In enterprise technology, pricing rarely seems to receive the same design discipline as the product. For engineering teams, it is an afterthought. Get it working first, worry about monetisation later. We’re seeing that a lot with AI.

For marketing, it is a pre-market spreadsheet exercise. By the time a customer sees the bill of materials, the service price is often little more than a rolled-up number derived from decomposed SKUs. A platform without commercial simplification still behaves like a bundle of products in your finance system.

Networking has suffered from this for decades. Vendors flooded the market with endless SKUs for switches, routers, controllers, and feature packs until every customer contract looked like an ERP order form. The brilliance of engineering was cancelled out by the incoherence of pricing, and customers felt it immediately.

This is the context in which Extreme Networks is now positioning Platform ONE. They are recognising something simple. That pricing design is part of platform design. And that focus is promising.

Extreme is quickly building credibility in unforgiving campus environments where orchestration matters more than simplification and where trust is the only true currency. Platform ONE builds on that foundation by collapsing not just networking and AI into a single management fabric, but also by treating licensing design as an architectural choice.

Instead of a labyrinth of SKUs, Extreme is deliberately moving to a simplified tiered structure, where device families fall into pooled subscription tiers and features are organised at standard, advanced, and premium levels. Consumption-based models are emerging for providers. The point isn’t that all sprawl has vanished. It hasn’t. But that Extreme is at least talking about it and attempting to collapse both the technology stack and the commercial stack in one move. That intent is too rare in this industry.

Cisco continues to dominate on scale, but its licensing and global go to market is still defined by complexity. DNA Center and its associated licensing tiers remain dense, with additional charges for security, analytics, and AI features. Customers often complain that Cisco contracts feel like a puzzle only specialists can decode.

HPE Aruba has pushed hard into unified network management, but its commercial approach still leans on bundles and feature packs. Licensing simplification has been incremental, not transformative. The architecture may be improving, but the contract experience has not kept pace.

Juniper, with its Mist AI platform, has differentiated strongly on automation and assurance in the IT ops space. Yet its SKU catalogue remains broad, particularly across switching and routing, where legacy and modern lines coexist. The platform promise is compelling, but the commercial coherence is uneven.

Against this backdrop, Extreme’s attempt to collapse catalogue complexity is not just a feature, it is a differentiator. It also signals a willingness to compete not only on technology depth but also on customer experience at the contract level. There are broader lesssons here for everyone.

Especially in other sectors that show how uneven the pricing field remains.

In the emerging world of platform, ERP incumbents still cling to SKU proliferation. Salesforce’s Einstein 1 struggles with the sprawl of acquired clouds. Microsoft uses bundling (e.g. E3, E5 etc.) to mask complexity but rarely eliminates it. Broadcom and VMware have gone even further, collapsing portfolios into bundles and enforcing subscription-only models, but at the cost of customer trust. Even ServiceNow, the current strongest example of platform gravity, faces criticism for SKU sprawl as it figures out how to layer AI into its pricing.

The lesson is consistent. Platform rationalisation without commercial simplification still feels like buying point solutions. Commercial simplification without platform depth is just a prettier lock-in. The winners will be those who do both.

Extreme is betting that credibility in the platform era depends on collapsing the architecture and the catalogue together. Platform ONE arrives as a genuinely merged management fabric, paired with a licensing model that signals simplification. The company hasn’t solved every challenge. Only real-world renewals will reveal whether coherence survives procurement. But I applaud the unmistakable intent.

That it comes from a networking vendor, not an ERP incumbent, is part of the point. Extreme is showing that commercial design is inseparable from platform design. If they can carry this through execution, Platform ONE won’t just be another launch but it could demonstrate that the future of platforms belongs not only to those who unify the technology, but to those who collapse the catalogue as well.

The other signal worth noting is financial. Extreme has been executing share repurchases ($25 million in the last quarter as part of a broader $200 million authorisation). It’s a move that only makes sense if cash generation and balance sheet strength are in order. Buybacks are never the whole story, but in Extreme’s case they do reinforce a picture of a company confident enough to return capital while funding growth. Taken alongside the strategic direction of Platform ONE, it suggests a business that is not just talking about platform, but delivering operationally and commercially.

