From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Tom McKay

itbrew.com

Aline Lerner on why job coding tests have gotten so onerous

Interviewing.io founder Aline Lerner on what to expect applying for a job at a top-tier tech firm right now.

A man typing on a laptop in front of a rack of servers.

Legacy technology is still costing businesses big time, Deloitte survey finds

 A Deloitte survey found 82% of respondent companies had missed cost reduction targets; incapable technology infrastructure was the biggest complication.

Eoin Higgins

IT job woes don’t extend to AI sector, studies find

“It’s the tech area du jour,” one expert says.

Two dots and an arrow connected by a curving line denoting IT strategy

IT Strategy

What we do in the shadows might involve AI—and that’s an added stress for IT teams.

“Shadow AI”—when staff deploy AI tools without giving their in-house administrators and cybersecurity experts a heads up—is an ongoing issue for organizations. For IT departments, that means it’s necessary to establish rules and regulations, Silverfort CISO John Paul Cunningham told IT Brew. But time often isn’t on the side of IT pros when it comes to securing top-down control over a company’s AI usage.

“AI is here to stay, at the rate that new things are being implemented, it’s just incredibly hard for security teams to catch up,” Cunningham said. “What we really need as an industry is time to allow the security tools and the capabilities of security to catch up.”

One of the keys to handling shadow AI is ensuring that your team can monitor and maintain standards within organizations. Deploying AI tools without the proper iterative infrastructure around them can lead to problems; Cunningham prefers to look to the past for effective strategies, he said.

“The pattern of least privilege and zero trust that we’ve implemented in the Old World still is applicable to the New World,” Cunningham said. “The pattern of segmenting access and data and the scope of a program, a structured program, an old school program, is still true with AI today, and we need to apply all these patterns and learnings to AI.”

The ubiquity of AI tooling is leading to more specific use cases, which, in turn, is making them more attractive for workers who want to cover their responsibilities with AI tools. But there’s a gap between employees’ AI capabilities and their cybersecurity knowledge. Ido Gaver, Sweep.io CEO and co-founder, told IT Brew that trust issues often come from mistakes rather than malicious action.

“The tolerance for mistakes is different between different departments,” Gaver said. “What we’re seeing is that the people that are actually driving the change are CIOs or VPs of systems that know that there’s a lot of noise in the market.”

No matter what the case, if you can’t control the tool, you shouldn’t add it—nor let your staff import it secretly via shadow AI, Gaver said. Knowing which tools do what and which are safe is important for IT teams. IT pros can keep tabs on what’s out there in order to get ahead of misuse.

“Technical teams know how difficult their job is, and the reality is that to build AI tools that are making their job easier is also very, very difficult,” Gaver said. “If someone tells you that AI is magic, don’t buy into it; it’s a lot of hard work to build a tool.”

Some AI agents are given high-level permissions—which makes it hard to keep tabs on who is where and doing what inside a system. Treating AI like a unique identity is a good way to approach the problem, Cunningham told IT Brew, because it can limit access.

“We need to say it’s not just an identity, but it’s an identity for a very specific purpose and we’re going to limit the privilege of that identity to that singular purpose and that singular scope of data and that singular task,” Cunningham said. “It’s like a micro-segmentation of identity.”

pawn pieces with a king piece in the shadows

Shadow AI must be considered in cybersecurity strategy 

“If someone tells you that AI is magic, don’t buy into it,” CEO says.

Billy Hurley

Online education platform Udacity on Oct. 15 

 an accredited Master of Science in Artificial Intelligence program that the company estimates will cost students less than $5,000. The offering is one of a botload of AI education options these days: boot camps, certifications, and multi-year on-campus programs.

University pros and industry analysts shared with IT Brew some 2025 AI upskilling opportunities that stood out to them. For IT pros who want to quickly upskill in AI, these are some options.

Why should IT pros consider learning some nifty AI skills? Two words: job opportunities. A July 28 report from job-recruiting site 

 found that AI jobs, despite constituting “a small portion of all job postings,” increased 53% YOY in 2025. Those jobs whose postings referred to “AI” offered base salaries of around $121,000, according to the study, “compared to $64k for all non-AI roles.”

IT pros should realize their peers are rapidly learning AI skills, potentially putting them in a better position for future opportunities. A study from 

, released in April, found that the number of candidates planning to earn an AI certification increased from 17% in 2022 to 35% in 2024.

