM’s Manhattan headquarters, the company’s agentic experts considered the disastrous outcomes in a custom-bottle scenario with no technical safeguards in place.

For one, a large language model (LLM) has to be ready to field offensive prompts and offensive outcomes in such a public application. 

You should filter and test the outputs and inputs to ensure they are customer-appropriate and in line with brand guidelines, according to Manish Goyal, VP and senior partner, global AI, and analytics leader at IBM Consulting. A technology must reject displeasing prompts before they even hit the LLM.

“You want to have guardrails on what I will allow or not allow,” Goyal said.

Before an agentic or generative AI tool goes live, IBM’s team offers workshops based on client needs to help orgs determine priorities and mechanisms to guard against potential negative impacts. (PepsiCo, Gatorade’s parent company, went through such an exercise, Goyal told us. Lily O’Brien, global comms lead for IBM, later shared in an email that IBM worked with Pepsi to establish a “Responsible AI framework” and set of governance policies.)

Goyal and Phaedra Boinodiris, IBM Consulting’s global leader for trustworthy AI, walked IT Brew through the data-governance drills in a theoretical scenario: a hotel wants an AI agent in guests’ rooms to act as a concierge and provide activity suggestions.

First, a consultant guides the client through all the people impacted: a front-desk employee, a child guest, an AI engineer, a restaurant owner, a litigator, to name a few.

They’re then placed into categories of:

Data subjects (a restaurant owner who has their data in the AI system)

Decision subjects (a guest whom the decision is about)

Pedestrians (those indirectly impacted, without a direct role in shaping system decisions)

Decision-makers (people using the AI to support a decision)

Data makers (people who input the information as data into the system)

System builders and influencers (people actively involved in developing and setting direction for systems)

“It’s so critically important to have the groups of people doing these exercises be truly reflective of the diverse communities that you’re serving, but also be multidisciplinary,” Boinodiris said.

Once that’s mapped out, a team dedicated to use cases, like procurement or a business unit, considers “secondary positive effects” (new partnership opportunities with a scuba-diving company) and “tertiary negative effects” (liability issues related to data sharing, or wrong and frustrating outputs).

Following a categorization of risk, the design team reviews agreed-upon company priorities—say, data privacy—and vote on “baseline,” “enhanced,” or “vigilant” guardrails.

A team may decide that “explainability” and “observability” are important aspects for the hotel AI deployment. That could mean basic security logs for observability (baseline) or live dashboards with anomaly detection (vigilant); each has varying costs. Explainability could mean simple explanations for what data was used to train the model (baseline), or it could mean links to evidence as part of its output (vigilant). “Enhanced” practices are the middle option.

“This gives people the language to use, both with the builders and with the buyers, so that they can understand when you use the word ‘fairness,’ or you use the word ‘explainability,’ what it actually means in terms of what needs to be built,” she said.

And every company can determine its important criteria: explainability, observability, or otherwise.

“If I have an AI that’s predicting the movements of ants on an ant farm, data privacy is not applicable,” Boinodiris said.

Then, the “grand finale,” according to Boinodiris, involves presenting an org’s AI council the business use case, the unintended effects or risks, and the approach for mitigating them.

A company’s requirements may change as the unexpected occurs. 

 recently shared how orgs are not prepared for “ethical nightmares” related to disasters like IP violations, discriminatory outputs, and privacy exposures. What could go wrong? In Gatorade terms: 

“It is always the right organizational culture that is required to curate AI in a responsible way, one that you know approaches this with humility and a recognition that this has to have constant reflection,” Boinodiris said.

Want an agent? IBM guides clients through AI guardrails

What should a hotel ask before it deploys a digital concierge? We went through the exercise. 

Brianna Monsanto

There’s nothing like the smell of chicken wonton tacos with a hint of modern technology to go with it.

Applebee’s, a Dine Brands Global franchise, is spicing up its point of sale (POS) systems as part of a larger technology transformation occurring at the food and beverage company.

IT Brew caught up with Dine Brands CIO Justin Skelton to learn more about what the company has been cooking up on the back end of the popular restaurant chain. Skelton, whose favorite Applebee’s dish is the riblet platter, told IT Brew that the franchise was due for an upgrade from its 

, given that its current POS system has been in production for about 20 years. He described the tablets used by servers to take orders as old and clunky.

“It’s sort of like using an old Atari system versus using a PS5,” said Skelton, who joined Dine Brands in 2019 as VP of IT infrastructure and operations.

For those of us whose restaurant knowledge comes solely from 

, Skelton said a good POS system can elevate the service a restaurant is able to provide to a customer.

