The Future of IT in the Age of AI

 To kick off 2025, I originally planned to write about the future of IT in general.  But I quickly surrendered to the fact that, at this moment in time, the future of IT really mostly boils down to two letters: AI.  Since we know AI is going to continue to advance and extend its tentacles into everything, the question is not “will it happen”, but rather “what will it look like?”  So that’s what I’m going to explore here.  Focusing on internal business operations, I’m going to lay out some AI predictions, trends, and bits of practical advice.

WHERE IS AI TAKING US?

I’ll start with the heavy stuff: be prepared for AI to drastically transform the very nature of business over the next 10 years or so.  By 2035, certain aspects of the way businesses operate might not even be recognizable to our 2025 selves.  I believe today’s business leaders need to assume that a very drastic AI transformation will play out, and then work backwards from there to develop at least a rough roadmap for your business.  If the drastic scenario doesn’t play out?  Great; you’re ahead of the game.  But if it does play out and you have not prepared?

So… let’s paint a picture of what this extreme AI-powered business scenario might look like ten years down the road.  Put on your time travel helmets – you are now in the year 2035:

• AI PREVALENCE IN 2035: The rush to embrace AI was universal.  In most industries, competitive survival required it. AI-powered businesses are now the norm.  Autonomous AI agents handle a significant portion of day-to-day operations with virtually no human interaction; these agents communicate directly with each other and carry out a wide variety of decisions and tasks behind the scenes.
  
  
• WORKFORCE IN 2035: Starting back in the early 2020’s, AI steadily improved its ability to enhance employee productivity in new and better ways.  Its problem-solving became increasingly sophisticated.  But early on, employees also realized that AI’s ability to mimic – and ultimately displace – humans could pose a threat to their livelihood.  And they were right.  Permanent employees have been significantly displaced by AI systems and freelance specialists.  Now, AI even handles most business decisions!  This has resulted in sharp reductions in human leadership teams.  Of course many roles are still primarily performed by humans.  But the hottest skill sets are now in the development and management of technology systems.  And almost every employee, no matter their role, has had to reskill, upskill, and become much more AI-literate.

• WORKER ENHANCEMENTS IN 2035:  Most employees have an AI assistant.  Wearable technology for employees is now commonplace, including things like VR glasses, controller gloves, and exoskeletons.  But, more significantly, some companies have now begun to test computer chip implants in human bodies.  These implants are designed to augment an employee’s cognitive capabilities related to their work tasks.  This practice has raised serious ethical controversy because it will ultimately put those who are unwilling or unable to do it at a disadvantage in the workforce.
  
  
• ORG STRUCTURE IN 2035: Most businesses now have a Chief AI Officer (CAIO or CAI) or a Chief Technology Operations Officer (CTOO).  It’s not common anymore to run IT and Operations as separate functions.  They are more likely to be combined within a single “AI” or “Technology Operations” department, which is often seen as the most important group in the organization.

• SPEND & REVENUE IN 2035: By 2030, the majority of companies were spending more on AI technology than on human employees in most industries. And around the same time, AI started generating more revenue than human employees. AI is now the largest driver of growth.
  
  
• COMPETITION IN 2035: AI technologies have evened the playing field, favoring small businesses whose capabilities have been enhanced to rival those of larger companies and whose agility allows them to adapt more quickly.

OK – back in 2025 (snaps fingers).  Considering that the future imagined above is even a possibility, there sure are a lot of implications for IT in the intervening years, aren’t there?

AI’S EFFECT ON BUSINESS STRATEGY TODAY

AI has become a game changer in strategic planning because of its ramifications for so many different areas of the business.  Not only will it profoundly reshape both the technical and operational sides of the organization, it will ultimately blur the distinction between them.

• IT is undergoing a “re-branding” – the increased focus on AI is, by necessity, putting IT front and center in conversations around business strategy.  Today’s IT function needs to be (and should be recognized as) a strategic business partner, an agent of change, and a driver of transformation.  IT can no longer just support strategies, it has to originate strategies.
  
• Companies are planning around both AI’s benefits and its threats – including threats to their business model. 
• IT roadmaps are being shortened – commercial AI offerings are fast to value and have low barriers to entry.  The pace of change will keep accelerating, and as a result it’s harder to plan forward with accuracy.  IT roadmaps are now commonly 12-24 months instead of 3 years, revised more frequently, with more flexibility and less detail the further out they go.
  
• Budgets are being adjusted – as we enter 2025, organizations are reducing spend in other core tech areas (such as cloud, security, and IoT) to direct more budget toward AI.
  
