From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Tom McKay

itbrew.com

Aline Lerner on why job coding tests have gotten so onerous

Interviewing.io founder Aline Lerner on what to expect applying for a job at a top-tier tech firm right now.

A man typing on a laptop in front of a rack of servers.

Legacy technology is still costing businesses big time, Deloitte survey finds

 A Deloitte survey found 82% of respondent companies had missed cost reduction targets; incapable technology infrastructure was the biggest complication.

Eoin Higgins

IT job woes don’t extend to AI sector, studies find

“It’s the tech area du jour,” one expert says.

Two dots and an arrow connected by a curving line denoting IT strategy

IT Strategy

Brianna Monsanto

You’ve heard of spirit week, but have you heard of AI week, its nerdier, lesser known cousin?

In June, the product development team at digital analytics platform company Amplitude spent a week at the company’s San Francisco office, taking a break from their usual workload to participate in the company’s first ever AI week.

Amplitude Chief Engineering Officer Wade Chambers told IT Brew that the purpose of Amplitude’s AI week was to find a way to get employees to the same level of “fluency” when using AI tools in a short amount of time. A 

 surveyed 2,500 employees and IT leaders and found that 86% of employees feel they aren’t using AI tools to their full potential.

“We have a lot of the right core talent with deep understanding of models and the tech tools and technology that you can use around,” Chambers said. “What we wanted to do was make sure that that was now spread through the entire organization.”

Chambers said the company took inspiration from the 

 Meta made available to its employees when the tech giant started homing in on its mobile-first strategy. He added that it was important for Amplitude to find a balance between training employees and challenging them.

“If there’s too much challenge and not enough training, everybody gets anxious,” Chambers said. “And if there’s too much training and not enough challenge, everybody gets bored.”

The beginning of Amplitude’s AI week involved training on “

” tools like Cursor and Bolt, guest speakers from AI-savvy companies, and discussions around the 

From day three onward, employees were given time to practice using the tools in a safe environment.

“If you need 20 hours of practice to become good at something, we wanted to make sure that we shoved those 20 hours into a single contiguous block,” Chambers said.

Chambers said some employees focused on finding ways AI could help advance some of the things they were currently working on, while others were free to use the days as “greenfield exploration.”

On each of the three days, employees participated in a show, tell, and ask, where teams presented their discoveries and failures. By the end of the week, Chambers said employees had built “profound” and “meaningful things.”

“[On] one team, the leader came to me afterwards and is like, ‘Yeah, we had something lined up in Q3 where we thought that was going to take three months to do based on sort of historical norms. I think that’s now going to happen in less than three weeks,’” Chambers said.

Less than a month after Amplitude’s company AI week, Chambers said there are already a few ideas from AI week that are making its way into product.

“I can think of easily three and maybe four that probably within the next week or so will make their way into working product,” Chambers said. “We’ll probably roll it out to a very small set of users and make sure that it’s having its intended effect.”

Robotic hand shifting a mouse around the canvas in a circular motion

Why this company thinks AI week should be the new norm

“If there’s too much challenge and not enough training, everybody gets anxious,” Amplitude Chief Engineering Officer Wade Chambers says. 

Billy Hurley

During a recent IT Brew event dedicated to guiding tech pros through the 

, an attendee had the following question:

Culturally, how do I help my IT team be seen in the company as a driver of innovation and not a barrier to bringing on new tools? We recently had to shut down the use of an AI tool we hadn’t fully evaluated yet because of the large amount of proprietary data we have to keep secure and I’m worried it’s created a culture where employees are using tools anyways without us knowing (arguably more unsafe).

IT Brew guest and Gartner Associate Principal Analyst Olivia Montgomery told attendees that IT teams should soften their communication style and foster a more collaborative spirit, rather than banning new AI outright.

“Maybe instead of just shutting down an app completely, you work with them to integrate it into the ecosystem and be very clear about, ‘Hey, let’s 

 get this into a secure environment [where] you’re happy with the functionality and we’re happy with the security and the usage of it,” Montgomery said.

PwC’s annual CEO survey found that 49% of global chief execs—polled in October and November 2024—expected GenAI to increase profitability over the next year.

We posed the IT Brew reader’s question to Rohan Sen, a partner at PwC and leader on responsible AI use, who discussed a three-part strategy for IT teams to be seen as innovation drivers, not downers:

on behaviors that are “outside the box” of risk tolerance

 for IT teams and tech to present risks to business leaders

We asked Sen for examples of the rules and risks.

Below are his responses, edited for length and clarity.