Recommendations

Recommendations are available to paid subscribers.

Read more

The security industry has always chased grand unifications. Every few years another vendor promises the single pane of glass. That one platform to tame the chaos of logs, alerts, and events. Today that ambition has shifted to SIEM and observability. Splunk, Elastic, and Sumo tout the union of performance and security telemetry. Datadog has added SIEM features. The logic is simple. If you already monitor every metric and trace, why not correlate them with threats and compliance rules?

It is a seductive vision. I wrote a short note on it back in January. It is also exactly what makes American cloud security company Zscaler1 interesting. Because they have chosen a different path. They don’t want to be your appliance partner or SIEM or observability console. Instead, they have doubled down on being something completely different: the broker in the middle that sits between every user, device, and application.

Think of PayPal, Stripe, or Square. Those companies didn’t become banks or storefronts. They became the trusted intermediaries, verifying and settling every transaction. Zscaler plays the same role in security. They are not the bank. They are not the store. They are the exchange.

This positioning isn’t theoretical, but nor is it entirely new. Large institutions have always needed brokers to connect users, applications, and networks. What makes Zscaler different is not that it invented the broker role, but that it has re-engineered it by delivering what used to be physical infrastructure as software. Zscaler already plays that role at serious scale, brokering connections for large banks and governments in Asia Pacific via thirty-two regional data centres, including five across Australia and New Zealand. You don’t get embedded at that level unless the fabric is trusted.

The technical decision was simple but radical. Zscaler rejected the heavy bill-of-materials and hardware-centric model of security appliances, re-imagining security enforcement as a cloud-native service delivered through a single global fabric capable of inspecting and enforcing traffic in real time.

That shift matters because enterprises now run in a distributed, SaaS-first world. Workers log in from homes and branches no longer bound by the corporate perimeter, apps live far beyond the company data centre, and disruption across all lines of business is a constant.

Under these modern conditions, backhauling traffic through appliances suddenly feels as dated as routing digital payments through cheques. Practically speaking, in Zscaler’s model, a user (or asset) in Brisbane or Bengaluru simply connects to the nearest node, traffic is inspected, then brokered to its destination, be that Salesforce, Microsoft 365, or even a legacy app in a dusty data centre. Enforcement follows the user, not the network.

The philosophy is blunt. Zero Trust at scale. No safe zones, no trusted locations. No user or device is trusted simply for being “inside” the LAN. Everyone and everything is effectively off the network. This isn’t just an elegant architecture. It tackles the hard truth that many cyberattacks don’t come from shadowy outsiders but from trusted staff, stolen identities, or compromised devices already inside the perimeter. By removing the assumption of internal trust, Zscaler minimises the blast radius so that when compromise happens, its impact stays contained.

The adoption challenge Zscaler faces is not whether the architecture works. It does. But whether companies can change their mindset. Because while it sounds (theoretically) simple, it also collides with thirty years of entrenched network thinking. Network engineers have built LANs the same way for decades. Firewalls, proxies, and intrusion appliances have defined security. Vendors like Palo Alto, Cisco, and Fortinet thrived on it. Zscaler grew up serving those same customers, many of whom remain comfortable with boxes.

But the perimeter is dissolving. In an as-a-Service world, traffic rarely touches the old edge. Users connect from everywhere, applications live anywhere, and inside and outside are blurred. What makes Zscaler different is that enforcement has to travel with the traffic.

Zscaler’s model works because it is a service, not a product. Like PayPal, it sells trust, not hardware. But its go-to-market still carries the weight of the old appliance world. The sales channels, the network diagrams, even the SKUs all echo a product company. That mismatch matters, because Zscaler is not just another vendor in the replacement cycle. It is a displacement company. It isn’t swapping out one firewall for a shinier firewall, or one VPN concentrator for another. It is displacing the entire premise that appliances belong at the centre of enterprise security. Closing the gap between what it truly is (a trust service built to displace the old model), and how it still presents itself to the market will be one of Zscaler’s biggest hurdles to its next wave of growth.

