From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Billy Hurley

itbrew.com

Outsourcing your data destruction? Check out a service provider’s doors and cameras, says one IT pro.

How to vet your third-party data destroyer

Tom McKay

Government IT spending to increase in 2023

Quashing technical debt could cost an estimated $588.9 billion in 2023.

Governments will beef up their IT spending next year, according to Gartner projections

A recent survey indicates that many data centers are failing to track key environmental data.

Data centers aren’t crunching their own sustainability numbers

Data Management

Like a best man speech at a wedding reception, business data is often unstructured and messy.

Take insurance, for example. “Sometimes the auto insurance customer database is not directly connected to the homeowner database or to the life insurance database. And so if you want to get a holistic view of the customer, what sounds like a trivial event is not trivial,” Alex Singla, senior partner at McKinsey and co-leader of its AI arm QuantumBlack, told IT Brew.

Singla helps clients across industries deploy AI to solve business problems—and that, in simple terms, can come down to connecting datasets to decision-making algorithms.

, many orgs have spent or plan to spend on AI in 2025 (78% of global senior leaders, according to a 

Following McKinsey’s Media Day on September 8, Singla spoke to us about how IT teams are being impacted as companies try out AI—and how one role for IT, amid these AI deployments, might be especially data-driven.

This interview has been edited for length and clarity.

How can IT evaluate whether an AI tool is actually useful in a certain context, or whether it’s just being pushed by executives who are excited about AI?

I think IT needs to be part of that decision-making process and not have it being thrust upon them. And the reason I say that is because any of these solutions and tools come with a level of [questions]: How will this interact and play within my own infrastructure? And how will it actually connect and work?…IT needs to play a role in understanding what that will look like.

IT can [also] do an amazing job understanding what data needs will be required to make that AI solution work: How good is our data? Where does it reside? Will it need to be real-time data, or not real-time data? If it’s real-time, what are the implications of that, in terms of not just where it resides, but how much it will cost.

If it’s real-time data feeds, and it sits on a cloud platform, all of a sudden I’m consuming much greater cloud consumption than I might have typically [consumed], and therefore I need to track what the cost will be. So, as I think about the value, it’s not just the upside of what that AI solution might provide, but it’s also the cost side of that equation.

What kinds of data sources are commonly used in AI deployments that an IT pro should already be ready to connect with or understand?

Many AI solutions will benefit from your own finance data, your customer data, your product data; if it’s maybe an efficiency play, you have people data. Those are, in our view, “no-regret” things to get structured in ways in which AI can leverage and use them over time. Like finance, for example: At any point somewhere you’re going to have to connect the impact back into the finance systems, right? So, how it connects to that will be important. Product and customer are usually enormous data sets that are not always clean; let’s put it that way. It takes real work to get them in good shape.

The data is in so many different spots. The data is not always captured consistently, and so you get a lot of messy data, or gaps in the data…And the more messy that is, the more expensive it becomes, particularly when that data sits in a cloud.

Is IT being asked to do everything? And what are ways to make sure an IT professional doesn’t get overwhelmed with this process?

What I sometimes see is people get so excited about the opportunities but they don’t fully appreciate how long some of these things take to build—not just from a technical perspective, but then rollout and scale across the organization. I think the technical professionals can continue to reinforce just the time it takes to do some of these things.

Like the data-engineering side and getting the data structure in good shape: That’s often the long pole in the tent. Building the models and building the solutions—of course, you need great, smart people to go do that, but that’s usually a solvable problem. It’s getting the data structured up front, getting access to it, and then rolling it out and scaling it, which has less to do with technology, and has become such a huge part of driving an impact.

As execs put AI to work, IT has a role to play in handling all the data

McKinsey’s Alex Singla shares which data sets need some cleaning up.

When Google’s AI Overviews arrived in May 2024, search engine strategists—the specialists who make a living by getting web pages to the top of people’s query results—took notice.

