From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

A semiconductor icon depicting IT hardware

Hardware

Billy Hurley

itbrew.com

Pop-ups, privacy notices, and consent checks provide a tiny bit of order in our unwieldy digital world, especially when it comes to pictures and videos of you. Some company-issued notifications, for example, might prompt you to agree to a platform or organization’s use of your likeness in a captured photo.

It’s harder to read that kind of fine print, however, with an unfamiliar pair of glasses—specifically augmented-reality (AR) ones. Our digital social contract becomes even more difficult to enforce if there are 

 with stylish eyewear that’s capable of recording you instantly.

“How do you roll that out, when you have, say, a million individuals with glasses just walking around, living their lives? Are they to wear T-shirts or signage that says, ‘Hey, I’m not myopic, I’m not [near]-sighted. I’m wearing these glasses because I’d like to take pictures of everyone as I walk about doing my daily life,’” Joe Jones, director of research and insights at nonprofit privacy organization IAPP, told IT Brew with a laugh.

Jones spoke with us about security and privacy risks—as well as the upside—of wearables as this technology becomes more advanced.

This interview has been edited for length and clarity.

Are you seeing mainstream adoption of AR glasses to help people do their jobs?

I would say, not mainstream. But I’m definitely seeing an increase in activity and increasing 

 in using AR glasses, or other devices that can help simulate real-world or can help augment real-world environments. You’re seeing this in a number of contexts: You

 medicine, broader scientific research. You’re also seeing it in anything where there are very minute manufacturing- or engineering- or precision-based professions as well—realms that don’t engage the privacy or civil liberties realm to the same degree. If you’re looking at where there might be leaks in infrastructure, or where there might be radiation, that’s different to dentistry…or to having a conversation with your friends, peers, or loved ones using AR glasses.

Do any privacy concerns come to mind as this technology gets adopted?

Your name, age, inferences, pupil dilation, etc., could all be picked up by someone’s AR glasses. And the moment is so fleeting, just as much as it’s so ubiquitous…The questions around the lawfulness and the efficacy of the not just documentary safeguards, but the governance and compliance safeguards that exist when you’re collecting data, when you should be telling people what you’re doing with that data, how you’re going to handle it, what rights they have, and what recourse they have.

I think a lot of the more mature players in this space are processing a lot of that data as locally as possible. Many of them are processing their data on device, so in the headset, on the glasses, and once that data is no longer being used or doesn’t have the utility, a lot of that data is being deleted.

Can documentation and compliance safeguards be somehow implemented in everyday life? Are we just kind of stuck with this risk?

I do think we’ll see some of the manufacturers and systems suppliers of these will say, “data is collected, and here’s how we’re dealing with that data.” And so if you’re walking down the street and you see someone who’s wearing these glasses, you might think, “Okay, I want to know how Company X may have collected my data there.”

The big challenge to all of this is the stylistic design, which makes it harder and harder for individuals to know that their data has been collected in the first place. It’s one thing to talk about CCTV. You see the camera. It’s one thing to talk about the selfie; you see a phone go up…A lot of this technology is going back to a more analog design so that we 

know it’s technological, and it becomes even harder to understand what safeguards, what documentation and checks and balances exist.

Would you have any advice for, say, a dentist who is using these glasses?

Making sure that they are on top of their own governance, their own infrastructure security, their own privacy compliance is going to be really key. There’s only so much they can control when it comes to the device manufactured by someone else, but the extent to which they’re pulling down and pulling out that data for their own use in their own systems. That’s when they have more control and more is expected of them.

A portrait of Joe Jones, director of research and insights at nonprofit privacy organization, IAPP

With AR glasses, IAPP’s Joe Jones sees security and privacy challenges

It’s difficult to protect information from video- and photo-capturing eyewear.

The past 15 years of smart glasses were a bit foggy—looking at you, 

. Despite some early promise, the technology never seemed to really take off with consumers or professionals.