On trust, I think the roadmap is good. Suspicious files can be detonated in safe zones. Analytics can act as early-warning radar. Decoys can trap anyone targeting AI systems. Large language model requests can be filtered to stop leakage and runaway costs. I think that taken together these moves also hint at a bigger ambition. Not just to broker traffic, but to broker data itself. Zscaler is already branding this layer Zscaler Data Fabric (for Security).

That stance sets it apart from others. If I look at other recent announcements in the security provider market, Dynatrace is embedding security into developer pipelines, Check Point is buying its way into AI-native stacks, and BeyondTrust is treating AI agents as identities to govern. Each aims to own vertical slices of the stack whereas Zscaler defines itself by horizontal neutrality. It connects to everyone, competes with no one.

This is where the PayPal analogy sharpens. PayPal began as a settlement layer, then expanded into wallets and credit. Stripe grew from API payments into billing and treasury. Square evolved from card readers into a full financial ecosystem. Each began as a broker, and once they had earned ubiquity, they built outward along the trust curve.

Zscaler now faces the same pivot. It has already proven itself as the trusted exchange for traffic. The question is what comes next? In that sense, the future of Zscaler will be defined less by whether it can broker trust (it can), and more by what it builds on top of the trust it has already earned. In commercial terms, I think the former means protecting the base, whereas the latter is where whole new client personas begin to emerge.

For now, its strength lies in what it refuses to do. It does not build a SIEM. It does not chase observability. It streams logs outward, keeping neutrality intact. That neutrality is its moat. But at times it can also make the company’s positioning feel a little defensive, or at least not fully committed to being different. To truly own the role of global broker, it is important that Zscaler defines itself in positive terms, not just by what it declines.

I think it is too easy or basic to say that neutrality also makes Zscaler an irresistible acquisition target.

On paper you could imagine Datadog acquiring it to close the loop from detection to enforcement. Or Cisco, now owning Splunk, finally delivering the platform story it has promised. But an acquisition would kill neutrality. Splunk would no longer prioritise a Cisco-owned Zscaler. Elastic and Sumo would pull back. The very thing that makes Zscaler valuable would evaporate.

Perhaps that is why Zscaler stays out of analytics. Its value is being the settlement layer of the cloud era. They are the broker that every connection flows through, and where every flow is verified before it proceeds. If the industry keeps buying physical appliances, its position weakens. But if SaaS adoption continues to accelerate (explode), Zscaler becomes a more dominant logical control point. It is very easy to see a future where economic gravity favours the broker.

I found myself wondering just how big Zscaler can get. Can they achieve ubiquity? Do they even aspire to that? PayPal only became indispensable once it reached small merchants. Stripe lowered the barrier for developers. Square armed cafés and market stalls. Ubiquity turns brokers into ecosystems.

Zscaler has already convinced banks, governments, and multinationals. But can Zero Trust become as default and invisible as tapping a card at checkout? Or will Zscaler settle into the IBM path of seeking to dominate at the top, but never chase ubiquity? Microsoft built for ubiquity. IBM never did.

That choice between broad reach and elite dominance now looms. If Zscaler can cross the line, it becomes the PayPal of security. If not, it remains a trusted brand at the top end, while others shape the mainstream.

Either way, the broker model has history on its side. When executed in its purest form, it tends to win. And when it does, it rewrites the rules for everyone else.

Recommendations

Recommendations are available to paid subscribers.

Read more

In the world of enterprise infrastructure, networking isn’t just a technical layer. It’s the circulatory system. That’s why in most parts of enterprise IT, gaining a new customer is a win. But in networking, it’s an act of displacement. A decision to rip and replace the connective tissue of an entire organisation.

For challenger brands like Extreme Networks, every new customer is more than a logo. It’s a signal. They don’t win customers by being cheaper or louder. They earn defections by being trusted to replace the system that underpins everything else. From connectivity to compliance and from performance to security.

That system is usually Cisco. And it’s not just embedded in racks. It’s embedded in workflows, certifications, procurement policy, and a culture of “no one ever got fired for buying…”. The very thing that makes network infrastructure critical, its invisibility, also makes it the least welcome place for disruption.

