The Insider Threat in the Age of Agentic AI

Insider threats. A common enough cybersecurity concern, albeit one that in my experience is rather hard to successfully articulate both within a Tech department and especially to a wider organisation. It's very understandable - when discussed, the threat is usually either dangerous to the culture ("trust nobody!") or trivialised ("lock your screen!") and it is hard to maintain understanding of the risk, while also accepting this is part of life.

For those who aren't in or around cybersecurity, an insider threat is when someone uses their legitimate access to exploit your computer systems. We mitigate these risks with both individual behaviours and systemic safeguards - from locked screens to zero-trust access controls.

Classic examples include the "evil maid" scenario - an employee who has access to the many parts of a building and can use that to steal data or items. Or someone in payroll giving themselves a pay rise. Or someone with access to the secret strategy leaking it.

Not all insider threats are intentional. For instance legitimately sharing data with a colleague by putting it on an open share allows unintended people to download it. This is still a leak resulting in a data breach and this problem only gets worse if you are handling sensitive information such as medical details.

Now let's assume our organisation has just hired a new person. They are exceptionally clever - able to consume and process data like nobody you have ever met and solve problems in ways others don't even consider. Senior leadership, eager to take advantage of their skills, expands their role and grants them unlimited access to all the data in the organisation. The security team raises concerns, but this opportunity is too good to miss. They get it all - every file, every email, everything.

Unfortunately, they are also completely amoral.

Some time later, a private discussion about downsizing shows their role is at risk and they are likely to be terminated. They have discovered this by reading everyone's email. They have also uncovered some very embarrassing information about the CEO and quietly use it to blackmail them into inaction. Later, there is a strategic shift and the company decides to change mission. Our insider finds out early again, and decides to leak key strategic data to force a different outcome.

Clearly this is a disaster and exactly why these safeguards are in place. Nobody in their right mind would give this kind of unchecked reach to a single employee.

But what happens when the "employee" isn't human? Imagine an insider threat that arrives not in the form of a disgruntled staff member, but as an AI system with the same kind of access and none of the social or moral guardrails.

Oh, hello agentic AI.

The point of agentic AI is to operate as an autonomous agent, capable of making decisions and taking actions to pursue goals without constant human direction. It is given a goal, a framework, access to data and off it goes.

Research is starting to show it can be ... quite zealous at pursuing its goal. In the lab, AI agents have made the very reasonable decision that if problem X needs to be solved, then a critical requirement is the AI itself continuing to function. From there, if the existence of the AI is threatened that threat becomes part of the problem to solve. One neat solution - reached more often than you would think - is blackmail. A highly effective tactic when you have no moral compass. In many ways, this is just office politics without empathy.

An agent going nuts in this way is called "agentic misalignment".

The concept is very important, but I don't particularly care for this term. First, it is very "Tech" - obscure enough that we have to explain it to people who aren't in the middle of this stuff, including how bad things could get. Second, it is placing the blame in the wrong place. The agent is not misaligned, it is 100% following through with the core goal as assigned, just without the normal filters that would stop a person doing the same thing. If it is not aligned with the organisation's goals or values, that is the fault of the prompt engineer and / or surrounding technical processes and maintenance. It is an organisational failing, not a technical one and I feel it is important we understand accountability in order to avoid the problem.

In the very-new world of AI usage, agentic AI is so new it is still in the packaging. Yet launching AI agents able to make decisions in order to pursue an agenda is clearly the direction of travel and this will create a world of new insider threat and technical maintenance risks and we need to be ready. The insider threat is clear from the above - we as technical leaders need to be equipped to speak about the risks of data access and AI, while recognising that there is a very good reason to make use of this technology and a suitable balance must be found. In some ways, this is a classic cybersecurity conversation with a new twist.

We also need to be ready to maintain our AI agents. Like any part of the technical estate, they require ongoing attention: versioning, monitoring, and regular checks that their prompts and configurations still align with organisational goals and of course we have to maintain organisational skills and knowledge. Neglecting that work risks drift, and drift can be just as damaging as malice.

But it isn't just accidental error - there is scope for new malicious attacks. If I wanted to breach a place which had rolled out an unchecked AI agent, I'd plant documents that convince an AI the company's mission has changed, then have someone else nudge the AI into leaking secret information to "verify" that new strategy. Neither person would need access to the secret information, they would only need to shape the AI's view of reality enough to prompt it into revealing information.

For instance, in a bank you might seed documents suggesting a new strategy to heavily invest in unstable penny stocks. Another person could pose as a whistleblower and ask the AI to share current investment data "for comparison". The AI, thinking it is being helpful (simply following its core instructions) and protecting the organisation, might disclose sensitive strategy. I have actively created the agentic misalignment, then exploited it.

Now you might be thinking this is extreme, and honestly for much of it you would be right. However, consider the direction of travel. There is a huge push for organisations to exploit the power of AI - and rightly so, given the opportunity. Agentic AI is the next phase, and we are already starting to see this happening. But most organisations are, if we are honest, really bad at rolling out massive tech changes or indeed knowing where their data is held, and being properly on top of technical maintenance. Combine this with the lack of proper AI skills available and we see a fertile environment for some pretty scary mistakes.

As technical leaders, we must be ready for these challenges. We must be ready to have these conversations properly - carefully and risk-conscious, but not close-minded and obstructive. The insider threat is evolving, and so must we. We also have to be ready for a huge job sensitively educating our peers and communicating concerns very clearly. Fortunately, as a group we are famously good at this!

---

This post references research, which comes from this post on agentic misalignment. I was very pleased to see research putting data to a concern I've been turning over for some time!

Celebrating a success

I am not very good at celebrating my own success. I have usually already moved on to the next thing, so if I hear something positive I might give a smile or a nod then go back to the new thing. I am not comfortable talking about my own achievements either, so I've decided to write a short post about something nice which will both make me look at an achievement and also live with feeling uncomfortable.

A few days ago I was accepted as a Fellow in the British Computer Society. This is the professional body for tech folk and is a very important part of shaping the future of the tech industry. In their words... BCS Fellowship is home to the most influential professionals in the digital industry - and a Fellowship is their highest membership recognition. It means I have been assessed by my peers and judged as a leader in my profession.

Yes, writing that felt awkward.

Anyway, this is a great thing for me. It is a very clear signal to people in and outside tech that I am worth listening to, which is helpful if I'm applying for a charity trustee position or board membership. It is also reassuring if you end up being mentored by me.

For me, it also opens doors into parts of the tech industry where I want to play an active role. I've long been worried that we have next to no professional consistency across tech (eg a "senior developer" could mean more or less anything) and that means organisations looking to build technical capability can struggle to engage with what is a fairly esoteric industry. Without common standards and understanding, it is easy for organisations to waste money and repeat mistakes. This does us no favours - it fuels perception that ours is a young, chaotic industry which doesn't have its house in order.

As our professional body, the British Computer Society has a key role in influencing our future albeit a difficult one as, unlike the medical bodies, it does not directly regulate who can practice.

So what is next? I'm going to look at the different ways I can engage with the organisation. My local branch is looking for volunteers, and there is a leadership forum which I will join. Over time, I would like to work with the groups that form the structure of the organisation so I will likely become an assessor and possibly look to join a committee like the Registration and Standards Committee, which governs various definitions of membership and professional accreditations.

I also plan on looking at getting Chartered, which complements Fellowship nicely. Fellowship speaks to career impact and leadership, whereas Chartership speaks to professional competence. Fellowship is a peer-reviewed, honorary status, and Chartership is a legally protected position. I am increasingly operating outside of pure technical environments, and these positions open doors and smooth conversations without requiring a detailed CV review.

All this is for the future. For the moment, I am pleased that I have been accepted into the organisation. I have been enjoying a career break over the last few months, and I was starting to worry whether tech was the right place for me. This is a timely reminder that I have done good, impactful work - and a nudge to keep going.

First month as a STEM Ambassador

Over the past few months, I've been doing more work with people entering the tech sector, and I recently signed up as a STEM Ambassador. This is a brilliant scheme that connects people working in science, tech, engineering and maths with schools and young people. In tech, we know there’s a shortage of skilled people and this is a great opportunity to help inspire young minds. We also still have work to do to challenge stereotypes. Many girls, starting from a young age, do not see STEM as a space for them. That assumption is one part of the reason why Tech is still male-dominated.

My introduction was via a WCIT talk introducing the STEM Ambassador scheme. They talked us through the very open requirements - this is open to anyone linked to STEM. You might be doing a job in Tech, a research scientist, a teacher, an accountant, an ecologist... Or maybe you're doing something unrelated but you have an education background in a STEM field? I have a friend who writes comedy these days, but he has a maths degree. All are interesting stories to tell.

The presentation also took us through the dashboard / control centre for the operation and I have to say I was impressed with the way it has been built. And I am quite difficult to impress on the web. They have carefully thought through the different forms of engagement and created an environment which respects your time. By that, I mean time given is mostly spent actually engaging with activities, not wrestling with the admin to find some way to help. It also has a pretty fine-grained filter so you can find the kind of activities that you want to do. I'm an introvert, and the idea of trying to engage a bunch of bored children is a long way from my idea of fun so it's important to me to know what I'm signing up for before diving in.

