From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Eoin Higgins

itbrew.com

IT workers laid off from big tech firms have a new suitor—the auto industry

‘The demand for technology workers is still outpacing the supply, even though more supply is being pumped into the system,’ says one expert.

Billy Hurley

Tech CEOs have brighter outlook than pessimistic peers

Despite global uncertainties, some tech CEOs know they’re so money.

Speed up software upgrades—with a slow build of momentum

A key to upgrading outdated software: Get the conversation going.

a large, dimly lit office with all empty desks except one with a male worker sitting in his chair looking at his computer screen

Work

Brianna Monsanto

For years, executives have joked-not-joked about wanting to clone their best employees.

 could make those cloning dreams a reality…sorta. With workforces transitioning to a mix of employees and their virtual twins, there’s more pressure than ever to ensure that everyone inside the organization—both human and digital—remains on task.

So, what exactly is a digital twin of an employee? It depends on who you ask. In an 

, Gartner defined it as “a model that enterprises build to understand how real employees will respond or behave in a given context.”

“The [digital twin of employees] is an emerging way to use data, models, and simulations in support of productivity, performance, experience, and well-being goals,” Gartner Distinguished VP Analyst Helen Poitevin wrote.

Ryan Hamze, director at technology research and advisory firm Information Services Group, said digital twins in the manufacturing industry refer to digital replicas of an employee’s workflow.

“You’re looking at how it is simply actually doing things, and through there you can find bottlenecks,” Hamze said. “You can find the inefficiencies of how they do things [and] the bureaucracy humans have to go through to get approval sometimes.”

Digital twins of employees may also mean an AI persona of an employee that is capable of communicating with others. CJ Meadows, head of innovation for Asia at the SP Jain School of Global Management, told IT Brew she digitally twinned herself in this manner using enterprise AI persona company Personal AI, and sees several use cases for this deployment.

“In future, we’re going to see more and more digital twins on the org chart. So, our organizations are going to be mixed,” Meadows said. “There’s going to be some humans in there and some technology people in there as well.”

, digital twins of employees can be a valuable investment for companies. Hamze, for instance, said organizations can use these digital simulations for upskilling their workforce by showcasing the exact process new employees need to learn.

“If you replicate that exact process, especially with technical processes, more physical ones, it would be easy to train people for the future,” he said.

Gartner said digital twins of employees can also be beneficial in dangerous work environments, as well as for productivity gains in machine-heavy settings.

Meadows outlined one use case for her digital twin in her professional life: making herself available to answer questions for MBA students around the clock. She believes digital twins could likewise free up time for employees to tend to significant tasks.

“You know how you answer the same damn question for 50 people? Okay, how about we have your digital twin do that and you spend time doing what we actually need a human to do, and which would be hopefully more meaningful work for you,” Meadows said.

 Digital twins of employees can come with their own baggage. Hamze, for instance, said the replicas could stir up negative feelings among employees if organizations skimp on communicating their purpose and fail to build trust on the idea.

“Always understand that monitoring employees is always met with resistance because of surveillance issues and fear of being replaced,” Hamze said.

The Gartner report also notes that privacy regulation and labor laws can impact how organizations are able to collect data on employees for digital twin purposes, and that off-the-shelf solutions are rarely available.

In its report, Gartner said digital twins of employees are still in a nascent phase. However, Hamze said organizations looking to expand their workforce with these virtual employees can do so by clarifying what their purpose will be.

“You have to understand your scope of what you’re doing, why you’re doing it, what’s the highest value output you need,” Hamze said. He added organizations need a solid strategy for how the data leveraged by their digital twins will be collected.

“Is it coming from systems? Is it coming from cameras, monitoring the employee and AI analyzing those steps?” Hamze said. “Is it coming from data entry that you’re putting in?”

As for AI persona digital twins, Meadows said organizations may choose to treat digital twins of employees as “personal assistants” who can take on work that could be automated. Meadows said she keeps her own digital twin in check by making adjustments on the backend of it as needed.

“People have come back to me and told me things, and then with that feedback, I’ve gone in to make adjustments and corrections and so forth,” Meadows said.

A man in a suit stands on a platform across from an avatar.

What to expect when you’re expecting digital twins 

Digital twins of employees can help organizations reap productivity gains and useful for unsafe work environments.