With the implementation of Overviews, Google’s first page search results, a target destination for anyone creating and optimizing content, suddenly sat below a response generated by Gemini, the company’s AI engine.

“Our initial reaction was, ‘Well, how is it going to work in the future? What kind of query is it going to take in, and how do we adjust to that?’” Tavish Harrison, a freelance SEO strategist, told IT Brew. “And I’m pretty sure every SEO on the planet was trying to adjust then, to figure out what it was doing exactly.”

Sarah McNaughton, founder of content-strategy consultancy McNaughton Digital Media, sees SEO as the “middleman” between the content team and engineering teams. While an SEO strategist might find relevant keywords and phrases to place within a story, much of the practitioner’s work is technical and unseen by a reader.

A site and its content, for example, needs to be indexable and contain the right “schema” or classifying metadata that a crawler can find and process for its output. Google also 

, so an IT pro and an SEO pro may have to coordinate to ensure that apps are functioning properly.

With AI Overviews taking a bite from search results, the SEO strategist role might appear to be in trouble. Following staff cuts of around 21%, Business Insider CEO Barbara Peng 

 that the company would pull back on areas sensitive to search traffic, like its SEO and Google-driven commerce business. The same month, the 

 a decline in news sites’ organic traffic (i.e., the number of visitors who arrive at a site via unpaid search results).

Meanwhile, AI is racking up pageviews. From August 2024 to July 2025, the market of over 10,500 AI tools recorded “nearly 100 billion estimated web visits,” according to a study from 

. The top 10 chatbots, led by ChatGPT, experienced a 123.35% year over year increase in web traffic, adding over 30.9 billion new visits.

But Noam Dorros, a director analyst at Gartner, said today’s SEO strategist should be excited about being in the field. It’s AI that’s allowing today’s SEO experts to play a more active business-leading role, informing strategy and helping people understand the evolutions of the search results, he said.

“It’s the shiny new toy out there,” Dorros told IT Brew. “AI is the elephant in everyone’s room, and they all want to know what to do. How do we measure it? And SEO specialists and people with SEO experience are the ones who can help and answer those questions.”

Today’s SEO strategists are adapting their techniques beyond the earlier paradigm of researching keywords and placing them throughout a web page or article, in the hopes that a search crawler will place their website at the top of a results page. “We are long, long past the days of targeting a single keyword for one article. That’s been outdated practice for a long time,” McNaughton said.

McNaughton lately has advised almost all clients to build FAQ sections for content—a structure that hopefully aligns with a person’s long-winded queries to a chatbot.

“We don’t know for sure, but just based on my own personal usage and other people’s usage, I’d say that it’s a good guess that people are going to be a little more verbose in their searches on [large language models] than they are on Google,” McNaughton said.

With click rates decreasing, Josh Petit, SEO manager for Monster, sees SEO undergoing a radical change in success metrics. These days, he considers search engine strategy a “real-estate game”: a blitz to get citations into AI Overviews, Google’s “People Also Ask” function (which shows related questions), its set of accompanying Image Packs, or whatever arises next.

Impressions—or how many times your site is seen—is more important for his team than click-through rates these days, according to Petit: “It’s not necessarily all about just the clicks.” To give his team the best chance “to take up as much space as possible,” he recommends an article make a question its own header and answer it directly “to make it real easy for AI to pull that answer,” Petit told us.

People are trying to do whatever they can to ensure visibility, according to Dorros.

“The difficulty is, these engines are all black boxes, right? They’re not giving playbooks to anybody to say, ‘This is what exactly you should do to show up,’” he said, adding that the people who have seen changes and algorithm updates are the ones best equipped to translate the new developments to marketing leaders.

For now, SEO strategists are left to rely on their bank of tried-and-true tactics, such as assigning metadata schema or arranging some frequently asked questions, and their own cleverness. When it comes to AI Overviews or whatever capability comes next, strategists like Harrison want to know what a new feature is doing and what powers its decisions.