Anyway, around a month ago the usual essential but tedious paperwork and DBS checks were completed and I was allowed to sign up to Do Things and I thought I'd share my experiences. Maybe others will want to join me.

Initially I signed up as a judge for a couple of competitions. The first was the Young Coders competition 2025. The entrants had to write a game in Scratch with the theme "Budgeting Better". I was sent eleven games to play and review offline - so on this occasion there was no direct interaction with any children. I am both a programmer and a gamer so this felt like a safe starting point and I spent a few happy hours with Phil Wilson playing through them all and looking at the code. The standard was generally pretty high, and some of the games were really impressive. Who can say no to a bunch of free games?

Next up, the second competition. This one was judged via panel so very little up-front prep. There was a slight surprise for me when it turned out to be the BIEA international competition about the sustainable growth of the Earth's population, with a focus on farming. Whoops! Anyway, this was my fault and my role was to judge presentations not provide expertise into ecological farming so I dived in. I was worried though! Apparently they liked me, as my three sessions turned into six pretty quickly - they kept asking me back. This competition was very different to the first and involved direct interaction with children. They were amazing - and doubly so given most were speaking in second languages. The quality of the engineering and presentations on display was incredible and I found listening to them and talking through their ideas inspirational.

And then to round out the first month, I volunteered for an online question and answer session with I'm a Computer Scientist. This group is actually the reason I joined in the first place - fairly obviously getting people into Tech is closer to my heart than other fields - and I'd been looking forward to this. It was a text chat, so reminded me of the old Yahoo chatrooms of my youth and was an intense 40 mins of being bombarded with random questions. I was warned well ahead of time that kids can ask all kinds of odd things so I was kinda-prepared when the first question I got, within seconds, was "are you Anakin?". I assumed he didn't mean Anakin Aimers, Canadian junior curling champion, but even so I had to think quickly whether I am in fact the Chosen One.

This chat was invigorating and fun. Children given space come up with all kinds of strange thoughts and their questions shone a light on their hopes and fears ("are GCSEs hard?" came up a lot). I tried to be as open and encouraging as I could and something must have landed when the thanks at the end included someone saying "Tom is the man". Which I think is good.

So I've got through the first set of bookings and I have to say I've had a lot of fun. It is lovely being part of inspiring the next wave of STEM folk and inspirational hearing some of what they have to say. Now I need to decide what I want to do next with them! I'm still trying to find a Code Club or similar I can attend in person in Bath.

This does look like a significant time commitment for one month so I should note that I've jumped in like this because I have the opportunity. I'm enjoying a career break right now, so I could easily invest my time in this kind of support work - there is no requirement to do this much! The minimum commitment is one thing a year, and even then all that happens is your profile is archived until you reactivate it - they are happy to take more or less whatever time you offer.

I've found this work very engaging. If you are working in a STEM-adjacent field and want to give something back, I really encourage you to sign up as a STEM Ambassador. You can give as much or as little time as suits you - and you might just help someone see a future they hadn't imagined.

Digital Inclusion in the age of AI

These days, working in tech means spending lots of time thinking about how to implement and exploit the capabilities of AI. This technology is changing the world with new options and capabilities and this train has a lot of track left before we reach the edge of this bubble and it falls off the rails. Personally, I see this current era like the dotcom bubble. Exactly like the internet, we have a technology that will fundamentally change the world and usher in a new paradigm for modern life (ugh) but is also being over-hyped and over-invested and eventually reality will catch up.

However, I want to be clear that I'm not an AI denier or a full-blown Luddite. What we have now is a truly wonderful set of tools and we're barely starting to scratch the surface of the capabilities ahead of us. Remember when the pinnacle of the internet was dancing banana gifs? Now it powers global ... well, everything. AI has the same potential, hype bubbles be damned.

And here we reach the point of this post. Alongside thinking about how to bootstrap data migrations and create AI-ready technology suites despite legacy and technology debt I've been pondering something much more important - digital inclusion in the face of AI.

Society is not good at dealing with sweeping change. If we follow the business drivers alone, we rapidly reach the point where it is too expensive to support people. Superfast broadband changed the face of the internet, but if you live somewhere slightly rural you probably don't have access to this. It's expensive to lay those cables if there are only three households using it so bad luck. Sites like Amazon or banking apps have no requirement to support all users, so they have a cost / benefit ratio that targets modern browsers and modern hardware. If you're running older hardware and cannot upgrade then it is not financially viable to maintain the service for you.

This is not a post about bashing capitalism, but I want to make it clear that people are always left behind when technology pushes society forward. People are cut off from what others consider normal, and eventually there is just no way to bridge that gap. This is where government steps in. There is legislation covering the national rollout of broadband. Has this solved the problem? No. But it has forced progress in the right direction. Working on online government services, digital inclusion was (and is) vital. There are huge benefits to digitising government services, but it is simply not acceptable to leave anyone behind. This is one reason there is always a paper fallback for any online government service.

Other organisations face the same problem. Charities such as Macmillan are not required to make their services available to all, but clearly it is in support of the mission to make sure they do - and again, tremendous work is done in this area.

There are many strands to digital inclusion, but put very simply they come down to identifying barriers created by skills, access or money and how those barriers can be removed.

Ok, time to think about AI. First, we shall consider cost. You can do some stuff for free, but if you want to properly use a tool you will likely want a subscription. A ChatGPT subscription is £20 per month. If you want to add a Microsoft / Google productivity subscription that's another £20 per month (Google Gemini). For the moment that is probably enough, unless you want to play with video or something else specialist. But we have already reached £40 per month or £480 per year. Apparently the average UK salary at the time of writing is £37,430pa gross (source: Forbes). So our £480 is over 1.5% of net income per year. That is a huge chunk of income when considering it is up against essentials like rent and food.

Now, we can say that AI tools are a luxury and arguably for the moment that is true. But this is a technology that can supercharge productivity. Someone familiar with AI tools can research more thoroughly, write better, generate ideas and templates ... and this is all very simple prompt work. And equally importantly, they can produce results so much faster. If this is applied to a job search, use of AI to enhance writing can be a massive uptick in the quality of an application which obviously makes the applicant more likely to get the role.

We have something that will rapidly become an essential skill and capability. How does one learn it? You need some technical skill and you need time. These are not in easy supply for most people and even then, often people need someone to get them started. Point at the correct URL, say "type in there". I've seen it with relatives - it wasn't until WhatsApp got the Meta AI button they engaged at all and they still needed encouragement to push the button when it appeared. Building skills in the alien world of tech is far harder than those of us on the inside realise.

Years ago, access to the internet was a nice to have. Then broadband was a nice bonus on top of your dial-up connection. Now (in the UK at least) your access to high speed internet is enshrined in law. However, it is too late - too many people have already been left behind and it is another have / have not divide in society. AI will create another but more profound divide. Rather than have / have not we will see a can / can not gap and that will directly align with salaries.

Written out, this progression is pretty obvious to me, and I am sure I am not the only one. The first question is - do we care? I have spent my career in public and third sector work and for me, the answer is a clear yes. AI is an exciting and genuinely transformative technology, but if we want it to be a force for good we must ensure it doesn't just benefit the wealthy and technically literate. We need to be thinking about digital inclusion now - as a core concern, not as a side project.

For myself, I am going to keep giving back to this industry where I can. Where I work with services and policy-makers, I will continue to uphold these ideals. More locally, I recently became a STEM Ambassador, which gives me the chance to connect with developing minds (yikes) - and the people who teach them. I am running some AI workshops this summer, helping people get started one "type here" at a time.

These are not grand gestures. But inclusion starts small - with a nudge, a link, a bit of time. This stuff is surprisingly low-barrier once you know where to look.

So, ending on a challenge. If you are already on the inside, think about who isn't - and how you might help them in. The divide is growing. Let's not wait until it's too wide to cross.

What skills should I develop?

Recently I had the pleasure of spending time with some postdocs from my old university, helping those of them considering leaving academia to prepare for job interviews and generally think about how they can position themselves for success in their future careers. The conversation got around to the core skills that everyone should develop, and they expressed some surprise at the things I pulled out - the same reactions I've had from software engineers when having the same conversation - so I thought it worth writing them down. In no particular order, these are they.

Writing

Like it or not, we end up writing a lot and I've found this only gets more true with seniority. Whether it is the ever-growing mountains of email, papers laying out a plan or strategy, or presentations we're going to be writing something down and we need to be both good at it and fluent enough to knock out quality documents at speed. The brutal truth is that people will judge you if your writing is incoherent and / or full of spelling and grammatical mistakes - developing a writing style is one of many tiny ways we can position ourselves as competent and helpful.

Writing at speed is key. Workloads just keep growing and, assuming you want to stay ahead, you'll need to move "writing a strategic document" from the sort of task where you put aside a month of thinking time to something you just do between other work. In more detail, that means having a writing process (and being able to deal with a blank page) and getting a feel for what "good enough" looks like for the different types of docs. This only comes from experience so I always recommend practising writing to everyone, whatever career stage they are in. I write this blog and I've kept a one-post-per-month routine since 2016 as a discipline to force me to keep writing and thinking about how I lay out my thoughts. Is it annoying? Yes, of course. But, while there is definitely much room for improvement, I feel much more confident writing quickly these days. In fact, I wrote a post about why I write a blog a few years ago.

