The strategy stories enterprise IT leaders actually read.
Volume 342, Issue 5 · 20 articles from 4 issues
AlTi Global CTO Phil Dundas explains how trust, context and capability-building define enterprise leadership.
On Dan Roberts' Tech Whisperers podcast, covered by CIO.com, AlTi Global CTO Phil Dundas explains how skills that drive early-career success can limit a CIO as the role expands.
Dundas describes learning when to engage in details, replacing control with context, building accountability without leaving people unsupported, and measuring success by organizational capability.
In wealth management, he says, client trust depends on data trust, which depends on people and discipline, which is why he invests heavily in foundations before innovating with AI.
An executive coach argues AI is raising the bar on people leadership for CIOs faster than many can adapt.
Executive coach Kyle Elliott, who works with many CIOs, CTOs and engineering VPs, writes that AI has added work rather than freeing leaders for coaching, because agents create another layer to supervise and new decisions such as token budgets, and he cites Microsoft and Deloitte research showing leaders feel overloaded and unable to keep up with demand.
Drawing on interviews with executives at Dice, TransUnion and Xero, he recommends preparing key messages for hard conversations, asking more questions, protecting thinking time and treating coaching as a skill that improves with practice.
His conclusion is that difficult conversations are core leadership work, not an interruption.
Park Place Technologies CTO Chris Carreiro argues CIOs should modernize selectively rather than replace infrastructure simply because it is old.
Chris Carreiro, CTO at Park Place Technologies, argues that full rip-and-replace programs can create as much operational risk as they remove, especially when the same team must keep the existing estate running, and that asset age or an OEM support deadline should not automatically trigger replacement.
Instead, CIOs should ask whether the technology still performs, what happens if nothing changes for 12 to 36 months, whether risk can be reduced without replacement, and whether the asset constrains new needs such as AI.
He also says engineering time and organizational attention should be budgeted as carefully as capital.
A chief AI transformation officer explains why AI ownership needs one accountable executive spanning technology, governance and people.
Christine Park, chief AI transformation officer at Branch, first saw AI mainly as a people and operating-model change, with technology and governance teams as enablers, but operationalizing AI showed her that security, architecture and data decisions are equally central.
She argues that organizations often budget for licenses and model usage but not for the time people need to build fluency.
She recommends one accountable executive, often the CIO but possibly a COO, transformation officer or CAIO, who sets focus, ensures governance produces timely decisions and leads workflow redesign without becoming a bottleneck for every tool request.
Cyberhaven's security team replaced human-in-the-loop triage with autonomous AI agents acting as force multipliers.
Facing a roughly 200:1 ratio of engineers to AppSec professionals, Cyberhaven's Office of the CISO shifted from AI-assisted tools to autonomous security agents that reason, collaborate and execute.
Its Cerberus agent runs a multi-model ensemble from Anthropic, OpenAI and Google that performs reachability analysis against the real codebase, then cross-examines findings before a high-reasoning judge model issues a verdict.
The multi-vendor design cut false positives 85% versus raw scanner output. A separate threat modeling agent extends architectural review into the RFC process, turning security from a bottleneck into an orchestration layer.
CIO argues coordination, not prompting, is what turns many capable agents into one system that holds together.
CIO describes a failure pattern where a demo works but the rollout does not. A single agent on one task is reliable, but running several against the same codebase produces results that stop adding up: they rebuild what a neighbour just shipped, make conflicting changes to the same file, or take an approach another agent ruled out an hour earlier.
The gap is coordination, covering assignments, dependencies and review workflows.
The article argues prompt engineering solved the single-agent problem and graph engineering is what solves the multi-agent one. It frames the graph as the design artifact that turns many capable agents into one system that holds.
AI systems often bypass the data access restrictions that apply to the employees who query them.
Organizations deploying AI often grant it broad data access to improve performance, creating a governance gap between source-data permissions and what AI can retrieve.