Udacity’s program requires students to complete seven “nanodegree” programs, including 

. The program also calls for 750 additional hours of study in electives like 

Degrees are awarded by higher-ed institution Woolf, which lets qualified organizations join as new member colleges and offer accredited degrees. While most of the learning is “self-paced,” according to Udacity’s VP of Consumer Jared Molton, and can be done on one’s own schedule, he said mentors are available to provide feedback in office hours and live sessions. Udacity estimates the program will take 2,250 study hours, or roughly 18 to 24 months, to complete.

 found that “more than three-quarters of AI job openings give preference to candidates with a Master’s degree.”

 recently ranked Master of Science in AI programs, which listed Carnegie Mellon, Duke, and Northwestern in its top three spots. The average total tuition for those options, according to TechGuide, was $64,154.

Molton said his team discovered that 28% of Udacity’s graduates reported starting a new academic program after obtaining a nanodegree. “That was kind of an ‘a-ha’ moment for us. We were like, ‘Hey, we know our learners are doing this. How do we set them up even better for that opportunity?’”

Though businesses in 2024 appeared to prefer Master’s degrees, market-intelligence firm Gartner recently recommended that organizations prioritize candidates with certifications that close skills gaps in valuable, business-impacting areas like AI, cybersecurity, and cloud. “More employers are dropping degree requirements, recognizing that IT certifications provide a faster, more objective validation of workforce readiness, especially in critical areas like AI, cloud, and cybersecurity,” according to Gartner’s published guidance in August 2025.

Gartner highlighted these “prominent” certifications in its recent report:

Artificial Intelligence Graduate Certificate

IBM Applied AI [Developer] Professional Certificate (

 and Advanced Certifications from Microsoft, Google, and Nvidia, which Gartner’s recommendations said focus on “real-world integration of AI into cloud, data engineering, and edge computing environments.”

’s Certified Artificial Intelligence Scientist and Artificial Intelligence Engineer Certification (

DeepLearning.AI’s Deep Learning Specialization (

There are numerous education options for AI, but a clear standard for the emerging technology has not yet emerged.

“You don’t necessarily have to have a four-year degree to get an entry-level tech job,” Kirk Smallwood, VP of key accounts and industry engagement at CompTIA, 

Udacity announces low-cost Master of Science in AI

 As IT practitioners seek upskilling, we explore today’s AI training options.

Data centers keep growing in importance to the tech industry—and with that importance comes rising energy needs.

That demand for energy is already making waves. McKinsey’s 

 projects that, by 2030, data centers could constitute more than 14% of US national demand; growth in the infrastructure in North America dwarfs the rest of the world.

Diego Hernandez Diaz, a McKinsey researcher who led the report, told IT Brew that data centers could exceed the annual global growth rate of 17% a year if they can get energy off-grid. But there are challenges to making that a reality, not the least of which is finding alternative energy sources.

“That number can grow higher if we are able to solve some of the grid connection constraints that exist in the system today and or if demand further increases above and beyond what we are seeing,” Diaz said, “which obviously necessitates alternative measures to be explored.”

For many in the data center space, that means nuclear power. Companies like Amazon are 

 alongside natural gas. And with other energy resources still in development, energy demand will continue to be a concern as part of data and AI sector growth.

Just how high that demand will actually reach remains unclear. Electric and energy utility companies are still trying to work out just how much demand is real. Rob Gramlich, Grid Strategies president, 

 that while the infrastructure isn’t there to satisfy projected demand, “the industry’s got to plan based on the best information we have at the moment.”

Mikey Lucas, founder of the American Energy Fund, told IT Brew that the billions being spent on AI and data centers present a new “Wild West”-style frontier where the demand for energy is like the demand for land. That means a major increase in need that can’t be fulfilled by the grid.

“In reality, the grid cannot keep up with AI, and we all know that,” Lucas said. “A lot of these sites will have on-site generation—they don’t have a choice, because if they don’t have on-site generation, then they’re going to have to wait six to 15 years just to get interconnected because of the red tape with utility companies.”

Whatever solution they come to, the sooner the better.

“The three grids that are in the United States are already at, essentially, peak,” Lucas said.

Diaz believes that the solution is somewhere in the middle: a hybrid of on- and off-grid. Centers with their own generation facilities and the ability to connect to the grid is the “optimal setting,” he said, allowing for the reliability that AI needs.

“That allows you to deliver on the premise that a lot of these guys operate on, five nines reliability—they need to be up 99.999% of the time,” Diaz said. “To do that, you need to have access to the power for the same amount of time.”

As data center industry grows, so do energy demands

“In reality, the grid cannot keep up with AI, and we all know that,” an energy advocate tells IT Brew. 