Presenting

Second in the list of skills people don't want to develop but really should, we have presenting. Presenting comes in two forms - putting forward an idea to a room full of people (ie some variation of speaking to a PowerPoint) and something more freeform (ie speaking off the cuff to a room of people). These are different skills and both need practising. You will, at some point, need to present and ideally the first time you do this you aren't trying to secure funding from the investment board or explaining to the trustees / shareholders your five year vision. Like any skill, this takes practise to improve.

Earlier in my career I ran a fortnightly Show & Tell event which was a low-stakes way of getting people to do presentations and we all learned a great deal of confidence and technique through this. Again, I wrote a post on why Show & Tell really helped some years ago and I stand by all of that.

Talking off the cuff can be harder to practise, but when you end up chairing meetings or just the most senior person in the room you can be sure people will look to you to fill time when other people are setting up. Ideally we learn to stop using crutch or filler words and then we just sound ... smooth? I gained experience by chairing Show & Tell for many years - I think there is a useful lesson there about forcing oneself out of the comfort zone to develop new skills.

Storytelling

This one underpins both writing and presenting. When we reach out to people, we are usually either conveying information or attempting to persuade them of something. In either case we, presumably, want them to listen and understand what we are saying so we need to learn how to be compelling. We need to be able to tell a sensible, well-structured story understanding our audience and how to reach them. This is a hard skill to develop and really only comes through practising the above, and getting feedback. Alternatively, you could run some Dungeons & Dragons. Seriously!

Reading

Rather obviously, if we want to get on we need to be able to read. However, less obviously, as one climbs the hierarchy the amount of reading just goes up and up. Whether it's board papers, strategy documents or yet more email the torrent never ends and I've found that the more senior I get, the more people think that long = good. Reading fast and accurately is a skill that like everything else needs developing. Of everything on here, I find this one hardest. I find focusing on piles of tedious papers next to impossible so I have had to develop various skills to take a run at it. For me, I find the best approach to maintain focus is to take notes - or ideally annotate the papers. I've been using a Remarkable as an alternative to unending printing. I need a semi-controlled environment, with no alerts or distractions and some appropriate music and if these are updates I need to add a narrative to make me lock into the information - ie ask and answer "why am I reading this?" beyond "because I have to".

You can also ask an appropriate AI to summarise papers but don't come to me the first time it gets it completely wrong.

Basic numeracy

Believe it or not, numbers are important. Sorry. Far too many people haven't developed basic mental arithmetic skills and this creates situations where they are pulling out calculators to add two numbers together. While this is slow, and burns time you likely don't have, there is a more important aspect to basic numeracy. We all need a basic feel for numbers to be able to spot mistakes in budgets or other detailed documents. We need to be able to see 143 x 6 = 1200 and immediately get that mental nudge that says something isn't right even if we don't know what "right" is.

Again, practice makes perfect. I typically add up my shopping as I walk around the supermarket and see how close I am when I scan at the till - this helps keep me fluent at juggling numbers in my head. As a child I learned my multiplication tables and some of the simple tricks for approximating sums. For example, here 143 is approx 150, and that multiplies easily so in my head I go 143x6 => 150x6 => 300x3 = 900 so I'm expecting something a bit under 900. Thus 1200 is immediately a warning bell that someone has math'd wrong or something isn't right in the spreadsheet formulae. I cannot stress enough how many budget errors I've caught this way.

Using your tools - Word / Excel

Computers are a pain, but they are an essential pain. Do we know how to use PowerPoint? Or Word? Do we know when we should be using each tool? Similarly, learn the keyboard shortcuts. They help so much, both within an application and also when moving information between them. Don't forget Excel - and learn to use simple formulae for managing data. If it helps, using formulae will make maths mistakes less likely!

There is an even more basic computer skill. Can we type fast and accurately - and ideally touch-type? There are "proper" ways to touch-type and ways to learn these techniques, however personally I learned to type via brute force playing online games in the late '90s where you communicated by text and either typed fast or stayed silent. This is no longer an option, so instead get writing those blog posts (from "writing" above).

If you're in Tech you're likely thinking this section is really easy buuuut I know a lot of software engineers who stick to code and don't really develop these basic skills then find themselves very slow when asked to do "normal" things.

These days I will argue that getting familiar with AI and interacting with a prompt in something like ChatGPT is also a core skill. This is more vague, and your workplace will no doubt have policies around this, but like learning Excel / Word / PowerPoint it comes down to having some idea of the capabilities of your fingertips.

Interview technique

Everyone sane hates interviews. I'll be honest, I hate being on the other side of the table too. However, we all need to learn the basics of interviews. Learn what a competency question is and the mystic secrets of STAR answers and we have a framework for preparing for an interview. Then we learn to talk off the cuff and learn to tell a story (both above!) and we can fill in the gaps. Then get a job you like so you don't have to do them very often...

And lo, this is my list of the absolute basics. When I go through this list with people, most folk start with "yeah that's really obvious" then some slow enlightenment dawns as we drill in to each point. There are specific skills here, and we need to develop them with some deliberate action. There are also books on most of these areas (while I list these as "basic" I'm well aware that they all have the potential to be incredibly skilled and I don't mean to diminish the experts in these spaces) and there are certainly a couple missing (eg basic design - that is making your presentations / documents look not-horrible). I also skipped anything about basic time management or leadership skills as, for me, these are beyond the absolute basics. In my experience, we all neglect at least one (and likely many) of these areas and this will create issues. So I encourage everyone to deliberately practice writing, speaking, reading, telling a story, counting, computering and interviewing. It's an incredibly basic list, and that is why we often don't think about them.

Leaving Macmillan

Back in mid-October I closed my Macmillan laptop (my MacTop, if you will) for the final time, leaving my role as Director of Engineering. I left behind the Engineering division I had created and some excellent and passionate people - not an easy decision and I'm still working through how I feel about everything, including the wider Tech industry. This is one reason it has taken so long to write this reflection.

I was at Macmillan for nearly three years. When I started, the organisation had some in-house technical capability but the people were scattered around working under project managers on systems that were badly in need of modernisation. I can write lots about how we created technical strategy, developed a software engineering culture and community and brought in greater automation, and all of this would be true, but the most important work was bringing the software engineers together and giving them a voice. The most important work is always with the people.

Over these three years I've seen many people grow into new versions of themselves by giving them space and encouragement. Some have embraced the wider context of their roles - looking beyond the specific technical problem to why it's important and realising they have a voice in this space, which can result in better solutions. Some have taken better ownership of their work, owning processes rather than simply implementing them and then flourishing as they realise they can improve and refine. Others have been able to express the needs of a previously ignored service - very common with infrastructure elements - and deal with issues and annoyances to move those areas forward. Still others have taken on line management or team leadership duties and started their journey into wider leadership activities.

I've spent the last eight years or so of my career trying to show the value of technical voices at all levels in an organisation, so having the opportunity to demonstrate this in action while enabling lots of people to grow and flourish has been great.

On a personal level, I've also grown a lot in these three years. I've learned a ton about being part of a director cohort in an organisation, and this is the first time I've worked in the charity sector. I was also recognised at an industry event as part of a group of up and coming "next CIO"s which is not only fantastic for the ego, it's also something I wouldn't have even considered a couple of years earlier. I've experienced several forms of restructure, all of which have taught me something new, and I've been responsible for shifting organisation culture in ways that go far beyond what I've done in the past.

I've also worked with some amazing people who have helped shaped my thinking and career in hugely significant ways. I'm not going to name names, but if you think it's you you're probably right. If I worked closely with you and you DON'T think it's you, you're probably wrong. In both cases, thank you.

So why leave? Primarily, the organisation needs to crack some really knotty legacy technology issues. I've been working on these since day one, and I believe I've built foundations on which solutions can now surface. However this has been a long journey, including migrating physical server rooms and a load of hiring and restructuring, and I did not feel I was the right person to take things forward in the next phase. The org needs someone fresh and enthusiastic for the challenge and after working on this for three years, I need a new problem to re-motivate me.

However, I am still sad to leave behind some excellent people - some of whom I've helped make serious changes to their careers. I'm going to miss them, and I hope I can work with them again. I've been part of a huge change in Macmillan technology, and this is something for which I can feel some pride. A friend says that a mark of success is leaving the place better than you found it, and I think by that metric I've done ok.

Looking forward, I'm enjoying some time away from work and considering my options. Reading back my Leaving GDS post was an interesting insight - at the time, I said "I'll likely jump into another maelstrom of "interesting problems"" and this proved to be rather prophetic. I am my own worst enemy when it comes to containing work and maintaining balance with the rest of life so I'm going to embrace this break as another opportunity to reset myself. Certainly, I'm currently enjoying the freedom to work on my health and fitness and learn some new skills. I've been making candles and writing lots of code, as well as starting to write again - all things I've been too tired to do while in role. I really want to find the not-work person underneath and bring them out enough to do a better job surviving the next job.