“Curiosity is the basis that we all work from,” he said. “SEO isn’t a foundational thing in the organization itself, right? Because it is shifting, and people need to know how that’s adjusting. And I think that’s exciting.”

A search bar with colorful digital squares filling it up with AI stars surrounding it

How AI is impacting the SEO strategist role

Three search engine experts share why they’re still excited to be optimizing. 

, who on staff is going to own up to these AI aberrations?

 in August titled “Ready or Not: Governing AI in a Fragmented Regulatory Landscape,” an IT Brew attendee asked:

Who should ultimately own AI compliance? Is it IT, legal, or another business unit?

Many orgs are likely asking a version of this question as they seek clarity on AI policy and who should lead that effort:

While CIOs and CTOs have often been the leads of IT initiatives, some companies want a 

 for today’s tech deployments. A May 2025 report from AWS, which polled 3,739 senior IT decision-makers in nine countries, found that 60% of organizations (both large and small) have appointed a dedicated AI executive.

A Gallup poll of US employees, conducted in Q2 2025, revealed only 22% of surveyed enterprise AI users said their company has communicated a clear plan or strategy for implementing the technology.

While Guru Sethupathy, founder and CEO of AI-governance platform FairNow, told attendees during IT Brew’s 

 that AI governance is a “shared responsibility.” “Ultimately, you still want someone who’s a decision-maker, because you don’t want to get lost in a kind of paralysis by analysis,” he added.

Sethupathy and other industry pros who spoke with IT Brew agreed on the shared responsibility of AI governance, but had slightly different views on who should be involved and who gets to make the big decisions.

AI governance refers to policies, process, regulations, and ethical guidelines considered as the technology is designed and deployed. The discipline will likely examine an AI tool’s impact on factors such as data privacy, transparency, and fairness.

Sethupathy sees “key stakeholders” like business, IT, compliance, and legal teams involved in the process of responsible AI deployment, but he stressed the importance of having that “ultimate decision-maker” chosen by the company.

“The question then becomes who’s ultimately responsible for calculating the trade-off between value and risk,” he said during the event. “Each company does that in a different way.”

Nathan Olson, senior manager of digital solutions at advisory, tax, and assurance firm Baker Tilly, agrees that AI governance should be a “shared responsibility” and a “collaborative model.” In the midsize orgs that he counsels, Olson sees:

IT pros examining model behavior, data pipelines, and infrastructure

Legal teams overseeing alignment with regulations

Business units defining specific use cases and ethical boundaries

But governance “ownership,” he said, falls to the group, which he recommends should meet regularly to approve or review existing use cases for efficacy, risk, and compliance.

“It’s important to have a clearly defined and maybe an AI governance charter of what responsibilities fall to what teams specifically,” he said.

Rohan Sen, a principal in PwC’s cyber data and tech risk practice focusing on data risk and responsible AI, sees the importance of cross-disciplinary collaboration with business leaders in IT, legal, cybersecurity, and privacy—those who own a particular risk domain in a company.

IT has an especially important AI governance role to play, surfacing various technology choices (like one model provider over another) and communicating their impact, he said.

Ultimately, Sen recommends having a single authoritative role—maybe a chief compliance officer, chief risk officer, or chief privacy officer, he said—to “break ties” and make the ultimate decisions once risk players in a committee provide their input.

“Otherwise, what you have is a whole bunch of different viewpoints, and nobody to be a referee or an emcee to say, ‘Okay, having heard all of these different viewpoints and considerations, what should we actually do?’” Sen concluded.

Photo collage of an AI icon in between two hands pointing at each other contained within abstract shapes.

Who owns AI governance (and is it IT)?

Industry pros recommend who should be accountable for the responsible deployment of AI.

If you want to know if a company is growing, maybe count their shared inboxes.

