In today’s digital-first era, IT and business teams are waking up to alerts that critical services are down, dashboards look fine, but real users are frustrated. Hidden blind spots in legacy monitoring put companies at risk for costly outages, user dissatisfaction and serious revenue losses. In 2025 alone, one in eight enterprises loses over $10 million per month to these issues, while about half lose more than $1 million every month due to undetected disruptions.

Why traditional observability fails

Most observability tools were built to watch internal systems: monitoring MELT (metrics, events, logs, traces) on owned servers, containers and apps. But the modern enterprise runs not only on custom code, but also on SaaS platforms, APIs, external cloud providers and multi-region networks. The health of Internet components—DNS, SSL, routing and ISP reliability — now directly impacts the user experience.

Traditional Application Performance Monitoring (APM) tools struggle to capture and interpret issues that arise beyond your infrastructure. As a result, even as backend metrics report “green,” users experience outages, slowdowns and errors that go undiagnosed.

End-to-end visibility: APM plus IPM

To close these blind spots, leading organizations now couple APM with internet performance monitoring (IPM). While APM provides an inside-out view — tracking internal code, system health and traces—IPM offers the outside-in perspective. It actively tracks global Internet health, the performance of APIs, cloud services, regional ISP health and more. Together, they provide teams with real-time, end-to-end visibility from code to end user, regardless of where the disruption occurs.

 You know what? Notably, organizations such as SAP, IKEA and Akamai have leveraged this dual approach to achieve significant improvements, including faster incident detection, reduced downtime and better alignment of IT and business outcomes. Teams can now measure the actual impact of service outages on customer satisfaction and revenue, not just system uptime.

The role of OpenTelemetry for data unification

OpenTelemetry (OTel) has emerged as the glue binding APM and IPM ecosystems. As an open standard, OTel standardizes a set of traces, metrics and records across heterogeneous systems. Adopting OTel helps enterprises avoid vendor lock-in, standardize cross-platform monitoring and reduce device creep and complexity, according to CNCF.

For instance, a retail enterprise could deploy OTel SDKs in its mobile and web apps, feeding telemetry data simultaneously to both APM and IPM systems and providing centralized, actionable dashboards for both operations and business analysis.

Why centralize observability operations

With increased complexity and the growing cost of fragmented tools, many enterprises are forming centralized observability teams. These teams standardize tool selection, enforce best practices and ensure that observability is aligned with business priorities — not just tech KPIs. This consolidation reduces licensing and training expenses, prevents tool sprawl and improves collaboration and agility.

EMA research and Elastic surveys confirm that centralized teams are most likely to champion IPM adoption, acknowledging that external Internet paths are now as critical as internal code paths to user experience and business outcomes.

Real-world use cases: Preventing blind spots and business losses

1. Retail e-commerce: Outage on Black Friday

Scenario: A global retailer experiences slow-loading web pages for customers in Asia during Black Friday, even as internal dashboards show healthy traffic and low server latencies.

Resolution: With IPM, the team traces the problem to a regional ISP routing issue affecting CDN performance in Asia. Early detection allows rerouting and preemptive communication with customers, saving millions in potential lost transactions and preserving brand reputation.

2. Digital communication platforms: Slack

Scenario: Slack relies on observability to ensure reliable and timely message delivery across the globe. When intermittent message lags are reported, traditional logs offer no clues.

Resolution: Observability tools correlate real user monitoring with backend performance and external API health, enabling rapid diagnosis and resolution of issues, thereby keeping communication flowing and minimizing disruptions.

3. Financial services: Real-time transaction monitoring

Scenario: A bank’s transaction engine periodically fails to update account records after third-party payment API integrations are disrupted by regional Internet outages. Internal APM tools do not register any code exceptions.

Resolution: By integrating IPM, the bank detects anomalies in Internet traffic patterns affecting APIs, resolves issues promptly and compounds trust in financial operations.

4. Healthcare applications: Telemedicine reliability

Scenario: A telemedicine platform faces sporadic video connection drops for patients in certain rural areas. Internal systems operate normally, leaving staff without clear answers.

Resolution: Combining IPM with APM reveals that last-mile ISP instability and DNS resolution issues are to blame, not core services or app code. With this knowledge, the provider helps users switch to more reliable networks and invests in geo-distributed failovers for critical APIs.

5. Education systems: Data pipeline and grade record integrity

Scenario: An education provider’s grading system silently overwrites student records due to a malfunction in pipeline integrations, undetected for days.

Resolution: With data observability, the team is alerted to anomalies in data freshness and schema changes within minutes, thereby preserving data integrity and protecting student outcomes.

The payoff: Modern observability in action

Organizations embracing centralized observability tools that support OpenTelemetry, consistently achieve:

• Faster incident resolution: Problems are identified and addressed within minutes, not hours.
• Lower operational costs: Fewer redundant tools and improved efficiency lead to tangible savings.
• Superior user experience: Monitoring what truly matters to end users closes gaps before they turn into headlines.
• Greater alignment with business goals: Observability metrics directly support business KPIs, safeguarding revenue and reputation.

In 2025 and beyond, observability is about much more than uptime it is the foundation for business resilience, customer trust and IT value generation.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

In the next few years, “invisible AI” will fundamentally change how enterprises approach customer experience (CX). The concept is simple yet transformative: the most effective AI will be the least visible — seamlessly integrated into workflows, guiding customer service teams, supporting managers, and surfacing insights in real-time without adding complexity. Workforce Engagement Management (WEM) platforms represent one early example of this shift toward intelligence that empowers rather than interrupts.

At SuccessKPI, we believe invisible AI represents the next great leap in customer experience — one that places humans back at the center of technology. While over 80% of AI projects industrywide fail to meet objectives, invisible AI succeeds because it starts with the end in mind: measurable business outcomes such as ROI, compliance, customer satisfaction and agent empowerment.

This is not about deploying AI for AI’s sake. It is about achieving real results for humans — quietly, efficiently and continuously.

The evolution of engagement: From tools to intelligence

Traditional CX platforms rely on dashboards, manual workflows and sampling-based analytics. As customer expectations, regulatory pressures and hybrid work models grow more complex, these systems can become bottlenecks instead of enablers. Leaders need deeper insights and more automation, but must avoid adding friction for agents or managers.

Invisible AI solves this problem by operating behind the scenes — listening, learning and supporting without requiring users to learn new tools. It continuously monitors calls, chats and interactions to evaluate sentiment, compliance and intent, delivering timely nudges, risk alerts and guidance exactly when needed.

Agents stay focused on customers. Managers stay focused on strategy. AI quietly handles the heavy lifting.

Why cloud-based AI wins over DIY AI

A critical enabler of invisible AI is the shift to cloud-native intelligence. Enterprises and customer service organizations increasingly recognize that:

• Cloud-based AI delivers faster innovation because models improve continuously without internal rebuilds.
• It scales instantly to support peaks in interaction volume without costly hardware or engineering.
• It dramatically reduces total cost of ownership, eliminating the need to hire specialized AI talent, manage infrastructure or retrain models manually.
• Security, compliance and resilience benefit from the collective investment of leading cloud providers and AI platforms.

Building AI infrastructure in-house may seem appealing, but the pace of model evolution means internal systems become outdated almost immediately. Invisible AI requires constant learning, tuning and deployment — a cycle only cloud-based platforms can realistically sustain at enterprise scale.

From reactive to predictive: Quality elevated at scale

Historically, quality processes relied on random sampling and slow feedback cycles. Invisible AI changes this entirely. Every interaction can be analyzed automatically, scored for compliance and sentiment and grouped by themes or emerging issues.

Leaders gain real-time intelligence about risks, billing issues, product failures or shifts in customer tone — long before they escalate. Agents receive immediate, supportive guidance instead of waiting for quarterly reviews. Quality improves while reducing bias, workload and manual analysis.

Invisible AI thrives when organizations define their desired outcomes from the start, such as:

• Improving customer satisfaction and loyalty
• Ensuring compliance and reducing risk
• Enhancing agent performance and retention
• Driving measurable ROI through efficiency gains

The technology then supports these goals organically, upgrading itself over time without requiring users to adapt or retrain.

This mindset — building AI results, not AI tools — is what separates successful implementations from the 80% that fail.

Automation paradoxically makes workplaces more human. By removing repetitive tasks and surfacing contextual insights, invisible AI allows people to do what they do best: empathize, problem-solve and build trust.

Imagine an agent who automatically sees emotional signals, historical interactions and account insights without searching or switching screens. Imagine a supervisor alerted instantly when sentiment dips so they can intervene proactively. That’s invisible AI in action.

One hallmark of invisible AI is continuous, silent improvement. Models grow more accurate, compliance frameworks update automatically and sentiment detection adapts to new languages and cultural nuances — all without retraining sessions or system downtime.

For CIOs and technology leaders, this means stability paired with continuous progress — a rare combination in enterprise transformation.

The Future: AI that disappears into great experiences

By 2026, invisible AI will be indispensable to customer experience operations. Early adopters will enjoy stronger outcomes, more efficient operations and more empowered employees.

As AI grows more advanced, it will also grow less visible. The future is technology that blends so naturally into workflows that users barely realize it’s there — they simply notice that everything works better.

That is the true promise of invisible AI: not to replace humans, but to elevate them.

The organizations that lead the future won’t be the ones promoting their AI. They’ll be the ones whose customers and employees hardly notice it at all — only that their experiences feel effortless.