But there is a shift happening. And it’s not just about price-performance ratios or better dashboards. It’s about understanding what kind of enterprise environments now dominate our lives and designing for those realities.

That’s where Extreme’s position becomes clear. They are a medium-to-high-density campus solution provider. And that’s not a limitation. It’s a strategy. Because the world, it turns out, is made of campuses.

We Already Live in Campuses

From the moment we leave home, we move through connected campuses. The medical centre where we get our blood test. The office co-working space. The university precinct that blends students, researchers, and business startups. The Westfield shopping centre that’s also a logistics hub and entertainment zone. The airport and its lounges. The linear transport network. The stadium. The library. The council chambers and the aquatic centre and the school.

These places are not just locations. They are digital ecosystems. Each one combines dense connectivity with security requirements, roaming endpoints with compliance obligations, and real-time user experiences with invisible infrastructure. Each one combining public access with private operations.

Extreme didn’t stumble into this space. They designed for it. These are the environments where traditional architectures struggle, where packet flow alone is not enough, and where intelligence, resilience, and visibility become the real differentiators.

That’s why the controversy over 15-minute cities always feels a little absurd to me. Not because it isn’t worth questioning urban planning agendas. But because we already live this way. We are campus citizens. We just never called it that. Moving from one digitally enabled campus to another, with expectations that connectivity will follow us, protect us, and respond to us. The question is not whether this model is coming. It’s who’s building for it.

The Casino Example

Think about what a casino is today. It’s a gaming floor, yes, but also a hotel, a live entertainment venue, a fleet of restaurants, a retail precinct, and a car park with license plate recognition. It may have an adjacent conferencing centre. It runs a mobile guest app. It operates a complex internal surveillance system. It’s a magnet for cyber threats and a fully PCI-compliant financial transaction processor.

That’s not one network, it’s dozens of overlapping systems running on a tightly integrated fabric. And that fabric must serve the competing needs of guest experience, staff operations, security policy, compliance, and uptime requirements so strict that a few seconds of latency can cost millions in lost revenue or compromised trust.

Now imagine walking into that environment with a PowerPoint deck and a generic promise to “simplify operations.” It’s laughable. In these environments, you don’t win with simplification. You win with orchestration. You win with platform.

You need to secure every node, monitor every endpoint, and predict failures before they happen. You need to visualise patterns across the entire topology, from PoE switches buried in the data center to Wi-Fi 6E access points hidden in the penthouse suite. And you need to integrate all of it with security platforms, aging business systems, and real-time applications, without taking any of them offline or breaking operational continuity.

All of that, by the way, must be done while unseating the incumbent vendor that’s had a decade-long head start.

This is where Extreme Networks shows up differently. Not as a hardware company, but as a platform company. One that understands that the edge is now everywhere, and that modern networking is no longer defined by data flow alone. It’s defined by experience assurance, by AI-driven operational insight, and by the clarity to act before things break.

This is what many still miss about the evolution of enterprise networking. The network has moved up the stack. It’s not about better speeds or lower latency alone. It’s about visibility, integration, and control. It’s also part of the transition to a new 21st century architecture.

To call a switch or a wireless access point “hardware” in 2025 is a category error. Yes, it moves packets. Yes, it consumes PoE. But what makes that switch viable and competitive is not just throughput or power efficiency. It’s the AIOps-infused monitoring layer, the seamless tie-in to observability pipelines, the SIEM integration, the dashboard designed to speak to humans, not just Level 3 engineers.

In environments like Disney Studios in Sydney, that difference isn’t theoretical. It’s operational. It can determine whether a production crew brings a container load of their own networking gear for a three-day or nine-month shoot, or simply plugs into an environment that works. Because at that level, it’s no longer about the hardware, it’s about the service.

It’s the same for an airport tenant or a Westfield pop-up. They’re not network engineers. They’re retailers, logistics operators, content creators. What they need is a ready network. One that responds like a service, not like a project.

The network becomes something consumed, not owned. Something trusted to perform, not configured line by line. Regardless of the client, the expectation is the same: walk in, plug in, and deliver. The value isn’t in the ports. It’s in the promise.