But millions are reportedly buying into some form of hands-free, photo-taking, video-recording eyewear, and vendors are investing heavily in developing new products.

We spoke with people using augmented-reality (AR) glasses in their everyday work—and security and privacy professionals who offered reminders on the risks of this rapidly evolving tech.

 Paul Zeylikman, a dentist who runs Brooklyn and Queens’s Little Tooth Pediatric Dentistry, recently used first-generation Ray-Ban Meta glasses to record a lip-tie procedure, also known as a laser frenectomy. The doctor said he records complicated procedures with the glasses, then uses the short videos or photos to provide instruction to peers.

Dr. Zeylikman, wearing the advanced eyewear at the office

“I can’t de-gown, and take my gloves off, and start recording with a camera,” he told IT Brew. To begin recording, Zeylikman uses a verbal prompt or holds a button located on the side of the glasses.

Zeylikman said he obtains written consent from patients regarding his use of AR glasses, and also asks for a verbal consent from a parent in the room before taking a photo or video. He emphasizes that he’s using the footage “for educational purposes,” and footage isn’t shared on social media or publicly distributed.

Dentistry is just one of many professions incorporating AR eyewear. On Oct. 22, Amazon 

 to help workers “identify hazards, seamlessly navigate to customers’ doorsteps, and improve customer deliveries.”

Engineering software company Bentley Systems has a research lab exploring AR applications in construction settings, using devices like the Apple Vision Pro and Meta headsets to provide on-screen virtual representations and to support digital run-throughs of giant construction projects.

“Allowing people to rehearse with those headsets and project themselves exactly like they would be onsite allows them to be better prepared and to act in a more safe way,” Bentley Systems CTO Julien Moutte said.

Though many companies appear to be in a more experimental phase with AR eyewear, tech vendors have been steadily investing in the technology over the past few years. Meta reportedly 

 of its Ray-Ban Meta glasses in 2024, according to The Verge. Last week, Samsung introduced Galaxy XR, the first device built on Android XR, Google’s new operating system for headsets and glasses.

But it’s been a long, bumpy road to get to this point:

In 2012, Google introduced Google Glass, wearable AR glasses featuring a small display, voice activation, and smartphone connectivity (

the company ended support for its enterprise version in 2023

Tech companies built AI-assisted vision technologies for specific industries, including Vuzix M100 for healthcare and industrial settings in 2013 and Recon Jet for athletes in 2015.

Microsoft launched its HoloLens in 2016. The AR headset managed to get a sequel (the HoloLens 2) but eventually ceased production.

2021’s Ray-Ban generation 1, also known as Stories, featuring an AI voice assistant, photo and video capture, and audio notifications. (Its second-gen option arrived this year.)

Apple launched its “spatial computing” Vision Pro in 2024, but is reportedly revamping its design to compete with Meta’s AI glasses, 

As adoption of AR and VR increases in specialized industries, so does the potential for cyberattacks and privacy risks.

When asked about encryption features on the smart glasses, Meta spokesperson Dina El-Kassaby Luce referred IT Brew to the company’s 

, which states,“For added peace of mind, photos and videos are encrypted on the smart glasses.” The glasses can also only be synced with one user, and the data is not transferrable between accounts if, say, the glasses were lost and then found by someone else.

There’s also a light to indicate when video or photos are taken—not that that light 

Zeylikman said generally he tries to get any data out of the glasses and locally onto his (locked) phone quickly, to prevent the data from being stored in a cloud environment.

Though the health regulations known as HIPAA do not mention AR glasses specifically, the standard calls for protected health information to be encrypted in transmission and at rest

“From a HIPAA standpoint, my use of the glasses is essentially equivalent to taking a cell phone photo or video to show a colleague—just in a more hands-free, efficient format,” Zeylikman wrote to us in a follow-up email, where he also emphasized that he’s using the glasses in a “limited, privacy-forward manner” until he can fully verify security specifications.