And that’s how we’ll know the future has arrived.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Amazon has set up a new in-house AI organization reporting direct to the CEO, responsible for its Nova range of AI models, silicon development (the Graviton, Trainium, and Nitro chips) and the emerging development of quantum computing. The new move will bring AI and advanced technology research into the heart of Amazon itself, where previously it was part of Amazon Web Services.

The new organization will be headed by Amazon veteran Peter DeSantis, who launched the company’s cloud storage service EC2 and is the current leader of AWS’s Utility Computing Services.

Amazon CEO Andy Jassy announced the change in a letter to staff, saying DeSantis had a track record of solving problems at the edge of what’s technically possible. “With our Nova 2 models just launched at re:Invent, our custom silicon growing rapidly, and the advantages of optimizing across models, chips, and cloud software and infrastructure, we wanted to free Peter up to focus his energy, invention cycles, and leadership on these new areas.”

DeSantis will report directly to Jassy, rather than AWS CEO Matt Garman, stressing the importance of AI to the company.

DeSantis has some history here. Last year, he took to the stage at re:Invent to announce the launch of a 10p10u, an enhanced network developed to handle the expected increase in AI-generated traffic.

The more things change…

The introduction of the new division within Amazon itself is a major shift in philosophy. Sanchit Vir Gogia, Chief Analyst, Greyhound Research said that the move was not a vanity reshuffle. “Amazon is admitting that AI is now inseparable from infrastructure economics, infrastructure control, and infrastructure power. The unit of decision shifts from ‘Which service do I try?’ to ‘Which stack do I align with?’ Within this world: framing, cloud and AI stop being parallel tracks in your organisation but merge into a single platform governance problem.”

While the reorganization has big consequences within Amazon, customers for its cloud computing services are unlikely to see much difference, at least for now.

… the more they stay the same

Brian Jackson, Research Director at Info-Tech, thinks that, in the immediate term, there will be no difference in the way that companies buy from Amazon.  “I don’t see this affecting the way that customers engage or use their AWS services. AWS has its AI products clearly defined now, with agents that help developers produce code, Bedrock to develop applications that leverage a range of LLM options, and then there is SageMaker and Nova Forge for different aspects of AI training. Those products will remain the same,” he said.

The development of Nova 2 could provide an interesting option for organizations. “Amazon positions the Nova family of LLMs as providing outputs that are almost as good as the very best models at a fraction of the cost,” said Jackson. “If you’re looking for an LLM to solve a specific business problem, Amazon Nova is an option you’ll consider and test to see if its outputs are going to be just as effective for your use case as GPT 5.2, and deliver it at a much lower cost per token.”

Justin Tung, Senior Principal Analyst at Gartner, agrees that the Amazon move will offer its customers a genuinely new option.  “While organizations seeking the most advanced, high-performance models may not view Nova 2 as the leading option, it provides a compelling balance of speed, accuracy and, importantly, cost. For many enterprise use cases, the ideal model is not necessarily the most powerful, but the one that delivers reliable performance at a more accessible price point – and in that regard, Nova 2 remains a strong and practical choice.”

Quantum computing on the horizon

Perhaps the more interesting move is the inclusion of the nascent quantum computing development within the new organization. Eric Kessler, general manager of AWS Braket, speaking at re:Invent, this year, said that Amazon estimates that fault-tolerant quantum computing will be possible for scientific use cases by the end of the decade.

“Putting quantum computing in this new division makes sense because Amazon views AI and quantum computing as having a mutually beneficial relationship. That is, AI will be used to advance quantum computer design, and quantum computing will be used to advance AI, by acting as data samplers to generate high-quality training data,” Jackson said.

Greyhound’s Gogia said that by pairing quantum with AI and silicon and bringing the whole division within Amazon itself, the company is signalling that specialized compute will increasingly be consumed as managed infrastructure with integrated services, rather than as stand-alone exotic experiments. “If CIOs treat quantum as a branding exercise without governance, they will burn credibility and budget. If they treat it as disciplined R&D with milestones, they build readiness at low cost.”

He added that “Quantum is not a mainstream production lever yet, but it is strategically rational for Amazon to keep it close to its AI and silicon agenda, because when quantum does become useful for narrow domains, the organizations that will move first are the ones that treated it like a governed capability.”

The integration of these advanced services under the general Amazon umbrella is a move that stresses how important AI is going to be to organizations in the future. Amazon recognizes that it’s not just an aspect of IT services but a crucial element in every aspect of purchasing.

Diciembre es un mes intenso para la industria del juguete, el momento cumbre de la campaña de Navidad. La elevada demanda lo convierte en fundamental para las cuentas de resultados: según las proyecciones de la Asociación Española de Fabricantes de Juguetes (AEFJ), en ella se concentrarán el 60% de las ventas anuales.

Sea en Navidad o fuera de ella, la industria del juguete es un potente actor económico. A nivel global, y según datos de 2023 de Circana para la International Council of Toy Industries, mueve unas ventas por valor de 108.700 millones de dólares. Las cuentas de Euromonitor (de 2024 y que incluyen en el total también a los videojuegos) hablan ya de 279.000 millones de dólares. En España, la AEFJ prevé para este año una subida del 2,5% de la facturación, con un gasto medio por niño en juguetes en la campaña de Navidad de 195 euros.

La lista de los juguetes más deseados incluye toda clase de productos. El ranking anual que elabora cada Navidad Amazon lista juegos de construcción, robots, muñecas, cocinitas y clásicos como juegos de cartas. Este amplio abanico evidencia otra de las cuestiones que transpiran los análisis del sector, el de que este es un mercado complejo, que debe atender a muchas variables. La industria del juguete no solo tiene a niños y niñas como clientes finales (y todos los familiares que se encargan de hacer realmente esa compra), sino también a personas adultas que compran para ellas mismas. Es la emergente categoría de los kidults, “un segmento clave de crecimiento”, como concluye Euromonitor. De hecho, muchos juguetes se compran por nostalgia, confort emocional, conexiones sociales o hasta escapismo, según esta firma de análisis.

A la variedad del propio público objetivo del juego y de sus razones para la compra se suman la regulación, las crecientes expectativas sobre el alcance y valores de los juguetes o los retos marcados por las tendencias cambiantes de mercado. Jugar puede parecer muy sencillo, pero cumplir con las expectativas no lo es tanto. “La industria del juguete evoluciona continuamente, integrando nuevas narrativas y valores sin renunciar a la esencia del juego”, asegura Marta Salmón, presidenta de la AEFJ, al hilo de la presentación de previsiones de la asociación. “Esta capacidad de renovación constante es clave para mantener un mercado dinámico y competitivo”, suma.

Ante un mercado complejo y variado, se necesita innovación y tecnología.

Tecnología para innovar y seguir el ritmo

“El sector del juguete siempre ha sido en cierto modo pionero a la hora de adoptar algunas tecnologías e incorporarlas en los productos”, explica a CIO ESPAÑA Joaquín Vilaplana, director de innovación y sostenibilidad en AIJU Instituto Tecnológico de Productos Infantiles y Ocio, situado en el epicentro juguetero español, el Valle del Juguete. “Es un sector que es atrevido a la hora de innovar en el producto”, añade. Esto se traduce no solo en el lanzamiento de juguetes de base tecnológica (que deben, eso sí, mantener unos precios lo suficientemente competitivos como para ser atractivos en un mercado sensible al coste: “tiene que ser bueno, bonito y barato”), sino también en el uso de herramientas tecnológicas en su día a día.

El sector “avanza a la industria 4.0”, incorporando soluciones para monitorizar y planificar la producción, sistemas de control y demás herramientas para una fabricación optimizada y eficiente. “Dependiendo del tamaño de las empresas, existe una continua actualización en las metodologías”, indica Vilaplana. La tecnología no está solo “en el producto en sí, sino también en la fase previa de diseño y fabricación”. El sector armoniza el uso de “formas tradicionales de fabricar y producir” con la incorporación de nuevas herramientas punteras.

El análisis de datos ayuda a comprender las tendencias y afinar el lanzamiento de productos (que, aunque hagan su agosto en diciembre, ya deben pasar por las ferias sectoriales de inicio del año), así como mejorar la planificación de fabricación. “Es muy importante tener una capacidad de previsión buena, porque si no es imposible llegar a todo”, señala el experto, explicando que cada vez es más complicado gestionar el riesgo y que los modelos de compromisos de compras en ferias está cambiando. “Te confirman los pedidos cada vez más tarde y la capacidad de reacción es cada vez más ajustada”, indica.

Igualmente, la propia naturaleza del mercado del juguete hace más clave a la tecnología. Al ser un sector con una estacionalidad muy clara, se necesita ser capaces de gestionar ese pico sin que nada falle. Las herramientas de gestión logística son fundamentales. Al tiempo, el boom de internet también ha cambiado el estado de las cosas: el sector ha tenido que adaptarse a la venta online. “La empresa tiene que ser capaz de suministrar o entregar en plazos muy ajustados y estrechos”, suma el experto.

AJIU

Juguetes ante los retos del siglo XXI

La tecnología también está ayudando a que los juguetes naveguen los retos del siglo XXI, como ser más sostenibles o afrontar nuevas materias primas, al tiempo que ha abierto nuevas oportunidades, como el de hacerlos potencialmente más inclusivos.