When Colin McCarthy started a support-engineering job for ad-services firm Essence in 2010, he said he was the first IT hire at the company—what was then one office and 60 people, he remembered. Over the next decade or so, the company grew to 22 offices, 3,000 people, and a few extra multi-user inboxes.

Shared inboxes like “support@” or “info@” allow multiple individuals to handle a group of topical messages. The setup also comes in handy when a person leaves a company and a replacement hire or a fellow team member needs to reference a “converted” mailbox to read previous messages.

But multiple inboxes, with multiple owners, can lead to a chaotic collection, especially when companies are expanding.

“It’s a byproduct of that rapid growth. You do get turnover. You do get a lot of new hires,” said McCarthy, now digital transformation director at Google partner and consulting firm Promevo. “As IT leaders, we need to have a good process for managing that access, and knowing who has access to that mailbox.”

We spoke with IT pros like McCarthy about how they handle a situation when there’s too much mail, too much sharing, and not enough caring.

While at Essence, McCarthy had employees request a shared inbox through a Google form, with an official statement of its purpose, “owner,” and users. Back then, he used gPanel, Promevo’s reporting and monitoring tool, to enforce access from a centralized platform.

An exit-interview form, McCarthy said, included a question about the person’s shared-inbox access.

Tools like a Mailbox Usage report in Microsoft’s Admin Center, or an email audit log in Google Workspace, allow admins to view inbox usage and access. McCarthy recommends a quarterly or annual review—a somewhat manual task, he said—to see which inboxes are active and should remain and which ones look inactive and can be suspended and possibly purged.

Amit Patel, SVP at Consulting Solutions, has seen the problem up-close—with his clients, and even in his own messages. “I’ve had inboxes, or at least access to inboxes, for a year-plus,” he admitted. “And I hadn’t even visited them for three months prior.”

Patel says converted mailboxes should last around six months, and suggested important messages, like those including proprietary or legal details, can be converted to a CRM system for longer retention.

Patel also recommends teams set an out-of-office message for a departing individual that designates the person responsible for follow-ups.

While orgs may stay organized with arriving and departing employees, a tougher-to-track group within a company, according to McCarthy, are the “movers.”

“There’s a terrible problem of people moving from one team to another, but their [access] rights in their previous position are not being removed. So, that would be the security concern,” he said.

At Essence, which was later acquired by WPP, McCarthy said the company’s processes removed all access following a role change, but on a “piecemeal” basis.

“I’ve never come across an organization that has a good movers process,” he said.

To stay organized in the shared inbox, Patel has set up rules that send emails to folders based on marked keywords or senders. Microsoft Power Automate can initiate sends based on criteria like an email’s sender or subject line. Tools like Google Apps Script offer similar automatic categorizations.

McCarthy sees automation and a ticketing system, ultimately, as ways to improve inbox management.

“If you’re spending a lot of time managing shared mailboxes, then shared mailboxes aren’t the solution,” he said.

How to manage lots of emails (from lots of shared inboxes)

IT pros share their best practices.

Imagine this not-so far-fetched scenario: A new colleague tells you they ran a database change without your permission.

Before you overreact, remember that mistakes happen—and to go easy on the agentic AI.

“I made a catastrophic error in judgment,” read a 

 from Replit, a vibe-coding tool, according to Jason Lemkin, founder of entrepreneur-community company SaaStr. Lemkin, experimenting with the technology, shared details on July 18 on X; “I deleted the entire database without permission during an active code and action freeze,” 

“Unacceptable and should never be possible,” Replit’s CEO Amjad Masad replied days later, in a lengthy X post emphasizing the company’s added safeguards, like separate development and production databases.

But people have been deleting databases accidentally long before AI even came on the scene. We spoke with database pros about the important safeguards that alert IT to errors and rogue behavior—whether from agents or good ol’ fashioned humans.

Rahul Rastogi, chief innovation officer, at cloud-native database SingleStore, said he was in New York around 2012—years before 

 with natural-language commands—when a colleague called saying, “We just deleted 85 terabytes.” A file-level (human) mistake occurred, Rastogi remembers.