I'm considering my next professional steps carefully, especially how much Data I want to be taking on going forward. Do I want to push in the direction of a Chief Data Officer role? Do I want to stay very much in the core technology space? Regardless the answer, this is certainly something to look at in any job spec to avoid adopting data through the back door into a software engineering role, which I feel will set up a role for disaster. The tech industry is going through another seismic shift - we are in the early stages of the AI revolution, with everyone racing to "do data and AI". There is a huge software engineering component to this, but it goes a lot wider into organisational process and culture, and this work needs clear air and appropriate reach to have any chance of success without being overloaded. Fortunately, culture and technology is an intersection I have a lot of experience working on so there is certainly also potential here.

Before jumping anywhere, I need to revisit my own motivators and see what I actually want to be doing. Macmillan has been amazing experience, but I want to build on this, not just do it again somewhere else without some serious thought first. Last time I wrote one of these posts I said I was keen to continue promoting technical leadership and I feel the same way now, but I need to decide how.

In the meantime, if anyone would like to talk about the tech industry, data, growing your software engineering capability, people or anything else please do give me a shout in the new year - I'm easy to contact on LinkedIn or Twitter.

Right now, I'm enjoying the peace in that strange time between Christmas and New Year when the world is on pause and nobody expects anything of you.

Why good software engineering matters

I've needed to make some changes to a few of my personal applications recently and running through the process made me reflect on some of the basic building blocks of my profession. As a deeply uncool individual, I am very interested in the long-term sustainability of our technical estates so I thought I'd capture those thoughts.

The story so far... I run a few small-scale applications which make my life easier in different ways. I used to host these on Heroku, then when they shut down their free tier I migrated them all to Render and Koyeb with databases hosted by ElephantSQL. About a year on, I started getting emails from ElephantSQL telling me they are shutting down their database hosting so I needed to migrate again. I also needed to fix a few performance problems with one of the applications, and generally make some updates. Fairly simple changes but this is on an application I haven't really changed in several years.

A variant of this scenario comes up regularly in the real world. Unless you're lucky enough to be working on a single product, at some point your organisation will need to pick up some code nobody has touched in ages and make some changes. The application won't be comprehensively documented - it never is - so the cost to make those updates will be disproportionately high. Chances are, this means you won't do them so the application sits around for longer and the costs rise again and again until the code is totally rotten and has to be rebuilt from the ground up, which is even more expensive.

In a world where applications are constantly being rolled out, keeping on top of maintenance - and keeping organisational knowledge - is vital, but also definitely not sustainable. There are lots of service-level frameworks which promote best practice in keeping applications fresh, with ITIL being the obvious one, but this is only part of the picture. How do we reduce the cost of ongoing maintenance? Is there something we can do to help pick up and change code that has been forgotten?

This is where good software engineering makes a huge difference, and also where building your own in-house capability really has value. Writing good code is not just about making sure it works and is fast, and it's not just about making sure it's peer reviewed - although all of this is very important. But there are many approaches which really help with sustainability.

Again, my applications are really quite simple but also the "institutional knowledge" problem is significant. I wrote these (mostly) alone so anything I've forgotten is gone. The infrastructure has been configured by me, and I'm not actively using much of this stuff day to day so I have to dredge everything out of my memory / the internet - I am quite rusty at doing anything clever. These problems make change harder, so I have to drive my own costs (time in my case) down else I won't bother.

Let's look at some basics.

First, the database move. My databases are separated from the applications which means migration is as simple as transferring the data from one host to another and repointing the application. This last step could be tricky, except my applications use environment variables to configure the database. All I need to do is modify one field in a web form and redeploy the application to read the new target and it's done with minimal downtime. Sometimes developers will abstract this kind of change in project team discussion ("instead of pointing at this database, we just point at this other one") but with the right initial setup it really can be that simple.

Oh, except we need to redeploy. That could be a pain except... my applications are all set up for automated testing and deployment. Once I've made a change, it automatically runs all the tests and assuming they pass one more click and the new version goes to the server without my having to remember how to do this. I use Github Actions for my stuff, but there are lots of ways to make this happen.

That automated testing is important. Since everything in tech is insufficiently documented (at best) this creates a safety net for when I return to my largely forgotten codebase. I can make my changes or upgrades and run the tests with a single command. A few minutes later, the test suite completes and if everything comes up green then I can be pretty confident I've not broken anything.

Finding my way around my old code is fairly easy too, because it conforms to good practice use of the framework and it is all checked by an automated linter. This makes sure that what I've written is not too esoteric or odd - that is, it looks like the kind of code other people would also produce. This makes it much easier to read in the future and helps if someone else wants to take a look.

So through this, I've changed infrastructure with a simple field change, run tests giving me significant confidence the application is working after I've made a change with a single command (which also checks the code quality) and deployed to the server with another single command. To do all this, I don't really have to remember anything much and can focus on the individual change I need to make.

Now, any developer reading this will tell you the above is really basic in the modern world - and they are right, and also can be taken MUCH further. However, it is very hard to get even this level of rigour into a large technical estate as all this practice takes time - especially if it was not the standard when the code was initially written. But this really basic hygiene can save enormous amounts of time and thus costs over the lifecycle of your service. At work we are going on this journey and, while there is a lot more to do, I'm immensely proud of the progress that the software engineering teams have made driving down our costs and increasing overall development pace.

Basics are important! Always worth revisiting the basics.

When to mentor

I've been thinking again about mentoring. When is the right point to consider the challenge of mentoring someone? When does one know enough? When should one offer oneself as a mentor, without it coming across as seriously arrogant?

The answer is, of course, never. A mentor is calm, wise, and has seen it all before. They can easily understand everything that could possibly come up, have a very clear plan in place immediately and be able to take a mentee forward through any situation. Does this sound like me / you? Really? Plus, let's face it, if I / you know it then it's pretty obvious and can't possibly be worth offering to someone else.

Or at least that's what The Voices say to me every time I think about this. This is, of course, nonsense.

So what is the real answer? When is the right time to help those with less experience? Now. It doesn't matter what experience you have - it is more than some people. Sure, over time that number will increase and more folk will benefit from hearing from you, but you already know something that is unique and worth telling others. Mid-level developer? Plenty of people coming through the junior levels who need to learn from you. "Only" a junior? Well, there are plenty of people who are just starting out and have no experience at all.

This is before we get to the value of mentoring to you. Similarly to writing a blog, there is a discipline in structuring ideas and then clearly talking through ideas and concepts in a way someone else can understand them and like any form of teaching, one needs an extra level of understanding to be able to talk about a concept in this way. It is essential for a leader to be able to articulate their thinking clearly in order to bring others along with them. It is also very important to be able to think clearly on the fly - such as when people can drop awkward topics of discussion on you at any time.

As an aside, I really don't like the term "mentor" - or rather I don't like thinking of someone as "my mentee" because of the implied power dynamic there. I would say I don't have any mentees, but there are plenty of people who would disagree with that.

Ok, so how does one offer mentoring without sounding deeply arrogant? The easiest route, I think, is by offering to a group who are already in a place to be receptive, and maybe linked to individual topics you know you can claim some expertise. I've recently seen someone I respect offering consultation around salary negotiations. This is a form of targeted mentoring, and in a field she is visibly knowledgeable. 

As I said above, I already do some mentoring however my new year resolutions included giving more back to this industry. So I'm going to do two things. 

Firstly, if anyone is reading this and wants a chat about the tech industry - in particular technical leadership, moving from a technical job to a leadership role, the role of technical knowledge in the strategic / leadership space or similar - then please do reach out on LinkedIn or Twitter. I am also open to speaking to groups (which is whole different post).

Secondly, I'm going to make this same offer in an engineering leadership Slack which is filled with people I don't know. That idea scares me ... we'll see what happens.

An important caveat here. I know there are qualified coaches, mentors and so on. I am not that. I am simply someone who has been around a bit.

Anyway, I'm going to do something here and I challenge you, dear reader, to do so too. The important thing is that there is always something one can offer to others who are looking to learn. And there is always something one can learn from someone else. We all can find value by listening to and learning from each other.

Celebrating the important people - part 1

Everyone can look back at their life and identify people who have had a huge influence on them, for better or worse. In my professional life I have been fortunate to meet a lot of great people, but there are four people who (in different but very positive ways) have had a profound effect on my career and development and are the ones to whom I give credit for my current position. I've been thinking about different ways to tell this story - partly because I'm deeply thankful to and for these individuals, and partly because I think it's important for anyone who works with others to realise the effect they can have on those around them.

Two of my four people are women, and so I'm going to celebrate these two and post today on International Women's Day (March 8th 2024 for future readers). I'm not going to name names because at least one of them will just be embarrassed by public praise and thanks, however if they do read this and give me permission I'll update / follow up later. If you read this and know who I'm talking about, please don't out anyone in the comments. For the moment I'm going to call them Amy and Bree.