“Hay infinidad de familias de productos que, siendo clásicos, tienen un potencial a la hora de integrar nuevas tecnologías o conseguir ese enfoque de inclusividad”, apunta Vilaplana. En su centro tecnológico, hacen “evaluaciones de usabilidad y jugabilidad del producto” que ayudan a comprender cómo funcionan los juguetes con cada grupo poblacional y a abrir nuevas características que hagan del producto algo “más inclusivo”, ya que “puede ser utilizado por públicos con ciertas limitaciones”. Al hacerlo, también ganan en valor educativo sobre la diversidad. “Un juguete es un elemento educativo”, recuerda, que puede “potenciar determinadas capacidades y desarrollar determinadas habilidades y actitudes”.

Otro de los grandes retos es el uso de materias primas. Algunas estimaciones señalan que el 90% de los juguetes se siguen haciendo a nivel global con plástico, lo que convierte a la juguetera en una de las industrias más intensas en el uso de este material del planeta. Muchas compañías han lanzado programas de I+D para encontrar alternativas mucho más responsables o más fácilmente reciclables. Abandonar por completo el plástico no es del todo sencillo. Ahí está el caso de Lego, que en 2023 dejó de usar plástico reciclado de botellas cuando descubrió que no reducía su huella de carbono (la compañía, aun así, insistía entonces en que seguían comprometidos con la sostenibilidad y buscando formas alternativas). Desde la industria del juguete recuerdan, con todo, que el plástico de los juguetes se puede reciclar, aunque no sea sencillo porque no hay tanta escala como puede haber en, por ejemplo, el plástico de los envases.

Y, finalmente, los juguetes deben enfrentarse también a las diferentes regulaciones, algo para lo que la tecnología está muy presente.  “Un requisito que acabará afectando es el pasaporte digital del producto”, explica Vilaplana. Es un reto que tocará a todos los sectores manufactureros, pero que el juguete tendrá también que abordar con sus propias peculiaridades.

AIJU

La era de la IA

Sin duda, otro de los grandes retos a los que tendrá que enfrentarse la industria del juguete es el de la inteligencia artificial, que está también llegando ya a sus productos finales. Más allá de lo que pueda suponer como apoyo en la fabricación o comercialización, la IA se podría asentar como un complejo elemento más de la propia identidad del juguete, una pieza más del juego.  Compañías de nuevo cuño, como Curio, están integrando IA directamente en los juguetes, creando muñecos que son al tiempo chatbots. “Combinamos tecnología, seguridad e imaginación, creando un mundo de juego en el que la ciencia y las historias toman vida”. Así es como se presenta esta empresa.

A las startups que experimentan con productos potenciales se suman los movimientos de los grandes gigantes. Este mismo diciembre, Disney anunció un acuerdo estratégico con Open AI. El gran titular es que Sora podrá generar vídeos cortos (no comerciales, puesto que son para fans) con los personajes del universo de la multinacional. Sin embargo, el potencial podría ir más allá, puesto que en la nota de prensa aseguran que se integrará potencialmente en más áreas. Más claro es el movimiento de Mattel, que cerró su propio acuerdo con Open AI, en este caso a principios de verano. “Cada uno de nuestros productos y experiencias está diseñado para inspirar a los fans, entretener a las audiencias y enriquecer la vida mediante el juego. La IA tiene el poder de expandir esa misión y ampliar el alcance de nuestras marcas en nuevas y emocionantes vías”, señalaba entonces Josh Silverman, el máximo responsable de franquicias de Mattel. El comunicado ya dejaba claro que se avecinaban “productos alimentados por IA”.

Aun así, este movimiento sectorial no está exento de críticas y de dudas. Al fin y al cabo, la IA ya protagoniza estos debates fuera del mundo de los juguetes. Es más que esperable que lo haga también dentro de ellos. Como muestra una prueba de The Guardian con uno de estos muñecos IA, se cuestiona el impacto en privacidad, relaciones sociales y hasta salud mental. Se teme que abra lo que ya se ha bautizado como el empathy gap (la brecha de la empatía), perdiendo de vista que aquello son juguetes y no personas, o que se genere una nueva brecha digital entre las familias capaces de navegar este nuevo contexto y las que no. En resumidas cuentas, los juguetes deben enfrentarse a los mismos retos que esta tecnología encuentra en otros sectores.

¿Cómo adaptarse a los cambios que supone la irrupción de la inteligencia artificial generativa en el seno de las empresas? ¿Qué riesgos comporta en el día a día de las organizaciones? Para muchas de ellas, la IA generativa es “una ola” que nos está “pasando por encima”, a la que no es fácil adaptarse porque muchas veces llega “sin comprarla” y sin que desde la dirección se haya establecido un proceso claro de adaptación a los procesos productivos. De todo ello se habló en un almuerzo de trabajo organizado el pasado 11 de noviembre por CIO ESPAÑA con la colaboración de Red Hat y Accenture, que fue moderado por Fernando Muñoz, director del CIO Executive España y en el que responsables tecnológicos de distintas organizaciones compartieron su punto de vista sobre estas herramientas y sobre el concepto de soberanía digital, cada vez más relevante para las compañías.

Manuel Tarrasa Sánchez, CIO y CTO de TuringDream, apuntó tres grandes retos para la adopción de la inteligencia artificial generativa. “El primero —apuntó— viene desde arriba, porque el consejo de Administración ejerce presión para que se use la IA”. “El problema es que las empresas no encuentran gente que sea capaz de aunar conocimientos de IA y de negocio”, explicó. La solución a su juicio pasa por habilitar centros de competencia para formar los profesionales adecuados. “El segundo problema —prosiguió— es que la IA también llega desde abajo. Los empleados se dan cuenta de que puede ser un acelerador de su carrera y, aunque las empresas cierren el acceso a ChatGPT, los trabajadores lo llevan en el móvil”.   

El tercer problema, señaló, viene de las alucinaciones. Entre el 10 y el 30% de los modelos las sufre, aunque esto es algo que, en su opinión, se va a poder solucionar con las IA agentivas. El experto también apuntó otros de los grandes riesgos de instalar proyectos piloto, que la persona que lo haya instalado abandone la organización. “El mayor riesgo está en garantizar la continuidad del servicio”, remarcó.

Garpress | Foundry

Emilio González, jefe de sistemas del Ayuntamiento de Alcorcón, advirtió de los peligros que entraña la ‘shadow AI’, el uso no autorizado de herramientas de inteligencia artificial dentro de una organización sin la supervisión del departamento de TI. “Tenemos que dar formación a personas para que no suban a la IA documentos confidenciales”, aseguró. “Con la IA somos superfuncionarios, pero el apartado de protección de datos persiste como el principal reto”, dijo González, quien apuntó también otro desafío: la rápida obsolescencia de las inversiones en IA.

De la protección de datos habló también Raquel Pardiñas, gerente de suministro y proveedores de TI de Atradius Crédito y Caución, quien señaló que, aunque la IA generativa sirve para ganar tiempo en tareas administrativas, muchas veces sus usuarios desconocen si están incumpliendo la Ley de Protección de Datos. “Es el principal desafío”, enfatizó.

Ana Arredondo Macua, CIO de la Oficina Española de Patentes y Marcas, describió la situación la que se enfrenta una institución como la suya. “Un examinador de patentes puede tardar 18 meses en conceder una. La IA es muy útil para reducir este tiempo, pero el examinador tiene miedo a perder su trabajo, a no ser relevante”, relató. También habló de la necesidad de interoperabilidad, algo clave en una institución que comparte información y patentes con otros estados. “La fecha de una patente es crucial, por lo que el intercambio de información es imprescindible”, dijo tras señalar que la IA aporta una base de información para ser más eficiente.

Garpress | Foundry

Propuesta de valor, no de riesgo

Sobre todos estos desafíos, Julio Sánchez Miranda, líder de la práctica de Red Hat en Accenture para EMEA, fue contundente. “La inteligencia artificial se tiene que enfocar a valor, no a riesgo. Eso va a cambiar la narrativa”, dijo. “Hay que establecer claramente el objetivo, saber lo que quiero. Es una tecnología incipiente que si no pruebas y testeas no terminas de conocer”, añadió Mar Santos, directora de ventas corporativas de Red Hat. 

Julio Sánchez introdujo también uno de los principales temas del debate: la soberanía digital. Sobre este punto, recordó que el 80% de los modelos funcionales de la IAG son americanos, un 15% chinos y solo un 5% europeos. “El concepto de soberanía es control, y hoy es un tema geopolítico”, remarcó. En su opinión, hay que tener claros los términos de contrato en los que se usa la IA y conocer qué empresas y cómo garantizan la protección de los datos. “Si usas datos personales de tus clientes en plataformas como ChatGPT puedes tener un problema”, advirtió.

En esa misma línea se expresó Nilley Gómez Rodíguez, líder de Data & AI de Reale Seguros, quien explicó cómo su compañía ha cortado el acceso a ChatGPT para asegurar con un modelo propio de IA generativa el cumplimiento normativo. “Creamos un programa que pueda ser usado para el negocio, ofreciendo formación a los usuarios”, dijo tras subrayar que el principal desafío en los próximos meses será la generalización del uso de la IA agentiva. “Para el usuario tiene que ser transparente”, aseveró.

Garpress | Foundry

Desde la Universidad Complutense de Madrid, José Arbues Bedia, director del Centro de Inteligencia Institucional, explicó cómo su institución trabaja en una triple vertiente, empleando IA para la docencia, la gestión y el análisis de datos. No obstante, apuntó su desconfianza en un modelo que, a su juicio, aún no vale por sí solo. “La IA generativa trabaja con modelos literales y cuenta muchas mentiras”, dijo.