In environments like casinos, stadiums, and elite sports facilities, the stakes aren’t just technical. They are experiential and financial. Every switch, every access point, every SD-WAN route is now a live source of telemetry. That data doesn’t just describe the health of the network, it tells the business how people move, where they congregate, how long they dwell, what services they access, and how the environment responds in real time.

This is behavioural analytics in a physical space. For a casino, it means understanding the movement of high-value guests, optimising staffing and security in real time, or predicting operational anomalies before they disrupt VIP services. For a stadium, it could mean identifying congestion points during halftime, adjusting digital signage dynamically, or ensuring mobile ordering apps perform flawlessly under load.

The power isn’t in the individual hardware components anymore. The power is in the platform. That’s what allows these businesses to respond before something fails, to personalise experiences as they unfold, and to protect operations without slowing them down.

This is why the network is no longer infrastructure but a strategic asset. Not because it moves packets efficiently, but because it gives the business awareness. And that awareness translates directly into revenue, loyalty, safety, and control.

Extreme knows this. And that’s why their roadmap matters. Especially around the release of it’s next generation Extreme Platform ONE.

They’re not just building out campus infrastructure. They’re building a control layer that spans switching, routing, wireless, edge, and analytics and crucially, that speaks to the systems businesses already rely on to keep their operations flowing.

Nowhere is that platform vision clearer than in Extreme’s partnership with ServiceNow.

This isn’t just about integration points. It’s a philosophical alignment. The network is no longer a passive utility. It’s an active participant in the service layer of the enterprise.

By connecting directly into ITSM workflows, Extreme can turn anomalies into actions. Incident creation becomes automated. Root cause analysis becomes contextual. Escalation is enriched by live data. In many cases, the resolution process begins before the user is even aware of an issue.

The network becomes a trigger for intelligence. Service management stops being reactive. It becomes self-sustaining. That’s what it means to turn ITSM into a fait accompli. The event occurs. The action is taken. The record is already written. It’s a different rhythm of operations entirely.

And it’s a glimpse of how platforms, not just products, will define enterprise expectations from here on.

The Friendly Challenger with a Strategic Edge

What makes Extreme particularly compelling is that they’ve done all this while staying grounded. Their teams show up. Their customers seem to like working with them. They don’t disappear after the deal closes. And in an industry where relationships are often transactional, that’s strategic.

Because displacing an incumbent isn’t just about proving you’re better. It’s about being trusted to take over. In the most critical environments. Under the most unforgiving constraints. With the full understanding that success will not be measured by product performance but by operational clarity, reduced downtime, fewer escalations, and smarter decisions made faster.

That’s the platform play. Not just offering better tooling. But offering better outcomes. Repeatedly. Predictably. And quietly.

So yes, they’re a (billion dollar) challenger brand. But not an outsider. They’ve earned their place. And in a world defined by connected campuses, experience-driven expectations, and rising operational complexity, they may be the most future-aligned networking platform you’re not yet working with.

If you’re rethinking your enterprise architecture, put Extreme on your Day One list. Not because they’re perfect. But because they understand the world as it is. And the network as it must become.

They may have entered the market many years ago as a hardware vendor, but they are emerging as something far more strategic. Their latest monitoring capabilities don’t just enhance visibility, but push directly into an area I have been calling out for a while: the convergence of SIEM and Observability.

They’re not simply showing you what’s happening on their own gear. They’re offering multi-vendor visibility and cross-domain manageability, powered by interactive AI, running on a public and private and hybrid cloud-native platforms. This isn’t an overlay. It’s a redefinition of how the enterprise experiences its network.

But look closer, and a longer-term trajectory also becomes visible.

This is not just about managing infrastructure. It’s about owning the context that flows through it. About turning telemetry into insight, insight into automation, and automation into business advantage.

That’s the quiet transition happening here. From hardware vendor, to control platform, to data broker. One capable of shaping how the modern enterprise sees itself, secures itself, and makes decisions in real time.

And the most interesting part? They’re doing it without making a scene.