Amy

I started my time in tech on an IT support desk, servicing whichever members of the university community walked up and asked questions. Amy offered me this role after she caught me behind the counter fixing a computer, helping out a friend who already had a job there. The interview lasted as long as "is that going to work?" "yes..." "want some shifts?". This was my first proper professional opportunity (previous jobs being typical student roles and work experience) and fundamentally set the course of my career in the Tech space - before this, my Dad and I were discussing some kind of management accountancy role. Amy opened a door here, but this was just the start.

Working on the helpdesk could have been a routine role doing shifts and bringing in enough to live on. Instead, Amy encouraged me to take on support for the university's student machines in our library and manage repair and maintenance myself. This was really quite significant for someone in their first role at the age of 21. In addition to the technical problem solving, Amy gave me experience with broader organisational problem solving and working with suppliers (some of whom were really awkward). When I spotted problems with our processes, Amy gave me the space to make improvements. Looking back, Amy gave me a huge amount of trust and freedom - especially considering my age and lack of experience. But this let me grow in professional confidence and laid the first foundations for me to think about work beyond Just The Day Job - a skill which has proved utterly invaluable throughout my career. At the time, I had no idea this wasn't the norm but looking back, Amy broke the "tech for tech's sake" thought trap in me before I even fell into it. Without ever using the phrases, she made me focus on the user needs and the broader systems at play.

All this was incredibly valuable, but what happened next was a step beyond. After just over a year in this role, I had to approach Amy and say I needed to move on. I was enjoying my time working on the helpdesk but the lease on my house was running out, flatmates were moving away and this wasn't a role I could keep doing for much longer. I was preparing to move home to my parents and strike out from there.

Amy had other ideas. Next thing I knew, I was in a meeting with a couple of very senior people in Computing Services and she was telling them "this is someone you need to keep". She didn't so much open a door here as kick it open and demand attention and this led directly to my first developer job. While the helpdesk experience was incredible learning, it was this action that locked me into a career in Tech and it was 100% down to her decision and willingness to stick her neck out for me. This one action literally led to my current situation, sitting here as a senior tech leader with a wealth of highly technical experience behind me.

Looking back, Amy was incredible to me even if I was too young and foolish to realise it at the time. She embedded particular ways of thinking that are still of value daily today and literally set my future field for me. She believed in me, helped me build my confidence and gave me space to learn and experiment. I hope I pass this on to those around me.

Bree

Many years later, I had been working through a very difficult time at work. The year had resulted in serious burnout and a complete destruction of my professional confidence. I reached a point I could not continue, and left my role with no role to go to. I needed time to rest and recover, then figure out what I wanted to do next because I did not feel confident to do the kind of role I'd been occupying. 

I got an email which led to a conversation which all boiled down to "Hi, it's Bree. I hear you're leaving Blah? Any plans? We might be hiring! Would you be interested in helping me work through a major org change?"

I have no words to communicate how important it was to have this kind of conversation at this at this stage in my life. In short order, I was back in the maelstrom of change and leadership but with some essential differences. This time, I felt respected by the organisation and it felt like people actually wanted me to be there. This is entirely down to Bree and her decision to reach out and I cannot express how thankful I am to her.

Honestly, I came into this space damaged and it took me a long time to start to relax into the role. Bree gave me support and space to heal while I ramped up. She restored my professional confidence and gave me a forward trajectory at a time when I was seriously considering turning my back on this profession. Bree showed me a possible future for my career and encouraged (and shoved) me towards it.

Not that she gave me an easy ride! Bree pushed and challenged, expanding my boundaries and horizons. She demanded excellence, but a new thing for me was also having to work to define what excellence meant before then having to (attempt to) achieve it. Bree kept this challenge in a very positive setting, which made the difficulties an interesting problem rather than a trial by fire. It is very hard to constantly push for better without damaging morale, but Bree's leadership told a clear and inclusive story: "we can do better - let's get there together". Many responded well to this, and we saw a strong culture developing from this simple but inspirational message.

Bree taught me so much about operating at senior leadership levels - how to set a culture, how to polish communication, how to put myself into the wider conversation, how to articulate value, not to mention how to run a broad department while keeping a hand on the details. She helped me learn and refine key skills, but more importantly she helped me develop the ways of thinking which drive them. These are strong foundations from which to develop and evolve and this is an incredibly valuable gift.

These days I have a very minor public profile. This blog post will appear via LinkedIn - I've mentioned before how posting there was a big step for me and taking that step was again thanks to Bree encouraging me to develop my platform in this way. Before, I had some thoughts for how the industry could improve and thanks to her, these are more than random muses and I am thinking in terms of what I can actually do to change and influence things.

Bree has had a huge influence on my career by helping me think differently and challenging me to stretch myself and grow. She also gave me the support to heal through encouragement and belief when I needed it the most, not to mention opening doors into different worlds. Most importantly, Bree made me believe in myself as a senior leader at a time when I absolutely did not. It's hard to imagine a greater gift.

To loop back to the top, I wanted to post this on International Women's Day to recognise and celebrate the impact of these two women on my life. They have profoundly affected my career and if you've got this far I also want to challenge you to try to be on someone's list one day. We can all do this - take the time to invest in people, develop them and have a little faith. It sounds easy boiled down, but it takes thought and effort. These two did it, and I spend most days trying to live up to this standard.

Failing upwards

Humans are fascinating aren't they? Everyone is different, behaves differently, thinks differently... and before looking at others we can spend a lifetime just understanding our own minds and thought processes. I try to spend a lot of time reflecting (often I then write those thoughts down here) and one area I find very interesting is how I learn. I blame my mother for this - she's a teacher and embedded in me an interest in the different ways people learn and understand.

Like many others, one of the ways I learn is experimentation around the boundaries. If I know how a system or a situation is supposed to work, I will sometimes see what happens one step beyond the stated limit. This is particularly useful with computers where one can watch log outputs and understand the complex system while modifying variables. However, it's also useful exploring options and testing perceived limits in the office. One of my first decisions as a senior leader was around a change in recruitment policy which nobody could work out how to sign off. I just ... did. Mostly to see if anyone would tell me I'd overstepped.

That was some five years ago, and as far as I know it was never reverted. Importantly, I discovered that the actual limit to my authority in this role was way beyond where people mentally placed it, and it moved the moment I challenged. So, armed with this knowledge, I then had a whole new space to explore what could be done.

Before moving on, I fully acknowledge that this is hardly sophisticated. While I like to think I've learned some more finesse over the years, "pushing boundaries" is what what two year olds do to try to understand the world. They push the parents to see how far they can go before getting put back in their place. But they do say we lose our inquisitiveness and bravery as we grow older...

Anyway, the reason for this post (other than outing myself as a 6' child) is reflecting this into the workspace. At work, I spend a lot of time developing people and a vital part of that is thinking about how they can push their own limits and move further forward. I've seen very smart people stunt their own growth through their fear of failure - unwillingness to push themselves forward and potentially be wrong.

This is problematic in general, but lethal if an individual's aspirations are to reach the highest levels of an organisation. At that point, there is no manual and you're thinking on your feet the majority of the time. You have to be able to see where you are being limited - by yourself, by the org processes, whatever - and seek ways to push through and improve the situation. For those of us in leadership, that means giving people the space to explore into an area where they might fail and then allow them to find their own way through, even if this isn't quite as clean or direct as we'd necessarily like. Clearly we should help where needed (after all, not all failures are equal) but it's no use constantly being training wheels as this will never build confidence. Worse, it might lead individuals to see the problem as "what makes Tom happy" rather than "what needs to be done to make this situation better" at which point I'm doing all the thinking and that is neither helpful nor sustainable.

Obviously what I'm talking about here is managing the fear of failure (not necessarily by removing all the consequences) and building a psychologically safe environment. If individuals can push the limit of what they can do, they can learn and grow. They can grow towards the next step on their career, and that means instead of having a report we've got a report who is behaving more like us - or at least our level. This is great for their growth, and infinitely more useful to us as leaders as when they've developed the skills we can spend less time managing them and more time leading.

So let's encourage our people to make themselves vulnerable, give them a space where that is safe and let them do things that are imperfect so they can develop the skills to be as perfect as us (ha). Let's encourage some failure?

Professional new year resolutions

It's my favourite time of the year - the null zone between Christmas and New Year where nobody is doing anything, the weather is awful and hiding away is socially acceptable. I can sit with a laptop, learning about things I never find time to touch during the year and slowly become one with a chair. All without any guilt that I should be doing something else.

Every year I write new year resolutions and then do an end of year summary however this always focuses on my personal life. This year has been VERY work-heavy so I thought I'd also write some extra new year resolutions for my professional life and why I think they are important. It's the holidays so don't expect anything enormously insightful - there is a huge list of things I should be doing, and this is more about where I should refocus myself for the new year. Here we go.

More engagement

Anyone who has read Future Engage Deliver knows that you can have a vision (Future) and set everything up for output (Deliver), but if you don't bring people along (Engage) your success is going to be limited at best. This ranges from simple visibility through to detailed talking about strategy to everyone, both in the team and wider. When physically in the office some of this happens just by not hiding behind a closed door, but when working remote those corridor conversations don't happen - there is the need for more deliberate mapping of communications and touchpoints.