“Estoy trabajando en no trabajar, pero aún es demasiado pronto para ello”, dijo tras subrayar que “la única palanca de cambio en la Administración es la transparencia”. En su opinión, es demasiado arriesgado tener una IA propia para la universidad. “Con SAP sí puedo garantizar unos resultados, pero no con la inteligencia artificial”, dijo.

Para Carlos Maza, director de Digitalización y Tecnologías de la Información del Tribunal de Cuentas, los proyectos de IA los deberían pagar los departamentos de Recursos Humanos y Formación. “Ahora es el momento de conocer y aprender”, dijo, no sin antes señalar que la IA “está entrando sin comprarla” a través de muchas herramientas que ofrecen servicios incluidos en sus suscripciones.

Soberanía digital: el papel de Europa

Los asistentes analizaron también el lugar de Europa en un escenario donde la soberanía digital se ha convertido hoy en una prioridad política. “Determinar dónde reside el dato nos puede parecer una pregunta cómica, pero no lo es para el Derecho que nos regula”, dijo Carlos Maza, quien apuntó que, para una institución como el Tribunal de Cuentas, que maneja datos de terceros, la confidencialidad de los mismos es clave para el funcionamiento.

“Europa va lenta en IA. El enfoque será el correcto, pero no es competitivo, y sin recursos no estamos al nivel de otras regiones”, dijo Emilio González. Para Manuel Tarrasa, los principales problemas residen en la velocidad y la escala, que hacen que la distancia se agrande día a día. Pierre Pita, el director de ventas de TI de Atradius Crédito y Caución, apuntó una línea de actuación. “La legislación DORA nos obligó a hacer mucho trabajo, pero nos da una capa extra de seguridad”, dijo.

Garpress | Foundry

Julio Sánchez explicó que Red Hat trabaja en un entorno de ‘confidential computing’, una tecnología que protege los datos en uso mediante el procesamiento en entornos seguros. “Es relevante gobernar los modelos en entornos controlados”, enfatizó. En esta línea, citó un estudio según el cual al menos un tercio de las cargas de IA deberían ser ejecutadas en entornos soberanos para proporcionar valor a la organización.

“En el futuro —concluyó— apostamos por crear modelos verticales customizables y pequeños que ayuden a optimizar las infraestructuras y a reducir costes”. “La IA ha venido para quedarse. Es un reto para todos, pero Red Hat está en el camino correcto para ayudar a usar la IA de forma controlada en riesgos y costes”, añadió Mar Santos.

When I transitioned from the CFO’s desk to a leadership coach and as a director on corporate boards, I observed a truth: that securing approval for technology investment isn’t just an IT conversation. But it’s a business conversation.

It’s about trust, alignment, language and, most importantly, shared purpose. For every CIO reading this article, note that the money you seek is not simply a line item in a budget, but it’s the future your business is seeking to build. Getting it backed by your finance team and endorsed by the Board will enable smooth implementation for you as the CIO. Here’s how you can go about it.

Understand your CFO’s perspective

Early in my corporate career, I remember a tech leader walking into my office with a slide deck full of diagrams and acronyms. I didn’t reject the idea because it lacked merit, but because I couldn’t see the business outcome.

As CFO, what I cared about were three things, which were the return on investment, risk management and cash impact. If the technology didn’t speak those languages, it would struggle for approval.

According to research, the companies where the CIO-CFO relationship is strong are far more likely to secure digital funding.

Action: Before submitting your request, ask: how does this project help shape the margin, growth, cost avoidance or lead to increased productivity? Include a cost-benefit analysis if required. Let the financial pulse of the company be at the centre of your case.

Align the tech initiative with business strategy

As a Board Director, I often ask: “How does this tech initiative support our strategic objective?” Whether it was entering a new market, improving customer experience or managing a cost base, if the technology didn’t map to one of those, the Board would push back.  

As highlighted in industry research, the shift from IT function to enterprise strategy means the CIO and CFO must operate almost as co-pilots on the business growth journey.

Action: Create a clear line of sight between the initiative and your company’s strategic growth plan. Highlight with phrases such as “supports strategic priority A,” “enables 10% faster time-to-market,” “reduces cost by X%.”

Build a compelling business case

In one of my Board roles, the tech leader, I recall, had a clear ask. He presented the Board with a clear timeline, with an ROI and the payback period. It got approved. I’ve since coached CIOs to think in those terms: the ask must be frameable in financial language, such as total cost of ownership (TCO), internal rate of return (IRR), payback period, etc., not just technical merit.

According to TechTarget, CIOs working under CFO oversight need business cases that translate into straightforward financial justification.

Action: For each major cost you identify, show the offsetting benefit (reduced cost, new revenue, risk mitigation, etc.). Include scenario modelling (base case, optimistic case). Commit to tracking outcomes. If required, educate Board members on the impact of the proposed tech initiative.

Address risk mitigation and compliance

During my tenure as CFO, I learned early that even the most promising tech initiative could stall if the risk side was invisible. Whether it’s regulatory exposure, cybersecurity vulnerability, legacy-system complexity or integration failures, the Board and finance leadership want to see that you’ve “thought about what can go wrong” as much as “what good will come.”

I recall receiving an impersonating email from my CEO seeking urgent transfer of funds when he was away on vacation. I realized it was fishy and got the tech team to check on its source and fix the future risks. Remember that the cost of non-compliance is always higher than the cost of compliance. Better safe than sorry.

A recent study emphasises that IT investments require consistent governance and value measurement to assure the CFO that the initiative isn’t a black box of cost and uncertainty.

Action: In your presentation or business case, include a dedicated section titled “Risk & Mitigation.” Outline the major threats (for example: vendor lock-in, data quality gaps, regulatory change, legacy compatibility, etc.) and map each to a control or plan. Explain how you’ll manage governance, pilot phase, KPIs, etc. Demonstrating governance and transparency converts technology ambition into a credible business investment.

Communicate in a language they understand

I’ve seen tech leaders lose the CFO or Board audience by using IT jargon. Remember, they are not IT experts and may not be familiar with the IT terms. One Board member summarized it well: “Tell me what it does for the business, not just how you’ll build it.”

As one guide on executive-level selling points out, “Selling to the C-suite requires shifting from tactical to strategic language but focusing on business outcomes, not features.”

Action: Practice your presentation with a finance colleague. Replace geek-speak with business outcomes. Use visuals that show the benefits of tech and the outcomes. Speak on growth, speed, risk, cost and not just features.

Use real-life examples and success stories

In my Board role, when I heard a CIO reference successful deployments at peer companies, it built confidence and momentum. Because people believe in success stories more than mere statements. Polish your communication and storytelling skills.

In the broader research, it’s clear that resolving conflicts between CIOs and CFOs often comes through demonstrating tangible results and building trust incrementally.

Action: Include a section in your article/request: “Proof-points”. Show internal wins (if any), even small ones. Or external industry benchmarks. Share data such as “Reduced downtime from X to Y,” “Pilot delivered 5% cost saving.” Then link it to the larger roll-out.

Foster a collaborative approach

My transition from CFO to independent director reinforced one thing: tech leaders who view the CFO and Board as adversaries lose before they begin. The high-performing partnerships I saw treated the CFO as a co-owner of the strategy, not an obstacle.

Gartner found that when CIO and CFO collaborate closely, organizations are much more likely to find funding and meet business outcomes.

Action: Set up a joint governance forum (CIO + CFO + business leaders). Invite and involve the CFO in your tech roadmap discussions. Ask how you can help you with financial visibility, or what metrics they are tracking. Frame yourself as an ally, not just a spender, to get the buy-in from your CFO.

Prepare for the future

Having served as CFO and now as a Board director, one thing is crystal clear: the investments you bring to the table today can either lock you into yesterday’s world or position your organization for tomorrow’s. As a CIO, when you come to finance or the Board with a technology ask, it’s not enough to show “what this project solves now”. You must show “where this project leads us” and showcase the destination of capability, scalability and strategic advantage.

A recent survey by Boston Consulting Group found that many technology investments stall not because they lack potential, but because they don’t integrate into a longer-term roadmap or sequence of value. In other words, you need to articulate how this investment serves today and primes the business for the next wave of change.

Whether it’s AI, cloud scalability, ESG reporting or digital ecosystems, your ask should reflect readiness for tomorrow. Are we future-ready? What actions will make us future-ready? How can we educate our people and integrate AI into our business?

Action: In your proposal, include what each phase will bring about. For example:

• Phase 1: Deliver core outcome
• Phase 2: Scale/expand
• Phase 3: Future-mode

Show how this investment creates optionality; your business is not just solving today’s problem but positioning for the next wave. By mapping out the journey, you reassure the CFO and Board that you’re not just spending, but you’re investing. You’re not just solving a problem, but you’re building a capability that serves the future. And that’s how technology funding shifts from one-off to strategic.

Bringing it all together

If you started this article as a transaction like “I need funding for project X”, shift your mindset to a partnership: “Here’s how we together will drive business growth, manage risk and position the company for the future.”

I’ve been on the finance side. I’ve sat in the boardroom listening to the voices that approve or veto. I know what makes them lean in and what makes them pause. For you, the CIO, this isn’t just about technology. It’s about business momentum, credibility, trust and shared language.

So before you walk into that boardroom or finance review, rehearse your message for the CFO and the Board audience. Use business language. Embed financial metrics. Build governance and risk clarity. Show you’re working with them, not against. And finally, tell a story. One that begins with the business opportunity, weaves through the tech solution and ends with measurable value.