Where were you at the peak of the Covid-19 pandemic?

Some folks may recall spending 2020 making sourdough bread or DIY dalgona coffee. Others might still cringe when they remember how they always forgot to unmute when speaking on endless Zoom calls.

For IT professionals, the pandemic presented some once-in-a-lifetime challenges. Between 2019 and 2021, the number of 

 in the country tripled, from 9 million people to more than 27 million, according to 

. The wave of remote work threw many IT professionals into the Wild West, forcing them to fight off pesky Zoom bombers, rescue remote colleagues from forgotten passwords and outdated apps, and act as cybersecurity sheriff amidst a swarm of scammers trying to take advantage of remote work and health anxiety.

IT Brew caught up with several IT professionals to understand how they dealt with all these issues (and more!) during the early days of the pandemic.

Between March 1 and May 31, 2020, 42 US states and territories issued stay-at-home orders, 

. Jesse Wolcott, who was an IT manager at hotel and casino entertainment company Caesars Entertainment during the pandemic’s early stages, told IT Brew he found out the Horseshoe Casino Baltimore would be closing just after he returned from a trip to Japan.

“We’re closing the casino…which is words that don’t go together,” Wolcott, now an assistant director of IT at Royal Farms, said.

The impromptu halt on the world came with a few benefits. For the next eight weeks, Wolcott walked through an empty casino, giving him the opportunity to tend to things he previously didn’t have the time to do.

“I’m walking around to my server room, blowing stuff out with compressed air, and taking the trash out, and cleaning up my server rooms,” Wolcott said. “And I’m like, ‘This is great. I’m finally getting all these things done.’”

For Wolcott, assisting casino employees in a remote work environment wasn’t “too tragic of a transition,” given the fact that employees who needed to do remote work had already done so to some extent in the past and already had equipment. However, that task was top of mind for many IT workers whose colleagues weren’t familiar with working from their couches. Pedro Mendez, director of IT at dairy product manufacturer Tropical Cheese Industries during the pandemic, said one of the challenging parts of this adjustment was helping his colleagues learn new ways of using technology.

“Not too many people realize how technology plays such an important part [in] how our company operates or runs,” Mendez said. “Not too many people paid too much attention to that until that time.”

Mendez’s team of three supported roughly 350 employees, 200 of whom owned at least a couple of different work devices. Employees were sent home with computers that had TeamViewer installed in the event that they needed IT support, which Mendez said grew tenfold. In addition to the challenge of troubleshooting problems remotely, employees had to deal with additional variables such as poor internet connectivity.

“We had a very tight shift. We were always on call,” Mendez, now a director of IT at bedding manufacturer Pegasus Home Fashions, said, adding that he is very proud of what his team was able to accomplish.

When it came to IT/OT operations involving machinery, Mendez said the company and his team took precautions that would help employees do their jobs while remaining safe: “We started implementing gloves or trying to minimize the amount a computer will need to be shared by multiple people, things like that.” Tropical Cheese was able to operate for the entire pandemic, excluding one week when a few employees were sick.

David Torgerson, VP of technology and security at Lucid Software, which builds software products for visual brainstorming and diagramming, said the hypothetical scenario of Lucid employees needing to work remotely had always been discussed within the company. However, that hypothetical suddenly became real when Lucid’s CEO told Torgerson that the company’s employees would be sent home to work remotely…in the next 20 minutes.

“I was like, ‘Yeah, we’re ready. It’ll be fine. It’ll be fine. It’ll be fine,” said Torgerson, who was a senior director of DevOps at the time. “And then I ran to my team, saying, ‘Are we going to be fine? If not, we have to make it fine.’”

Torgerson said the transition from in-person to remote at Lucid was smooth: Shifting the company from a free version of Zoom to the premium one was one of the biggest changes. However, fulfilling employees’ desire for connection proved a challenge.

The issue led Torgerson to leverage his technical role to foster more connections among the company’s workforce. In addition to leading an initiative that taught employees how to be “successful” while working remotely (tips involved taking showers as often as one would when commuting to the office), he helped his organization experiment with ways they could use their current application stack for virtual social events.

“We set up a rotation that was an opt-in of just connecting people randomly together, different departments, different teams, no agenda,” Torgerson said. “We just gave people time to just talk.”