• Org structures are changing – ideally, someone at the senior leadership level needs to own corporate AI strategy.  Companies need to consider creating a formal CAIO (or similar) role, and consider what it would look like to create an internal “Tech Operations” (or similar) team that merges your IT and Operations functions and has a deep focus on business systems.
  
• Job roles are changing (or going away) – beyond using generative AI to augment day-to-day tasks and interact with customers, the concept of the “digital worker” is becoming a real thing. Salesforce is already pitching its Agentforce as “digital labor”.  Today, AI efficiencies in sales, marketing, and customer support are already proving their ROI.  By 2026, audio-based AI agents may outpace text-based AI agents.  In 2025 more companies will need to seriously reckon with AI actually replacing jobs. 

A TOP-DOWN APPROACH TO AI

AI initiatives fall into two main categories: 

1. Customer-facing: building AI into your products
2. Internal: building AI into your business operations 

If number 1 applies to your company, you’re already doing it (and that’s not the focus of this article).

Number 2 applies to everyone.  Some companies are already quite far along in their “internal AI” journey, and some are just getting started.  Larger companies have the resources to develop customized solutions, but the good news for smaller companies is that they have plenty of options for “buy” rather than “build”.  The catch?  There’s… a lot to choose from.  Commercial AI tools are popping up everywhere, and they’re increasingly powerful, purpose-built, and easy to use.  Vendors are already beating down your door to sell them to you.  It’s tempting to sign up for everything that sounds good in a rush to be “AI first” and show that you’re “doing AI”.

But why would you approach what may be the biggest transformation in your company’s history in such a piecemeal way?  I think a more deliberate, top-down approach will better prepare you for the future.  The challenge for small businesses is not in finding AI solutions, or even in understanding the technology.  The challenge is in developing a holistic corporate AI strategy and plan so that you can prioritize your company’s most important needs, optimize your budget and resources, avoid duplication and unnecessary thrash, and maximize the value that you realize from these solutions.

Your holistic plan would include processes for things like:

1. Discovery – determining which business processes, pain points, desired capabilities and business differentiators should be prioritized for AI
2. Developing an AI charter and policy – documenting the organization’s AI goals and expected timelines, approach, governance, and acceptable use
3. Evaluating and selecting solutions – focusing on solving high-priority problems and creating competitive advantages
4. Evaluating cost – from all angles: dollars, resources, change, and time
5. Reassessing the org chart and staffing projections
6. Educating users
7. Educating business leaders

…and (8) – last but definitely not least – focusing on your company’s data, which we’ll cover next.

DATA DATA DATA!

OK, this part is less exciting, but the most important thing about AI might not be the technology itself.  All value derived from AI starts with the underlying data!  The “garbage in garbage out” rule applies here. 

Every company is sitting on a mountain of data, collected over years, which, if leveraged to its fullest potential, could provide a competitive advantage and differentiation in their market.

At its core, what does AI do?  It takes mountains of raw data and turns it into refined, accurate deliverables in specified formats.  If you want to pave the way toward a bold future where AI is producing valuable deliverables specific to your business (hint: you do), then your business data has to be clean, standardized, and complete.

So while you’re evaluating which business processes and capabilities you want to prioritize for AI projects, at the same time you’ll need to be looking at the underlying data that enables those processes and capabilities.  Often this data will be spread across multiple systems.  For example:

• Customer service initiatives may require data from CRM, tech support, accounting, and contract management systems
• Data analysis initiatives may require data from purchasing, inventory, laboratory, and manufacturing systems
• Research initiatives may require data from emails, internal documents, policies, white papers, case studies, position papers

TIP for 2025: Understand “RAG” AI (Retrieval Augmented Generation) – this is where an SLM or LLM (small or large language model) is used to generate the core response but additional data is also brought in from external systems to augment the response.

To be clear, data hygiene has long been a major business concern.  The goal of maintaining consistent, accurate, clean data – and standardizing it across platforms and eliminating data silos – is nothing new.  But AI is bringing this concern to the forefront, and many companies are finding they need to undertake data cleanup efforts before, or alongside, their AI initiatives.  

The reward?  Commercial AI platforms are enabling processing and integration of large, diverse data sets in a way that small companies could never achieve before.  This is lowering the barrier of entry to “big data” style analysis that large companies have been leveraging for years.

SECURITY

As you can probably imagine, AI presents cybersecurity with a very sharp double-edged sword.  It’s a powerful tool for both the bad guys and the good guys.