That’s when technology funding moves from permission to partnership. And that’s when you, as CIO, step into the role of a true strategic business enabler.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Large enterprises will significantly miscalculate their AI infrastructure costs over the next couple of years, prompting more CIOs to expand the scope of their FinOps teams, IDC predicts.

Enterprise AI users are headed for an “AI infrastructure reckoning,” as CIOs and finance leaders realize that standard budget forecasting doesn’t work for compute-heavy AI projects, says Jevin Jensen, IDC’s vice president of infrastructure and operations research. Global 1,000 companies will underestimate their AI infrastructure costs by 30% through 2027, IDC predicts.

The cost of ramping up AI projects is fundamentally different than launching a new ERP solution and other IT systems that enterprises have been deploying for decades, Jensen says. Calculating the cost of GPUs, inference, networking, and tokens can be much more complicated than planning a budget for a more traditional IT system, and CIOs also need to consider security, governance, and employee training costs.

“AI is expensive, unpredictable, dramatically different than traditional IT projects, and growing faster than most budgets can track,” he writes in a blog post. “AI-enabled applications are often resource-intensive, coupled with opaque consumption models, and have outpaced the traditional IT budgeting playbook.”

IT leaders often underestimate the pricing complexity associated with scaling AI, Jensen writes.

From the blog post: “Models that double in size can consume 10 times the compute. Inference workloads run continuously, consuming GPU cycles long after training ends. What once looked like a contained line item now behaves like a living organism — growing, adapting, and draining resources unpredictably.”

Point of no return

As CIOs struggle to estimate AI costs, a spending frenzy by large AI vendors such as OpenAI and Anthropic adds pressure to recover the investments, some critics say. In a recent appearance on the Decoder podcast, IBM CEO Arvind Krishna warned about the cost of building 100 gigawatts of data center capacity, at a price of about $8 trillion, as the projected fuel needed to power large vendors’ AI ambitions.

“There’s no way you’re going to get a return on that, in my view, because $8 trillion of capex means you need roughly $800 billion of profit just to pay for the interest,” Krishna says. 

The math doesn’t add up, adds Barry Baker, COO of IBM Infrastructure and general manager of IBM Systems. In the short term, a single gigawatt data center will likely cost more than $75 billion, he says, echoing the concerns of his boss.

“Much of this investment is occurring in parallel resulting in the demand outstripping the supply and dramatically raising prices for every element of the cost equation — from people, to concrete, to the silicon,” Baker says.

At the same time, the self-life of the hardware at AI data centers is limited, he adds. “Adding to these staggering figures is the reality that the actual compute will need to be replaced every few years, creating an ongoing reinvestment cycle that many organizations have failed to fully account for in their long-term planning,” Baker says.

IDC’s Jensen agrees that massive AI spending by vendors and hyperscalers, such as AWS, Microsoft Azure, and Google Cloud, may keep prices high in the near term. “They’re trying to recoup their hundreds of billions of costs by trying to sell it to you for $150 billion,” he says.

Past 2027, however, AI infrastructure prices should fall, he predicts. GPU prices from manufacturers such as Nvidia are likely to come down, and the hyperscalers and AI vendors could eventually cut their prices to up demand in an effort to recover their costs.

Struggling to estimate costs

Beyond the discussion about massive spending on data centers and GPUs, many IT leaders at enterprises consuming AI infrastructure services find it difficult to estimate costs, some experts say.

The IDC prediction about underestimated costs is plausible, if not conservative, says Nik Kale, principal engineer for CX engineering, cloud security, and AI platforms at Cisco. Many organizations project AI infrastructure costs as if they were predictable cloud workloads, he adds.

“Usage expands quickly once models are introduced into the business,” he says. “A workflow designed for a single team often becomes a shared service across the company, which leads to a significant increase in demand that was not captured in the original cost model.”

Systems required to reduce the risks of running AI, including monitoring, drift detection, logging, and validation checks, can consume more computing power than expected, Kale adds.

“In several enterprise environments, these supporting systems have grown to cost as much as, or even more than, the model inference itself,” he says.

The case for FinOps

CIOs need to take precautions when attempting to determine their AI infrastructure costs, experts say, and IDC’s Jensen sees a growing reliance on FinOps solutions, with adoption no longer optional. CIOs will be responsible, with the most common reporting structure of FinOps teams residing in their offices, he notes.

FinOps practices are essential to understanding the best fits for AI projects at specific enterprises, he says. Good FinOps practices will force IT leaders to focus on AI projects with the best ROI probabilities, to understand infrastructure costs, and to adjust as conditions change, he adds.

“AI has moved technology spending from predictable consumption to probabilistic behavior,” he says. “That means financial visibility must become continuous, not periodic.”

IT leaders should focus first on the AI projects that are easy wins, but those are different at every organization, Jensen says; a relatively simple AI project at one enterprise may be impossible at another.

“If you have an idea for a project, but your competitor is losing money on it, let them continue to lose money,” he says. “If it doesn’t work, you have to change things.”

Adopting FinOps practices is a good start, but IT leaders will need to go deeper, says Cisco’s Kale. FinOps traditionally provides a mechanism to track spending and allocate costs, based resources used, but with AI, cost-control teams will need to understand how models perform and identify where their organizations are consuming unnecessarily computing resources, he says.

FinOps teams should use operational analytics that allow the organization to view how money is being spent but also show how workloads operate, he says.

“A viable strategy to limit unnecessary resource usage is to guide teams to utilize the minimum sized models available for each specific task,” he adds. “Frequently, requests can be rerouted to smaller or distilled models without impacting user experiences.”

FinOps teams should also evaluate the design of their AI retrieval systems, validation pipelines, and policy checks to ensure they are operating independently and not more frequently than required, Kale recommends.

CIOs should also pay attention to GPU use, he adds. “Frequently, GPU nodes are operating at a fraction of their total capacity due to poor scheduling and lack of consolidated workload management,” he says. “Improved orchestration and workload placement can result in substantial cost savings.”

Avoid vendor lock-in

IBM’s Baker recommends that organizations adopt hybrid architectures to avoid overcommitting to a single AI infrastructure provider. In addition, CIOs should always pay attention to the computing resources needed to operate their AI workloads, he says.

“Right-sizing AI technology investment offers significant savings opportunities,” he adds. “Not every problem requires the largest model or the fastest response time.”

Organizations should consider quantization and compression techniques and deploy smaller models tuned for specific tasks, rather than general-purpose large language models, Baker says. “Use appropriate compute resources rather than defaulting to the most powerful option available.”

Many organizations can also benefit from strategic patience, he adds. “Avoiding investments in capabilities not yet needed allows organizations to learn from early adopters who absorb the penalties of being too early,” he says.

In 2023, the UK’s NHS launched the Federated Data Platform, one of Europe’s most ambitious data projects. On paper, the initiative was flawless. It aimed to connect disparate patient data to improve planning, reduce waiting lists, and make more informed decisions.

But the project encountered considerable resistance from both physicians and patient organizations from the start. Authorities spoke of efficiency and better use of resources, yet physician and patient associations heard concerns about surveillance and loss of control. This lack of shared understanding created a divide that’s hampered the entire project.

Although this case belongs to the healthcare sector, a CIO from any other can recognize the situation of a solid initiative that, despite its logic, experiences more friction than expected.

The illusion of speaking the same language

CIOs understand they must speak the language of the business. Many have made the journey of learning how to express themselves in the language of other departments and reduce their jargon. But there are still decisions that take time, create roadblocks, or slowly progress with difficulty. Everyone is supposed to speak the same language, but in reality, the conversation doesn’t flow.

The reason is simpler than it seems. Just because several people use the same words doesn’t mean they’re saying the same thing. Terms like value, urgency, or risk are only universal in appearance. For finance, value might be margin, in commerce it means growth, and for operations, continuity.

However you look at it, such unchecked communication carries the illusion of alignment as well as the risks that come with it.

Underneath the words: the human operating system

Why is there such a disparity in meaning? It’s not a question of vocabulary or precision. Words are only the visible part, but what determines meaning is the reality ascribed to them and how each person receives them. Each area and person operates with an individual framework made up of values, beliefs, and perceptions. Therefore, each stakeholder will filter any communication or proposal through it. So it’s at this level that concerns and priorities are identified, and where not only initiatives are decided, but where the CIO’s role is perceived as either an ally who understands many perspectives, or is someone who speaks from the outside.

Listening: the underutilized tool

In the case of the NHS, the president of the British Medical Association, the main body representing doctors and healthcare professionals in the UK, wrote to the British government stating that neither the public nor the profession have been adequately consulted. This created a trust vacuum that still persists.

At this point, a crucial skill emerges for an initiative to be accepted: the ability to listen. In organizations, speaking can be a form of competition. People speak to reinforce a position, defend a narrative, or secure a place on the agenda. However, few compete to listen, and true influence usually belongs to those who know how.

Listening goes beyond mere courtesy as it’s about understanding context. With listening comes being able to grasp another perspective that might be contentious, or another interpretation of success, or what compromises are willing to be made. Without that understanding, any attempt to speak the language of business relies on assumptions.

And by virtue of listening comes the skillset of being able to better ask informed questions and pursue value-driven practices. Three examples include:

Clarifying keywords

Identify the words that most easily generate different understanding. From there, questions can be posed that force their meaning to be made explicit. It’s about directly asking what a specific word means to the other person or department. These questions reveal what’s important to other areas and prevent the CIO from making assumptions.