Jenai Marinkovic, CEO of governance nonprofit GRCIE and a member of the ISACA Emerging Trends Working Group, sees the benefits of the smart glasses, but emphasized the importance of industry practitioners obtaining written consent and adhering to the state- and age-related privacy regulations. Generally speaking, phone-held data can be risky, she said, because a phone is often not a corporate-owned device. Marinkovic recommended that every smart-glasses user build a data map to understand the full route of any sensitive information.

“You need to make sure that that data is encrypted through every single one of those pathways,” Marinkovic said.

Joe Jones, director of research and insights at nonprofit privacy org IAPP, noted the difficulty in maintaining a digital social contract or privacy notice as the millions of glasses wearers bring the tech from industry to everyday life.

He has seen some business leaders already embracing best practices when it comes to AR usage, including processing data locally and on-device as much as possible, and deleting data as soon as it’s no longer needed.

“There’s only so much [wearers] can control when it comes to the device manufactured by someone else, but the extent to which they’re pulling down and pulling out that data for their own use in their own systems. That’s when they have more control and more is expected of them,” Jones said.

An office space viewed through VR goggles.

Professionals see new possibilities with AR glasses

But cyber pros see security and privacy risks.

Brianna Monsanto

Not all heroes wear capes. Some, like Leontien Talboom, rock bangs and suspenders while playing a real-life game of 

 on old floppy disks to preserve their content.

When Talboom was a kid, she used floppy disks to save her fictional stories about Furbys, the popular robotic toy of the 90s, which she would write on her father’s old work laptop.

Today, Talboom, who is now a Cambridge University Library technical analyst, spends her time preserving knowledge about floppies while rescuing content from them as part of the library’s Future Nostalgia project.

Why is Future Nostalgia’s work so important? There is limited time to image floppy disks (i.e., duplicate the data on them) because their material can degrade and oxidize over time.

“A lot of the ones that we have in our collection are dating from the ’70s, ’80s, ’90s,” Talboom said. “So, we’re talking at least 30 years by, even getting very close to 50 years for some of them.”

Talboom added that the library hopes to archive knowledge from older floppy disks that may not currently be easily accessible.

“The bigger floppy disks, [the] 5.25-inch floppies, they come from a time when it was a little bit of a Wild West, in a floppy world where everyone was kind of still doing their own thing,” Talboom said. “So, a lot of systems from that time are not very well-documented.”

 Floppy disks in the Cambridge University Library’s collection come from a variety of different places, including the library’s special collections department, which collects records from the university and associated businesses, personal archives, and the Royal Greenwich Observatory.

The imaging process varies from floppy to floppy, according to Talboom. It doesn’t take much to image a high density 3.5-inch floppy disk, for example, because most are MS-D OS formatted, she said.

“They are quite easy to get material from just because they’re very similarly formatted to what we would expect from file systems nowadays,” Talboom said.

Older floppy disks are another story. Because modern computers are no longer able to “talk” to floppy disks, the retro computing community has developed a number of floppy disk controllers and emulators that can be used to translate the data from floppy disks to current motherboards and see the content, Talboom said

“The one that we currently use is called a Greaseweasel…That’s basically what we use for anything that’s not a high-density 3.5-inch DOS-formatted floppy disk,” Talboom said.

“It gets really complicated when you have a system which is not supported by emulators or a system that is not very well-researched, and that’s where still a lot of work has to be done,” Talboom added.

Talboom said the imaging process takes only a few minutes—“which is not too bad, but considering how little…data that actually is, it is very long,” she said. As part of the project, which has been ongoing since October 2024, Talboom has also learned tidbits here and there about floppy disk maintenance, including what to do when a floppy has mold growing on it.

“What we have discovered up to now is that just giving them a wipe has already made quite a difference,” Talboom said. “But that mold can be really damaging, not necessarily to the floppy disk drive itself, but to the floppy disk, because the reader basically latches on to the mold and smears it all around the floppy disk and can badly damage it.”