• Bad guys: AI enhancements are already resulting in breaches that are more frequent, more efficient, easier to carry out, and on average more expensive for victims.  AI-facilitated ransomware is a major threat (and is currently a favorite tactic for political retaliation by nation-states).  AI has made phishing and other scams, like deep fakes, increasingly sophisticated and targeted.  And new types of attacks have emerged, like prompt injection attacks that can extract confidential information from generative AI systems.

• Good guys: AI is able to enhance almost every aspect of threat defense.  It can improve detection capabilities for intrusions, phishing, and malware; it can enable more accurate threat assessments, more refined alerting, and better/faster automated responses.

So, while it’s true that cybersecurity is much more automated than it used to be, so is cybercrime.  Although many companies are watching their spending right now, business leaders need to be aware that cybersecurity is on the front lines of the AI “battle”.  It is more complex and arguably more critical than ever.  Therefore, security is not an area where it’s advisable to replace employees with AI anytime soon.  Yes, AI will improve efficiencies of security teams, but skilled humans are still required to stay abreast of threats, configure the tools, understand the information and responses they generate, take appropriate actions, and communicate with management and clients.

Business leaders should also be aware that there’s a huge cybersecurity talent shortage right now.  So the advice here is, take care of your existing in-house security talent (continue to hire, retain, and upskill), and be aware that mitigation of cyber threats is always multi-faceted: it includes not just AI-powered detection and response tools but also proper access controls, fraud controls, and user training.

NOTE: Of particular concern right now is the public sector, because of its volume of sensitive data, attractiveness to foreign actors, and the fact that the public sector has been slow to adopt AI practices.

CONCLUSION

AI is here, and it is the future.  Have a plan.  Build your AI chops aggressively within your plan.  Use it to solve business problems – evaluate the suitability of available AI solutions for your key processes, pain points, desired capabilities, and competitive differentiators.  Build custom AI solutions if you have the resources to do that, but home-grown solutions will be increasingly unnecessary for small companies.  A certain degree of failure is OK in the early stages – you are building your organizational AI muscles.  Train your staff.  Train your business leaders.  Hire with an eye to AI skills – a good rule of thumb will be to screen for AI skills or AI literacy when hiring in almost every role.

Again, approach this with the assumption that eventually AI will take over all aspects of how you run your business – assume you will be “under water” in just a few years.  2024 may have been the last year that small companies could be tentatively sticking their toe in and splashing around.  By 2025 you really need to have learned how to swim.

And finally, this is the part where I let you know I can help. If the above seems big, scary, or complicated, I can help your business assess its AI needs, put these principles into practice, and chart an AI journey that sets you up for the long haul.

The IT Expectation Gap – Why Your IT Isn’t Providing What The Business Actually Needs

 

When you say “IT”, what does that mean in your organization?  You might be thinking, isn’t IT just “IT”?  And to that I would say, not so fast!  Every IT department is different.  Yes, at a basic level IT manages your Google and your Microsoft, responds to helpdesk tickets, and makes sure your internet works.  The core stuff.  But most IT departments (even departments of one person) handle a lot more than that.

Every IT team manages an assortment of functions and duties that’s dictated by the company’s type, size, budget, systems, goals, and org structure.  If IT operates on an island disconnected from leadership, its mix of required functions is almost certainly not defined, its skills and resources are assembled reactively, and things can get pretty far out of alignment with what’s actually best for the business.

In new companies, it very rarely occurs to anyone to define a scope for the organization’s IT expectations.  A charter, if you will.  It is definitely a worthwhile exercise.  If you don’t do this, you may have multiple very-important-people in your company who either A) have a different idea of what IT is supposed to be providing, or B) have never thought about it.

Heck, most IT Managers have never thought about it.  Most IT Managers, being service-oriented professionals, come in with the attitude that, darnit, I will provide technology support in whatever way is needed.  But if “whatever’s needed” is not quantified or communicated, you’ll have problems whenever undefined IT expectations aren’t met.

“We should avoid that!” you might be (correctly) thinking.  If you do produce an IT charter, It’ll give you clarity on skills, staffing, and scaling, but more importantly it will provide a mechanism for IT and executive leadership to connect and agree on exactly what IT’s role and scope should look like in your company.  This will ultimately go a long way toward avoiding those “how could we let this happen?” moments down the road.