Disclosure: I attended the Extreme Networks APAC Analyst Summit in June 2025 as a guest. The event was held at Disney Studios Australia, one of Extreme’s flagship customers.

Kasparov’s initial victory over Deep Blue in 1996 highlighted the enduring dominance of human intuition and strategy over machine calculation. However, his loss in the rematch a year later marked a turning point, demonstrating the rapid evolution of machine capabilities.

This shift symbolised the potential of machines to not only challenge but also surpass even the brightest human minds in specific contexts. In the broader narrative, it underscores how humans and machines, while distinct in strengths, are increasingly intertwined. It’s a theme that resonates strongly in the modern era of AI-assisted software development and secure coding.

Fast forward to today, and the narrative of “man versus machine” has transformed. We are no longer pitting individuals against algorithms in isolated competitions; instead, we’re entering an era where humans and AI must collaborate, particularly in critical areas like software development and cybersecurity.

However, while organisations continue to heavily invest in once-in-a-generation technologies, investment in the developer community who use and manage these tools hasn’t kept pace.

This imbalance has historically been difficult to address, but today, new platforms and solutions make it easier than ever to equip people with the skills needed to keep up with rapid technological advancements that will ultimately keep our businesses safe and secure.

The State of Developers in the Modern Era

Developers are the architects of our digital world, and their role has never been more pivotal or complex. As organisations increasingly adopt AI-assisted tools like GitHub Copilot and ServiceNow NowAssist1 and Atlassian’s ROVO2 , the focus is shifting toward augmenting human capabilities rather than replacing them.

However, this shift brings a new set of challenges. While tools like these promise greater efficiency and support of the development teams, the veracity of the underlying AI models in relation to security and reliability should still be in question.

Based on a few conversations I've had, Anthropic's Claude and OpenAI ChatGPT are often regarded as the most dependable models from a security perspective. This kind of infers that other models can pose significantly higher risks depending on the underlying development languages being used. What it doesn’t change is the importance of thoughtful selection and implementation of AI tools in development workflows.

For organisations, the key challenges in developing secure code are relatively straightforward to identify. One major issue is the lack of visibility into their developers' actual skill levels. While they may know which programming languages their teams are using, they often don’t have a clear understanding of whether those developers have been properly trained or possess the necessary expertise in those languages; such as specific accreditations or certifications that validate their proficiency.

Secondly, boards and executive leadership teams consistently rank cybersecurity as a top priority, but there’s often a disconnect at the operational level. Secure coding practices, which are critical to preventing vulnerabilities, frequently lag behind because this level of detail is rarely addressed strategically. Likewise, CISOs may not realise the extent of these gaps until insecure practices surface in code commits. Without adequate training and tools, developers are left to navigate these challenges on their own, increasing the risk of vulnerabilities.

Finally, the wide range of programming languages and frameworks commonly used by development teams significantly complicates efforts to maintain secure coding practices. With potentially dozens of languages in use within a single organisation, standardising training, enforcing security protocols, and ensuring consistent expertise across teams becomes an increasingly complex task. Without closing these gaps in developer skills and secure coding practices, every language or framework in use becomes a potential threat vector. Each instance of inadequate training or oversight creates an opportunity for vulnerabilities to emerge, broadening the organisation’s attack surface.

A Fundamental IT Management Challenge

These skills gaps are not a new problem, nor should they be overshadowed by the excitement around AI and other emerging technologies. They stem from a foundational IT management principle that has been a cornerstone of frameworks like ITIL for decades: Workforce and Capacity Management. Addressing these gaps has always been critical, but the stakes are even higher in today’s rapidly evolving technological landscape.

Workforce and Capacity Management is an essential part of service design. It ensures that employees have the skills to meet both current and future demands. Yet, in many organisations, this critical ITIL principle is overlooked. Particularly within IT departments, where skill gaps often go unnoticed the further you move from the boardroom.

Leadership teams frequently assume their technical staff are fully equipped, but this assumption is rarely backed by the necessary investment in understanding or addressing skill deficiencies. Instead of focusing on training and development, organisations tend to hire for talent and leave existing gaps unaddressed, creating a significant risk for both operational efficiency and security.