Let’s say we’re sending some data to a third-party vendor. As an example, a rule of the road might mean that that third-party vendor needs to go through your standard procurement intake and due diligence process and be approved—not just from a “know your customer” concept, but maybe there’s also a degree of security reviews that have been done as part of that, the standard onboarding of that third party, and those approvals are in place. So, the question then becomes: If you’ve done that and it’s been approved, go. But if you’ve not done that, then pause, right? And then it becomes a decision about, “Alright, what are the risks here of not having that approval in place? And are those risks small enough to continue?” That’s a business and IT joint decision.

What kind of trade-offs can be discussed in forums?

In the [attendee] question, there was a hesitance, because the data was sensitive. Well, one approach might be to then de-identify the data, and that might actually reduce risk down to a level that might be acceptable. IT and business should think creatively as to what measures they can take to buy down the risk so that they can continue to drive that innovation.

Can you help me understand the concept of risk stratification, with an example or two?

Let’s say an employee at a company is using something like a Microsoft Copilot to write an email or summarize a document, but they are actually then reviewing that document or reviewing the summary and then incorporating it into some work product—having a human in the loop. Relatively low risk, right? It’s one person. They’re doing it to accelerate their productivity, versus an AI solution that perhaps is looking at large amounts of financial data, and then preparing summaries and narratives that are going out, let’s say, as part of an investor relations packet, or something that’s a little bit more public facing, that’s a little bit more high risk. The cost of getting that wrong right is much, much higher than that productivity example, and so aligning the level of controls and review and requirements based on risk—that’s what I’m talking about in terms of risk stratification. When you start embarking on an AI solution, understand, based on well-defined guidelines, what’s considered low, medium, and high risk.

image of human and robot shaking hands out of computers

Asked and answered: How to limit AI and still be seen as IT innovators

Techs pros from PwC and Capterra weigh in on the risk and communication strategies.

ITBR-Quantum computing audio embed

Not to ruin the party like it’s 1999, but there’s a looming Y2K-like technology threat that IT pros need to prepare for before it’s too late: quantum computing.

The promise of quantum computing and its problem-solving prowess also poses a glaring threat to old encryption methods like the 

With sensitive data potentially unlocked to adversaries, tech pros who spoke with IT Brew advised practitioners to reopen the Y2K playbook

and apply familiar preventative steps from that memorable turn of the century: take inventory, apply updates, and test. Quantum preparations, security specialists told IT Brew, include working through a checklist of tool inventory, vendor conversation, and a changeout from old encryption to new.

Instead of using bits, quantum computers deploy particle-manipulating qubits to quickly store and process data on refrigerated hardware running at temperatures approaching absolute zero. Some possibilities for the high-speed calculators include 

In 1994, computer scientist Peter Schor developed an algorithm that factored large numbers quickly. The demonstration revealed risk to the encryption of the time, given that the protection mechanism often relied on multiplying large prime numbers.

In 2001, a quantum computer developed by IBM and Stanford University 

 and factored the number 15 on a 7-qubit processor. Since the demonstration, companies like D-Wave, 

As the computing advances, security pros fear that quantum tech can break the encryption guarding enterprise data.

Adversaries already have access to the technology needed to employ “harvest now, decrypt later” attacks, according to a 2024 Global Risk Institute report, “to intercept, copy, and archive encrypted communications for eventual decryption with a quantum computer.”

On August 13, in response to the quantum threat, the National Institute of Standards and Technology announced 

 for tech vendors and practitioners to start using.

Preparation for a quantum crypto-breaker has led many IT professionals to assess regulatory implications, update encryption standards, and collaborate with hardware and software vendors. Many, however, aren’t ready for the final exam.

A survey from international professional association ISACA found that 40% of respondents are not aware of their company’s plans, and 41% say they do not plan to address quantum computing at present.

ISACA released a quantum-preparedness checklist, including:

Checklist

Part of the readiness assessment can be simply seeing what breaks when a new encryption standard gets added.

 in its Chrome browser by default for the online-privacy protocol known as TLS 1.3, for example. A system admin can “use a browser with the new algorithms enabled…and see if they can still connect to old firewall interfaces,” Johannes Ullrich, dean of research for the SANS Technology Institute, 

A recent survey, commissioned by cybersecurity platform provider DigiCert and conducted by Propeller Insights, found that 69% of “cyber leaders” expect quantum threats to break encryption in 5 years, but only 5% have quantum-safe encryption in place. (Respondents included 1,042 senior and C-level cybersecurity managers in the US, UK, and Australia, according to the company.)