“That intentional ability to help people feel recognized, feel seen, feel heard has made a huge difference,” Torgerson added.

Social distancing and social engineering, too.

 As employees juggled work and their personal lives from the comfort of their homes, malicious actors tried to take advantage of organizations as they navigated through unprecedented territory. Stratascale Field CISO Casey Corcoran said the pandemic accelerated the adoption of 

 policies to enable remote work during a time when endpoint detection and response was “scarce.”

Before 2020, Corcoran continued, organizations had mostly relied on resources like virus scanners. However, those tools weren’t as useful with workers falling back on their own PCs and phones.

“Your home computer may or may not have had any of that on it,” Corcoran said. “There was no way to understand what that machine had been exposed to [or] who was even using that machine.”

 was another problem for companies as employees got creative with tools and services to help them with the remote-work version of day-to-day tasks and communications. For example, many employees began using their personal Dropbox to exchange important documents.

“People were just doing it,” Corcoran said. “They just set up a Dropbox…and then they put a corporate document up there and then send a link to somebody with very little visibility oversight on how that was being secured.”

Threat actors took advantage of these hiccups. There was a 78% increase in the number of ransomware attacks executed in March 2021 compared to the same period a year prior, when the pandemic was just beginning, according to BlackFog’s 

 blog. The new standard of remote work also allowed for the rise of 

While the attack surface widened for a number of organizations, there were still some bright spots for the industry overall. Paul Bingham, SVP and executive dean of Western Governors University’s School of Information Technology, said the pandemic really outlined the importance of cybersecurity for both organizations and users.

“Everybody was now more cognizant of it, because they didn’t want some random dude showing up on their Zoom meeting or whatever,” Bingham said, referring to the advent of “

He added that the pandemic encouraged prospective cybersecurity professionals to clearly see the value of the 

Covid-19 also reshaped how some IT professionals lead in their roles. Wolcott, for instance, said the pandemic heightened his 

 for his team “up to 100” after watching some of his colleagues fall ill.

“You have this pit in your stomach of: What’s going to happen?” Wolcott said. “And it’s not because I’m going to have to rehire. It’s not because I have a gap at work. It’s because this is a person who I spend a lot of time with and I care about.”

Mendez said the pandemic taught him that everyone is capable of learning how to work remotely. He also feels more confident about helping his current organization navigate another catastrophe.

“Most of the IT professionals that have gone through the pandemic, I’m pretty sure we all know what to do better, or how to do it better, because of both the experiences that we had and [because] technology nowadays is so much more reliable.”

An IT professional at their computer station

What it was like to be working in IT during the Covid-19 pandemic

“I ran to my team, saying, ‘Are we going to be fine? If not, we have to make it fine,’” one professional recalls.

Like the agent of a one-hit wonder pop star, many employers around the nation are pushing their employees to make a comeback…except this one is back to the office.

The big return-to-office (RTO) push appears here to stay for an increasing number of employers. According to a 

 querying 849 US managers in January, 27% of companies expect to enforce a five-day in-office workweek by the end of 2025.

But this trend requires more than just free food and other perks to coax employees into making a return.

Ivanti CSO Daniel Spicer told IT Brew that IT professionals have a key role to play in ensuring a good employee experience in a company’s RTO strategy. He said friction in the employee experience post-return can lead to employees using 

“You actually end up with more security threats, from my vantage point, when there isn’t a good employee experience because then they’re trying to figure out, ‘How do I get my job done in the face of all these challenges?’” Spicer said. “And that normally involves pulling in a bunch of other tools or using technology that isn’t approved by the company.”

Aaron Warner, founder and CEO of cybersecurity consulting firm ProCircular, said that IT professionals expecting an increase in office attendance from once remote and hybrid employees may find that returning devices have 

, unpatched software, or are out of date. He suggested that the transition is a good time to review the standard build or the expected configuration for company devices.

“Get a good, clean image for every workstation you want in your company, and start with the computers that are coming back,” Warner said, adding that it may be a good time to invest in 

Warner suggested that IT professionals should also consider revamping core policies around mobile device management, acceptable use, and privacy.

“If your policy document reads like stereo instructions, it’s probably a good time to rewrite that thing so that somebody knows that it’s important and it’s a good place to set expectations or reset expectations,” Warner said.