“A lot of times when our guests come in, particularly during the lunch day part...they’re very busy. They need to come in, they need to leave,” Skelton said. “So, the fact that we can improve our service level and get our guests on their way and improve that guest experience is something that’s significant.”

During his search for a next-gen POS system, Skelton outlined the need for a system with several qualities. For one, it needed to be able to accommodate the rate at which Applebee’s changed its menu, which happens any time it has a new menu item, promotion, or 

“The platform needs to be flexible enough to be able to accommodate that change at scale,” Skelton said. “So, an enterprise capability was critically important for us.”

The new POS system also needed to be modern, cloud-based, and compliant with the franchise’s security and governance requirements, Skelton added.

After a “fairly lengthy journey,” Skelton said the restaurant chain—which has more than 1,600 locations globally—ultimately selected Toast as its new vendor. With the new POS system, restaurants in the franchise would be able to send orders directly to their kitchens through their kitchen display systems (KDS) and accept payments directly on tablets.

“The fact that you can actually take payment right there on that device is really transformational for our Applebee’s system,” Skelton said.

IHOP, Applebee’s sister brand, went through a similar 

 last year when it upgraded its legacy POS system to Tray, a cloud-native platform. There are more than 1,800 IHOP locations worldwide.

“Before the Tray rollout, if you walked into an IHOP, largely the servers would actually take your order on a paper pad,” he said, adding that the pancake house restaurant chain also installed new KDS technology into stores to help bolster communication between servers and cooks.

Skelton, who prefers IHOP’s classic french toast over an order of pancakes, said Dine Brands learned several lessons from IHOP’s migration process that will be leveraged in Applebee’s 

, including the importance of change management. He said the company has made sure to maintain frequent communications with Applebee’s employees about the rollout of the pending POS system and what they can expect down the line at their stores.

“You’ve got change management that goes from being able to write down the order to actually hitting the buttons on a screen on a tablet,” Skelton said. “It may seem little. These changes may not seem that dramatic, but they are change management things you have to consider.”

Applebee’s is currently piloting Toast in select stores. Skelton said the chain intends to roll out the new-gen POS system “in earnest” next year. He added that a similar transformation is in the works for Fuzzy’s Taco Shop, another franchise in Dine Brand’s portfolio.

Skelton advised companies looking to undergo a 

 to understand who their customers are and to make sure new technology meets functional requirements, end user demands, and non-functional requirements.

“Those are things like system availability. It being cloud-based,” Skelton said. “The things [that] aren’t visible easily to…the guest.”

He added that companies should be willing to face challenges during the process.

“Along the way, if you don’t get it right, that’s okay,” Skelton said. “You got to be willing to fail.”

An Applebee’s Restaurant near Times Square in New York City, USA.

How Dine Brands is cooking up a legacy system overhaul at Applebee’s

The company concluded a two-year migration to a new cloud POS system at IHOP last year.

Tech is more than an industry; it’s a national security prerogative. So, why is the sector’s federal procurement system—how the government works with outside sources to acquire goods and services—stuck in the past?

That’s a question Steven Aberle, CEO and founder of Rohirrim, has been asking himself lately. Rohirrim is a procurement and request for proposal (RFP) solutions AI company and Aberle a former government contractor.

His RohanProcure product was created after government officials reached out to bring the commercial side of automation to the federal side. It’s all in service of faster procurement, Aberle told IT Brew, which he believes is “a national security imperative.”

“Procurement speed is not an administrative convenience anymore,” Aberle said. “It needs to be a core element of deterrence.”

Acquisition is important because you don’t want lag time when it comes to procuring technology that can give an advantage against an adversary. Every month spent in bureaucratic back and forth is a month where someone else is spinning up a new method of attack and infiltration, he said; the chance you lose the battle before it begins is too high.

Aberle broke down the timescale: “near-peer adversaries are starting to move a front line system from concept to field in about 18 to 36 months—our major programs still average eight to 11 years.” Put in real terms, that could mean that by the time the procured tech makes its way to those who need it, adversaries could be using software and hardware a few generations ahead of the US.

Introducing AI to the process could streamline and automate many of the repetitive tasks involved. Aberle is certainly not the only person to make the case for integrating the technology into procurement; in April, Oracle Executive Director Sarjoo Shah 

 that AI’s potential in the procurement process includes “analyzing historical vendor performance data, predicting the reliability and risk, maybe even conducting sophisticated market research and benchmarking.”

Federal tech contracting is an ever-changing space. Industry expectation is that the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) requirements mean that contractors will have to adhere to the guidelines for 2025 and beyond. Deltek Senior Manager of Cloud Solutions Michael Greenman told IT Brew earlier this month that the requirements 

, meaning that contractors are going to have to adapt.