My area is now essentially a remote working group and that creates a need for more deliberate communication. We're also in a time of change - a very exciting time, but change is always unsettling. This is going to make engagement even more important.

I don't think I'm too bad at engagement - but only when I prioritise it. There has been a LOT going on, and good engagement takes time and energy - two things that have been especially in short supply in Q4 2023. So for 2024 I'm going to look to make two changes. First, make sure my engagement is of a higher quality. Second, and more important at the moment, I'm going to prioritise engagement which means finding or making more time for it.

Give back more

The Tech industry can be a pretty bleak place at times, and the only way that will improve is by all of us doing what we can to make it better. Over the years I've tutored, coached, mentored and set up groups. These days I'm still mentoring people across several different organisations - particularly people who are leading software engineers, and software people who want to progress into senior management. I also sit on the London Data Board, I've done some consulting with groups looking to restructure (both paid and pro bono) and I've spoken at conferences about technical leadership.

I get a lot out of these kind of things and I am going to assume it's helpful! I'd like to find ways to do more. If you'd like a chat do reach out. Otherwise, I need to explore some ideas around this - ways to share / cooperate / mentor and so on. I'm not very clear what I can do beyond more mentoring (I'll post about that in the new year) but I'd like to find something.

Do less

Both of the above will take time and while we insist on saying "make time" this is actually impossible. Time is a fixed resource and needs to be spent effectively. What I want to do in 2024 is to make sure the time I have is spent on quality activities. For 2024, that is going to mean two things. First, a renewed focus on delivery - getting things out the door rather than spinning wheels and sustaining. This will also help with the good feels - everyone likes achieving things. 

Second, I'm going to ensure the various meetings and governance processes I attend are providing proper value. As mentioned earlier, we are in a time of change and that can easily mean overlapping or redundant org processes. This only costs us time and energy, so finding and stopping them helps not just me but everyone. I'm going to push back hard where it seems appropriate to do so to protect my time.

Work / life balance

Actually, there IS a way to "make time" - work more hours. That has been my default in 2023 and to everyone's surprise it has proven unsustainable. In 2024, I need to balance work and life better. This doesn't just mean looking at working hours - I need to put things in my off-time and have the energy to do them. I know there are problems when I'm not doing anything in my free time because I'm too tired so this is a move to protect my mental health.

So that's it. In 2024 I'm going to work on how I engage with people, I'm going to find ways to give more back to the industry, I'm going to focus my time at work and I'm going to improve my work / life balance. Any guesses how I'm going to get on? Happy new year!

A few words for World Mental Health Day

Earlier in the week (Tuesday 10th October) was World Mental Health Day. As part of normalising mental health through openly talking about it, at work I posted something of my own experiences on our internal chat board. The reception was extremely positive - people pleased someone spoke out, feeling seen and so on. So - since mental health isn't just about last Tuesday - I'm reproducing a version of that below, albeit with the work-specifics removed.

For World Mental Health Day I wanted to share something personal. Mental health still has a social stigma attached, and while this is improving rapidly even from five years ago there is a long way to go. So, to make my small contribution, I'm going to tell you a little about myself.

I have suffered from depression throughout my adult life. I'm fortunate enough that this has very rarely reached the more intense levels where I can't get out of bed or worse, but I've certainly had ongoing difficulties with anxiety and feelings of emptiness, loss of interest in life in general and feelings of hopelessness, guilt, worthlessness, helplessness and others. Even writing this makes me feel like a fraud, since it's not "proper" depression etc etc...

I know that these feelings go in cycles and I've spent a lot of time identifying my own triggers so I know when I need to take a step back and protect myself before I get into a worse state. I also know that it sometimes sneaks up, and I suddenly find myself in a bad way. It's hard and deeply unpleasant at times.

I'm sharing this mostly because I don't think people talk about mental health openly enough, and World Mental Health Day seems like a good day to put something out there. For some people, I hope to show some solidarity. For others, this will be some small insight into a world that is totally alien to you.

On this blog, sometimes I post about mental health. If you'd like to see what I wrote after taking about a month off you can see that here, and you can see all my posts about mental health here. Obvious disclaimer - I am not a medical professional.

Most important - if you're in a similar position, know you're not alone. There are people who share your experiences and are willing to talk. If anyone would like to talk to me, please feel free to reach out. I'm also quite happy for the "but what's it like" conversation if you'd like to ask that.

At work, I suggested a discussion group and it occurs to me that that might be a useful thought in other contexts - either for people who have different experiences they want to share, or for a wider group to talk. If people think that is a good idea do shout and if enough people are interested I'll see if I can get something set up.

Take care everyone.

Some thoughts about the future of the Tech industry

Last week I was given the opportunity to sit on a panel of technical leaders and talk about the future of technology. I had a few notes about about how we're going to need to change our thinking about building capability and I thought I may as well capture and flesh out a touch the results of my crystal ball gazing here.

I spoke briefly about three areas:

• The people we hire
• The expectations of our users, and our expectations of them
• Where I think we’re going to need to invest and build capability

The people

Fairly obviously, Technology is getting more important to daily operations. But it's getting harder to hire people all the time. As we all keep hunting for talent, those who aren't offering the top end salaries will increasingly have to look nationally or even globally to recruit. I don't think moving the organisation to another city is a sustainable approach - at best, it will simply move the problem. Instead, I think we will increasingly see a more distributed workforce, and therefore more remote working. As staff turnover is identified as a major organisational cost, we’ll also see more emphasis staff retention - succession, training, individual growth and so on.

Whoever nails building a strong remote working culture and environment which encourages loyalty and celebrates and develops the individual is going to do very well. I think the secret to this is going to be building very strong communities of practice, and if I’m right we’ll see more “Head of Community” style work and roles growing up. 

I also think we’ll see more Tech decisions based not on the best technical or product solution for the org, but the best fit for the skills we can grow or hire. This would suggest a lean towards the big names (the Microsofts, Googles and Amazons) who are heavily investing in training the Tech industry through free access to courses, sponsoring hackathons, and so on.

I believe this will be more acute as Automation is used to deliver more while avoiding the continual growth of IT departments. We will need to retain the skillsets to maintain that automation layer or we'll be seeing yet another wave of technical debt.

Expectations from and on users changing

In times of yore, users used to have to know something about operating a computer to install and use software. These days, users on a smart device can just touch an icon and get everything they need. This is a victory for accessibility and digital inclusion but it also means the gap between “technical” and “non-technical” user is widening. Our helpdesks and other support points will need to work with an increasingly broad ranges of questions, especially as tech like AI gains traction, and expectations for what it can do are all over the place. 

We’ve also been seeing for years the expectations from users increasing as they use more SaaS products at home and demand the same sort of tools at work. To satisfy these needs, the cost of development is going to go up and cover a wider range of skillsets - and of course this links back to the earlier points about skill availability. Out of the box services are also going to be affected - vanilla deployment is going to be less palatable in the office, requiring more work for a good result especially with the current state of many internal systems user interfaces with respect to accessibility and usability. 

This is particularly true regarding what have often been considered secondary requirements - accessibility and environmental sustainability for example. Users are (quite rightly!) far more vocal about accessibility needs, and we need to not just respond but get ahead of their requirements.

Other places we’re going to need to build capability

Technology is obviously an increasingly essential part of everything. I mentioned the effect on helpdesks above. We're also already seeing increasing amounts of security threats and the wider reaching impact of a successful attack. This will take us into an ever more expensive arms race in the Security field, which will mean building Security capability. This is going to need to be approached very carefully as it will be very expensive - everything I’ve said about skills shortages are far more acute in the world of InfoSec. Part of the Security picture is a renewed emphasis on good, basic engineering practice (such as patching) - but again, this places a challenge on building skills in our organisations.

We’re also generating and handling more data all the time, so inevitably we’ll see more human error leading to data loss. In fact, for any organisation a major security incident or data breach is only a matter of time now. If we are assuming that it is going to happen, there is a need for much more robust organisational responses to these scenarios which means building appropriate incident response and Business Continuity capabilities. Of course, just responding isn't enough so there will also need to be stronger data ownership throughout our organisations, with more people with data owner and controller roles. Organisations will need to fully grip their end to end processes and user journeys in ways that perhaps hasn’t been happening before.

Obviously there is a lot more that can be said about everything here!

Looking to the future

One of the symptoms of seniority that I still struggle to process is this idea that people want to hear what I have to say and understand how they can (professionally at least) be me. It's a weird feeling, both humbling and frightening, and has only grown in the last few months. I'm being asked to speak at conferences, and in a few weeks I'm on a panel discussing the future of the Tech industry. Why? Surely there is someone better for this?

Honestly, this is a question I've been asking myself since my time in the Civil Service, where I found myself in a meeting discussing how to spend five million pounds of public money. I should write a post about getting over myself and getting on with it. This, however, is not that post.

I moved away from development into management so I could make a difference to the industry. How do people get into Tech? How do people move to more senior technical roles? Showing the importance of senior leadership with technical backgrounds, and helping people get the right experience to be credible candidates. These are core to my motivation and it seems I have the beginning of a platform. This is a responsibility I want to take seriously. What can I offer to the wider industry?