He added that there is value in communicating to employees their role in protecting their company from threats.

“From a security perspective, the most valuable insights you will get into your own cybersecurity come from those employees,” Warner said. “So, the better you’re able to build trust across that environment, the more you’re going to know about what’s happening inside of that environment.”

Some IT professionals currently going through the RTO transition said things may be a little different than before. Cory Rice, VP of IT at KnowBe4, said his company has reintroduced a hybrid and full-time work model for some of its employees. These days, Rice spends his time making sure employees have headsets to address noise complaints and dealing with forgotten or lost equipment.

“Now you’re back to people bringing things back and forth,” Rice said. “So, 10 people forget their chargers a day, 10 people forget their headsets a day, people just forget their computers and leave those at home.”

He said the shift back to in-person work has come with some perks, however, such as better help desk etiquette.

“Everybody got used to putting in tickets,” Rice said. “So, even when they’re in the office, rather than walk down and say, ‘I want to bother the help desk,’ they log a ticket, which has actually been a really nice change that happened.”

Disagreement over remote work return to office

Your office is requiring people to return to in-person work. Now what?

IT pros should consider reevaluating core policies around mobile device management and acceptable use of company devices, says one cybersecurity CEO. 

The war for AI talent has turned the tech industry into a real-life game of 

, and let’s just say most companies aren’t making it to the Showcase Showdown.

High salary expectations are the biggest challenge companies of all sizes face when hiring AI talent, with small to mid-size companies feeling the brunt of the sticker shock.

 querying 500 US software engineers, senior managers, and other higher ups at companies with between 250 and 10,000 employees earlier this year. Other challenges the survey referenced include a 

, a too-lengthy hiring process, and unclear role requirements.

Aaron Sines, director of AI recruiting at tech recruitment agency Edison & Black, told IT Brew that he has seen salary expectation problems time and time again, largely because of a salary expectations “mismatch” between companies and candidates.

“Companies think they can hire AI talent like they can hire software engineers, and it’s like trying to hire Elon Musk with a Toyota salary,” Sines said. CloudZero estimates that most AI professionals earn more than $100,000 with more than one-fourth (26%) earning between $150,000 and $200,000.

Sines explained that the industry is currently undergoing what he calls the “1,000 people problem.” Currently, there are about 1,000 people with the “deep theoretical knowledge” needed to build and train advanced AI models known as frontier models. (Sines noted it’s likely about 2,000 people, but 1,000 sounds catchier). The problem is every company wants to grab the cream of the crop, especially those with experience at top AI companies, leaving many regular tech companies unable to compete.

“A lot of times we’re kind of giving them the hard news that, ‘Hey, you’re way off, way off. So, unless you’re willing to adjust your expectations, we’re not going to be able to deliver on this,’” Sines said.

Eric Fehr, chief revenue officer at Search Solution Group, recalled once working with a mid-size SaaS company that was seeking an inaugural in-house machine learning engineer with an initial budget in the range of $160,000 to $165,000. Fehr said candidates with the appropriate level of experience for the role were expecting upward of $200,000.

“That’s a pretty significant gap,” Fehr said. “That caused some friction and kind of caused progress to stall for a couple weeks.”

 For companies that may not be able to afford top AI talent, Sines suggests upskilling current talent or hiring and refining entry-level candidates.

“A lot of more sophisticated engineers who’ve been working on machine learning, or something peripheral of machine learning, can definitely be upskilled,” Sines said. “And a lot of them, I think, are really eager to be.”

Digital dollar sign floating above a hand

Companies and AI talent not on same page when it comes to salary expectations

One AI recruiter tells IT Brew that he is constantly needing to do a salary reality check with tech companies seeking AI talent. 

Things you may be judged for in a professional setting: the firmness of your handshake, the amount of eye contact you make, your ability to engage in small talk near the watercooler…and the way you keep your organization secure?

 a leg up in crafting their next cyber threat, making sure employees are practicing good security hygiene and integrating secure practices in their work is more important than ever. That’s why many companies are getting creative to ensure they stay one step ahead with cybersecurity issues.