Brianna Monsanto

It’s all fun and games until the person in charge of managing your organization’s AI subscriptions decides to leave.

The above scenario is not so far-fetched. As companies 

, it may seem natural to designate the responsibility for the tools to one tech-savvy person in the organization. But what happens when that person’s time at the company comes to an end?

Zander Deitz, VP of sales at AI and SaaS portfolio management company Productiv, told IT Brew that documentation comes in handy for companies in the era of AI, especially when transitioning AI-related responsibilities from one person to another.

“If you don’t have a good system in place that is easy for someone to pick up and understand on day one, whether it’s the person directly managing AI or some other process…you’ve just backlogged their work by months,” Deitz said.

 So, who’s ultimately responsible for an organization’s AI products and subscriptions? Deitz said the answer will vary from organization to organization.

“If it’s a smaller startup-type company, this is going to typically fall immediately on the CIO or CISO,” Deitz said. “They’re going to be in charge of building a governance policy when it comes to AI, selecting approved tools, reviewing embedded AI within applications, [and] ensuring contract terms are in line with what their policy is.”

A larger organization may have more resources for managing AI responsibilities, Deitz said, adding that a 

 may be responsible for this, or tasks might even be delegated to a specific AI task force.

Neuralogics Group CTO Christian O. Petersen cautions against dumping the responsibility of AI products and applications solely on the IT department.

“All AI needs to have both the business owner and a tech owner. That’s really fundamental,” Petersen said. “And it’s never been more important than now because…we’re moving towards a future where there’s nothing we do in a business that’s not going to be somewhat or largely AI-powered.”

Petersen said documentation is essential for 

, and that companies need to approach it from both a business and tech perspective. On the business side, Petersen said companies need to identify the objectives of the department using an AI application and how AI contributes to them.

“Now you actually have complete agreement on why we have this AI in the first place,” Petersen said. “Based on that, it’s really easy to decide what it [is] that we want to use it for. Are there things we don’t want to use it for?”

On the tech side, Petersen said departments should also document which AI tools can access which data. Having this information written down informs incoming employees about who’s responsible for overseeing and securing AI.

“There’s no surprises,” Petersen said. “We know why we have it. We know what it’s supposed to do. We know how we’re supposed to use it.”

Unclear documentation of AI within the organization can cause problems for organizations down the line, according to Deitz.

“You don’t necessarily have to have rigid policies against everything, but if you don’t know what’s going on and what people are using approved and unapproved [tools], and if you’re not bringing those unapproved things behind SSO [single sign-on], you expose yourself to giant lawsuits if somebody puts sensitive data into a system, even by accident.”

Photo collage of an AI icon in between two hands pointing at each other contained within abstract shapes.

Who really controls AI in an organization?

One professional says documentation is key to sharing AI protocols and approved usage with incoming employees.

Trust is the foundation of all relationships. That’s why several tech companies are expanding their C-suites with an executive whose sole job is ensuring their company maintains high levels of integrity with customers.

These chief trust officers, or CTrOs, are C-suite executives who build stakeholder trust in their company, including in how it handles and secures consumer data. According to an 

, the role has emerged over the past decade amongst tech and B2B software companies in response to various issues, including the potential to use technology and data for privacy abuse, bias, and harassment.

“Effectively, what the role does is offer assurance to the customers or potential customers of that organization that their data, their information, their technology, the infrastructure, the platform itself, can be trusted as those customers adopt it,” Forrester VP and Principal Analyst Jeff Pollard told IT Brew. “So, it goes a little bit beyond security.”

In recent years, the CTrO role has found its way in the C-suites of various tech companies, including Salesforce and Autodesk. Pollard said it could be beneficial for a company to hire a CTrO because it escalates the responsibility of trust into an “executive priority.”

“You’re making them a member of the C-suite, which, in itself, shows an intentionality that I think is positive because it should influence the rest of what the company does,” Pollard said.

He added that designating a leader to be in charge of trust allows “more focus for the roles that roll up to the CTrO as opposed to everyone trying to do everything.”

However, adding a CTrO to your C-suite can come with baggage if not done properly, according to Pollard, who said the reporting structures associated with the role may unintentionally separate professionals from the technical side of their business.

“One of the very realistic concerns here, from a chief trust officer perspective, is when you’re broken out of the technology work and you span beyond that…just by definition, you do lose some insight as to what the tech org is doing,” he said.