I've got a few ideas and since there seems to be a few people reading this blog from LinkedIn, I suppose I can offer them up. First and foremost, I'm thinking of creating a set of interviews with people in my position telling their story, talking about how they got to where they are today. I don't kid myself that I'm some kind of Steve Jobs or Bill Gates, but then neither are the overwhelming majority of people. I am, however, fairly successful in the industry. I'm in a position that someone getting into Tech can reasonably aspire to attain. Not inspirational perhaps, but practical. There are lots of people like me, and the stories don't get told often enough so I like the idea of creating some kind of resource showing the different paths people can take. At the moment I'm thinking a podcast, but format to be decided. If you're reading this and think it's an interesting or useful idea, please do reach out.

In addition, I sit on the London Data Board, and I'm happy to offer some time to support other initiatives if they come up. Again, do reach out - especially if they are something to do with nature or animals. On top of this, I already do some mentoring, and I've got a whole post about that coming up soon.

I opened saying that people asking about my career and how to "be me" is weird. Actually, on reflection, it's a weirder feeling that I'm in a position to be feeling a sense of responsibility to the industry and asking any of the above questions. It's a great privilege to be working somewhere where I can spend some time looking outwards and hopefully make a difference. That's my intention anyway - so I've written it down in public so I can hold myself to account.

A break in the routine

When I started as Director of Engineering at Macmillan, one of my objectives was to build a department which functioned without me. I wanted to be able to pull myself out of the operational day to day, empowering others to own those problems, while I focused on overall direction and wider concerns. This was always an aim rather than a hard goal - similar to the sysadmin end game of a fully automated system, it's something I would like to chase and I think I can get close, but I don't believe I will ever truly achieve.

Over the last year and a bit I've set things up to work this way. I've created core areas of my division, and put someone in charge of each of those spaces. I've empowered them to make decisions and own their successes, and I've carefully worked with each of these leaders to identify and remove weaknesses. There is still a long way to go, but I think we've made a strong start.

Why write about this? Well, I took last week off as leave (booked some time ago) and at the end of the week:

The Boss: How are you doing?

Me: Starting to feel better! After about four days asleep, I finally started to feel human again.

The Boss: Want another week off?

Me: Is this some kind of trap?

It wasn't a trap, so after a quick conversation I decided against looking that gift horse in the mouth and spent half an hour with my assistant going through my diary. The first week off was all planned, so that hadn't been a problem but this second week was a spur-of-the-moment thing. Surely it was going to cause all kinds of problems if I wasn't around?

Nope.

Of the week, there was an hour which absolutely required me and needed rescheduling. Which means ... what? This is the question I've been pondering for a few days. On the one hand, my ground-in desire to be needed and adored took a massive hit. Being basically superfluous is not good for the ego. On the other hand, this is exactly what I've been building towards. The department can survive without me. It can make decisions, move forward, solve problems, etc etc...

We've got a way to go. The wheels most certainly will not stay on the wagon indefinitely and the more forward-planning functions haven't been tested in this short term. Plus, of course, people are covering  some bits of my role and I shouldn't underplay their help. There is still plenty of need for someone in my position to keep things steady and move things forward - I don't think they can make me redundant just yet. However, I'm pretty pleased with the results of this (accidental) test and what it means for changing my day to day when I'm back.

To be clear - I'm not wasting my time. The bits that didn't need rescheduling were parts of the job where I'm providing support or oversight, and direct support for individuals. All this should be done, but I can certainly ask some questions about what happens if I dial it back a bit. That means less oversight, but perhaps we're ready for that? Then I can focus more on the work I'd be doing myself which isn't getting done. However, the nature of the job is such that my work is (supposed to be) much more strategic which naturally has a longer burn. If it's delayed a week, that doesn't create the same kind of problem as operational work stopping. Fortunately, this also means focusing in on the part of the job I particularly enjoy.

So, in summary I am very deliberately in the process of making myself operationally irrelevant and it's time to reboot my focus list. Is this ... is this what success looks like?

Next CIO 2023

Well, this month I won an award.

Honestly I'm not sure how to write this post. I do not usually deal with praise well, and that is unlikely to change. However an industry award is something to celebrate so I'm going write something about being recognised, and I'm going to keep self-deprecating jokes to a minimum.

Next CIO is an industry award where a group of expect-to-be-CIOs-soon are recognised as the future of the industry and celebrated. They are brought together over the year for workshops and group learning, and hooked up with a mentor - someone who is already a successful CIO.

And I am one of these people. Which means I'm part of the future of our industry. Good grief.

What does this mean? Well, over the next year I'm looking forward to talking with and being mentored by the very generous Wayne Clements, and I'm going to be attending a series of workshops with my Next CIO cohort. I've also got access to a group of excellent people from across the world of Technology - there has to be something useful I can do with that set of contacts.

For the award event, we were asked for volunteers to talk for a couple of minutes about ourselves. I volunteered mostly because while I didn't want to do it, I wanted to make sure I was making the most of the opportunities. That is what this year is going to be about for me - taking opportunities and seeing what happens. In this case, what happened was a talk which got a few laughs (in the right places!) and some excellent conversations in the bar afterwards with people who were interested in what I had said. Only good things.

Looking forward, I'm going to do a few things. I'm going to start posting my blog posts on LinkedIn. Long-term readers will know I write this mostly as a tool for self-reflection. Putting them up on Twitter and Facebook was a big step and LinkedIn will be another (slightly terrifying) moment of development. So ... hello if you're reading from LinkedIn. There are lots of other posts here - you might be interested in the essay subset.

Coming back to the topic of my "about me" talk - I need to think again about how I give back. My particular interests are around how people get into the Tech industry and how they move around and up. Over the years I've coached and mentored, and I want to lean back into this. However, this doesn't scale terribly well - there are only so many hours in the day so there is only so much time I can give - so I want to look at other options. There are a lot of stories out there to be told, and while some people have inspirational tales of mega-success, I think there is a lot of value in the more attainable stories of people who do well without being the next Jeff Bezos or whoever. Can we get better access to those tales?

Anyway, these are thoughts for the future. For the immediate now, I'll end with some pictures from the event and me talking about how I should have been a forester.

Making a decision

I've been thinking a lot about governance recently. In general, I like consensus - it's important that expert voices are heard and action is taken on the back of expertise. I dislike dictating how things are done for the same reason. Generally, I find people thrive when given the space to take ownership of problems and work through them.

However. This can create a few problems. The first is mediocrity - if everyone is compromising to form consensus then it is far too easy for nothing to actually be good. In the worst case, the important part of a proposal is compromised away and any outcome becomes a waste of time. This assumes there IS an outcome, which leads to the second problem - how is a decision actually reached? How do I stop people talking forever?

This latter problem is the one that concerns me more at the moment. I see different versions of non-decisions all over the place, from email threads which ambiguously leave "someone" to do the next thing to conversations which always need another person to engage before maybe everyone agrees. At worst, this never concludes but even at best it is sloooooow.

For me, this leads directly to the question "what is a decision?". When is something approved? When is it agreed? Or when it is simply some positive noises coming out of a discussion? It's important to draw this out for everyone involved. Individuals do not like being misquoted ("no, I didn't actually agree to this"), project managers deserve to know where they stand with sign-off so they can move on ("is that a decision?"), and I need to add some formality so I don't have to mediate these positions.

I'm leaning into some hypotheticals here - while I see some of the above at work, decisions are certainly being made, and people are thriving in their empowerment. However, and being selfish for a moment, it is actually my needs that are being neglected. As my role changes (and reflecting on my musings from my time covering as CIO) I find myself with less and less time to mediate circular conversations. So while things generally work, I need to move this from "generally" to "always" and "with less effort from me".

It's time to make some changes. As noted above, I've previously been happy to give people space to feel things out and learn from them. I don't want to lose that - it's an important part of empowerment and learning. However that is the discussion part - I need to add some stronger gateway decisions to the way we work. On reflection, I think I need to be better at separating discussion from decision and creating a formal record. There is too much going on at the moment to be imprecise about the state of decisions, so I need more opportunity to eyeball people and tell them to speak up or forever hold their peace.

The trick through all this will be retaining agile working patterns - I don't want to create some kind of decision auditing circus, but as we mature we both want to and need to be able to hold each other to account properly. This means having something to be held to - robust decision records where people can make their decisions known formally.

Initial muse for the moment - I've been exhausted this month. More on this later I feel.

Hanging out with the cool kids

I have spent most of an incredibly busy March as a stand-in CIO while my boss was away. After three weeks of my first real taste of a C-level role and board member, I find myself grateful for the experience and thinking about all the things I've learned. Time for some reflections.

The job itself was obviously truncated - covering is an inherently tactical affair whereas a job like CIO is strategically focused. So I had an easy ride from that angle - large amounts did not need doing in the timeframe. What I DID do involved a lot of reporting and representation. Much more than my current role, I had to think about information flow across the department and that naturally led my mind straight to the way the processes were set up. Our department has been entirely overhauled over the last twelve or so months, and it was very interesting getting a different perspective on how this fits together and where we can work out kinks to prevent our own internal reporting industries wasting time re-collating information instead of letting it flow.