Let’s unpack this a little further.  To start with, what are the core IT responsibilities in just about every organization?  The list is relatively short:

Core IT functions:

1. Service delivery – managing applications, systems, workstations, user accounts
2. Helpdesk – supporting the environment, fixing things when they break
3. Infrastructure management – maintaining networks and servers

Beyond this, what else might IT be expected to own?  This list is longer.  Some functions that are integral to IT can be owned outside IT.  And, especially in small companies, some functions will have shared ownership, or don’t exist yet, or have no defined owner.

Potential IT functions:

1. Compliance – data security, privacy, audits, GxP
2. Strategy – roadmapping, digital solutions & transformations, emerging technologies
3. Business Systems – enterprise platform administration, integrations, data management
4. Project Management – cross-functional projects, portfolio management, change management
5. Procurement – budgeting, purchasing, vendor & contract management
6. Web Environment – web infrastructure management, corporate website development
7. Software Development – e-commerce & internal apps, DevOps, observability
8. (And more…)

Looking at the above you might be thinking “of course IT does that” for some items, and “why would IT do that?” for other items.  This is where expectation gaps can creep in.  Why is the IT department especially susceptible to expectation gaps?

• IT supports every department, and departments’ tech needs (and expectations) can vary quite widely
• IT collaborates with many departments – Legal, Accounting, Engineering, HR, Marketing, etc. – which can lead to ambiguous ownership of cross-functional duties
• IT tends to lag behind other departments in organizational maturity; newer companies often lack a strategic IT leader and many rely on outsource providers
• Technical people, overall, tend not to be business people, and as a result they don’t always know how to take a higher-level view or ask the right questions
• Business people, overall, tend not to be technical, and as a result they don’t always have an accurate idea of what’s “doable” with existing resources
• Since IT is technical, a lot of core work is done behind the scenes that’s not easily understood by the rest of the company, which can lead to a “what is IT actually doing” perception

If all this seems like a lot to grapple with for a small company, this is where I mention I can help 🙂  I can analyze your current state against your planned future state and put together a charter to ensure your IT team is structured and resourced to meet defined expectations.  The goal is to enable IT to scale for the future, provide required skills and outcomes, and mesh with complimentary functions throughout the organization.

IT Security: What Does the C-Suite Need to Know?

 

IT security is complicated, technical, multi-faceted, and always changing.  It’s also an inescapable concern for every company.  How are the non-techies, business folks, and C-Suite leaders supposed to keep up??  What do you really need to know?  Here are 6 key principles:

1. The scary stuff – I’ll start with the part you already know: poor security leads to incidents and breaches.  These are never good for your company’s bottom line or reputation.  And it might not just be your data that gets compromised – you might expose your customers’ data, or conversely, an un-vetted vendor of yours might accidentally expose your data along with theirs.
   
   So, I know you know this, but it’s worth reiterating that breaches are costly.  There are fines associated with violating privacy laws; there are ransom payments associated with falling victim to ransomware (if you decide to pay).  And aside from the financial hit, a breach will bring significant logistical, legal, and reputational headaches.
   
   
2. The boring stuff – To fortify against the above, IT needs to do a lot behind the scenes that you’ll never even know about 99% of the time.  They configure firewalls, access rules, detection and monitoring systems, antivirus, patching, encryption, and more.  There’s a lot that goes into the day-to-day business of keeping the bad guys at bay and following best practices.
   
   
3. But security is even more than this – I was once asked in an interview, “so tell me about security?”  I was like, hmm, where do I start…  It’s not just technical controls.  It should be a mindset, a philosophy, a culture, something to be factored into every project, every system, every process in your company.  It’s something all of your employees should be trained on.  Is this always the case, especially in small companies?  Nope.  Should it be, especially as you grow?  Yup.
   
   
4. There’s doing it, and there’s proving you did it – Yes, you need to keep your ducks in a row to prevent security incidents.  You also need to document what you do.  Documentation is almost as important as the security controls themselves.  It will ideally feed into a third-party audit report like a SOC 2.  That way, if you DO experience a breach, your documentation – and your awesome clean audit report – act as evidence that you had reasonable measures in place, which can greatly reduce your legal exposure and reputational damage.
   
   
5. Compliance = customers – These days, in almost every industry, privacy and security compliance is mere table stakes.  Your customers assume – and require – that you comply with privacy regulations and you conduct security audits (like SOC 2).
   
   NOTE: for new companies wondering where to even start building their security posture, compliance is a great grounding point.  Taking steps toward adhering to applicable laws and regulatory requirements for your industry – and any contractual obligations – is a good place to start.  Adherence to a specific framework (like NIST, ISO, or SOC 2) will also definitely point you in the right direction.
   