 Chris Peake became CTrO at revenue AI platform company Gong in August. He told IT Brew his role combines IT and security at the SaaS provider.

“Day-to-day operationally, it’s addressing historical things on both the IT side of making sure that we’ve got systems up and running that support the business, [and] controlling endpoints and all those kinds of things,” Peake said, adding he is also responsible for making sure security is built into Gong’s products.

Peake, a former CISO, said a lot of the skills from his previous role have translated into his current one. However, he said the CTrO role differs from the CISO role because it operates more on the “business level,” as the work done by a CTrO can directly impact revenue generation, contract negotiation, and onboarding new customers.

“I think that’s why we see a lot of the chief trust officers are former CISOs, because there is a natural fit there,” Peake said. “It’s just adding that next layer.”

 Forrester claims the CTrO role is more than just a “passing trend,” perhaps unlike 

“If it does disappear, I don’t think the need for someone to oversee trust disappears,” Pollard said. “Maybe the title does, but if it does then it’s subsumed by the CISO…hopefully they use that as part of their new remit to expand upon what they’ve done in the past and not just be the sort of legacy department of ‘no.’”

Meet the new trending C-suite role: the chief trust officer

Why more SaaS companies are hiring chief trust officers 

Software companies are hiring chief trust officers to foster transparency with consumers.

As many employees use GenAI platforms to find the right answers to tech and business conundrums, some of their colleagues see value in collecting the right questions.

Three IT professionals shared what they learned after implementing prompt libraries for their organizations. Whether adding 50 new prompts in one month like West Monroe’s Reva Busby, or stopping at around five like PR-firm pro Emily Koehn, a collection of go-to chatbot inputs offers a helpful head start for a variety of tasks within an organization.

“I think a prompt library is important because it allows the use of AI to scale faster,” Busby, director of the commercial growth team at business and technology consulting firm West Monroe, told IT Brew. “You are getting pre-built and well-engineered prompts that you can use right off the bat, without having to have all that knowledge about building a prompt yourself.”

In 2023, West Monroe introduced Nigel, an internal chat platform assisting the company’s 2,000 employees with tasks like drafting emails, writing code, and analyzing datasets.

The platform holds a library of 278 prompts, and has about 12,000 all-time uses (and 8,000 just in 2025), according to data shared by WM.

While Busby did not reveal exact prompts, the director said one prompt for generating a sales email includes case-specific factors for the user to input, including: background information about a client, tone, and output format.

While some prompts may be a sentence long, Busby said, others related to sales or consultant teams are “robust” and may require lots of extra details “because you’re trying to execute a very specific workflow in the context of some repeatable service.”

Busby uses a specific prompt when organizing notes after a candidate interview—one that pulls data like job role, notes, and feedback into desired table formats.

For Koehn, PR account director at Crackle PR, the prompt library is a smaller guide for the nine or so full-time employees using tools like ChatGPT, Perplexity, or Gemini. Prompts exist for main categories like:

 from analytics consulting firm Trust Insights, which factors role, action, context, and execution into the prompts. One helpful prompt for Koehn, she said, pulls the most headline-worthy findings from an uploaded client report.

“Now that gives me a fantastic starting point in minutes,” Koehn said. “Do I still go through every single tab of data and verify that AI didn’t hallucinate? Absolutely. Do I still look at the data to make sure that AI didn’t miss any things that are really significant or interesting? Absolutely.”

A report from the US Chamber of Commerce, which polled over 3,800 businesses in June 2025, found that 58% of small businesses (250 or fewer employees) use GenAI—up from 40% in 2024 and more than double compared to 2023 (23%).

Generative AI is also popular with the companies who are investing heavily in creating it. Microsoft CEO Satya Nadella revealed some 

 recently on LinkedIn, including “Based on my prior interactions with [/person], give me 5 things likely top of mind for our next meeting.”

West Monroe’s library, built “from scratch,” according to Busby, organizes prompts by topics (productivity and performance management, for example) and job role (like sales). A search bar gives employees suggestions for helpful inputs, and prompts can also be ranked and sorted by usage and popularity, Reva said; employees can pin their favorites.

“You need to be able to narrow down quickly to what’s relevant to you,” Busby said.

Recommendation #2. Get everyone involved.

When West Monroe’s Nigel came online, the team noticed a trend: a few people were writing all the prompts. Busby stressed the importance of letting employees “cocreate” on prompts; the firm has even recently offered a prompt-building “wizard” for the non-experts.