The biggest impact of the project, which is set to conclude in January of next year, has been the creation of a guide that anyone can reference when imaging floppy disks, Talboom said. The project has also helped people better understand the need for digital preservation, which Talboom said is important for more than just accessing data from old floppies.

“That’s very true for all the emerging formats that we see nowadays. Anything that’s published on the internet, anything that comes from new sorts of hard drives or data tapes or anything like that,” Talboom said. “So, it’s also very much helped in translating and explaining what we actually do as a community because for a lot of people, it can be quite abstract and a little bit weird.”

Why Cambridge University Library is safeguarding floppy disk knowledge

Cambridge University Library Technical Analyst Leontien Talboom tells IT Brew that it’s important to image floppy disks  due to their limited lifespan.

Eoin Higgins

Could you start a car across the country with a refurbished remote starter? Or open a stranger’s garage with your used door opener?

, meaning that, under the right circumstances, using a device in one place could send an actionable command across the airwaves to a different location.

Deral Heiland, IoT principal security researcher at Rapid7, told IT Brew that one of the concerns is dual registration—getting a refurbished device and registering it without ensuring prior data was wiped clean. While most companies have solved this problem, some off-brand firms have not, meaning that a small percentage of devices can be dual-registered—and used by bad actors.

Heiland buys a lot of secondhand devices for work.“Usually, it’s not linked back to the cloud services; probably about 50% of those devices, when I buy them, still are registered and still have the person’s personal wi-fi account information on them, the pre-share keys,” he said. “I’ve even pulled passwords off devices.”

For Ensar Seker, VP of research and CISO at SOCRadar Cyber Intelligence, the reality of that risk was made clear recently when he bought a new garage door opener that was set up for another existing account. In his case, the device wasn’t even used, at least as far as he knows.

“When I was trying to set it up, I saw an error saying the device was registered for some other account, and the camera was already on,” Seker said, adding that “it wasn’t even refurbished. It was a brand-new garage door opener.”

It’s not the only example of strange device activity Seker has noticed. He has opened his garage door and witnessed his neighbor’s open at the same time because they’re on the same frequency. It underscores how this hardware is seldom as secure as it should be.

When it comes to cars, Heiland said, the problem is pronounced. Because modern automobiles are integrated with smart technology, you need to do a full factory reset between owners; even when you’re told things have been wiped, features such as remote start can still impact their previous owners.

“You get a car, and I’ve seen some horror stories where the person goes…‘I had this application for remote start, and it still worked. And I was able to remote start the car, and it gave me all the indications that the car remote started halfway across the country,’” Heiland said.

The cybersecurity consequences of dual registration are real. It’s not a glitch, Seker told IT Brew, but rather a core problem of the “CIA triad: confidentiality, integrity and availability, or the fundamentals of cybersecurity.” If orphaned credentials can sit for a period of time in a device and still be activated, that presents the potential for abuse. The problem is more or less invisible, Seker said, until it’s exploited.

“If a malicious actor ends up with the device that still has functional links to a past target, it essentially becomes a remote entry point,” Seker said, adding, “while on the surface it looks like a quirky hardware issue, underneath it’s a breakdown in device life cycle governance and access control, and ultimately, digital trust.”

For IT pros, that means taking a “don’t trust, verify” attitude. It’s more than a refurbished device problem, it’s an IoT concern. Every connected device on your network should be treated as a persistent access node.

“If it comes into your home or organization pre-owned, assume it’s not clean until proven otherwise,” Seker said. “Go through full reset procedures, check for firmware updates, verify cloud associations and, where possible, isolate devices on the segment that works if it is possible—especially if they control physical assets like locks, cameras or vehicles and more broadly. We need to shift the culture around IoT from plug and play to zero trust by default.”

A garage door rolling up due to remote hardware.

Remote hardware that isn’t wiped clean can present threats to users, former owners

 “I’ve seen some horror stories,” IoT researcher tells IT Brew.

 isn’t widely available yet, but the time is likely coming—and with it, the ability for users to deploy the technology for encryption and cryptography.