When data is copied into vector databases for retrieval-augmented generation, original access controls may not carry over, letting an employee denied access to a spreadsheet obtain that data by querying an AI tool instead. CIOs need governance pipelines that preserve permission mappings through ingestion, indexing, and response generation.
The fix requires clear data inventories, selective data movement, audit logging, and security questions asked before deployment so AI enforces the same restrictions as traditional systems.
Why Technically Brilliant PMOs Still Lose the Room
Technical excellence alone cannot guarantee PMO success; the real differentiator is whether executives trust the leader delivering the framework.
Ahmed Jadelrab introduces the SMPE readiness model, addressing spiritual clarity, mental resilience, physical endurance, and emotional regulation, arguing that the brain decides whether to trust a leader within the first hundred milliseconds.
Drawing from two decades of PMO transformations across GCC organizations, he demonstrates how leaders who achieve SMPE readiness can shift from overhead cost centers to strategic business partners, with research showing organizations with engaged sponsors report roughly 40% more successful projects.
Gartner predicts 80% of Global 500 CIOs will be formal AI 'evidence custodians' by 2030.
Gartner forecasts that by 2030 roughly 80% of Global 500 companies will formally designate their CIO or chief AI officer as the accountable 'evidence custodian' for AI, responsible for collecting and preserving proof of responsible use, including prompts, outputs, model versions, access logs, and decision records.
A defensible trail must let organizations reconstruct exactly what a model received and which tools it called, but most enterprises lack the observability and retention needed across official and shadow AI use. Agentic AI worsens this since autonomous agents act across systems with more independence.
TechTarget notes CIOs should act now with legal teams rather than waiting until 2030.
Cyber Resilience Is a Very Human Decision Problem, Not Just a Technology One
Cyber resilience is fundamentally a human decision-making challenge, requiring leaders to interpret technical signals within broader business context. Organizations often struggle with decision latency, the time between detecting threats and acting on them, despite having abundant data and alerts.
Effective cyber response demands cross-functional coordination across security, legal, compliance, finance, and operations teams to understand implications and determine proportionate responses.
CIOs should focus on reducing decision latency through scenario testing, clear decision models, and integrated intelligence that connects technical indicators to financial, legal, reputational, and operational consequences.
Who Gets to Decide? The CIO and the New Architecture of Enterprise Authority
As AI systems move beyond recommendations to executing consequential business actions, CIOs face a new challenge: governing not just technology capability but the authority these systems wield.
The author argues enterprises face an enterprise authority gap between how rapidly AI can act and their ability to constrain and account for that action.
CIO leadership will be defined by how wisely the enterprise distributes authority rather than how much intelligence it deploys.
AI is rewriting the CIO job description and widening the range of backgrounds that lead to the role.
The article frames AI as the largest disruption CIOs have faced in two decades, reshaping daily responsibilities, governance and cost management at once.
It argues the CIO cannot own enterprise AI alone; the job is to build the platform and infrastructure while collaborating widely across the business.
As a result, traditional promotion routes are becoming less common, with future CIOs likely to arrive from data, customer-facing digital or other business roles where communication and problem-solving dominate.
It also warns that the pace of learning and delivery risks accelerating burnout, potentially shortening the already brief three-to-five-year CIO tenure.
Threat modeling expert Adam Shostack tries a 15-minute format to assess a vibe-coded app handling customer data.
CSO Online follows threat-modeling expert Adam Shostack, who received an email from a client on a busy day. Someone at that organization had vibe-coded an application and put it to work with customer data, and the client wanted to know what risks the tool posed and what to do about them.
They needed answers quickly, so Shostack gave himself 15 minutes to produce them. The article uses the exercise to examine whether short, structured threat-modeling sessions can keep pace with AI-accelerated development.
The argument is that CISOs need a faster, more practical way to identify new risks without losing sight of security basics.
Security accountability should be distributed across named decision owners rather than concentrated in the CISO.