Pull Quote

Quantum prep includes work for the individual IT pro, like updating encryption for data at rest, or provisioning a new certificate for, say, a smart TV that has to authenticate to a network. Other updates require conversations with a vendor.

In addition to ISACA’s recs, Mike Nelson, global VP of digital trust at DigiCert, also advises clients to talk with software vendor partners to understand their timelines for supporting post-quantum cryptography.

“They should be able to communicate with you about their plans for that so that you know when they will be introducing it, so that you can have that coordinated approach,” Nelson told us.

Deloitte’s Bill Briggs told us in January 2025 that the prep scenario had a Y2K—or “

”—feel. The year 2000 fortunately began 

Over one-third (34%) of the quantum-computing researchers surveyed by the Global Risk Institute in 2024 estimated that a quantum computer could break a 48-bit RSA encryption within 10 years. There is a quantum countdown; it’s just hard to know when it’s “Q o’clock” exactly.

Nelson sees a more disordered, “messy” situation than Y2K as IT pros get ready for a test with no clear date. Some will ace the exam, he said, and some will try to migrate fast when they absolutely have to.

“There’s going to be things that are going to break, systems that are going to go down, and there will be outages,” he said.

An illustration features a golden, unlocked padlock at the center of a blue atom model with orbiting electrons, all set against a solid light purple background.

How to prepare for when quantum computers break encryption

Find your encrypted data, and see if your SaaS vendors have a clear plan.

Caroline Nihill

If US-based Googlers want to say goodbye to their “innies,” the company is offering buyouts to more teams.

Google spokesperson Courtenay Mencini told IT Brew that the company teams are offering the buyout program with severance for employees based in the US, “who many want to leave the company, whether for professional or personal reasons.”

“Earlier this year, some of our teams introduced a voluntary exit program with severance for US-based Googlers, and several more are now offering the program to support our important work ahead,” Mencini wrote.

The statement continued: “US-based employees on teams offering the voluntary program are able to apply regardless of role or level.”

Those on Google’s knowledge and information (K&I), central engineering, marketing, research and communication teams are able to part ways with the company. This follows earlier buyout announcements that affected Google’s 

Buyouts offered to the platforms and devices team were offered as a result of the large operating systems and hardware team’s merger last year, 

, and given as an option to employees that might not have been aligned with Google’s mission.

Mencini did not elaborate on the “work ahead” or respond directly to a question regarding what prompted these buyouts.

 reported that Google is offering a minimum of 14 weeks’ pay with an enrollment deadline of July 1 to employees in some orgs.

, mandating office returns to remote workers who live within 50 miles of an office to begin a hybrid work schedule and bring employees together in-person, which the company confirmed.

The outlet also shared a memo written by Google executive Nick Fox, who leads the K&I team, concerning the buyouts, which reads: “I really (really!) hope you don’t take this! We have ambitious plans and tons to get done…On the other hand, this [voluntary exit program] offers a supportive exit path for those of you who don’t feel aligned with our strategy, don’t feel energized by your work, or are having difficulty meeting the expectations of your role.”

Google announces expansion to company buyout for US employees

Google says the buyout program is now stretching to central engineering, knowledge and information, and research teams, among others. 

Consider this: You’re looking for a water bottle that exudes your style. Gatorade currently allows you to custom design your water bottle with a prompt of “anything you can imagine.” (“A panda flipping pancakes,” the site suggests.)

What could go wrong—besides that proverbial first GenAI pancake?

At a June 12 meeting in IBM’s Manhattan headquarters, the company’s agentic experts considered the disastrous outcomes in a custom-bottle scenario with no technical safeguards in place.

For one, a large language model (LLM) has to be ready to field offensive prompts and offensive outcomes in such a public application. 

You should filter and test the outputs and inputs to ensure they are customer-appropriate and in line with brand guidelines, according to Manish Goyal, VP and senior partner, global AI, and analytics leader at IBM Consulting. A technology must reject displeasing prompts before they even hit the LLM.

“You want to have guardrails on what I will allow or not allow,” Goyal said.

Before an agentic or generative AI tool goes live, IBM’s team offers workshops based on client needs to help orgs determine priorities and mechanisms to guard against potential negative impacts. (PepsiCo, Gatorade’s parent company, went through such an exercise, Goyal told us. Lily O’Brien, global comms lead for IBM, later shared in an email that IBM worked with Pepsi to establish a “Responsible AI framework” and set of governance policies.)