That includes threat actors. Marc Lijour, an Institute of Electrical and Electronics Engineers researcher, told IT Brew that attackers are already getting ready for the opportunity provided by quantum computing. They are “downloading everything they can at the moment and storing it, basically copying the internet and anything they can so they can open it later [using quantum technology],” he said.

That probably only applies to nation-states, John Bruggeman, a consulting CISO with CBTS and OnX, said. To Bruggeman, the likelihood is low that criminals are storing the information, but high that countries are.

“Probably the world’s largest storage repository is out in [Bluffdale] Utah—thanks to [former Utah senator Orrin Hatch and the NSA—and they are definitely, without a doubt, storing lots and lots of internet traffic waiting for the day when they can decrypt it using a quantum computer,” Bruggeman said.

 have, thus far, been limited in use to researchers and other high-volume projects. But the future of the technology is in commercial viability, Rigetti Computing CEO Subodh Kulkarni told IT Brew: “Almost all of us in the quantum computing field are absolutely convinced.”

Much of the talk around quantum computing remains hypothetical, but it’s fun to think about the possibilities. Oliver Dial, IBM Quantum CTO, told IT Brew that because the most common public key encryption online is based on factoring large number sets, a large enough quantum computer could theoretically break most of it.

“Those machines are still far outside of our reach, and it’s worth noting that there are new encryption protocols that are already approved by NIST, which are not vulnerable to this attack—they’re called quantum safe encryption algorithms,” Dial said. “It’s actually something that the world is working on adopting today to remove that boogeyman from the future.”

Switching encryption algorithms is easier than you might think, Bruggeman said, and “can be done in the background without disrupting day-to-day operations.” Often, users don’t even notice. Changing these backend details can be done quietly; it’s effectively a security software upgrade.

“You change the protocol that you’re using for the encryption algorithm, and now your point-to-point connections are no longer susceptible to man-in-the-middle attacks and harvest and decrypt later,” Bruggeman said.

It’s not a total fix to the issue, but it’s an easy step in the right direction. Bruggeman analogized it to developing fiber- optic internet solutions—one doesn’t have to change hardware as you increase the number of users.

“Imagine a scenario where you have fiber optic in your physical building—you’re in an office building, and you have 1,000 rooms and you have 1,000 people that come into work,” Bruggeman said. “You don’t have to change the fiber, you probably don’t even have to change the switches. The only thing you’d have to change is the backbone communication protocol.”

Update 10/20/2025: John Bruggeman's title has been updated.

Quantum cryptography offers ability to protect from attackers looking to break encryption

“They are definitely, without a doubt, storing lots and lots of internet traffic waiting for the day when they can decrypt it using a quantum computer,” a consulting CISO says.

 it had reached quantum supremacy—that their quantum computer had performed a calculation a regular computer could not—the technology continues to push boundaries.

Classical computing relies on bits (which can be either a 1 or 0) and classical computations involve a single input, algorithm, and output. 

 relies on “qubits,” which exist not only as ones and zeros but in a “superposition” state in-between, allowing quantum computers to analyze multiple solutions and outputs simultaneously. The technology has promise in the encryption space as well as simulations and research applications.

Google’s quantum supremacy was achieved through random circuit sampling, a complicated technical breakthrough that involves registering the output of a set of qubits. This sampling requires a level of processing power that’s not possible with standard computers, even powerful ones. Sergio Boixo, Google’s director of quantum computing, told IT Brew that the discovery was a watershed moment akin to the Wright brothers first taking flight.

“It was the first demonstration that there is a new, different paradigm of computation that allows you to do some things which are practically impossible for classical, traditional computers,” Boixo said. “It was not a commercial application yet, that’s still part of the journey.”

Before Google’s paper came out asserting the success of quantum supremacy, the idea of quantum computing’s viability was still being debated (IBM, which is also a big player in the quantum computing space, 

), superconducting quantum integrated circuit firm Rigetti Computing CEO Subodh Kulkarni told IT Brew. Now it’s no longer a question of if quantum computers will eventually become commercially viable, but when.