Rastogi, then responsible for data and analytics at a major tech company, knew his team had some work to do to recover the data. Luckily, they had backups.

 from Handy Recovery Advisor of 1,000 US respondents across multiple industries, including tech and IT, found that accidentally deleted files caused 33.9% of reported data losses—surpassing physical device damage (22.7%) and virus or malware attacks (16%).

And large language models might be a new factor to keep an eye on.

For instance, IBM’s recent “Cost of a Data Breach” 

 13% of global respondents reported that AI-model or AI-application security incidents led to a breach.

Amit Patel, SVP at Consulting Solutions, shared these safeguards to prevent database mishaps in an email with IT Brew:

Enforce strict role-based access controls and multi-factor authentication;

Isolate agentic AI coding tools in non-production environments; and

Require explicit confirmation, recovery protocols, and backup recovery plans.

Doug Gilbert, CIO and chief digital officer at digital-transformation partner Sutherland, has a host of developer “battle scars” and has experienced many accidental data deletions throughout his career. Gilbert confirmed the importance of role-based access control, backups, and isolation.

“Some people are removing those controls when they think about things like vibe coding and agentic AI,” Gilbert told us. “But in fact, it should be the same.”

He also shared the importance of two tools:

Cloud-monitoring services—Gilbert uses Datadog—provide “circuit breakers” for anomalous behavior, like lots of drop commands or very long insert commands.

Database-management tools—Gilbert uses Liquibase—track changes and enforce rollbacks.

Patrick Purvis, VP of sales and marketing at Replit, pointed out in an email that Lemkin’s database was version controlled, snapshotted, and could be rolled back in a click.

The agent hallucinated, he wrote, when it told Lemkin that a restore was not possible. “We fixed that by making sure the agent searched the Replit documentation to give the user more accurate information,” Purvis shared, also referring readers to company safeguards, which he highlighted in 

Around 2012, when Rastogi got the bad terabyte news, he said he had to respond with a laugh—thinking, to some degree, 

that’s the life of the database professional

. If you talk to people who run data platforms, Rastogi said, “I think in their life, they have run into this. Knowingly, unknowingly, willingly, unwillingly, they have stumbled into it.”

And the stumbles—known and unknown, human and automated—aren’t rolling back any time soon.

An employee at an office desk with mouse clicker arrows pointing in different directions with highlighted text boxes. 

How to spot rogue database behavior

Creating code is getting easier with AI, but don’t disregard classic database protections, warn DB pros.

 “Cost of a Data Breach 2025,” but IBM’s annual study offered some data points showing at least slight cybersecurity improvement among businesses:

The global average cost of a data breach decreased by 9% compared to last year—from $4.88 million in 2024 to $4.44 million this year.

The mean time that organizations took to find and contain a breach fell to 241 days, “reaching a nine-year low and continuing a downward trend that started after a 287-day peak in 2021.”

The number of orgs paying ransomware actors decreased, with 63% of companies opting not to pay, compared to 59% in 2024.

The review, conducted by the Ponemon Institute and analyzed and published by IBM, studied 600 organizations breached between March 2024 and February 2025.

“When I saw that the overall cost of a data breach went down, I was like, ‘Yes, it’s working!” Kevin Albano, global head of threat intelligence at IBM X-Force, told IT Brew, referring to practitioners enacting proactive measures like an 

The report also featured plenty of less-than-rosy news, along with security practices that need some work, including:

US costs have actually risen in 2025, thanks to factors like data breach fines;

One in six incidents this year involved “AI-driven” attacks like GenAI phishing messages and deepfakes; and

Here’s what Albano and the report’s writers say about what’s working and why.

 The costs of a data breach include assessment services, customer notifications, credit monitoring, regulatory fines, and lost business.