Goyal and Phaedra Boinodiris, IBM Consulting’s global leader for trustworthy AI, walked IT Brew through the data-governance drills in a theoretical scenario: a hotel wants an AI agent in guests’ rooms to act as a concierge and provide activity suggestions.

First, a consultant guides the client through all the people impacted: a front-desk employee, a child guest, an AI engineer, a restaurant owner, a litigator, to name a few.

They’re then placed into categories of:

Data subjects (a restaurant owner who has their data in the AI system)

Decision subjects (a guest whom the decision is about)

Pedestrians (those indirectly impacted, without a direct role in shaping system decisions)

Decision-makers (people using the AI to support a decision)

Data makers (people who input the information as data into the system)

System builders and influencers (people actively involved in developing and setting direction for systems)

“It’s so critically important to have the groups of people doing these exercises be truly reflective of the diverse communities that you’re serving, but also be multidisciplinary,” Boinodiris said.

Once that’s mapped out, a team dedicated to use cases, like procurement or a business unit, considers “secondary positive effects” (new partnership opportunities with a scuba-diving company) and “tertiary negative effects” (liability issues related to data sharing, or wrong and frustrating outputs).

Following a categorization of risk, the design team reviews agreed-upon company priorities—say, data privacy—and vote on “baseline,” “enhanced,” or “vigilant” guardrails.

A team may decide that “explainability” and “observability” are important aspects for the hotel AI deployment. That could mean basic security logs for observability (baseline) or live dashboards with anomaly detection (vigilant); each has varying costs. Explainability could mean simple explanations for what data was used to train the model (baseline), or it could mean links to evidence as part of its output (vigilant). “Enhanced” practices are the middle option.

“This gives people the language to use, both with the builders and with the buyers, so that they can understand when you use the word ‘fairness,’ or you use the word ‘explainability,’ what it actually means in terms of what needs to be built,” she said.

And every company can determine its important criteria: explainability, observability, or otherwise.

“If I have an AI that’s predicting the movements of ants on an ant farm, data privacy is not applicable,” Boinodiris said.

Then, the “grand finale,” according to Boinodiris, involves presenting an org’s AI council the business use case, the unintended effects or risks, and the approach for mitigating them.

A company’s requirements may change as the unexpected occurs. 

 recently shared how orgs are not prepared for “ethical nightmares” related to disasters like IP violations, discriminatory outputs, and privacy exposures. What could go wrong? In Gatorade terms: 

“It is always the right organizational culture that is required to curate AI in a responsible way, one that you know approaches this with humility and a recognition that this has to have constant reflection,” Boinodiris said.

Want an agent? IBM guides clients through AI guardrails

What should a hotel ask before it deploys a digital concierge? We went through the exercise. 

There’s nothing like the smell of chicken wonton tacos with a hint of modern technology to go with it.

Applebee’s, a Dine Brands Global franchise, is spicing up its point of sale (POS) systems as part of a larger technology transformation occurring at the food and beverage company.

IT Brew caught up with Dine Brands CIO Justin Skelton to learn more about what the company has been cooking up on the back end of the popular restaurant chain. Skelton, whose favorite Applebee’s dish is the riblet platter, told IT Brew that the franchise was due for an upgrade from its 

, given that its current POS system has been in production for about 20 years. He described the tablets used by servers to take orders as old and clunky.

“It’s sort of like using an old Atari system versus using a PS5,” said Skelton, who joined Dine Brands in 2019 as VP of IT infrastructure and operations.

For those of us whose restaurant knowledge comes solely from 

, Skelton said a good POS system can elevate the service a restaurant is able to provide to a customer.

“A lot of times when our guests come in, particularly during the lunch day part...they’re very busy. They need to come in, they need to leave,” Skelton said. “So, the fact that we can improve our service level and get our guests on their way and improve that guest experience is something that’s significant.”

During his search for a next-gen POS system, Skelton outlined the need for a system with several qualities. For one, it needed to be able to accommodate the rate at which Applebee’s changed its menu, which happens any time it has a new menu item, promotion, or 

“The platform needs to be flexible enough to be able to accommodate that change at scale,” Skelton said. “So, an enterprise capability was critically important for us.”

The new POS system also needed to be modern, cloud-based, and compliant with the franchise’s security and governance requirements, Skelton added.

After a “fairly lengthy journey,” Skelton said the restaurant chain—which has more than 1,600 locations globally—ultimately selected Toast as its new vendor. With the new POS system, restaurants in the franchise would be able to send orders directly to their kitchens through their kitchen display systems (KDS) and accept payments directly on tablets.