The Skills Framework for the Information Age (SFIA) offers a structured approach to assessing and developing skills, but it’s under-utilised at an operational level.

If we were to strip it all back, insecure code, regulatory risks, and the absence of secure-by-design practices simply stem from a failure to align developer skills with organisational needs.

Secure Code Warrior: A New Paradigm

Enter Secure Code Warrior (SCW), a platform company seeking to redefine developer training and risk management. Historically viewed as a developer training tool, Secure Code Warrior has evolved into a comprehensive solution for securing development practices at scale. So if you are an organisation with its own large DevOps team, or one with a significant outsourced or offshore capability, there are two clear cost-benefit opportunities that this kind of capability can provide developer-reliant organisations:

1. Unlike traditional security training, the platform focuses on role-based and context-specific training. Developers learn to embed security into their work from the outset. An approach known as Secure by Design.

2. The platform enables organisations to shift the risk conversation from “which product is at risk?” to “which developer is at risk?” By using trust scores and integration into Git repositories, organisations can gain insights into developer skills and repository security and address problems literally at the source (i.e. the developers fingertips).

A third significant cost-benefit opportunity for “end-user” client organisations lies in the indirect systems integrator (SI) sector.

Global Scale Body Shops

The SI sector operates differently from traditional outsourcing contracts. SIs typically focus on delivering large-scale, custom-coded projects that require significant programming efforts. They are big projects that may or may not extend into managed services relationships. These projects often involve vast pools of developers, many of whom the client never directly interacts with. Instead, the client only sees the outputs of their work at various development milestones.

When bidding for work, SIs often showcase “resource pools” with expertise in specific technologies. However, clients typically lack visibility into the individual developers or teams responsible for the work, either because these resources are based in offshore centers or clients simply don’t ask. As a result, the quality of the final product has traditionally been the sole measure of success, while the skills and performance of those building it remain largely unexamined. Until something goes awry.

This lack of visibility creates a significant gap in the SI business model. Clients are unable to assess the skills or readiness of the developers involved at the point of contracting, leaving them reliant on the SI’s assurances about resource capabilities3. Overcoming this challenge would offer tremendous value to clients, enabling them to make more informed decisions and ensure higher-quality outcomes.

Platforms like SCW now make this possible. By providing insights into developer skills, coding practices, and even trust scores, SCW would allow clients to evaluate the capabilities of individual developers or teams within a prospective SI before work even begins.

This shift would transform how clients and SIs approach project resourcing, offering unprecedented transparency and enabling higher confidence in project delivery and significant points of differentiation amongst the SIs themselves.

The Role of AI and the Future of Development

AI-assisted development tools are reshaping the industry, but they come with caveats. Large language models (LLMs) like OpenAI’s GPT and Anthropic’s Claude are revolutionising secure coding but are only as reliable as their training data. That is because languages with comparatively sparse representation across the internet, such as COBOL or Salesforce’s OOL, APEX, provide less feedstock for the LLMs, and therefore remain higher-risk areas.

Despite these challenges, the opportunities are immense. In five years, AI tools may well eradicate entire classes of vulnerabilities, such as SQL injection. That is a very good thing. Developers’ roles should also start to shift from writing code to architecting secure, scalable systems. That is a very good thing. And secure-by-design should no longer be a niche practice but a baseline expectation.

Kasparov’s experience against Deep Blue taught us an important lesson: machines excel at specific tasks, but humans bring strategic thinking and adaptability to the table. In the age of AI and secure coding, this dynamic remains true.

Developers and AI must coexist, leveraging each other’s strengths while maintaining rigorous checks and balances.

The future isn’t about taking sides in the man-versus-machine debate or rushing toward quick, yet risk-prone solutions. Instead, it’s about fostering a thoughtful collaboration between human expertise and machine capabilities to achieve secure and sustainable outcomes. It’s about creating a symbiotic relationship where developers are empowered to innovate securely and AI serves as an enabler, not a replacement.

By embracing platforms like Secure Code Warrior and focusing on the fundamentals of IT management, organisations can turn the challenge of secure development back into the transformative opportunity it has always been.

Share