Defining what’s meant by success

Aim to agree on what constitutes a good outcome. What KPIs define the success of an initiative? What timeframe should it be measured by? What compromises would be acceptable and which wouldn’t? By making these limits explicit, the CIO establishes a common framework and prevents each party from interpreting success based on their own expectations.

Verifying shared understanding before closing

Use the end of each meeting to check how the message has been received. Ask someone to summarize in their own words what they believe to be the project’s purpose, what benefits they expect, and what risks they foresee. This check allows you to identify interpretations that haven’t been verbalized and to act accordingly.

In reality, these questions are just examples of a broader journey of exploring how words actually land.

From translator to trusted connector

For years, the need for the CIO to act as a translator between technology and business has been essential. This made sense while the challenge was to move beyond purely technical language. Today, it’s about aligning realities, not just words.

The CIO’s true influence won’t depend on simply expanding vocabulary, but rather on their ability to understand and operate within different cultural frameworks. When the business perceives that the CIO understands its pressures, metrics, and fears, it begins to see them as someone on the same team. From this position, alliances are born.

As this shared understanding develops, new questions arise about what the CIO’s narrative should be, and what they should say about technology, the business, and their own role in strengthening partnerships.

이번 투자는 알파벳 산하 투자사 캐피털G(CapitalG)와 멘로벤처스(Menlo Ventures)의 앤솔로지 펀드가 공동으로 주도했으며, 엔비디아의 벤처 투자 조직 엔벤처스, 세일즈포스 벤처스, 데이터브릭스 벤처스, , 아틀라시안 벤처스, 허브스팟 벤처스 등 글로벌 빅테크 및 SaaS 기업도 참여했다.

러버블은 ‘빌더의 시대(The Age of the Builder)’를 비전으로 제시하며, 전문 개발자가 아니더라도 아이디어를 바탕으로 비교적 빠르게 작동하는 소프트웨어를 만들 수 있는 환경을 목표로 하고 있다. 제품 매니저, 마케터, 운영 담당자, 의료 종사자, 예비 창업가 등 다양한 사용자를 ‘빌더’로 정의하고, 이들이 직접 제품을 구현할 수 있도록 돕는 데 초점을 둔다.

의료 현장에서 근무하는 간호사가 환자 여정 시각화 앱을 개발해 실제 청구 시스템에 적용한 사례나, 글로벌 컨설팅 기업이 제안서용 슬라이드를 인터랙티브 프로토타입으로 전환한 사례도 있다. 다만 커서, 피그마, 버셀 등 경쟁 기업들이 유사한 영역에 진출해 있다.

러버블 공식 블로그에 따르면, 러버블 플랫폼에서는 하루 10만 개 이상의 신규 프로젝트가 생성되고 있으며, 출시 첫 해에만 누적 2,500만 개 이상의 프로젝트가 만들어졌다. 최근 6개월간 러버블로 제작된 웹사이트와 애플리케이션 방문 수는 5억 회를 넘었고, 하루 평균 600만 명 이상이 러버블 기반 서비스에 접속하고 있다.

대기업을 중심으로 한 도입 사례도 점차 늘고 있다. 러버블은 독일의 도이치텔레콤과 글로벌 핀테크 기업 클라르나(Klarna)는 러버블을 활용해 기존에 수주 단위로 진행되던 기획·디자인·개발 과정을 며칠 단위로 단축했다고 소개했다. 또한 블로그에 업근된 사례에 따르면, 한 글로벌 ERP 기업은 기존에 4주와 20명이 투입되던 프로젝트를 4일, 4명 규모로 수행했으며, 현재 전체 프론트엔드의 약 75%를 러버블을 통해 생성하고 있다. 또한 글로벌 모빌리티 기업은 UX 콘셉트 테스트 기간을 6주에서 5일로 줄였고, 한 제품 매니저는 수십 분 만에 과거 수개월이 소요되던 프로토타입을 완성했다고 전했다.

캐피털G의 총괄 파트너 라엘라 스터디는 블로그를 통해 “러버블은 기업과 창업가 모두에게 사랑받는 드문 제품”이라며 “포춘 500 기업들의 수요는 소프트웨어 개발 방식이 근본적으로 변화하고 있음을 보여준다”고 평가했다. 멘로벤처스 역시 러버블을 우버, 앤트로픽과 같은 ‘카테고리 빌더’로 규정하며 장기적 성장 가능성에 주목했다.
jihyun.lee@foundryco.com

체크마르크스의 새로운 연구에 따르면, AI 에이전트가 의존하는 휴먼 인 더 루프(Human-in-the-Loop, HITL) 안전장치가 무력화될 수 있으며, 공격자가 이를 악성 코드 실행에 악용할 수 있는 것으로 나타났다.

HITL 대화창은 코드 실행, 파일 수정, 시스템 자원 접근과 같은 민감한 작업을 수행하기 전에 AI 에이전트가 실행하는 안전장치다. 이는 일종의 최종 확인 단계로, 사용자에게 ‘정말 실행해도 되는가’를 묻는 역할을 한다.

체크마르크스 연구진은 이를 ‘라이즈 인 더 루프(Lies-in-the-Loop, LITL)’라고 부르는 HITL 대화창 위조 기법으로 설명했다. 이 방식은 승인 대화창을 검토하는 사용자를 혼란스럽게 만들도록 AI 프롬프트에 악성 지시를 교묘하게 삽입하는 것이 특징이다.

연구 결과는 인간을 검증 과정에 포함시키는 것만으로는 프롬프트 수준의 악용을 차단하기에 충분하지 않다는 점을 보여준다. 사용자가 승인 요청 내용을 신뢰할 수 없게 되는 순간, HITL은 보호 장치 역할을 멈추고 공격 표면으로 바뀌게 된다.

체크마르크스 연구진은 블로그 게시글에서 “라이즈 인 더 루프(LITL) 공격은 승인 대화창에 대해 사용자가 갖는 신뢰를 악용한다”며 “대화창에 표시되는 내용을 조작함으로써 공격자는 안전장치를 무기로 전환하고, 프롬프트가 안전해 보이면 사용자는 의심 없이 이를 승인하게 된다”고 설명했다.

승인 대화창 위조, 감시를 공격 도구로 바꾸다

문제의 근본 원인은 AI 시스템이 사용자에게 확인 대화창을 제시하는 방식에서 비롯된다. HITL 워크플로는 AI 에이전트가 수행하려는 작업을 요약해 보여주고, 사용자가 승인 버튼을 누르기 전에 의심스러운 요소를 발견하길 전제로 설계돼 있다.

체크마르크스는 공격자가 정상적인 승인 대화창을 조작할 수 있음을 입증했다. 예를 들어 정상적으로 보이는 문구로 악성 페이로드를 덧붙이거나, 위험한 명령을 화면에서 보이지 않도록 밀어내고, 실제 실행될 내용과 다른 요약을 생성하도록 프롬프트를 설계하는 방식이다.

특히 터미널 형태의 인터페이스에서는 출력이 길거나 서식이 적용된 경우 이러한 속임수를 알아차리기 쉽지 않다. 체크마르크스에 따르면, 많은 AI 에이전트가 높은 권한으로 동작하는 만큼 한 번의 잘못된 승인만으로도 코드 실행, 운영체제 명령 수행, 파일 시스템 접근, 나아가 추가적인 침해로 직결될 수 있다.

연구진은 패딩이나 잘림(truncation) 기법을 넘어, 확인 화면이 렌더링되는 방식을 악용하는 다른 대화창 위조 기법도 소개했다. 마크다운 렌더링과 레이아웃 동작을 활용해 정상적인 텍스트와 숨겨진 명령을 시각적으로 분리하거나, 사용자에게 보이는 요약이 악성으로 인식되지 않도록 조작하는 방식이다.

연구진은 “공격자가 HITL 대화창에 사용되는 마크다운 문법을 이탈해 가짜 UI를 사용자에게 제시할 수 있다는 점은, 사실상 탐지가 어려운 훨씬 정교한 LITL 공격으로 이어질 수 있다”고 언급했다.

에이전트와 사용자를 위한 방어 대책

체크마르크스는 주로 AI 에이전트 개발자를 대상으로 대응 방안을 제시했다. HITL 대화창을 본질적으로 신뢰할 수 있는 요소로 보지 말고, 조작될 가능성이 있는 구성 요소로 인식해야 한다는 것이다. 이를 위해 대화창 렌더링 방식을 제한하고, 복잡한 UI 서식 사용을 줄이며, 사용자에게 보이는 요약과 실제 실행될 동작을 명확히 분리할 것을 권고했다.

연구진은 또한 사용자가 승인한 작업이 확인 시점에 표시된 내용과 실제로 일치하는지 검증하는 절차가 필요하다고 조언했다.

AI 사용자와 관련해서는, 텍스트 기반 터미널보다 풍부한 UI 환경에서 동작하는 에이전트가 기만적인 행위를 더 쉽게 식별할 수 있다고 분석했다. 연구진은 “예를 들어 VS 코드 확장은 마크다운을 완전하게 렌더링할 수 있는 반면, 터미널은 일반적으로 기본적인 ASCII 문자로만 콘텐츠를 표시한다”고 설명했다.