“The fact that you can actually take payment right there on that device is really transformational for our Applebee’s system,” Skelton said.

IHOP, Applebee’s sister brand, went through a similar 

 last year when it upgraded its legacy POS system to Tray, a cloud-native platform. There are more than 1,800 IHOP locations worldwide.

“Before the Tray rollout, if you walked into an IHOP, largely the servers would actually take your order on a paper pad,” he said, adding that the pancake house restaurant chain also installed new KDS technology into stores to help bolster communication between servers and cooks.

Skelton, who prefers IHOP’s classic french toast over an order of pancakes, said Dine Brands learned several lessons from IHOP’s migration process that will be leveraged in Applebee’s 

, including the importance of change management. He said the company has made sure to maintain frequent communications with Applebee’s employees about the rollout of the pending POS system and what they can expect down the line at their stores.

“You’ve got change management that goes from being able to write down the order to actually hitting the buttons on a screen on a tablet,” Skelton said. “It may seem little. These changes may not seem that dramatic, but they are change management things you have to consider.”

Applebee’s is currently piloting Toast in select stores. Skelton said the chain intends to roll out the new-gen POS system “in earnest” next year. He added that a similar transformation is in the works for Fuzzy’s Taco Shop, another franchise in Dine Brand’s portfolio.

Skelton advised companies looking to undergo a 

 to understand who their customers are and to make sure new technology meets functional requirements, end user demands, and non-functional requirements.

“Those are things like system availability. It being cloud-based,” Skelton said. “The things [that] aren’t visible easily to…the guest.”

He added that companies should be willing to face challenges during the process.

“Along the way, if you don’t get it right, that’s okay,” Skelton said. “You got to be willing to fail.”

An Applebee’s Restaurant near Times Square in New York City, USA.

How Dine Brands is cooking up a legacy system overhaul at Applebee’s

The company concluded a two-year migration to a new cloud POS system at IHOP last year.

Tech is more than an industry; it’s a national security prerogative. So, why is the sector’s federal procurement system—how the government works with outside sources to acquire goods and services—stuck in the past?

That’s a question Steven Aberle, CEO and founder of Rohirrim, has been asking himself lately. Rohirrim is a procurement and request for proposal (RFP) solutions AI company and Aberle a former government contractor.

His RohanProcure product was created after government officials reached out to bring the commercial side of automation to the federal side. It’s all in service of faster procurement, Aberle told IT Brew, which he believes is “a national security imperative.”

“Procurement speed is not an administrative convenience anymore,” Aberle said. “It needs to be a core element of deterrence.”

Acquisition is important because you don’t want lag time when it comes to procuring technology that can give an advantage against an adversary. Every month spent in bureaucratic back and forth is a month where someone else is spinning up a new method of attack and infiltration, he said; the chance you lose the battle before it begins is too high.

Aberle broke down the timescale: “near-peer adversaries are starting to move a front line system from concept to field in about 18 to 36 months—our major programs still average eight to 11 years.” Put in real terms, that could mean that by the time the procured tech makes its way to those who need it, adversaries could be using software and hardware a few generations ahead of the US.

Introducing AI to the process could streamline and automate many of the repetitive tasks involved. Aberle is certainly not the only person to make the case for integrating the technology into procurement; in April, Oracle Executive Director Sarjoo Shah 

 that AI’s potential in the procurement process includes “analyzing historical vendor performance data, predicting the reliability and risk, maybe even conducting sophisticated market research and benchmarking.”

Federal tech contracting is an ever-changing space. Industry expectation is that the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) requirements mean that contractors will have to adhere to the guidelines for 2025 and beyond. Deltek Senior Manager of Cloud Solutions Michael Greenman told IT Brew earlier this month that the requirements 

, meaning that contractors are going to have to adapt.

“CMMC is here to stay,” Greenman said. “You need to be doing this if you’re a defense contractor, if you serve the defense industrial base, whether as an MSP, an MSSP, or a cloud service provider like we are here at Deltek.”

That said, the interest from the federal government in using AI in procurement shows that things are open to change for the ease of applicants. The technology still requires human oversight, but it offers a way not only to get the contractors moving more quickly but also to close the procurement gap with adversaries.

“The key to that transformation is technology—and we believe a large part of that technology is transformers and generative AI—and bringing that into the acquisition,” Aberle said.

“Bringing generative AI into procurement and acquisition must be done so carefully in highly regulated environments where the government is constantly worried about risk and they’re constantly worried about protests and risk for very good reasons.”