Microsoft is one company that has taken a stab at making cybersecurity more top of mind for its employees. Since last December, security has been designated as a “core priority” for every Microsoft employee. That means security is a component of biannual employee performance reviews and “considered in every employee’s annual bonus and compensation.”

Some have taken a fancy to the new approach.

Deb Arnold, who runs an eponymous boutique consulting firm, said making cybersecurity a topic of discussion during employee reviews may be a good practice for security-focused companies because employees are more likely to pay attention to things they are incentivized to do.

“If leaders want cybersecurity taken seriously, they need to embed that into performance reviews,” Arnold said. “Otherwise, it’s the classic rewarding A, while hoping for B.”

However, Arnold said incentives to encourage security-focused behaviors must be paired with a broader cultural change to be fully effective.

David Murray, CEO of the people platform company Confirm, said he sees the value of considering security as part of performance at work in the current threat landscape.

“When you look at where the world is going, it’s helpful to remind people that we all contribute to safety and security in each of our respective organizations,” Murray said. “So, I am actually supportive of the idea of introducing the concepts to folks that each one of them contributes to security and that a company’s security is only as secure as its weakest link.”

“The employees have to have the knowledge and skills so they know how to act securely,” Arnold said. “They need the right systems and tools so that secure choices are the easy choices.”

David Rice, senior editor at People Managing People, said security is more of a “compliance issue.” While security would be an appropriate topic of discussion for an IT and cybersecurity-focused employee’s performance review, he said integrating it as a norm for other employees may unintentionally leave an employee’s security habits open to interpretation.

“When we think about, ‘How do I perform at my job?’, people will have different ideas about how that gets done, and I don’t know if you want to open that door in security,” Rice said.

Rice added that incentivizing security may result in an “inconsistency” in employee behavior.

“If it’s an expectation and you’ve got to meet it or you’re going to be having a discussion with your boss that’s not so pleasant, that’s different,” Rice said, suggesting that employees are likely to adhere to proper cybersecurity practices if this is expected of them.

Companies that want to incorporate security into their performance reviews need to do so the right way, according to JLEE & Associates founder and CEO Jimmie Lee. He said employees shouldn’t be evaluated on “ambiguous” security goals and that these targets should be tailored to their specific role.

“Security looks different from every employee, so you have to have a system that’s flexible,” Lee said.

various clip images signifying a performance reviews, including five stars, speech bubbles, an abstract checklist, and bar graph

Should security be considered in an employee’s performance review?

“If leaders want cybersecurity taken seriously, they need to embed that into performance reviews,” one expert says. 

Woosah! That’s something cyber mindfulness proponents think cybersecurity professionals should do more of to combat stress on the job and thwart social-engineering attack attempts.

cybersecurity professionals sure aren’t

 found that 66% of surveyed cybersecurity professionals felt their roles were more stressful compared to five years prior.

Sumona Banerji, founder and director of industry thinktank MindShield, told IT Brew that stress often comes from the unknowns of the future.

“To me, stress comes from the feeling of something that’s imminent, that’s coming or headed towards you that essentially people see as a threat,” Banerji said. For cybersecurity professionals, she said this could look like worrying about job security after a breach or the impact a large incident can have on their company.

Banerji said frazzled cybersecurity professionals can benefit from practicing mindfulness, which she described as the ability to remain present in a given moment in their day-to-day life. Practicing mindfulness can help professionals combat anxiety and stress and allow them to respond to things with a better sense of clarity and in a “far more regulated way,” she said.

“When we are extremely present, we are able to switch off all the conversations and chattering in the mind that happens about the past or the future,” Banerji said.

Anna Collard, SVP of content strategy and evangelist at KnowBe4 Africa, added that mindfulness during interactions with technology and the digital world—often referred to as digital mindfulness—can help professionals better defend against social engineering attacks and similar threats.

Mindfulness in the wild can look like a number of things, according to Collard. She said intention setting is one example of mindfulness that could help professionals “subconsciously” focus on tasks ahead.

“On a Monday, I would sit down with a nice cup of coffee and then I make my intentions for the year,” Collard said, adding that she also jots down goals for the week and month.

She added that breathwork can also be used when professionals get “emotionally roused” to prevent them from responding impulsively to an emotional trigger. She named box breathing—a four step breathwork exercise that involves breathing in and out for four-second intervals with brief pauses in between each breath—as one technique professionals could try to incorporate when they encounter a stressful email or phone call.