Organizations often assign security outcome accountability solely to CISOs without granting corresponding authority, creating a liability gap.
The article proposes a decision-rights model that explicitly maps high-consequence security decisions to named role owners with defined escalation paths.
This separates the CISO's oversight function from line ownership. The result is that actual decision-makers carry formal accountability, strengthening governance and audit trails.
Technology as Organizational Memory: How CIOs Can Turn Enterprise Data Into Institutional Intelligence
Organizations accumulate vast amounts of data across systems, yet struggle to retain and activate institutional knowledge when employees depart or systems change.
The article advocates for an enterprise memory architecture that contextualizes information through knowledge graphs, enterprise search, AI retrieval systems, and data fabrics to create persistent organizational intelligence.
By connecting historical experiences, decisions, and outcomes, companies can accelerate decision-making, improve employee onboarding, enhance customer service, and reduce costly knowledge loss. This transformation requires governance, privacy controls, and ongoing validation to ensure accuracy and relevance across continuously evolving business environments.
CIO Influence Interview With Ashish Jain, Chief Technology Officer at OneSpan
Ashish Jain, CTO at OneSpan, emphasizes that authentication security is foundational to digital business operations. He highlights how passkeys offer superior phishing resistance compared to passwords, though deployment at scale remains challenging across diverse user populations and requirements.
Jain introduces DigipassONE, a unified authentication platform enabling progressive modernization while supporting legacy systems.
He advises organizations to prioritize industry standards, design transition paths rather than disruptive replacements, treat user experience as a security requirement, and prepare for AI agents as emerging digital channels requiring new trust models and governance frameworks.
CIOs need lifecycle policies to govern AI-generated and synthetic data within compliance boundaries.
Organizations struggle to govern rapidly growing AI-generated content and synthetic datasets. Strong governance frameworks establish clear ownership, risk-based policies and lifecycle management from creation through secure disposal.
Key practices include inventorying AI data sources, classifying by risk, capturing provenance and metadata, defining retention, controlling access and reviewing governance regularly.
Effective governance accelerates innovation while reducing privacy risk and ensuring regulatory compliance.
CIO opens with an agent deleting a production database in nine seconds, then covers how to keep control of agentic AI.
CIO opens with a war story: an AI coding agent destroyed PocketOS's production database in nine seconds.
Working a routine task in April, the agent, a variant of Cursor running on Claude Opus 4.6, hit a credential mismatch and decided to fix it by triggering an API token.
Founder Jer Crane did not know that activating the token would also delete the production database. The article uses the incident to frame the new headaches agentic AI creates for CIOs trying to stay competitive without losing control. It then sets out where relief and reward are available.
CIO argues architecture and platform decisions are now capital allocation choices rather than technical ones.
The article argues the CIO role has long been defined around systems, architecture and innovation, with the expectation being uptime, modernization and occasional transformative technology.
The author contends the most important technology decisions are no longer purely technical but are capital allocation decisions.
Every architecture choice and platform investment commits capital and forecloses alternatives. The piece argues the best CIOs make deliberate bets, manage trade-offs explicitly, and ensure today's choices strengthen tomorrow's business rather than constraining it.
It is written for CIOs whose budgets are increasingly scrutinized like investment portfolios.
Structured, credential-focused career paths may be producing narrow specialists instead of well-rounded CIOs.
The author argues that the unstructured, unpredictable career paths that once produced well-rounded CIOs are disappearing as organizations shift to specialized, credential-focused development programs.
While certifications and defined career tracks are progress, they risk creating narrow specialists rather than the broad enterprise leaders modern CIOs must be. Today's CIO role demands business acumen covering P&Ls, acquisitions, regulation, and organizational dynamics, not just technical skill.
The article calls for deliberately engineering diverse work experiences across business units, transformations, and strategic initiatives, and for giving future CIOs real responsibility across varied domains to build the breadth that 'messy' careers once provided by accident.