체크마르크스는 이번 이슈를 앤트로픽과 마이크로소프트(MS)에 공개했으며, 두 기업 모두 해당 보고서를 확인했지만 보안 취약점으로 분류하지는 않았다고 밝혔다. 두 회사는 CSO의 논평 요청에 즉각적인 답변을 내놓지 않았다.
dl-ciokorea@foundryco.com

RSAC(구 RSA 콘퍼런스) 조사에 따르면 중소규모 기업은 글로벌 대기업에 비해 보안 침해 발생 시 CISO를 법적 책임으로부터 보호할 가능성이 현저히 낮은 것으로 나타났다.

전문가들은 이러한 결과가 우려스럽다고 평가했다. 보호 장치가 없을 경우 CISO는 직무 수행 과정에서 내린 의사결정과 관련한 법적·재정적 위험에 직접 노출될 수 있기 때문이다.

RSAC가 실시한 설문조사에서 포춘 1000대 기업 소속 CISO의 대다수인 88%는 회사로부터 법적 면책을 보장받고 있다고 답했다. 반면 직원 수가 500명가량인 기업에 속한 CISO의 경우 이 비율은 53%로 크게 낮아졌다.

두 그룹 모두에서 가장 일반적인 면책 수단은 임원 배상 책임보험(D&O 보험)이었으며, 포춘 1000대 기업 CISO 응답자 가운데 70%는 해당 보험의 적용을 받고 있다고 답했다.

로펌 CM로(CM Law)의 공동 설립자이자 변호사인 켈리 리튼베리 컬핸은 미드사이즈 기업 역시 직면하는 위험은 글로벌 대기업과 유사하다는 점에서, 이번 조사 결과가 보안 리더와 미드사이즈 기업 고용주 모두에게 경고가 된다고 설명했다.

컬핸은 “미드사이즈 기업은 운영의 복잡성과 규모에서 차이가 있을 수 있지만, 랜섬웨어, 데이터 침해, 규제 준수 실패와 같은 사이버보안 위험의 심각성은 동일하다. 면책이 없다면 CISO는 개인적으로 책임져야 하는 상황에 노출되고, 이는 역량 있는 전문가들이 해당 직무를 맡는 것을 주저하게 만드는 요인이 될 수 있다”라고 언급했다.

다시 말해, 미드사이즈 기업은 고용한 최고 보안 책임자를 개인적 책임으로부터 보호하지 못한 결과로 더 큰 위험에 빠질 수 있다는 분석이다.

CISO 대상 D&O 보험 적용 확대                

CISO를 보호하기 위한 안전망은 여러 단계로 구성될 수 있다. 그중 첫 번째는 회사의 면책 조항으로, 일반적으로 정관이나 내규에 포함된 규정을 의미한다.

고용 관행 책임 보험을 제공하는 WIA(World Insurance Associates)의 존 피터슨은 “보통 법무책임자와 이사회 결의를 통해 이뤄지는 회사의 면책 조항 문구는 반드시 적절하게 작성돼야 한다. 이를 통해 CISO가 다른 이사나 임원과 동등한 수준의 면책을 받을 수 있다”라고 설명했다.

CISO를 위한 두 번째 안전망은 보험 중개사를 통해 회사가 가입하는 D&O 책임 보험이다. 피터슨은 회사에 D&O 보험이 마련돼 있더라도, CISO가 해당 보험에서 ‘피보험자’로 명확히 포함돼 있는지 반드시 정책 내용을 직접 확인해야 한다고 조언했다.

IANS 리서치와 아티코서치(Artico Search)가 공동 발표한 최신 CISO 보상 보고서에 따르면, 실제로 D&O 보험에 CISO를 포함하는 사례가 점차 늘고 있는 것으로 나타났다.

2025년 보고서를 기준으로 미국과 캐나다의 CISO 가운데 50% 이상이 해당 보험 혜택을 받고 있다고 응답했으며, 이는 지난해 보고서의 40%보다 증가한 수치다. 또한 CISO 5명 중 1명은 조사나 감사 등을 위해 외부 법률 자문을 이용할 수 있다고 응답했다.

면책을 둘러싼 쟁점

다만 보험 중개사 맥길앤파트너스(McGill and Partners)의 미국 사이버 리더 라이언 그리핀은 D&O 보험과 고용주와의 직접 면책 계약 간 차이가 종종 잘못 이해되고 있다고 지적했다.

그리핀은 “CISO 보호를 위해 가장 중요한 수단은 고용주와 직접 체결한 면책 계약”이라며 “D&O 보험은 회사가 임원을 보호하기 위해 비용을 지급하는 방식이지만, 실제로 그 보호를 법적으로 보장하는 것은 면책 계약”이라고 설명했다.

그는 공식적인 면책 계약이 없는 경우 CISO가 매우 큰 위험에 노출될 수 있다고 경고했다.

그리핀은 “이 경우 CISO는 자신의 법적 방어 비용을 직접 부담해야 하며, 개인 저축이나 개인 종합 보험에 의존할 수밖에 없다. 재정적 손실을 넘어 경력 자체가 심각하게 훼손될 수 있다”라고 말했다.

이어 그는 “설령 최종적으로 기각되더라도 집행 조치에 연루되면 수년간 상장사의 임원으로 활동하지 못하는 제재가 내려질 수 있다. 이는 향후 직업의 선택지를 크게 제한한다”라고 설명했다.

책임 공방

RB-사이버 어슈어런스(RB-Cyber Assurance)의 공동 설립자이자 대표인 켄릭 배그널에 따르면, 이런 상황의 핵심에는 책임 소재 문제가 있다. 보안 사고 발생 시 책임은 거의 항상 ‘보안을 총괄하는 인물’로 인식되는 사람에게 돌아간다는 설명이다.

전 토론토 경찰청 형사 출신인 배그널은 “포춘 500대 기업의 CISO든, 직원 100명 규모 제조업체의 유일한 IT 책임자든 문제가 발생하면 누군가는 그에 대한 책임을 져야 한다”라고 말했다.

배그널은 글로벌 대기업과 미드사이즈 기업의 차이가 노출 수준이 아니라 자원에 있다고 분석했다. 즉, 대기업 CISO는 법무팀이나 위기 대응 PR 자문 등 보호 장치를 활용할 수 있는 경우가 많지만, 미드사이즈 기업에서는 한두 명이 컴플라이언스, IT, 보안 업무를 모두 떠안는 경우가 적지 않다.

이러한 구조는 사고 발생 시 큰 문제로 이어질 수 있다. 배그널은 “회사 규모가 작다는 이유만으로 규제 당국, 고객, 법원이 기대 수준을 낮추지는 않는다”라고 지적했다.

그는 “결과적으로 법적 보호가 없다면 미드사이즈 기업 CISO는 개인적·직업적으로 중대한 위험에 직면하게 된다. 교체 예산이 배정되지 않은 오래된 시스템이나, 업무에 방해가 된다는 이유로 보안 도입을 거부한 사업 부서 등 본인이 통제할 수 없었던 문제의 책임까지 떠안을 수 있다”라고 설명했다.

솔라윈즈 사태의 여전한 여파

지난 2023년 미국 증권거래 위원회(SEC)는 솔라윈즈(SolarWinds)의 CISO 티모시 브라운을 상대로 소송을 제기한 바 있다. 투자자를 오도하고 자사의 사이버 보안 조치를 정확하게 공시하지 않았다는 혐의다. 이 사건은 결코 특수한 사례가 아닐 수 있다. 해당 소송이 최종적으로 기각되면서 CISO가 보안 사고의 책임을 개인적으로 져야 한다는 우려는 어느 정도 완화됐지만, 문제 자체는 여전히 해결되지 않은 상태다.

컬핸은 “사이버보안 리더는 침해 사고와 대응 방식에 대해 점점 더 직접적인 책임을 지고 있다. 선의로 행동했음에도 불구하고, 규제 기관과 주주, 법원이 CISO를 소송 대상에 포함시키는 사례가 늘고 있다”라고 진단했다.

미드사이즈 기업은 법무 및 컴플라이언스 자원이 상대적으로 제한적인 경우가 많아, 면책 보험은 보안 전문가의 잠재적인 안전망으로서 더욱 중요한 의미를 갖는다.

다만 컬핸은 “D&O 보험은 반드시 확보해야 하지만, 항상 모든 위험을 포괄하지는 못한다”라고 언급했다. 기업의 리스크 관리와 보험 자문을 전문으로 하는 전직 법무책임자 출신 변호사인 컬핸은 CISO를 위한 모범 사례 점검 목록을 제시했다.

• D&O 보험에서 CISO에 대한 보장 범위 확인
• 사이버 관련 청구의 보장 한도와 제외 조항 검토
• CISO와 보안 책임자를 위한 추가 면책 계약 검토
• 사고 대응과 정보 공개 정책이 CISO 면책 조항과 충돌하지 않도록 사전에 정비

거버넌스 구조 전면 재정비 필요

RB-사이버 어슈어런스의 배그널은 CISO 역할이 이를 보호하는 거버넌스 구조보다 훨씬 빠르게 진화해 왔다고 진단했다.

배그널은 “오늘날 보안 리더는 전략가이자 기술 전문가이며, 위기 대응 전문가인 동시에 때로는 희생양 역할까지 요구받고 있다”라며 “특히 미드사이즈 기업이 이러한 현실을 인식하고 이에 걸맞은 법적·계약적 보호 장치를 구축하지 않는 한, 역량 있는 리더들이 CISO 역할을 맡는 데 주저하는 상황은 계속될 것”이라고 설명했다. 그는 “이로 인해 규모와 관계없이 기업이 필요로 하는 기술 및 정보 보안 자문을 충분히 확보하지 못하는 결과로 이어질 수 있다”라고 지적했다.