As long as a prompt doesn’t include a restricted topic like financials and compensation, Busby noted in a follow-up email to IT Brew, it will appear in the library, and employees can offer ideas and commentary to the prompt author. (The company also highlights standout prompts each month on the company’s homepage, Busby told us.)

Brady Lewis, senior director of AI innovation at marketing consultancy Marketri, has led the refinement of a prompt library that he says has reached 150 full prompts.

Lewis also meets every Monday with a six-person, cross-department AI council to investigate any problems with deployment, and to review new prompts for vague or otherwise troubling results.

And some prompts require…more prompts. Lewis advises employees with frustrating results to copy the output that 

work and try a new LLM (or start over with the same one) “to reframe the question.”

Lewis also has a collection—a small library if you will—of 10 or so prompt blocks. These little promptlets can aid in the construction of new prompts: “I want this formatted specifically in a CSV table format,” for example.

It’s a challenge, Lewis admits—balancing continuous education while not trying to “bombard the employees” with hours of training.

“We can’t control every single aspect of what every single employee does at all times. We’re trying to provide as many guardrails and make things as easy as possible,” Lewis said.

Illustration of an opened book laying on a book shelf with floating ai prompts above.

Best practices for building a prompt library

Three pros share what they learned about collecting good queries.

If you’re not careful, a test environment can turn into a live-run of a security disaster.

When Rob Forbes was working as a senior security architect, just a few years ago, he watched a major retailer inadvertently use live customer data in a platform not meant for production. The test platform—a customer identity and access management system, he recalled—was tied to production databases, so changes made in the former “rippled down into the production environment.”

“We had to quickly yank that back down before it got found and scanned on the internet,” Forbes, now field CISO at cybersecurity services company Stratascale, told IT Brew.

Forbes shared how his team revamped the change-management process following the rough test—a phase of software development that leaves plenty of opportunities for access and data leaks.

There are typically four stages of software development: 

A test platform—a complete setup of applications, infrastructure, and data that allows software to be tested for functionality and security

A staging platform, which is meant to simulate production before moving to the actual…

The test platform is in a controlled, non-production setting, not meant for public access or to host production data, according to John Pettit, CTO at Google Premier partner and consultancy Promevo.

“People start to blur the line between the test and staging,” Pettit said.

DevOps company Perforce Software, in a global survey of 250 orgs, found that 86% of organizations allow “data compliance exceptions” in non-production environments.

With test environments, Pettit sees a conflict between a team of fast-moving developers and a team of security practitioners who want some questions answered first.

“You have a culture responsible for protection, and you have a culture who’s responsible for building stuff and getting things done,” Pettit said. “The ‘getting things done’ team once they’re given access to something, rarely has the security mindset to think about, ‘How do I keep us safe?’”

Forbes added that access and data shortcomings often happen in test platforms because developers may be unfamiliar with a given cloud platform’s controls.

Following the incident with the retailer, Forbes said his team amassed “an inventory of failings” and tasked themselves with asking developers questions like: Why was production data used in test environments? Why were developers given admin accounts created for database access?

Following the incident (and for future test platforms), Forbes and his team created a process that snapshotted customer data and ran it through a data hygiene tool to scrub out sensitive information like account numbers and addresses.

Other companies rely on similar methods to ensure their valuable data is safe in case of an incident. In July, for example, Dell confirmed a breach of its Solution Centers test environment—a way to preview features to customers—

 that the data used “is primarily synthetic (fake) data, publicly available datasets used solely for product demonstration purposes or Dell scripts, systems data, non-sensitive information and testing outputs.” (Dell did not share the cause of the breach.)

Independent software vendors (ISVs) like Ensono sell test-server licenses to customers.

Once a “test” environment includes company data, Pettit treats the “test” like a production environment, recommending hardening practices such as password-rotation requirements, identity-aware proxies that restrict access over the internet, and monitoring from a security operations center (SOC) environment.

“I think that word ‘test’ is sort of a dangerous word to start with,” Pettit said. “If it’s a publicly accessible server that has your credentials, if it can connect to your data, connect your other internal systems, it’s not a test system.”

Forbes sees the test problem only becoming more challenging as companies try out AI.

 found that 44% of surveyed US employees said their orgs have implemented new AI tools—up from 33% in 2024.

Agents will need to be instructed on what coding languages, platforms, language models, and servers it can leverage, Forbes said, and it must be equipped with access restrictions and logging.

Agents, perhaps, are on the “getting things done” team.

“There are a lot more controls that we need to apply to AI because, again, it’s just trying to complete the task,” he said.


3D blue, pink, and green error alerts layered over each other