“CMMC is here to stay,” Greenman said. “You need to be doing this if you’re a defense contractor, if you serve the defense industrial base, whether as an MSP, an MSSP, or a cloud service provider like we are here at Deltek.”

That said, the interest from the federal government in using AI in procurement shows that things are open to change for the ease of applicants. The technology still requires human oversight, but it offers a way not only to get the contractors moving more quickly but also to close the procurement gap with adversaries.

“The key to that transformation is technology—and we believe a large part of that technology is transformers and generative AI—and bringing that into the acquisition,” Aberle said.

“Bringing generative AI into procurement and acquisition must be done so carefully in highly regulated environments where the government is constantly worried about risk and they’re constantly worried about protests and risk for very good reasons.”

Adversaries won’t wait—so neither should a federal procurement process, expert says

“Bringing generative AI into procurement and acquisition must be done so carefully,” Rohirrim CEO tells IT Brew.

New SVP of Product Ecosystems and Partners at Databricks Stephen Orban said that he admires how technical the company is and the vision it has for democratizing data and artificial intelligence for all.

“Generative AI over the last couple of years is not just a CIO-level concern, that’s a CEO- and boardroom-level concern,” Orban told IT Brew. “Every company I’ve talked to in the last two years is trying to figure out what AI means for their business, and many of them are turning to Databricks to help them break down those silos and use the analytics and AI on top of data that’s unified across their teams.”

That’s part of the reason he joined the early-stage data intelligence platform after time at Google Cloud and Amazon Web Services. During his time at AWS, Orban launched AWS Data Exchange, which offers data from hundreds of providers.

He sat down with IT Brew to share why he made the decision to join Databricks, and what he’d like to do now.

The conversation has been edited for length and clarity.

You worked at AWS and Google Cloud before coming to Databricks. What made you decide to join the team?

I’m in admiration of both how technical Databricks is and how deeply technical all the way up to the top—the founders are still very much here running the company and I admire the vision that they have to democratize data and AI for all.

It’s very technical, and that was very exciting to me, just to get to something a little bit more early. AWS and Google are also very technical, but I wouldn’t say that they're in the early stage anymore. They’re both very mature businesses.

So, that was one, and then just the high growth. Customers seem to love Databricks and [its a] high-growth environment.

Lastly, I’m a big believer in writing down and living through cultural principles. As I got to learn from and work with Databricks a lot, and I got to learn about the culture principles here, they really resonated with me. The combination of customer obsession, bias for action, first principles, thinking all of that is really core to how I operate. The confluence of all those things are really exciting for me.

Something on a lot of people’s minds in both the public and private sector is the importance of breaking down data silos. Can we talk about how, in your position, you want to prioritize that piece of things? How it could potentially make for a streamlined process for IT professionals?

Step one is to get the data in. So, connect, whether it be with a partner ecosystem or with various capabilities that we have, and then we have partnerships with all those SaaS companies that we have to connect to, like a Salesforce to help get that data in. So, that’s one way we’re working to break down the data silos.

The second is, how does that get governed? Once your data is all in one place and you want to start to give all your employees and your business analysts different capabilities that they can query across it, they still want to have permissions and governance on top of all that data. It’s not just because we have all of our data in one place. They want permissions and governance across that so you only get to see the things that you’re entitled to see.

Another way to break down those silos is all the business intelligence capabilities we’re offering inside our platform. Right now, we have notebooks that data scientists can use natively in Databricks to build their reports and analysis. But then again, we also have a lot of partnerships, and we have some business intelligence capabilities ourselves.

My aspiration is to make sure that we have any data set from any third party that a customer would want when they’re using Databricks.

I know you’re planning on increasing access to more third-party datasets at Databricks, and we know that cybersecurity is usually the utmost priority. How does cybersecurity fit into this goal, and what would it take to accomplish this?

Cybersecurity is a super interesting space. I’m actually pretty interested in going a lot deeper and seeing if there are ways for us to work with some of the cybersecurity vendors who have lots of threat intel or other valuable data that a lot of our customers might be interested in. I intend to start having a bunch of conversations with them around what we could be doing together to have the right datasets on Databricks to help our customers also manage their cybersecurity footprint. I think that’s a pretty big opportunity for us to look into.

I’m still learning the exact lift for our data prior to get material data sets up, however, I will say that many of them are using Databricks already and their data is already in the platform enabling Delta Share on that data, and they get to decide what data, how much of it, when, how often as part of setting up their Delta Share. They’re in full control of who they want to share, how much [of it], and when. We basically give the provider all the controls to be able to manage that on their own. Their customers can then start to use that data wherever they see fit when they go through Delta Sharing. 

A pair of glasses overlooking an article of text, while hovering code is emerging from highlighted lines of copy.