이어 배그널은 “CISO는 단순히 네트워크를 방어하는 역할에 그치지 않는다. 기업의 평판과 신뢰, 그리고 미래까지 지키는 책임을 맡고 있는 만큼, 그에 상응하는 보호가 반드시 필요하다”라고 강조했다.
dl-ciokorea@foundryco.com

에이전틱 AI(Agentic AI)는 지금 ‘모든 것, 모든 곳, 동시에’의 순간을 맞고 있는 듯 보인다. 하지만 과연 그럴까.

소셜미디어의 흐름과 벤더의 공식 발표, 과장된 표현이 난무하는 사고 리더십 영역을 주시하는 IT 실무자라면, 머지않아 전 세계 기업이 AI 에이전트를 중심으로 운영될 것이라고 생각해도 무리는 아니다. 코드 생성부터 콘텐츠 제작까지 다양한 작업을 자동화할 수 있는 소프트웨어인 AI 에이전트가 기업 운영의 핵심이 될 것처럼 비치기 때문이다.

에이전트형 인력(agentic workforce)의 시대가 도래했다는 선언과 함께 IT 지원 업무의 90%를 에이전트가 수행한다는 주장도 나온다. 에이전트 기반 제품으로 수익을 창출하는 진취적인 개발자 사례도 공유된다. 반면, 업계가 과도한 기대를 부추기고 있을 뿐 실제 현장은 그와 거리가 멀다고 지적하는 목소리도 적지 않다.

기술 분야에서 흔히 그렇듯, 현실은 보다 복합적이다. 다만 데이터는 일정 부분 방향을 보여준다. 맥킨지가 조사한 결과에 따르면, 전체 응답 기업의 39%가 AI 에이전트를 실험하고 있다고 답했지만, 단일 비즈니스 기능 내에서라도 AI 에이전트를 본격적으로 확장한 기업은 23%에 그쳤다.

AI 에이전트란 무엇인가

먼저 한 걸음 물러서서 살펴볼 필요가 있다. AI 에이전트란 정확히 무엇이며, 왜 IT 리더들은 이에 주목하고 있는가.

AI 에이전트는 대규모 언어 모델(LLM)과 기타 데이터 소스에서 얻은 맥락 이해와 데이터를 활용해 시스템 환경을 인지하고, 그 과정에서 학습하며, 목표를 달성하기 위해 문제를 추론해 나간다.

에이전트는 다른 에이전트는 물론 다양한 애플리케이션과도 함께 작동한다. 여왕벌을 만족시키기 위해 분주히 움직이는 일벌처럼, 주어진 일을 수행하며 효율적으로 목표를 달성하는 것이 궁극적인 목적이다.

사용자가 맥락을 제공하며 LLM을 원하는 결과로 유도하는 방식과 달리, 에이전트는 사전에 설계된 문제 해결 로직과 학습 데이터에 기반해 스스로 목표 달성 방법을 찾아낸다.

세일즈포스, 워크데이, 마이크로소프트 등은 이미 고객 서비스와 기타 기업 업무용 애플리케이션에 에이전트를 내장하고 있는 대표적인 벤더로 꼽힌다.

서두르면서도 속도를 늦추는 이유

그러나 여러 플랫폼에 걸쳐 작동하는 다중 에이전트 시스템의 도입은 상대적으로 더딘 흐름을 보이고 있다. 에이전트를 중심으로 기업 운영을 시도했다가 실패한 사례, 또는 에이전트가 치명적인 기술적 오류를 일으킨 사례가 잇따르면서 확산에 부정적인 영향을 미쳤기 때문이다.

IDC에서 AI 부문 수석 리서치 디렉터를 맡고 있는 낸시 고링은 다중 에이전트 시스템은 구축과 운영 모두에서 기술적 난도가 높고, 벤더 역시 에이전트가 생성하고 소비하는 데이터를 어떻게 수익화할지 정리되지 않은 상황에서 상호운용성을 쉽게 허용하지 않는다고 설명했다.

고링은 “이는 기술적인 문제이자 경쟁 구도의 문제”라며, 벤더들이 고객을 자사 생태계 안에 묶어두려는 의도가 강하다고 분석했다. 예를 들어 한 벤더의 고객 서비스 플랫폼 API는 다른 벤더의 이커머스 소프트웨어 API와 연동되지 않는 경우가 많다는 것이다.

센게이지의 CIO 켄 그레이디 역시 벤더들이 경쟁 우위를 확보하고 데이터 보호 장벽을 유지하기 위해 서로 엇갈린 방향으로 움직이고 있다는 점에 동의했다. 그는 이러한 구조가 에이전트에서 실질적인 가치를 얻은 기업이 아직 극히 제한적인 주요 원인이라고 설명했다.

개발자도 피할 수 없는 에이전트 도입의 현실적인 장벽

위험과 리스크라는 두 가지 그림자는 소프트웨어 개발 영역에도 짙게 드리워져 있다.

복셀의 CTO 브라이언 오설리번은 규모와 관계없이 많은 조직이 코드 자동화를 위해 에이전트를 성공적으로 배치했지만, 데이터 유출 위험, 벤더 종속적인 폐쇄 구조, 빠르게 누적되는 시스템 취약성이 에이전트의 전망을 약화시키고 있다고 지적했다. 그는 이러한 문제가 결국 “많은 비용만 들고 실질적인 역할은 하지 못하는 신뢰하기 어려운 시스템”으로 이어질 수 있다고 표현했다.

에이전트 기능의 일부만 부정확해도 전체 프로세스가 무너질 수 있다. 오설리번은 이 점이 IT 부서가 에이전트 도입의 선두에 서 있는 반면, 다른 사업 부서는 참여를 주저하는 이유를 설명해 준다고 분석했다. 그 결과, 가치가 큰 다른 영역으로 에이전트가 깊숙이 확산되는 사례는 여전히 제한적인 수준에 머물러 있다.

또 다른 문제는 메모리에 있다. 정확히 말하면 에이전트의 메모리 부족이다. 자율적인 운영이라는 약속을 실현하려면, 에이전트는 수행한 작업에서 학습하기 위해 장기·중기·단기 메모리에 접근할 수 있어야 한다. 이러한 기능이 없다면 에이전트는 본질적으로 수명이 짧은 LLM 채팅 세션과 크게 다르지 않다.

기대가 남아 있는 이유

그럼에도 불구하고 AI 산업이 이러한 과제를 해결하게 될 것이라는 기대는 여전히 크다. 업계 전반의 집단적 비즈니스 요구가 결국 해법을 만들어낼 것이라는 인식 때문이다. 이 단계에 이르면 에이전트는 개별 업무를 넘어 전체 워크플로와 프로세스, 나아가 기업 운영 전반까지 자동화할 수 있을 것이라는 전망도 나온다.

IT 리더는 인력을 보다 전략적인 업무로 재배치하거나 새로운 혁신 동력을 발굴할 수 있다. 인간이 잠든 동안에도 거의 손실 없이 기업이 24시간 돌아가는 세상을 상상하는 기술 낙관론자들이 그리는 이상적인 미래다.

IDC에 따르면, 2026년에는 글로벌 2000대 기업 전체 직무 가운데 최대 40%가 AI 에이전트와 함께 일하는 형태가 될 것으로 예상된다. 이는 많은 기업의 업무 흐름을 근본적으로 재정의할 것이라는 분석이다.

센게이지의 CIO 켄 그레이디는 벤더들이 결국 자신과 고객 모두에게 가장 적합한 전진 경로를 찾아낼 것이라고 내다봤다. 그는 보다 효율적인 비즈니스 프로세스를 구축하려는 조직을 중심으로 에이전트 도입이 확대될 것으로 전망했다.

예를 들어 현재 2% 수준에 머물러 있는 비즈니스 활용 사례가 기술과 프로토콜이 성숙함에 따라 20% 수준까지 성장할 수 있다는 설명이다. 그는 성공적인 파일럿 프로젝트를 실제 운영 환경으로 전환하려는 기업도 점차 늘어날 것이라고 언급했다.

그렇다면 이러한 전환을 앞두고 IT 리더는 무엇을 준비해야 할까.

에이전트는 아직 새롭게 부상한 기술 범주인 만큼, 이를 위한 확정된 도입 지침은 존재하지 않는다. 최소한 에이전트에 특화된 명확한 플레이북은 아직 마련되지 않았다.

그럼에도 IDC의 낸시 고링은 IT 리더가 우선 실행할 파일럿을 식별하고 테스트에 나서야 한다고 조언했다. 실험을 통해 신뢰와 이해도를 쌓아가는 동시에, 확장에 앞서 통제와 가시성을 확보할 수 있는 체계를 마련해야 한다는 설명이다.

기업은 핵심 추상화 계층과 기본 오케스트레이션을 구축하고, 테스트와 학습을 반복하면서 거버넌스와 모니터링 기능을 점진적으로 통합해야 한다. 특히 수십 개 이상의 에이전트로 확장하는 단계에서는 이러한 준비가 더욱 중요해진다.

실제 사용 패턴에 기반해 아키텍처를 지속적으로 다듬는 작업 역시 핵심 과제로 꼽힌다. 그리고 언제나 그렇듯, 빠르게 실패하고 그 과정에서 학습하는 문화가 에이전트 시대를 준비하는 데 중요한 요소로 작용한다.
dl-ciokorea@foundryco.com