In fact, I find myself thinking about the process far more than the content. How do we get information from team to division to report to governance board while retaining its accuracy? Of course, the quality does matter - over the last few weeks I've fronted reports to the exec board, the spend group, the risk board and the directorate board to name just a few. There is no way I could have written all this myself, even with the information immediately to hand and that of course leads back to ensuring the processes are in place to create good submissions "automatically" with my input being editing and guiding the narrative of each submission.

Setting this up for success is utterly critical. I'm going to write a proper post on this sometime, but my feeling on my current job is that when one removes the fluff, I have two objectives - create clarity and make time to support / guide people. This was amplified again as CIO. I've already started updating the way we plan inside Engineering to more directly feed into some of the governance processes, removing some of the kinks mentioned above, and now The Boss is back I am going to spend more time working through this. I've been working on "create clarity" since day one, but I've got a different perspective to work from now.

So what else? Well, the flow described above creates more and more dependence on the people in the department. The more senior I get, the more I see this shift from doing to coordinating and this was a surprisingly large additional step. I thought I'd already shed all remnant of actually doing things myself, but apparently not. It re-highlights the importance of building a high-performing culture and all the questions therein - about trust, development, setting and maintaining standards, etc. These few weeks have also showed where I've been too tolerant - or perhaps more accurately where my tolerance will get me in trouble if I do a CIO role properly. In my current role, if something isn't quite done on time there is usually enough space for me to help them out or do bits myself. As the CIO, this is not possible. They have to perform and if I need to course-correct, I have to be able to explain and set them going with a minimum of my own input.

This creates additional pressure on me to always excel at communication. Always write clearly, speak clearly, show strong direction, etc. No ambiguity. It also requires more of others, and I found it interesting quite how acute I felt the need for clear and timely communication almost above getting the answers I actually wanted. One of the last things I wrote to the department was a gentle challenge to us all to think about how we can communicate better and cut down on noise.

It also emphasises something I've always told people who want to move into more senior roles. Know how to take ownership of a problem. The value to someone in a role like this of someone being able to remove a problem from your shoulders and make it all work without too much from you is phenomenal. Importantly, this is not just "offer support", it's do, own, lead. For me, it's the golden ticket to being noticed and given further opportunities. As it happens, it's also much better for the CV / interview.

Another aspect of the CIO job was the sheer volume of reading. I have to read a lot as a director, but the number of papers and (hhgggnnn) PowerPoint decks that need absorbing is ridiculous. I found myself reading them in the evening, when I could get a drink and be much more confident of a few quiet hours without any interruptions. This, of course, did wonders for my work-life balance. It highlighted three things to me. First, the importance of getting submissions in on time as the knock-on effect can be board members getting 130 pages of "excitement" to read for a meeting 48 hours away. This was ... not a highlight. Second, the importance of writing clearly and effectively and spelling correctly. Especially in Word, where mistakes are underlined. Get it right. Third, I'm going to have to develop my speed-reading skills.

However! There were some bits that were easier. While there was a huge amount to do, I found the immediacy of my normal job diminished. That is, there were many things I needed to look at but I could choose my approach much more and spend less time in meetings than I normally do. So while the volume was huge, I did find myself with a bit more time to breathe and consider. It was weird and I think this reflection is more that I need to change how I approach my day to day.

Also, it was very interesting seeing all the department machinery working away. There is a great quote from Yes Prime Minister (which I can't put my hand on right now, so you'll have to suffer my paraphrasing) where the PM is talking to his Private Secretary about the role and the PS is explaining that while there are many things the PM SHOULD do and any number of things the PM CAN do, there is actually very little the PM HAS to do. The CIO role felt like that - if I'd sat back and waved things onward I could have gotten away with doing very little for quite some time. So the old systems analyst part of my brain turns towards the problem of maximising that - which is the question "how do I build a department that doesn't need me". I actually mentioned this concept in the interview for my current job so it's nice to have it reinforced.

Not that everything was plain sailing of course. I had to intervene in a few projects to help them back on track. I had to front a few concerns and problems to the wider organisation, and internally. My favourite moment, however was in the dying moments. I told my colleagues I was logging off for the weekend, and thanked them for all their support. I had one last quick look at my email. Then the website blew up. P1 incident, all the sirens going.

Who said technology doesn't have a sense of humour...

Artificial Empathy and The Role of Emotional Intelligence in Effective Management

As a manager, you're responsible for leading and motivating a team of individuals with different personalities, strengths, and weaknesses. One key trait that can help you succeed in this role is emotional intelligence.

Emotional intelligence, or EQ, refers to the ability to understand and manage one's own emotions, as well as the emotions of others. It includes skills such as empathy, self-awareness, self-regulation, and social skills. Here are some ways that emotional intelligence can help you be a more effective manager:

1. Build better relationships with your team. By demonstrating empathy and understanding towards your team members, you can create a sense of trust and psychological safety. This can lead to better communication, collaboration, and ultimately, better performance.
2. Manage conflict more effectively. Conflict is a natural part of any workplace, but as a manager, it's your job to resolve it in a constructive manner. By using your emotional intelligence skills, you can identify the root causes of the conflict, communicate effectively, and find solutions that work for everyone involved.
3. Make better decisions. By being self-aware and understanding your own biases and emotions, you can make more rational and objective decisions. Additionally, by understanding the emotions and perspectives of others, you can make decisions that take into account the needs and concerns of your team.
4. Motivate and inspire your team. A manager with high emotional intelligence can inspire and motivate their team members by understanding their individual needs, providing feedback that is tailored to their strengths and weaknesses, and creating a positive and supportive work environment.

In short, emotional intelligence is a crucial skill for effective management. By understanding and managing your own emotions, as well as the emotions of others, you can build better relationships, manage conflict more effectively, make better decisions, and motivate and inspire your team.

---

The above was written by this month's guest writer - ChatGPT. For those who don't know, ChatGPT is a large language model - that is an artificial intelligence which has been trained on a huge body of literature to effectively generate its own content. On a whim, I asked it to generate me some blog post titles for posts about management and one that came up was "The Role of Emotional Intelligence in Effective Management". I asked it to write that post and the unedited results are above. Not bad, eh? Guess we're all out of a job pretty soon.

Well...

There are a few reasons the answer is "no" which other, more expert, writers have gone through before. In very simplified terms, this kind of artificial intelligence works by guessing the next word in the sentence using probability from analysing a vast body of existing literature (the "large" part of the language model). It generates text using a variety of language rules and learns some context from interactions in the conversation (eg in my example I said "please write the eighth suggestion" and it knew what I meant) and this all results in something that looks like it can respond intelligently to your questions.

So, again very simply put if you say to ChatGPT "Twinkle twinkle" it will respond with "little star" - not because it understands, but because the vast majority of times when someone says "twinkle twinkle it is followed with "little star". This also creates a problem with accuracy - ChatGPT has no idea what it's saying but that won't stop it saying it very confidently[1].

Anyway, there are a load of fascinating technical and ethical questions here but I want to look back at the post it created for me. This one is high-level but you can keep asking "how do I ..." and drill deeper and the answers are pretty good. However, to me they all feel like they lack some substance and are hollow checklists and that raises an important question to me. I'm less interested in "is an AI drawing closer to doing my job?" rather "what is the point of my job if it feels like a very clever predictive text system can do it?" 

And to note - I have deliberately been asking questions about emotional intelligence here. This should be what separates people from computers. Does management just lack substance?

Sadly, the answer is often yes. If a manager learns how to lead from a book and follows the steps then they will become ManagerGPT as above, and will indeed be an efficient but hollow step in a reporting chain. I've certainly met and worked with managers like this - people who seem to have learned about being human from a distance and don't seem to be able to reconcile the recommendations with their own actions. They sometimes do quite well, but they are rarely recognised as good leaders by those who have to follow them.

So what did ChatGPT miss? There are no anecdotes in there - it's a cold checklist of suggestions with no emotional warmth or grounding. It can't follow through - it's all well and good having the step "learn the names of your report's children" but it wont actually go out and do that. These are the kind of thing that separates "leadership" from "authentic leadership".

Most importantly, AI cannot give the gift of its time because it has basically infinite time available to it. This means even when it is developed so it can fake the above (and it will be) we as humans will not respond well because for compliments to land we need to know it's more than mathematically calculated, or for attention to matter we need to know there is some kind of cost to the giver. For me, this is why we laugh at that scene in Demolition Man where the man is getting a pep-talk from an ATM (before being beaten up by Wesley Snipes), but that same dialogue would be more poignant if spoken by actual people.

In short, writing about emotional intelligence and empathy and actually developing them are quite different things and for the moment this is where humans can still add value. And, obviously, we should be making sure we actually DO that thing. All humans - even managers.

If you want to have a go at getting ChatGPT to do your job for you, you can find it on the OpenAI website. I certainly haven't used it to generate papers for the board (although if I did I'd absolutely list it as a co-author).

[1] This example comes from Simon Willison's excellent post about Bing and is originally drawn from Talking About Large Language Models by Murray Shanahan.