“Almost all of us in the quantum computing field are absolutely convinced,” Kulkarni said. “But even the skeptics who always thought this was something of the future and never really going to materialize, I think, can concur with us that this is going to happen.”

Timing is everything, and not everyone is going to agree on the watershed moments. Quantum computing has been in the works for decades. IBM Quantum CTO Oliver Dial is enthusiastic about the overall possibilities of the quantum community, but he points to a slightly earlier mark than Google’s quantum supremacy as key to the technology’s evolution. 

, IBM Quantum Experience’s cloud quantum processors opened the algorithms underlying the technology to a larger group of researchers, he said, which created an opportunity for anyone in the world to use the quantum hardware for research.

“It’s not so much the democratization of this research, although that’s part of what it did, but it’s really kind of making that step from, ‘Were building toys for us to play with ourselves,’ to where we are creating a tool for other people to use and do research with,” Dial said. “So, to me, 2016 is the watershed moment.”

One challenge faced by quantum computers is how to cool the hardware. Dial told IT Brew that IBM bases its quantum computers on supercomputing qubits, which can only operate at low temperatures. The devices are cooled to 0.02 degrees Kelvin above absolute zero, which Dial said is “colder than deep space.” While effective for quantum computers, it’s not a commercially viable technology.

“That is absolutely not something you want in your desktop,” Dial said. “It’s noisy, it’s loud, it’s maintenance-intensive. It belongs in a facility like a data center where we can give it the care and attention that it needs.”

Quantum processors currently provide physicists and other scientists with the tools to do big research projects that simply aren’t realistic with other computers. That’s the main use of the technology for now, Boixo said, but as things continue to move forward, the pool of who will use quantum computers will grow.

Of course, it’s not just scientists trying to uncover the limits of quantum technology who are using the computers. Marc Lijour, a researcher with the Institute of Electrical and Electronics Engineers, told IT Brew that attackers are interested in how quantum computers can potentially crack encryption much faster than traditional computers. They’re probably already playing with the technology, and waiting until the computers are widely available.

“Attackers…are downloading everything they can at the moment and storing it, basically copying the internet and anything they can so they can open it later [using quantum technology],” Lijour said.

That’s still a ways in the future. Boixo estimated chaining together 50–100 logical qubits is about five or so years away. With a number of firms looking at developing the next level of quantum computing, it’s a race. But the real adversary isn’t another company, it’s the limitations of material reality.

“There are, indeed, substantial, fundamental challenges to overcome,” Boixio said. “There is a broad community in quantum computing, there’s a lot of research that gets published by academia, but also industry groups, including ourselves and others. So, the whole field is sort of marching forward, and we’re still competing mostly against nature.”

Is quantum computing poised for another breakthrough?

“It was the first demonstration that there is a new, different paradigm of computation that allows you to do some things which are practically impossible for classical, traditional computers,” a Google exec tells IT Brew of quantum supremacy. 

John McKenny began his mainframe career in 1981, managing printers and reports generated by a powerful, refrigerator-size computer built to process and automate then-paper-based workflows at railway company CSX Technology.

Forty-plus years later, McKenny, now SVP and general manager for BMC Software’s mainframe business, helps clients operate and optimize the same mainframe technology from his railroad days—only the tech is now faster, sleeker, smaller, and AI-equipped.

While it’s tempting to think that virtually all modern enterprise IT workloads live in the cloud, or at least within on-premises hardware conceived and designed within the past 20 years, today’s mainframes still support critical applications in insurance, banking, government, and many other firms handling lots of transactions.

But what does the future of the mainframe look like, as more companies push to the cloud and begin to lose track of old languages (like COBOL) found in the decades-old hardware? We spoke with mainframe engineers like McKenny about how the mainframe is modernizing and opening its giant doors to emerging technologies and emerging enthusiasts.