   
6. Security is never finished – We are never 100% secure, and the bad guys are never finished finding new ways to ruin our day.  And our dependence on technology will only keep increasing.  It’s a never-ending effort – a journey not a destination – and our risk is never zero.  Ultimately, “security” is a process of mitigating, reducing, and managing risk.

So how can (should) the C-Suite participate?  What’s their role?

1. Oversight – You (executive leadership) aren’t required to be security experts, but at the same time someone outside IT needs to have visibility into the process.  IT can own the technical controls but the company owns the risks. Security risks need to be assessed as business risks.  Policies and audits should be reviewed and approved (outside of IT) annually.  This stuff directly affects your business, and leadership needs to be involved, at least at a high level.
   
2. Helping promote a security-first culture – As I mentioned, security is a mindset.  Promote it; define who owns it; ensure that security initiatives are prioritized.  Audits should have full sponsorship from the CEO.  Security is not just an “IT thing”, it extends to every department and every employee.  And the culture starts at the top.
   
3. Incident Planning – Certain activities require C-level participation, like risk assessment, disaster scenario testing, and creation of an incident response team.  Prioritize and take these seriously.

What should the C-Suite expect from their IT team?

IT can generally be relied upon to own:

• Controls – designing and implementing the technical measures used to protect data and systems
• Policies – creating, updating, and (especially) explaining and briefing leadership on major updates and, really, on anything they need to know
• Audits – until such time that you have a compliance department, it’s fair for IT to own the security audit process
• Staff Training – your employees are your “human firewall”; security awareness training is critical
• Communication – proactive monitoring, tracking, notification, and documentation of risks and incidents

Of course there’s a bit more to all this! The above is meant to be an overview, but here is the part where I mention that I can help 🙂  I can start with an assessment of your current security stance, structure, skills, gaps, priorities, and help you develop a plan.  Contact me if you’d like to discuss.

Managing Change in Small Companies

 

One of the biggest unexpected hurdles when small companies start to scale up is change management, which is really the big brother to project management.  It can sneak up on you.  With growth comes operational complexity.  More and more projects start happening simultaneously, and they compete for limited attention and resources.  At a certain point you may start to notice you’re losing track of change at multiple levels:

1. Small: Individual project change – managing the planning, implementation and communication around single projects
2. Big: Organization-wide change – managing priorities, budgeting, resource allocation, and timing across your company’s full range of projects

This raises the question: who has the top-down view of all your various initiatives, priorities, and resource allocations?  Well, if you’re like a lot of small companies – maybe nobody!  This can be a problem.

When your company is small, your IT people are project and change managers whether they know it or not.  For that matter so are your HR people, admin staff, and department managers.  It’s usually pretty ad hoc:

• Departments probably handle their own projects (IT may be called in for the techie parts)
• IT handles back-end infrastructure stuff
• Prioritization follows the “squeaky wheel” method – whoever is loudest or most important or has the biggest “C” in their title gets the attention (today)
• No standardized project methods
• No centralized change oversight

This scenario doesn’t scale well.  It leads to ambiguity and frustration across your whole organization around who’s working on what and what the top priorities are.  (Plus your IT folks are probably pulling their hair out trying to keep up.)

When your business enters a growth phase and project activity increases, ideally someone should own:

• The holistic view – ensuring that projects are approved through a organization-wide lens
• Prioritization – prioritizing projects and allocating resources across the full portfolio
• Process – ensuring that project and change execution follow good practices & standard processes

In a small company, all of this could fall to IT, though IT probably lacks the authority, knowledge, and bandwidth to wear all these hats.  So at this moment it’s instructive to take a look at how larger companies handle this.  Larger companies are more likely to have well-defined functions for:

• Project management as a distinct discipline, centralized within a corporate Project Management Office. This includes:
  • Program Management – management of groups of related projects
• Change management which follows formal methodologies.  This includes:
  • Portfolio Management – where all corporate change requests pass through a centralized body that oversees the full portfolio of company projects

But this all sounds kind of formal, not to mention expensive, for a small company. So the question for you – small yet growing company – becomes, how do we bridge the gap between our current ambiguous landscape and this “large company” scenario that we don’t have the time or budget to build??  And, a follow-up question: how do we figure out, just from a practical standpoint, how much simultaneous change is realistic for us to take on right now?

Well this is the part where I mention I can help 🙂  If the above sounds familiar, drop me a line.  There are ways you can address most of this using existing resources. I can provide guidance on getting a handle on your current initiatives, and how to build structure for change within your organization without hiring a squadron of Project and Change Managers before you’re ready.