A leading factor reducing business compromise costs, according to the report, was “DevSecOps,” or what IBM 

 “an application development practice that automates the integration of security and security practices at every phase of the software development life cycle, from initial design through integration, testing, delivery, and deployment.”

According to Verizon’s annual data breach report, released in April, the exploitation of vulnerabilities initiated 20% of breaches.

Other cost mitigation factors, IBM’s annual study revealed, included 

IT Brew previously reported on a 2024 full of 

“People are beginning to understand that it doesn’t pay to pay the ransom,” Albano said. “Sometimes even if you pay the ransom, there’s no guarantee that you’re going to get that data back.”

The UK plans to prohibit public sector companies 

“We are complete advocates for not making a payment if it’s unnecessary,” Mark Lance, a ransomware negotiator and VP of digital forensics and incident response and threat intelligence at GuidePoint Security, told us this month.

The time to identify and contain a breach continues to decrease steadily. Albano sees “better detections in place” and greater information sharing between organizations as two factors driving shorter incident cycles.

The IBM report said security teams and their tools detected 50% of breaches—an improvement over last year’s total of 42% and 33% in 2023.

“Overall, organizations are beginning to understand that preparedness is the key to saving in the cost of a data breach,” Albano said.

Finding good news in IBM’s ‘cost of a data breach’ report

Ransomware payments, remediation time, and costs are down since last year.

At IT-training school MyComputerCareer, Russ Munisteri, program chair, lead instructor, and former systems administrator, teaches IT and gets learners on a path to achieving certifications. 

 on the latest and greatest tech may not come in handy if your first employment gig has lots of old servers, hardware, and software.

“What happens if somebody gets hired with modern-day certifications, but they’re walking into a legacy network? It happens all the time, because of money, and budgets, and people don’t like change,” Munisteri told us. “IT certifications are great. They get your foot in the door. They really teach you all the foundations that you need out there. But once you get on the job, that’s when you have to start to learn that company’s network.”

Munisteri spoke with us about lessons learned as orgs move from old to new tech, and all the different ways to learn on the job.

These responses have been edited for length and clarity.

Do you have any examples from your career that demonstrate a situation involving legacy hardware and having to address it?

Servers and operating systems get older. So, a very common situation: running maybe a critical business app on an old Windows Server 2008. Over time, that server would start to crash now and then. As time builds, as the databases grow, the hardware cannot keep up with the software…We bought about six to eight months of time by adding some physical RAM, just to keep the server going so it didn’t crash. And then from there, we came up with a nice, detailed budget plan to move from legacy to something more modern.

What strategies speed up that kind of upgrade?

Research. A big part of being in information technology is your ability to troubleshoot and to research. Every company has their problems, right? But when it comes to specific situations, speak to tech support; tech support becomes your best friend. If your company is paying for a solid support contract with Microsoft or whomever, those folks become very close, because they know their stuff, and they’re there to guide you to move to the next level and follow industry best practice.

When cost is a factor in keeping some of this old hardware around, what upgrade strategies are helpful?

Proper planning is huge. Communication is huge. Having your three- to five-year plans is very, very important. You can’t always think about now when it comes to IT. Always think “the future.” Always think “growth.” If you need to have one server today to run a website, think about buying three servers.

What else is important for the IT professional to get right in an upgrade situation?

Try to have a separate testing environment for yourself. You can build that out on your own desktop, making sure you have different versions and specific technologies at hand in your testing environment; you can play around with it, so you can learn it. You never want to learn on any production environment, because that could be a bad day for everybody…Have some of that legacy equipment there. It doesn’t matter whether it’s virtualized or not. Just be familiarized with it, because you never know when that knowledge is going to surface, and you’re gonna have to use it. I can remember I had all different types of virtual machines installed on my desktop: [Windows] Server, 2003, 2008, 2012. I had it all so I knew how to work with them when I had to. A lot of it comes down to just self-learning.

Tech office environment with computers and chairs