A mainframe, a large-capacity computer with very high processing power, got its name from “the large cabinet or ‘main frame’ that held the central processing unit (CPU) of early computer systems,” 

,” designed in 1937, is considered the first mainframe computer. While early models had dimensions ranging from 2,000 to 10,000 square feet, says IBM, newer releases throughout the decades have shrunk to a more modest size, perfect for slotting into a data center.

Mainframes enable transactions at blazing speeds. IBM’s latest-gen mainframe system, the z17, released in April 2025, for example, boasts a processing capability of “up to 5 million inference operations per second with less than 1 ms response time.”

The mainframe, by design, has built-in features supporting can’t-fail applications, including redundant hardware components, a workload-balancing structure called 

, and advanced warnings of a faulty part.

“I’ve gotten calls from IBM throughout my career, and they’ve said, ‘Hey, one of your memory modules is failing. We’re on our way to replace it’…and nobody has any idea that that failure occurred,” Steven Perva, an expert mainframe innovation engineer at Ensono, told IT Brew.

Almost a century after their creation, mainframes, given their central role to many businesses, have remained in data centers and taken on new features.

One way to modernize, according to Perva, involves changing the software development approach for mainframes. Perva has been using new extensions to enable tools and capabilities familiar to non-mainframers, such as the AI code editor VS Code, the remote-access management interface SSH, and Microsoft Copilot code explanation.

Before these access methods, applications were (and still are, according to Perva) typically developed via TSO/ISPF command-prompt interfaces, also known as “green-screen” interfaces featuring 

-like green text on a black background. API connectivity, introduced by the z/OS Management Facility tool has enabled new coding options, Perva wrote to us in a follow-up email.

“It’s almost like a kid having a job that says, ‘Hey, we have all these new toys that are coming out. We want you to tell us which ones are fun,’” Perva said.

McKenny, too, has seen developers use similar code tools to write and update an application running on the mainframe. “By developing that in VS Code, they have access to look at and interact with information from the mainframe about that application, to get an explanation of that application, to get some insights as to how it works and all that can be done in a modern interface,” McKenny told IT Brew.

Many mainframes feature COBOL—the “Common Business-Oriented Language” invented in the 1950s. Expertise is currently in 

, as modernization, for some, might mean getting rid of all that COBOL.

Hassan Zamat, SVP at Kyndryl and the global practice leader for core enterprise and its mainframe-as-a-service platform zCloud, uses generative and agentic AI tools to translate legacy code like COBOL into modern programming languages like C# or Java, in addition to recommending architectural improvements.

Modernization could also mean a “hybrid” approach, pulling some on-mainframe functions into virtual mainframe environments in the cloud. A common “hybrid” scenario Perva sees: Orgs will move their development environments off the mainframe. “We see a lot of people who want to automate their testing, and they’re not developing all the time, so it doesn’t make sense for them to have a dedicated, forever-running development environment,” Perva said.

Tools like BMC’s AMI Ops and IBM Z’s AIOps use AI capabilities to monitor for disruption-causing events.

BMC’s annual mainframe survey, released in September 2025, revealed an emerging interest in the mainframe from younger IT professionals. Around 66% of the more than 1,000 global mainframe practitioners and stakeholders surveyed identified as millennial or Gen Z—an increase from 37% in 2018. Almost all (97%) of this year’s total respondents see the mainframe as a long-term platform or platform for new workloads—like generative AI assistants and even faster fraud detection and credit-risk scoring, McKenny shared as a few examples.

McKenny hopes to retire in the next 10 years or so, he said, leaving a place for a new generation responsible for taking the platform forward. “When you have someone that has a responsibility to develop on, to secure, to manage, to operate this environment for the next 15 or 20 or 25 years of their career, they’re more interested in looking at, ‘Hey, what are some of the new and different ways that we can exploit the power of this platform?’”

A man at a workstation, circa 1970. Behind him is an IBM System/370 mainframe computer. Credit: f8 Imaging/Getty Images