Enterprises are racing to deploy AI agents, but simply layering agentic capabilities onto legacy software stacks creates fragmented, siloed "Franken-Agents" that increase enterprise technical debt. Organizations instead need an AI-native architecture that orchestrates intelligent systems around business outcomes rather than disparate, disconnected tools ...

Artificial intelligence (AI) accelerates code production. We know this. It's also no secret that with AI-powered acceleration comes risk — to quality, security, performance, and more. What's less understood is the threat to digital accessibility, and, more importantly, why accessibility risk matters. Deque's recent survey ... underscores the point: organizations are generating accessibility debt faster than it can be addressed, at the exact moment regulation is making that debt most consequential ...

How can you prove to auditors that your organization's software conforms with security, governance and privacy requirements? If you answered, "we test it and show auditors the results," you may be missing the mark when it comes to the relationship between software testing and audits. On their own, test results are evidence of little more than the fact that you ran tests ...

The 2023 MGM Resorts cyberattack is a useful reminder of what happens when access controls fail beyond the initial login ... The lesson is not that credentials can be stolen. They will be. Employees make mistakes, passwords are compromised, and systems are misconfigured. The more important question is what someone can reach once they get in. That is where zero trust becomes an architecture problem rather than a product purchase ...

Humans do not initiate most interactions inside a modern cloud environment. APIs, workloads, and service accounts are handling an increasing share of access and data movement. AI agents trigger actions, often operating continuously and largely out of the team's visibility, and are responsible for securing them. Identity governs all of this, and the scale of that governance problem is large ...

There is a school of thought when considering AI security, if we can control the model, it is possible to control the risk. I don't buy it ... I have been on the receiving end of this argument for 30 years, and the industry keeps arriving at the same conclusions from first principles as though nobody kept notes ...

CI/CD pipelines typically don't become complicated due to a single poor decision. Complexity builds gradually as teams add new requirements for testing, security, deployment, notifications, artifact management, compliance, and other controls. Each new requirement may seem reasonable on its own. The issue arises when the pipeline is no longer evaluated as a whole ...

I recently researched and wrote a benchmarking report for meshIQ, 2026 Performance Benchmarks: Open-Source Messaging Brokers Report, and its findings demonstrated the limitations of asking which message broker is the fastest. That question is incomplete. Throughput and latency numbers are important, but they often don't account for the multiple protocols, payload sizes, concurrency levels, batching configurations, and messaging patterns seen across real-world deployments ...

Today's capabilities have fundamentally transformed application security. Yet despite unprecedented visibility into technical vulnerabilities, attackers continue to compromise organizations through weaknesses that many automated tools are not built to identify. The reason for this is straightforward. Scanners excel at finding flaws in code and configuration, but attackers are increasingly succeeding by exploiting the manner in which applications behave. That distinction is becoming more important as organizations build complex digital services, rely on APIs, and embed AI into their systems ...

As enterprises rapidly adopt AI across the software delivery lifecycle, a dangerous gap is opening between deployment speed and real verification. Large language models optimize for plausibility over correctness, creating a subtle, high-severity risk: organizations over-relying on unverified AI outputs and passing flawed code into production. Here is my take on how engineering leads can balance velocity with rigorous validation, without building in hidden operational liability ...