“There’s so many breathwork techniques that one can use to give ourselves a few seconds before we react,” Collard said. “That’s powerful.”

 Michael Swinarski, deputy CISO at the CorVel Corporation, told IT Brew that he has been more deliberate with shaping the culture at his organization with mindfulness and employee well-being in mind. After the pandemic, he said he began to check in frequently with his staff, speak openly about his own meditation habits, and remind his team to take care of themselves.

“I often have to remind folks: ‘Listen, even in comic book superheroes, they need to take the time to regenerate. You can’t save the world if you’re not taking care of yourself,’” Swinarski said.

Swinarski said conversations and actions around stress and mindfulness within the industry are still a “work in progress.” He suggested security leaders advance these conversations by exhibiting healthy behaviors at the leadership level and leading by example.

“I like to tell folks as a leader, it’s your job to set the volume, rather than rise to it.”

Shot of a young Black businesswoman looking stressed at her desk in a modern office.

Why cybersecurity professionals should practice mindfulness

More than half of cybersecurity professionals felt their roles were more stressful in 2024 compared to five years ago.

Handing over the keys to the new driver in the family? Daunting. Handing over the keys to cloud instances at your company to a new hire? Perhaps just as daunting.

A new employee’s first day is a big deal for everyone, and especially for the IT department, which is responsible for setting up the appropriate permissions and access controls for all of the organization’s cloud-based applications. It’s a massive responsibility, given the 

 if those same permissions are not properly supervised. A 

 found that 23% of cloud identities, both human and non-human, have “critical” or “high severity” excessive permissions.

Jay Martin, CISO at IT solutions and services provider Blue Mantis, told IT Brew that the industry is in a “fairly immature state” when it comes to handling cloud permissions and that having a standardized process around it is critical.

“The last thing you want to do is onboard an administrative assistant on the HR side into your financial system,” Martin said. “So, there’s practices that need to be set up in advance.”

 Neeraj Methi, VP of cybersecurity solutions at Myriad360, told IT Brew that organizations should avoid just letting anybody have the ability to create and renege on cloud-related permissions and implement a formalized process instead.

“Define a process, open tickets, and have a trail behind everything which is being requested and denied, so that you have an idea where all these access are,” Methi said.

Kurt Seifried, chief innovation officer at the Cloud Security Alliance, added that organizations should remember that vendors are constantly adding capabilities that could shake up how things are done.

“Your cloud vendor, especially somebody like Amazon, Microsoft, Google, or Zoom even, [is] constantly adding features and security,” Seifried said. “You gotta keep up with that.”

Once an employee is successfully provisioned, the fun doesn’t stop there. Seifried told IT Brew that there are many mistakes that can be made around access permissions once set. For example, for employees who are no longer with the company, Seifried’s “lockout procedure” for Google accounts used to mean suspending the account, changing the password, and un-suspending it to hand over access to managers. That changed after he realized former employees could potentially still access the account through credentials saved on Google’s account recovery feature.

“Lessons were learned,” Seifried said.

Martin added that organizations should be mindful of appropriately adjusting cloud instance access when employees switch roles in their company, an area he said customers tend to do poorly in.

 Some companies have begun to automate the process around cloud provisioning. Methi told IT Brew that it could help bolster productivity as users are able to access cloud credentials faster and eliminate room for human error.

“If you’re doing it manually, how effective could [you] be [at] keeping track of it?” Methi said, adding that the task could become a “nightmare” for some organizations.

Karthik Ranganathan, co-founder and co-CEO of Yugabyte, an open-source distributed SQL database company, told IT Brew that the cloud provisioning process at his company is mostly automated. Ranganathan said that Yugabyte is able to constantly update its processes around onboarding and has made it a significantly shorter experience for new hires.

“Now we’re talking hours,” Ranganathan said. “So, employee starts on Monday. By Monday afternoon, we’re sending them email. They have Slack. They have everything.”

Regardless if a company chooses to partly or fully automate the cloud provisioning process, Martin said it is always important to have a formal process in place.

“You can automate as much of this as you want with technology, but the first step really is to make sure that that process is vetted, that process is documented, that you have the proper workflow,” Martin said.